Re: [PATCH] serial: 8250: fix use-after-free of IRQ action name on port removal

[sashiko-bot@kernel.org]

> From: Joas Antonio dos Santos <joasantonio108@gmail.com>
> 
> serial_link_irq_chain() passes up->port.name directly to request_irq().
> The IRQ subsystem stores this pointer in irqaction->name without copying
> the string.
> 
> When the port that originally called request_irq() is removed while
> other ports still share the same IRQ:
> 
>   1. serial_unlink_irq_chain() removes the port from the shared list
>   2. Since other ports remain, free_irq() is NOT called
>   3. irqaction->name still references the removed port's name string
>   4. serial_core_remove_one_port() frees uport->name (kfree at line 3292)
>   5. irqaction->name becomes a dangling pointer
> 
> [ ... ]
> Reported-by: syzbot+bc6b37960b1d13f68f9f@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=bc6b37960b1d13f68f9f
> Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct")
> Cc: stable@vger.kernel.org
> Signed-off-by: Joas Antonio dos Santos <joasantonio108@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261103-serial-8250-irq-uaf-v1-1-24223dcc3119@gmail.com?part=1