Re: [PATCH v2 4/4] serial: imx: serialize imx_uart_ports[] lifetime

[Frank Li <Frank.li@oss.nxp.com>]

On Mon, Jul 20, 2026 at 12:10:14AM +0200, Karl Mehltretter wrote:
> [You don't often get email from kmehltretter@gmail.com. Learn why this is important at https://aka.ms/LearnAboutSenderIdentification ]
>
> imx_uart_probe() publishes the port in imx_uart_ports[] before
> uart_add_one_port(), because console setup during that call uses the
> table. The entry is not cleared if adding the port fails or after
> imx_uart_remove() removes it.
>
> The port is devm-allocated, so a failed probe or unbind leaves the table
> pointing at freed memory. A later registration of the shared console can
> then dereference the stale entry. Reproduced on QEMU's mcimx6ul-evk by
> unbinding a sibling UART, unbinding the console UART and rebinding the
> sibling:
>
>   BUG: KASAN: slab-use-after-free in imx_uart_console_setup+0xd0/0x3d8
>
> The entry must remain valid until uart_remove_one_port() unregisters the
> console. Clearing it afterward without serialization still races a
> sibling probe: the sibling can register the shared console using the
> dying entry before it is cleared. The next console write then
> dereferences NULL.
>
> Use a driver-wide mutex to serialize table publication, port addition
> and rollback with port removal and table clearing. Console callbacks
> remain lockless because uart_add_one_port() may invoke setup while
> probe holds the mutex.
>
> The probe-failure path also relies on "serial: core: do fallible
> allocations before the console can be registered", which moves the
> uport->name and uport->tty_groups allocations before console
> registration. Both changes should be backported together.
>
> Fixes: dbff4e9ea2e8 ("IMX UART: remove statically initialized tables")
> Fixes: 9f322ad064f9 ("imx: serial: handle initialisation failure correctly")
> Reported-by: Sashiko <sashiko-bot@kernel.org>
> Link: https://lore.kernel.org/all/20260719162850.043B41F000E9@smtp.kernel.org
> Cc: stable@vger.kernel.org
> Assisted-by: Claude:claude-fable-5
> Signed-off-by: Karl Mehltretter <kmehltretter@gmail.com>
> ---
>  drivers/tty/serial/imx.c | 21 +++++++++++++++++++--
>  1 file changed, 19 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/tty/serial/imx.c b/drivers/tty/serial/imx.c
> index 251a50c8aa38..def874f9cd00 100644
> --- a/drivers/tty/serial/imx.c
> +++ b/drivers/tty/serial/imx.c
> @@ -22,6 +22,7 @@
>  #include <linux/clk.h>
>  #include <linux/delay.h>
>  #include <linux/ktime.h>
> +#include <linux/mutex.h>
>  #include <linux/pinctrl/consumer.h>
>  #include <linux/rational.h>
>  #include <linux/slab.h>
> @@ -2080,6 +2081,15 @@ static const struct uart_ops imx_uart_pops = {
>
>  static struct imx_port *imx_uart_ports[UART_NR];
>
> +/*
> + * Store the port in imx_uart_ports[] before uart_add_one_port() and clear
> + * it only after uart_remove_one_port() returns. Console callbacks in both
> + * calls use the table, so this mutex serializes these sequences between
> + * sibling ports. Callbacks must not take it because uart_add_one_port()
> + * may invoke setup while it is held.
> + */
> +static DEFINE_MUTEX(imx_uart_ports_lock);
> +
>  #if IS_ENABLED(CONFIG_SERIAL_IMX_CONSOLE)
>  static void imx_uart_console_putchar(struct uart_port *port, unsigned char ch)
>  {
> @@ -2632,11 +2642,14 @@ static int imx_uart_probe(struct platform_device *pdev)
>                 }
>         }
>
> -       imx_uart_ports[sport->port.line] = sport;
> -
>         platform_set_drvdata(pdev, sport);
>
> +       mutex_lock(&imx_uart_ports_lock);
> +       imx_uart_ports[sport->port.line] = sport;
>         ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port);
> +       if (ret)
> +               imx_uart_ports[sport->port.line] = NULL;
> +       mutex_unlock(&imx_uart_ports_lock);

ret = uart_add_one_port(&imx_uart_uart_driver, &sport->port);
if (ret)
	goto err_clk;

imx_uart_ports[sport->port.line] = sport;

return 0

and at imx_uart_remove()

imx_uart_remove()
{
	imx_uart_ports[line] = NULL;
	uart_remove_one_port(&imx_uart_uart_driver, &sport->port);
}

Is above sequence to avoid use mutex?

Frank

>
>  err_clk:
>         clk_disable_unprepare(sport->clk_ipg);
> @@ -2647,8 +2660,12 @@ static int imx_uart_probe(struct platform_device *pdev)
>  static void imx_uart_remove(struct platform_device *pdev)
>  {
>         struct imx_port *sport = platform_get_drvdata(pdev);
> +       unsigned int line = sport->port.line;
>
> +       mutex_lock(&imx_uart_ports_lock);
>         uart_remove_one_port(&imx_uart_uart_driver, &sport->port);
> +       imx_uart_ports[line] = NULL;
> +       mutex_unlock(&imx_uart_ports_lock);
>  }
>
>  static void imx_uart_restore_context(struct imx_port *sport)
> --
> 2.53.0
>