Re: [PATCH v2 1/2] serial: amba-pl011: unprepare console clock on unregister

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] Missing NULL check for `uap` in `pl011_console_exit()` can lead to a NULL pointer dereference.
--

--- Patch [1]: [PATCH v2 1/2] serial: amba-pl011: unprepare console clock on unregister ---
commit 52f009641a6d04998b843ae51d6c555711f29559
Author: Karl Mehltretter <kmehltretter@gmail.com>

serial: amba-pl011: unprepare console clock on unregister

This commit adds a console .exit() callback to balance the clock prepare
count. It ensures that the UART clock is unprepared when the console is
unregistered, preventing stale reference leaks.

> diff --git a/drivers/tty/serial/amba-pl011.c b/drivers/tty/serial/amba-pl011.c
> index 8ed91e1da22be..1aa43994a3cdc 100644
> --- a/drivers/tty/serial/amba-pl011.c
> +++ b/drivers/tty/serial/amba-pl011.c
> @@ -2552,6 +2552,15 @@ static int pl011_console_setup(struct console *co, char *options)
>  	return uart_set_options(&uap->port, co, baud, parity, bits, flow);
>  }
>  
> +static int pl011_console_exit(struct console *co)
> +{
> +	struct uart_amba_port *uap = amba_ports[co->index];
> +
> +	clk_unprepare(uap->clk);

[Severity: High]
Is it possible for uap to be NULL here in pl011_console_exit() within
drivers/tty/serial/amba-pl011.c?

During device probe, uart_add_one_port() registers the console via
uart_configure_port(). If a subsequent operation in
serial_core_add_one_port() fails (for example, allocating uport->tty_groups
returns -ENOMEM), the error path returns the error but does not unregister
the console.

The driver then cleans up by calling pl011_unregister_port(), which clears
the amba_ports array entry by setting amba_ports[co->index] = NULL.

The console remains globally registered. If this console is eventually
unregistered (such as when displaced by a preferred console or via sysfs
unbind), pl011_console_exit() is invoked. It unconditionally assigns uap
and dereferences it, leading to a kernel panic. Other console callbacks like
pl011_console_setup() correctly check for a NULL uap before proceeding.

> +
> +	return 0;
> +}

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260724213348.77418-1-kmehltretter@gmail.com?part=1