Re: [PATCH v4 1/3] serial: 8250: hold hash_mutex across IRQ chain linking in serial_link_irq_chain()

[sashiko-bot@kernel.org]

> In serial_link_irq_chain(), serial_get_or_create_irq_info() acquires and
> releases hash_mutex before returning struct irq_info *i to the caller.
> Before serial_link_irq_chain() links the port into i->head, a concurrent
> serial_unlink_irq_chain() on the same shared IRQ line can observe a
> single-port i->head under hash_mutex, remove i from irq_lists, and
> kfree(i), causing a use-after-free when serial_link_irq_chain() accesses
> i->lock and i->head. In addition, if request_irq() fails at the end of
> serial_link_irq_chain(), serial_do_unlink(i, up) calls hlist_del(&i->node)
> and kfree(i) without holding hash_mutex.
> 
> Move guard(mutex)(&hash_mutex) from serial_get_or_create_irq_info() to its
> sole caller serial_link_irq_chain() so that hash_mutex is held across the
> lookup/allocation of struct irq_info, the insertion into i->head, and any
> error-path serial_do_unlink() cleanup.
> 
> Tested in QEMU against Linux 7.3.0-rc3 by configuring /dev/ttyS1 and
> /dev/ttyS2 to share IRQ 3 with ASYNC_SHARE_IRQ via TIOCSSERIAL and
> concurrently opening and closing both ports from two threads in a tight
> loop with KASAN enabled, verifying 0 KASAN faults or warnings.
> 
> Fixes: 25db8ad5c567 ("serial, 8250: remove NR_IRQ usage")
> Fixes: 99fc860fae83 ("serial: 8250: extract serial_get_or_create_irq_info()")
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924060511.2364717-1-benquike@gmail.com?part=1