Re: [PATCH] serial: core: shut down initialized port on removal

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Medium] tty: data race on port->console in serial_core_remove_one_port()
--

commit ff681977bacb42b18c6925085fd5fa965af4c283
Author: Igor Putko <igorpetindev@gmail.com>

serial: core: shut down initialized port on removal

This commit addresses a use-after-free read during IRQ setup by ensuring
initialized console ports are properly shut down before removal. It clears
the console flag and calls uart_shutdown() under the port mutex.

> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484b..030735da6b8c5 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -3210,8 +3210,15 @@ static void serial_core_remove_one_port(struct uart_driver *drv,
>  	/*
>  	 * If the port is used as a console, unregister it
>  	 */
> -	if (uart_console(uport))
> +	if (uart_console(uport)) {
>  		unregister_console(uport->cons);
> +		port->console = false;

[Severity: Medium]
Could this assignment cause a data race on the port->console bitfield?

If a user process holds the serial console open while the underlying device
is removed, serial_core_remove_one_port() will synchronously hang up the
tty by calling tty_port_tty_vhangup().

If the user process then calls close(), the syscall path will execute
tty_release() -> uart_close() -> tty_port_close() -> tty_port_shutdown().

In tty_port_shutdown(), the code acquires port->mutex and evaluates
port->console. Concurrently, the assignment above happens without
holding port->mutex.

While this might be practically benign at the machine level since byte stores
are usually atomic, concurrent read/write access without synchronization is
undefined behavior in C and can trigger KCSAN warnings.

> +	}
> +
> +	guard(mutex)(&port->mutex);
> +
> +	if (tty_port_initialized(port))
> +		uart_shutdown(NULL, state);

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260924192224.3175-1-igorpetindev@gmail.com?part=1