Re: [PATCH v5 1/3] serial: 8250: hold hash_mutex across IRQ chain linking in serial_link_irq_chain()

[sashiko-bot@kernel.org]

> In serial_link_irq_chain(), serial_get_or_create_irq_info() acquires
> hash_mutex to search or allocate a chain instance and drops hash_mutex
> before returning.
> 
> If a concurrent call to serial_unlink_irq_chain() runs immediately after
> serial_get_or_create_irq_info() returns while i->head is still NULL,
> serial_unlink_irq_chain() acquires hash_mutex, finds i with
> i->head == NULL, frees the chain structure via free_irq() / kfree(),
> and removes it from the hashtable. serial_link_irq_chain() then
> proceeds to scoped_guard(spinlock_irq, &i->lock), dereferencing the freed
> chain pointer i and causing a slab use-after-free.
> 
> Move guard(mutex)(&hash_mutex) to the beginning of
> serial_link_irq_chain() and rename serial_get_or_create_irq_info() to
> serial_get_or_create_irq_info_locked() so hash_mutex is held across the
> entire lookup, linking, and error-path unlinking sequence.
> 
> Tested in QEMU against tip of mainline (62f4c998b297, "Merge tag
> 'parisc-for-7.3-rc5' of git://git.kernel.org/.../parisc-linux")
> with KASAN enabled by concurrently opening/closing 8250 serial ports
> sharing IRQ 4 (ttyS0 and ttyS2): on the unfixed kernel KASAN detects
> slab-use-after-free in serial_link_irq_chain(); whereas with this fix
> applied, port registration and unregistration run cleanly with 0 KASAN
> warnings.
> 
> Fixes: e91f1ed6c24f ("serial: 8250: fix use-after-free in serial_link_irq_chain")
> Cc: stable@vger.kernel.org
> Reviewed-by: Ilpo Järvinen <ilpo.jarvinen@linux.intel.com>
> Assisted-by: LLM
> Signed-off-by: Hui Peng <benquike@gmail.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260930041216.155911-1-benquike@gmail.com?part=1