Re: [PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[cuigaosheng <cuigaosheng1@huawei.com>]

On 2026/9/29 5:47, Andy Shevchenko wrote:
> On Mon, Sep 28, 2026 at 07:34:56PM +0800, Gaosheng Cui wrote:
>
>> serial8250_unregister_port() removes a port and then re-registers it
>> against the legacy serial8250 device when that device is still
>> present, ignoring the return value of uart_add_one_port(). When the
>> re-register fails, the error path of serial_core_register_port()
>> removes the port device but leaves port->port_dev dangling (or NULL
>> if the port device allocation itself failed). serial8250 matches
>> ports on ->dev, so such half-registered slots still reach
>> serial_core_unregister_port() on the next unbind:
>>
>>    Oops: general protection fault ... SMP KASAN PTI
>>    KASAN: null-ptr-deref in range [0x40-0x47]
>>    RIP: serial_core_unregister_port+0xe5/0xa00
>>      serial8250_unregister_port+0x103
>>      serial8250_remove+0x61
>>      device_release_driver_internal+0x38c
>>      unbind_store+0xd1
>>      kernfs_fop_write_iter+0x329
>>      vfs_write+0x5d0
>>      ksys_write+0xf7
>>      do_syscall_64+0xdd
>>      entry_SYSCALL_64_after_hwframe+0x77
> Submitting Patches is clear about bloated backtraces in the commit message.
>
>> Fix the error path to clear port->port_dev, and bail out of
>> serial_core_unregister_port() when port_dev is NULL. Read
>> port->port_dev under port_mutex, like all of its writers.
>> Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
>> Assisted-by: GLM-5.3 OpenCode # fault analysis and fix rework
> Assisted-by: LLM
>
>> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>

Thanks, I have submitted the V4 patch.