[PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[Gaosheng Cui]

From: Cui GaoSheng <cuigaosheng1@huawei.com>

serial8250_unregister_port() removes a port and then re-registers it
against the legacy serial8250 device when that device is still
present, ignoring the return value of uart_add_one_port(). When the
re-register fails, the error path of serial_core_register_port()
removes the port device but leaves port->port_dev dangling (or NULL
if the port device allocation itself failed). serial8250 matches
ports on ->dev, so such half-registered slots still reach
serial_core_unregister_port() on the next unbind:

  Oops: general protection fault ... SMP KASAN PTI
  KASAN: null-ptr-deref in range [0x40-0x47]
  RIP: serial_core_unregister_port+0xe5/0xa00
    serial8250_unregister_port+0x103
    serial8250_remove+0x61
    device_release_driver_internal+0x38c
    unbind_store+0xd1
    kernfs_fop_write_iter+0x329
    vfs_write+0x5d0
    ksys_write+0xf7
    do_syscall_64+0xdd
    entry_SYSCALL_64_after_hwframe+0x77

Fix the error path to clear port->port_dev, and bail out of
serial_core_unregister_port() when port_dev is NULL. Read
port->port_dev under port_mutex, like all of its writers.

Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
Assisted-by: GLM-5.3 OpenCode # fault analysis and fix rework
Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>
---
Changes in v3:
- Drop the already-registered port rejection: nothing in-tree can
  register the same port twice.
- Trim the comments per review.

Changes in v2:
- Drop the state slot restore from the registration error path.
- Move the port->port_dev read and the !port_dev bail in
  serial_core_unregister_port() under port_mutex.
- Reject registering a port that is already registered.
 drivers/tty/serial/serial_core.c | 12 ++++++++++--
 1 file changed, 10 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 95774b0f1484..0a3dab5d556c 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -3358,6 +3358,7 @@ int serial_core_register_port(struct uart_driver *drv, struct uart_port *port)
 
 err_unregister_port_dev:
 	serial_base_port_device_remove(port->port_dev);
+	port->port_dev = NULL;
 
 err_unregister_ctrl_dev:
 	serial_base_ctrl_device_remove(new_ctrl_dev);
@@ -3372,12 +3373,19 @@ int serial_core_register_port(struct uart_driver *drv, struct uart_port *port)
 void serial_core_unregister_port(struct uart_driver *drv, struct uart_port *port)
 {
 	struct device *phys_dev = port->dev;
-	struct serial_port_device *port_dev = port->port_dev;
-	struct serial_ctrl_device *ctrl_dev = serial_core_get_ctrl_dev(port_dev);
+	struct serial_port_device *port_dev;
+	struct serial_ctrl_device *ctrl_dev;
 	int ctrl_id = port->ctrl_id;
 
 	guard(mutex)(&port_mutex);
 
+	/* May have never been registered. */
+	port_dev = port->port_dev;
+	if (!port_dev)
+		return;
+
+	ctrl_dev = serial_core_get_ctrl_dev(port_dev);
+
 	port->flags |= UPF_DEAD;
 
 	serial_core_remove_one_port(drv, port);
-- 
2.43.0

Re: [PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[sashiko-bot]

> From: Cui GaoSheng <cuigaosheng1@huawei.com>
> 
> serial8250_unregister_port() removes a port and then re-registers it
> against the legacy serial8250 device when that device is still
> present, ignoring the return value of uart_add_one_port(). When the
> re-register fails, the error path of serial_core_register_port()
> removes the port device but leaves port->port_dev dangling (or NULL
> if the port device allocation itself failed). serial8250 matches
> ports on ->dev, so such half-registered slots still reach
> serial_core_unregister_port() on the next unbind:
> 
>   Oops: general protection fault ... SMP KASAN PTI
>   KASAN: null-ptr-deref in range [0x40-0x47]
>   RIP: serial_core_unregister_port+0xe5/0xa00
>     serial8250_unregister_port+0x103
> [ ... ]
> port->port_dev under port_mutex, like all of its writers.
> 
> Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
> Assisted-by: GLM-5.3 OpenCode # fault analysis and fix rework
> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260928113456.3118750-1-cuigaosheng1@huawei.com?part=1

Re: [PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[Andy Shevchenko]

On Mon, Sep 28, 2026 at 07:34:56PM +0800, Gaosheng Cui wrote:

> serial8250_unregister_port() removes a port and then re-registers it
> against the legacy serial8250 device when that device is still
> present, ignoring the return value of uart_add_one_port(). When the
> re-register fails, the error path of serial_core_register_port()
> removes the port device but leaves port->port_dev dangling (or NULL
> if the port device allocation itself failed). serial8250 matches
> ports on ->dev, so such half-registered slots still reach
> serial_core_unregister_port() on the next unbind:
> 
>   Oops: general protection fault ... SMP KASAN PTI
>   KASAN: null-ptr-deref in range [0x40-0x47]
>   RIP: serial_core_unregister_port+0xe5/0xa00
>     serial8250_unregister_port+0x103
>     serial8250_remove+0x61
>     device_release_driver_internal+0x38c
>     unbind_store+0xd1
>     kernfs_fop_write_iter+0x329
>     vfs_write+0x5d0
>     ksys_write+0xf7
>     do_syscall_64+0xdd
>     entry_SYSCALL_64_after_hwframe+0x77

Submitting Patches is clear about bloated backtraces in the commit message.

> Fix the error path to clear port->port_dev, and bail out of
> serial_core_unregister_port() when port_dev is NULL. Read
> port->port_dev under port_mutex, like all of its writers.

> Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
> Assisted-by: GLM-5.3 OpenCode # fault analysis and fix rework

Assisted-by: LLM

> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>

-- 
With Best Regards,
Andy Shevchenko

Re: [PATCH -next,v3] serial: core: fix NULL/dangling port_dev on failed re-register

[cuigaosheng]

On 2026/9/29 5:47, Andy Shevchenko wrote:
> On Mon, Sep 28, 2026 at 07:34:56PM +0800, Gaosheng Cui wrote:
>
>> serial8250_unregister_port() removes a port and then re-registers it
>> against the legacy serial8250 device when that device is still
>> present, ignoring the return value of uart_add_one_port(). When the
>> re-register fails, the error path of serial_core_register_port()
>> removes the port device but leaves port->port_dev dangling (or NULL
>> if the port device allocation itself failed). serial8250 matches
>> ports on ->dev, so such half-registered slots still reach
>> serial_core_unregister_port() on the next unbind:
>>
>>    Oops: general protection fault ... SMP KASAN PTI
>>    KASAN: null-ptr-deref in range [0x40-0x47]
>>    RIP: serial_core_unregister_port+0xe5/0xa00
>>      serial8250_unregister_port+0x103
>>      serial8250_remove+0x61
>>      device_release_driver_internal+0x38c
>>      unbind_store+0xd1
>>      kernfs_fop_write_iter+0x329
>>      vfs_write+0x5d0
>>      ksys_write+0xf7
>>      do_syscall_64+0xdd
>>      entry_SYSCALL_64_after_hwframe+0x77
> Submitting Patches is clear about bloated backtraces in the commit message.
>
>> Fix the error path to clear port->port_dev, and bail out of
>> serial_core_unregister_port() when port_dev is NULL. Read
>> port->port_dev under port_mutex, like all of its writers.
>> Fixes: 84a9582fd203 ("serial: core: Start managing serial controllers to enable runtime PM")
>> Assisted-by: GLM-5.3 OpenCode # fault analysis and fix rework
> Assisted-by: LLM
>
>> Signed-off-by: Cui GaoSheng <cuigaosheng1@huawei.com>

Thanks, I have submitted the V4 patch.