Re: [PATCH] serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] serial: hw access without PM in uart_do_autoconfig()
--

commit f48636ab329a71ecd2a47c54111b53dd3b5b35da
Author: Hengyu Liang <hengyul@cs.unc.edu>

serial: core: fix TIOCSSERIAL and TIOCSERCONFIG on uninitialised ports

This commit changes the check in uart_set_info() and uart_do_autoconfig()
from tty_io_error() to tty_port_active(). This allows setserial to configure
a port that the kernel did not detect, fixing an issue where uninitialized
ports could not be configured.

> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 319a4b427f3a3..36c59f5fadebd 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
[ ... ]
> @@ -1143,7 +1147,8 @@ static int uart_do_autoconfig(struct tty_struct *tty, struct uart_state *state)
>  	 */
>  	scoped_cond_guard(mutex_intr, return -ERESTARTSYS, &port->mutex) {
>  		uport = uart_port_check(state);
> -		if (!uport || tty_io_error(tty))
> +		/* As in uart_set_info(), only refuse a hung up port. */
> +		if (!uport || !tty_port_active(port))
>  			return -EIO;

[Severity: High]
Does relaxing this check to tty_port_active() allow the ioctl to proceed on
uninitialized (PORT_UNKNOWN) ports where the power management state is still
OFF?

A user with CAP_SYS_ADMIN could call open() on an uninitialized port which
succeeds but sets TTY_IO_ERROR. If they then invoke the TIOCSERCONFIG ioctl,
the active but uninitialized port would pass this check.

Further down in uart_do_autoconfig(), the code executes:

    uport->ops->config_port(uport, flags);

Could this unconditionally invoke the driver's config_port callback before
uart_startup() has a chance to enable power and clocks? On architectures with
strict power domain management, accessing hardware registers without runtime
PM enabled can trigger a fatal bus error (synchronous external abort) and
kernel panic.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261010034616.3915864-1-hengyul@cs.unc.edu?part=1