Re: [PATCH 1/2] serial: sifive: fix NULL pointer dereference in probe IRQ window

[sashiko-bot@kernel.org]

> From: Sebastian Alba <sebasjosue84@estudiantec.cr>
> 
> sifive_serial_probe() installs the interrupt handler with request_irq()
> before uart_add_one_port() has run.  uart_add_one_port() is what assigns
> ssp->port.state, and ssp is allocated with devm_kzalloc(), so
> ssp->port.state is NULL for the whole window between the two calls.
> 
> The handler dereferences that pointer unconditionally:
> 
>   sifive_serial_irq()
>     __ssp_receive_chars()
>       uart_insert_char(&ssp->port, ...)        /* port->state->port */
>       tty_flip_buffer_push(&ssp->port.state->port);
> 
> so an RX interrupt taken inside the window oopses the kernel.
> [ ... ]
> left there.  Unwinding is adjusted accordingly: uart_remove_one_port()
> now balances the added port on the request_irq() failure path.
> 
> Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART")
> Signed-off-by: Sebastian Alba <sebasjosue84@estudiantec.cr>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261017074453.62645-1-sebasjosue84@gmail.com?part=1