Re: [PATCH v6] serial: 8250: fix use-after-free in IRQ chain handling

[Jing Wu <realwujing@gmail.com>]

[-- Warning: decoded text below may be mangled, UTF-8 assumed --]
[-- Attachment #1: Type: text/plain, Size: 1231 bytes --]

On Wed, Jul 08, 2026 at 03:53:26PM +0800, Wang Zhaolong wrote:
> Just one technical clarification: my v1 also moved hash_mutex to
> serial_link_irq_chain() and kept it held across irq_info lookup, i->head
> publication, the first request_irq(), and the request_irq() failure cleanup

Your v1 commit message discusses only the "Unbalanced enable for IRQ"
warning — it never mentions the use-after-free.  Our v1, one day later,
was the first to identify and document *both* races.  You confirmed on
May 29 that our v3 fixes your reproducer.

But the v1 lock-move is not the issue.  The issue is what happened after.

Our v5 (Jun 24) added lockdep_assert_held() and __must_hold() — reviewed
by Jiri on our v4.  Our v7 (Jul 8) renamed hash_mutex to irq_chain_mutex
— per Jiri's review on our v6.  Your v3 (Jul 8, after our v7) copies all
three of these improvements and presents them in your changelog as:

  "Changes in v3:
   - Rename hash_mutex to irq_chain_mutex
   - Add __must_hold() and lockdep_assert_held()"

That is not a technical clarification.  That is taking work we wrote,
reviewed by Jiri on our patches, and claiming it as your own.

Add the Co-developed-by tags.  We already added them for you on our v7.

Jing