From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wr1-f49.google.com (mail-wr1-f49.google.com [209.85.221.49]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 82BCB369207 for ; Fri, 31 Jul 2026 18:18:53 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.221.49 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785521935; cv=none; b=WJ+iwSF2EK5nl6bFt/mNdNNIzso5yYUn7nv+vZZl38h0cSOaTB5wdWQIXk1HFIGEhWpXR16ORRR6HKAw1WH/6UnY1ABpfi7hGhbi6QzXQ5uOCDVVxoWSqLgl7yIOPJ4yv5QZGr0YrbrntBKvCc04FCEE1DmHjtB2ydRbjxyycSc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1785521935; c=relaxed/simple; bh=YOKf9/usp4erLkDN0Msqj3Z2/dbnL0uqaOiOLKQ/ALI=; h=From:To:Cc:Subject:Date:Message-Id:In-Reply-To:References: MIME-Version; b=Cm4EolOW3YQlodyK2nhGdmI19k76vXsk0oWPLLc+58XQzHNBrtYyS9IZZItXZ8Cmbe5q4r3qlqGHceg8y3zGEtoGzaUqYRbQCxBKzjAc/A9fvSPYHLavRafH4kMkhytMfniZtpMyNI3piJQ5t4FdAtjA4MdiX+CUCWoguCshdA4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=EtVz4dVH; arc=none smtp.client-ip=209.85.221.49 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="EtVz4dVH" Received: by mail-wr1-f49.google.com with SMTP id ffacd0b85a97d-47db714766aso1474512f8f.0 for ; Fri, 31 Jul 2026 11:18:53 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1785521932; x=1786126732; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=pw2+6W330KNNbLzF0QvSgAqSLp8AT2ZZJuEbFAlLaQ4=; b=EtVz4dVHTHuDqKyYvFn3DFpFmPXz6urhsZYrCnT8xDDbpvcTIZGhc+4yqY1A53eYOW +yDX4XPvI/SB28K+bdjfu98362vCGuzxbK6lcAhRt9QIfrlYk3UqRGJiqbGk1N6ijBXK APcRgca7fBiD7TubX2vHL6ABy6mFfc8RYl/2G7wQevJGiPnZqKbJJWuA1YwYKAMz764r yrFo6rWzaXvWj6fdZmm9YKiKm+Cz7yLz/oFLElwM0PTsmhKeE2Z7CVYAtkSlc1C/BCFE wMSTgNPpUPKdQT/IYY3f63+ao/0EW/8YqOlQBVG6u9RYAD+/rSgwTvsDqF+TwHQw4Guu tt0w== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1785521932; x=1786126732; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=pw2+6W330KNNbLzF0QvSgAqSLp8AT2ZZJuEbFAlLaQ4=; b=QYhh8zk40keBBi0R1QjnYQbTzwcwewE/q3Ph9iVREH+/w733iUweaqXBkfpWSyVfgj GPq3FxeyTvEozUwvAMD+0vSwKIqpwH6b8qONK/QwSsVOgHKUYNmnJRyAi0sSnh+utAWB H+ifY2bLmH3A/v1MTC14pbZ0G7owi58R3R6D/WYKKj8BnWnvv4ARin7mSh+2s4OifzKt bDjYA4c7pCKrGy46vVFHLbtVSCS8kgn1IiB7Zh7djTPUyh8kkxs4DZj9DJxgPtsgAOCf TCTEJq/BdFJufVj/AeA32ZNP8rhPH6ekhmBLKF89PoJzPwasvywU9Xv07WKtjBxnxD5k /8oQ== X-Forwarded-Encrypted: i=1; AHgh+RrAMP1NwwvSCPxWSh614TT5vyYvmPI5Ely7Gx5odR+BWTmd6c3Fsno9pVOailf4TO6SeXt95xVMsTjI9+A=@vger.kernel.org X-Gm-Message-State: AOJu0Ywss4Qfzn70+rwKhQqbZgrI1eZTirUNpjm9romvdgkZY2mFjBWD ki1Ndlsn1IC1Io5As+PJVDGbh1dEM4l36GGZOmi/Jz/pDzGwOFXwTQq+ X-Gm-Gg: AR+sD13zVIEmoK1NAoIR2xMLGqjAuUbAXnmnuHGvXr7aYunkdPaSkCAP6gRJ/uKpLEX vICOl3KH46kClsViixzXnb3jiHq684drtNcvMK7YwGX+OXE/YHSDE+L/nHDM+I6qTJlm8ep+rLy EhvApby5Vf5ygRcCNnN3RmfvtP5uPefKQU33OKc4OihwLnk2K+7zskVtTz+HMo00pfTEKNC0iYF RwV4SpDsllLSVgA4qd3ILPFI0c9z2wjOjNYvq+rbLXrfhOAY3KH/UnF1XutnxKzQZ0WrGGBLf4n ZEmWvESjC4hLCw9VTVYi1LCoIzfzK+R2X6uKejQrcz4tCfiJR/kC9gyP57e1yEz1ksp1WDITgme PryzIpwPQDPGfzD7br2+MytKWvqSCTxgN8bHCy3F2awELH6kfzDFBMWL3yKd6V2jkIuQZq2vaZX YjpIhvKWrn2nmQtDksCpRuuMrpdx7kpznTpssz77p5MLhJJnnT8N6ton6slcFVPjLCIwEGX8XqM 6PCmSnP6t8v1aajLyUR3TsBskVgILAxPoVfBzlH1e3tRWLYZUTODnJDo92lTigzaalMJuzKLpl9 QtJ0CC2dL/KqdwJTDeFvO8HC7BFr/4JItML6D9rtGuCI8il4drqfG4pEqCMhWWWzAVax X-Received: by 2002:a5d:5f09:0:b0:47f:97e9:fe55 with SMTP id ffacd0b85a97d-47fd32ea399mr6710072f8f.22.1785521931614; Fri, 31 Jul 2026 11:18:51 -0700 (PDT) Received: from localhost.localdomain (dynamic-2a02-3100-a8d0-bc01-6d31-3d12-3a11-d2d0.310.pool.telefonica.de. [2a02:3100:a8d0:bc01:6d31:3d12:3a11:d2d0]) by smtp.gmail.com with ESMTPSA id ffacd0b85a97d-47fd41d1756sm7293694f8f.4.2026.07.31.11.18.50 (version=TLS1_3 cipher=TLS_CHACHA20_POLY1305_SHA256 bits=256/256); Fri, 31 Jul 2026 11:18:51 -0700 (PDT) From: Karl Mehltretter To: Greg Kroah-Hartman , Jiri Slaby Cc: Karl Mehltretter , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , linux-serial@vger.kernel.org, linux-kernel@vger.kernel.org, imx@lists.linux.dev, linux-arm-kernel@lists.infradead.org, Sashiko Subject: [PATCH v4 1/5] serial: core: do fallible allocations before the console can be registered Date: Fri, 31 Jul 2026 20:18:40 +0200 Message-Id: <20260731181844.11330-2-kmehltretter@gmail.com> X-Mailer: git-send-email 2.39.5 (Apple Git-154) In-Reply-To: <20260731181844.11330-1-kmehltretter@gmail.com> References: <20260731181844.11330-1-kmehltretter@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit serial_core_add_one_port() allocates uport->tty_groups after uart_configure_port(), which may register the console. If the allocation fails, the driver unwinds the port while its console remains registered. The earlier uport->name allocation has a related failure path that leaves state->uart_port linked to a port being freed. Failslab reproduced a NULL dereference in PL011 console output and a KASAN use-after-free in i.MX console output after failed binds. Allocate the name and tty_groups before linking the port and configuring it. Reserve space for the optional driver attribute group because config_port() may populate uport->attr_group during configuration. Fixes: 266dcff03eed ("Serial: allow port drivers to have a default attribute group") Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct") Reported-by: Sashiko Closes: https://lore.kernel.org/all/20260719070454.D6FA21F000E9@smtp.kernel.org/ Assisted-by: Claude:claude-fable-5 Signed-off-by: Karl Mehltretter --- drivers/tty/serial/serial_core.c | 30 ++++++++++++++++-------------- 1 file changed, 16 insertions(+), 14 deletions(-) diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c index a530ad372b43..03ee3d038f4e 100644 --- a/drivers/tty/serial/serial_core.c +++ b/drivers/tty/serial/serial_core.c @@ -3056,7 +3056,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u struct uart_state *state; struct tty_port *port; struct device *tty_dev; - int num_groups; if (uport->line >= drv->nr) return -EINVAL; @@ -3068,6 +3067,22 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u if (state->uart_port) return -EINVAL; + uport->name = kasprintf(GFP_KERNEL, "%s%u", drv->dev_name, + drv->tty_driver->name_base + uport->line); + if (!uport->name) + return -ENOMEM; + + /* + * uart_configure_port() may set uport->attr_group and register the + * console. Allocate room for both groups and a NULL terminator first. + */ + uport->tty_groups = kzalloc_objs(*uport->tty_groups, 3); + if (!uport->tty_groups) { + kfree(uport->name); + return -ENOMEM; + } + uport->tty_groups[0] = &tty_dev_attr_group; + /* Link the port to the driver state table and vice versa */ atomic_set(&state->refcount, 1); init_waitqueue_head(&state->remove_wait); @@ -3084,10 +3099,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u state->pm_state = UART_PM_STATE_UNDEFINED; uart_port_set_cons(uport, drv->cons); uport->minor = drv->tty_driver->minor_start + uport->line; - uport->name = kasprintf(GFP_KERNEL, "%s%u", drv->dev_name, - drv->tty_driver->name_base + uport->line); - if (!uport->name) - return -ENOMEM; if (uport->cons && uport->dev) of_console_check(uport->dev->of_node, uport->cons->name, uport->line); @@ -3102,15 +3113,6 @@ static int serial_core_add_one_port(struct uart_driver *drv, struct uart_port *u port->console = uart_console(uport); - num_groups = 2; - if (uport->attr_group) - num_groups++; - - uport->tty_groups = kzalloc_objs(*uport->tty_groups, num_groups); - if (!uport->tty_groups) - return -ENOMEM; - - uport->tty_groups[0] = &tty_dev_attr_group; if (uport->attr_group) uport->tty_groups[1] = uport->attr_group; -- 2.53.0