From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-ua1-f48.google.com (mail-ua1-f48.google.com [209.85.222.48]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6423D36E489 for ; Sat, 17 Oct 2026 07:45:31 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.222.48 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792223132; cv=none; b=bvaJq6Q1dJgnbd+41Mv6cSqCA1MGsZaH01Es4vB9SkhL/izxAqD1P3Ujp3X//b7kPRMidyCQmFj+Xg7srCQgmvfF7bDr/+zNZtIsUCJf0ET/98V1YOygpgCYrp99yh6GUD7p/iri89lazFlGDLAaeBCKE/WOnbWdkEGmTGKoEPE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1792223132; c=relaxed/simple; bh=qPVWbcybtA2FbyXQHtXtzDhQM1hYp+5hZUiApPPsn60=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=oriiDohfHaFPA2pE7OOdaBF79Ozmt9tfcVoDNraCwmtSgpo6swid1hLiylnO6Un4Mlrz+a4hYIZP7DfUopavVZXMEMWXkvvsbhWArknSiXMR2EZaZ1rL8yuzL9sE6YSrIfC7d9vo5f1WXwl41uRLMboJ3pEjrI+BXZqk3VGfvyQ= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=BUDWkYbX; arc=none smtp.client-ip=209.85.222.48 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="BUDWkYbX" Received: by mail-ua1-f48.google.com with SMTP id a1e0cc1a2514c-99071945aa7so380595241.3 for ; Sat, 17 Oct 2026 00:45:31 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1792223130; x=1792827930; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to:content-type; bh=7+MRhp20Qv6qzPEtCEOr1Z9CVtBjcSUa4+hS0qMlh6k=; b=BUDWkYbXQgl/YSuZcGfYXKjxUAoL134/L/AZRKLTVBSZ3S0lHQ8lnN6P3pjUDq5Kdd oi/ergSOOdtGdGEG6cCSAiwnTyNQGoaKnlOyCex5PNUWdBvIxp0yrJbfJTcb4yMqm0SY 7YkjhUDHIuMjsErVEALo3Xef/jE8dBEUHRF/n7tYMHsi+JaW4FsHRRH+z6fpv9JtQB2p rFr0ZjjitRn5HXR5bWK9KXLZAVtVaWyqxnYpl9bx4T1qfgwIzHFQPV2gjBoyQpV0zy47 Y5799ZcqNDhZEBtxhCc6ugZdCY8fcnUriufRjnVJ8AN2PA9GTMdSeCLNpHadlKr7Brna MX1Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20260707; t=1792223130; x=1792827930; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-gg:x-gm-message-state:from :to:cc:subject:date:message-id:reply-to:content-type; bh=7+MRhp20Qv6qzPEtCEOr1Z9CVtBjcSUa4+hS0qMlh6k=; b=yq6nv5dxXzfafRuPImik70LtfP32l/LTXYsWlTNJYfbJUMR++Ixa4NfTTl2iJlUzyF XsIqammYrGR2SHoji8AlXpaB4DHmU7Az3bpxPdtO+E2arHqIBcTHj38YA39sqUIZDOYj LZ2fFCiy6KvsVVXEke1HlAu1YIhf3clliJjtRaPOOK0rBY/nwmu98XG77RlXLpN+7e+v Ci8WrDd4ZRVYxfjoOTbb0Gcz8/Qdr28Z2sCPhouAEztOqbztco8TPm3dUUEAFw4JeAZ4 Yyvl/WjNqNv709ZpbXZIYjo73uOckjMspzmjlPxDJ3yVMuelRE3mY18iFVYLoaLourN3 tUjQ== X-Forwarded-Encrypted: i=1; AKwUvBz/vCwv+X0rli8lfh3Z0rTS6/FdTfaJOv5wr4bs5dYtKgxFsYNNPNCERXkCtt1RZYF/0kF0CriUTgInGUA=@vger.kernel.org X-Gm-Message-State: AFq9FYKOVjq6aNiPM6guts4mh1/auK8X/np0BgbUCw9GvM7/L7ctsddy mXM/YFD8O5mL2KuvrbI8xBq6H9p0RDHQ4obhTXcTKHmifYjdCybhbCo9 X-Gm-Gg: AYBFou1qXIFeR5Msyw6MRVg2tTFR4y5EUzgba81S7FGKDxP1HhQlYgjlkXerbIrXj3o 0LvcznjPbbaqdrWqCr0iTnoCBcYlB0YuG3ScAMl0HqdT9xUn4B4ddzahjs6Ud6HbtqTuXz9eh92 EHwDjj+6q5rMu9LOhS8VRVFem9v7PNtAZlLlV2Fx9YIyaShobwQb5EAoOrFNn/8J7cjzCBvP9jc vwhY61W+mcDd/1kB2yWLVuONvH9M6J9FueDcQwMqzxdDZWTuUHWcd6Wc8buV6I6Byx6UchUsh/L bZzheXTYcLhfqj4DswpzDOX0Nb4tV2kltcPeNhzefCaK0MiIMd1IQj2zRmVKGhYmaaS9PsDm/ns 86C26SiPj8jwdqGuiv3ycQ80O/5l9LS6nuI2hjJANi8ym61OkpUtfRlyp4Jj6GXaRiQF22YXBL6 hGnuj6diIoW9nR+3ivX77AS09RytqcSAzM71h7+T1jjUMQgFeuzzRZK9P8Bku8HAGhRm5UsoOti r8OhUBQwDxLiw1ie5wBTSBNSqf1Y41j+lSbC5wLePOIZHJsogICe+kpDBaLQTc= X-Received: by 2002:a05:6102:41a2:b0:7c0:4d52:8cc9 with SMTP id ada2fe7eead31-7cc36997787mr569456137.14.1792223130340; Sat, 17 Oct 2026 00:45:30 -0700 (PDT) Received: from localhost.localdomain ([186.151.100.62]) by smtp.gmail.com with ESMTPSA id 71dfb90a1353d-5ea9b53cfdfsm3701836e0c.15.2026.10.17.00.45.27 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 17 Oct 2026 00:45:29 -0700 (PDT) From: Sebastian Alba Vives To: gregkh@linuxfoundation.org, jirislaby@kernel.org, pjw@kernel.org, samuel.holland@sifive.com Cc: linux-serial@vger.kernel.org, linux-riscv@lists.infradead.org, linux-kernel@vger.kernel.org, Sebastian Alba Subject: [PATCH 1/2] serial: sifive: fix NULL pointer dereference in probe IRQ window Date: Sat, 17 Oct 2026 01:44:52 -0600 Message-ID: <20261017074453.62645-2-sebasjosue84@gmail.com> X-Mailer: git-send-email 2.43.0 In-Reply-To: <20261017074453.62645-1-sebasjosue84@gmail.com> References: <20261017074453.62645-1-sebasjosue84@gmail.com> Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Sebastian Alba sifive_serial_probe() installs the interrupt handler with request_irq() before uart_add_one_port() has run. uart_add_one_port() is what assigns ssp->port.state, and ssp is allocated with devm_kzalloc(), so ssp->port.state is NULL for the whole window between the two calls. The handler dereferences that pointer unconditionally: sifive_serial_irq() __ssp_receive_chars() uart_insert_char(&ssp->port, ...) /* port->state->port */ tty_flip_buffer_push(&ssp->port.state->port); so an RX interrupt taken inside the window oopses the kernel. The window is not purely theoretical. probe() programs TXCTRL and RXCTRL but never writes the interrupt enable register, so IE keeps whatever value the previous stage left in it. If RX watermark interrupts are still enabled there, or an interrupt is already pending at the PLIC, the handler runs as soon as request_irq() unmasks the line, with no timing requirement at all. On a HiFive Unmatched (FU740-C000) the vendor firmware leaves IE masked, so a cold boot on that board does not hit this. The realistic trigger is a handover where the previous stage leaves IE enabled, such as kexec into a new kernel while the UART is in use. Move request_irq() after uart_add_one_port() so the handler can never observe a half-initialised port, and explicitly mask the interrupt enable register during probe instead of inheriting whatever value was left there. Unwinding is adjusted accordingly: uart_remove_one_port() now balances the added port on the request_irq() failure path. Fixes: 45c054d0815b ("tty: serial: add driver for the SiFive UART") Signed-off-by: Sebastian Alba --- drivers/tty/serial/sifive.c | 19 +++++++++++-------- 1 file changed, 11 insertions(+), 8 deletions(-) diff --git a/drivers/tty/serial/sifive.c b/drivers/tty/serial/sifive.c index f615701fc..4a445d285 100644 --- a/drivers/tty/serial/sifive.c +++ b/drivers/tty/serial/sifive.c @@ -1046,27 +1046,30 @@ static int sifive_serial_probe(struct platform_device *pdev) SIFIVE_SERIAL_RXCTRL_RXEN_MASK, SIFIVE_SERIAL_RXCTRL_OFFS, ssp); - r = request_irq(ssp->port.irq, sifive_serial_irq, ssp->port.irqflags, - dev_name(&pdev->dev), ssp); - if (r) { - dev_err(&pdev->dev, "could not attach interrupt: %d\n", r); - goto probe_out2; - } + /* Mask all interrupts; the bootloader may have left some enabled */ + __ssp_writel(0, SIFIVE_SERIAL_IE_OFFS, ssp); __ssp_add_console_port(ssp); r = uart_add_one_port(&sifive_serial_uart_driver, &ssp->port); if (r != 0) { dev_err(&pdev->dev, "could not add uart: %d\n", r); + goto probe_out2; + } + + r = request_irq(ssp->port.irq, sifive_serial_irq, ssp->port.irqflags, + dev_name(&pdev->dev), ssp); + if (r) { + dev_err(&pdev->dev, "could not attach interrupt: %d\n", r); goto probe_out3; } return 0; probe_out3: - __ssp_remove_console_port(ssp); - free_irq(ssp->port.irq, ssp); + uart_remove_one_port(&sifive_serial_uart_driver, &ssp->port); probe_out2: + __ssp_remove_console_port(ssp); clk_notifier_unregister(ssp->clk, &ssp->clk_notifier); probe_out1: return r; -- 2.43.0