[PATCH] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

[PATCH] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

[Fan Wu]

brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout
quirk of the 8250 core when hardware flow control is enabled; the timer
callback brcmuart_hrtimer_func() dereferences priv.

brcmuart_remove() cancels the hrtimer before it unregisters the port, so
a receive-timeout interrupt that arrives in between re-arms the timer.
After devm frees priv, the callback runs on freed memory.

Unregister the port before cancelling the hrtimer.
serial8250_unregister_port() shuts the port down and frees its IRQ, so
brcmuart_handle_irq() can no longer restart the timer, and the final
hrtimer_cancel() drains any timer that was armed before or during the
unregister.

This issue was found by an in-house static analysis tool.

Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver")
Cc: stable@vger.kernel.org
Assisted-by: Codex:gpt-5.6
Co-developed-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Song Li <songl@zju.edu.cn>
Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
---
 drivers/tty/serial/8250/8250_bcm7271.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/tty/serial/8250/8250_bcm7271.c b/drivers/tty/serial/8250/8250_bcm7271.c
index 742004d63c6f..60c7d5c9100c 100644
--- a/drivers/tty/serial/8250/8250_bcm7271.c
+++ b/drivers/tty/serial/8250/8250_bcm7271.c
@@ -1123,8 +1123,8 @@ static void brcmuart_remove(struct platform_device *pdev)
 	struct brcmuart_priv *priv = platform_get_drvdata(pdev);

 	debugfs_remove_recursive(priv->debugfs_dir);
-	hrtimer_cancel(&priv->hrt);
 	serial8250_unregister_port(priv->line);
+	hrtimer_cancel(&priv->hrt);
 	brcmuart_free_bufs(&pdev->dev, priv);
 	if (priv->dma_enabled)
 		brcmuart_arbitration(priv, 0);

Re: [PATCH] serial: 8250_bcm7271: fix use-after-free in brcmuart_remove()

[Florian Fainelli]

On 9/9/26 01:40, Fan Wu wrote:
> brcmuart_handle_irq() starts priv->hrt to work around a receive-timeout
> quirk of the 8250 core when hardware flow control is enabled; the timer
> callback brcmuart_hrtimer_func() dereferences priv.
> 
> brcmuart_remove() cancels the hrtimer before it unregisters the port, so
> a receive-timeout interrupt that arrives in between re-arms the timer.
> After devm frees priv, the callback runs on freed memory.
> 
> Unregister the port before cancelling the hrtimer.
> serial8250_unregister_port() shuts the port down and frees its IRQ, so
> brcmuart_handle_irq() can no longer restart the timer, and the final
> hrtimer_cancel() drains any timer that was armed before or during the
> unregister.
> 
> This issue was found by an in-house static analysis tool.
> 
> Fixes: 41a469482de2 ("serial: 8250: Add new 8250-core based Broadcom STB driver")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.6
> Co-developed-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Song Li <songl@zju.edu.cn>
> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>

Reviewed-by: Florian Fainelli <florian.fainelli@broadcom.com>
-- 
Florian