Re: [PATCH v2] serial: core: shut down initialized port on removal

[Phil Rosenthal <phil@phil.gs>]

On Sat, Oct 03, 2026 at 07:33:37PM +0300, Igor Putko wrote:
> Fix this by acquiring port->mutex in serial_core_remove_one_port() after
> console unregistration, clearing port->console under the mutex to prevent
> data races with concurrent tty_port_shutdown(), and invoking
> uart_shutdown(NULL, state) if the port remains initialized.

I sent a patch for the same bug [1] without having seen this one. I
ran my reproducers on tty-next 36844ea19656 plus this commit
(810d467c11f0 in tty-testing), in a QEMU guest with KASAN. The 8250_pci
case with INTx is fixed: the IRQ is freed on unbind, reading
/proc/interrupts is clean and rebinding restores the console. It also
fixes a second symptom, on a polled port (irq 0, UPF_IOREMAP), where
serial8250_timeout() kept running after removal and dereferenced the
cleared membase. A port held open across removal and a console that
was never opened still work.

Tested-by: Phil Rosenthal <phil@phil.gs>

The patch uses scoped_guard(), which exists for mutexes from v6.5, so
it won't build on the 6.1, 5.15 and 5.10 stable trees. If you don't
plan to send backports for those, I can.

[1] https://lore.kernel.org/r/20261013-serial-console-remove-v2-1-2eca1a92c10d@phil.gs

Thanks,
Phil