[PATCH] serial: sccnxp: Fix potential stale ports after IRQ request failure

[Guangshuo Li]

The ports are registered before the interrupt is requested. If that
request fails, unregistering the UART driver frees its state array
while the registered ports still refer to it.

Check each port registration and remove the ports already registered
before unwinding the UART driver on either failure path.

This issue was found by our static analysis tool under development.

Fixes: 1d65c0b12656 ("serial: New serial driver SCCNXP")
Cc: stable@xxxxxxxxxxxxxxx
Signed-off-by: Guangshuo Li <liguangshuo@xxxxxxxxxxxxxxx>
---
 drivers/tty/serial/sccnxp.c | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c
index cb31e3aceb62..502f8ebe265b 100644
--- a/drivers/tty/serial/sccnxp.c
+++ b/drivers/tty/serial/sccnxp.c
@@ -989,7 +989,9 @@ static int sccnxp_probe(struct platform_device *pdev)
 		s->port[i].uartclk	= uartclk;
 		s->port[i].ops		= &sccnxp_ops;
 		s->port[i].has_sysrq = IS_ENABLED(CONFIG_SERIAL_SCCNXP_CONSOLE);
-		uart_add_one_port(&s->uart, &s->port[i]);
+		ret = uart_add_one_port(&s->uart, &s->port[i]);
+		if (ret)
+			goto err_remove_ports;
 		/* Set direction to input */
 		if (s->chip->flags & SCCNXP_HAVE_IO)
 			sccnxp_set_bit(&s->port[i], DIR_OP, 0);
@@ -1016,6 +1018,10 @@ static int sccnxp_probe(struct platform_device *pdev)
 		return 0;
 	}
 
+err_remove_ports:
+	while (i--)
+		uart_remove_one_port(&s->uart, &s->port[i]);
+
 	uart_unregister_driver(&s->uart);
 err_out:
 	if (!IS_ERR(s->regulator))
-- 
2.43.0