Re: [PATCH] serial: core: shut down initialized port on removal

[IgorpetinDev]

Hi Greg,
Note: syzbot did not actually provide a reproducer for this crash -
this patch is based on code analysis of the trace, not on hardware
testing. The pcl812 trigger from syzkaller is synthetic.

On a console port, tty_port_shutdown() skips ops->shutdown() because
port->console is true, so the IRQ is never released.
If the device is later unbound/removed, serial_core_remove_one_port()
frees uport->name via kfree(), but the IRQ is never freed.
Result: a stale irqaction pointing at freed memory in action->name,
even without anything else requesting that IRQ line.

sashiko-bot also pointed out a data race on port->console = false
outside the mutex - separate issue, but relevant.

If the underlying problem looks real to you, I'd rather withdraw this
patch, put together an actual reproducer (unbind a console port, check
for the stale irqaction), fix the locking properly, and send a v2.

thanks, igor

On Thu, Sep 24, 2026 at 10:22 PM Igor Putko <igorpetindev@xxxxxxxxx> wrote:
>
> When a serial port configured as a console is opened and subsequently
> closed, tty_port_shutdown() skips invoking port->ops->shutdown() because
> port->console is true. As a result, tty_port_initialized() remains true
> and the port's interrupt handler stays registered in the irq subsystem.
>
> If the underlying device is later unbound or removed (e.g. via sysfs
> unbind), serial_core_remove_one_port() unregisters the console, frees
> uport->name with kfree(), and clears state->uart_port without ever
> shutting down the port or freeing its IRQ. Consequently, the irqaction
> remains linked in the genirq descriptor with action->name pointing to
> freed memory.
>
> When another device later requests the same IRQ line, __setup_irq()
> encounters the stale action, detects a flags mismatch, and attempts to
> print old->name in pr_err(), triggering a KASAN use-after-free read:
>
>   BUG: KASAN: slab-use-after-free in string_nocheck lib/vsprintf.c:648
>   BUG: KASAN: slab-use-after-free in string+0x471/0x4d0 lib/vsprintf.c:730
>   Read of size 1 at addr ffff88802643b8a0 by task syz.0.818/8415
>   Call Trace:
>    <TASK>
>    string_nocheck lib/vsprintf.c:648
>    string+0x471/0x4d0 lib/vsprintf.c:730
>    vsnprintf+0x422/0x1300 lib/vsprintf.c:2949
>    vprintk_store+0x3b3/0xbe0 kernel/printk/printk.c:2307
>    vprintk_emit+0x139/0x6b0 kernel/printk/printk.c:2455
>    _printk+0xcf/0x110 kernel/printk/printk.c:2504
>    __setup_irq.cold+0x3be/0x3f1 kernel/irq/manage.c:1821
>    request_threaded_irq+0x261/0x3e0 kernel/irq/manage.c:2184
>    pcl812_attach+0x1b62/0x2300 drivers/comedi/drivers/pcl812.c:1174
>    ...
>
> Fix this by clearing port->console after unregistering the console and
> calling uart_shutdown(NULL, state) under port->mutex if the port remains
> initialized, ensuring the interrupt and hardware resources are freed
> before kfree(uport->name).
>
> Reported-by: syzbot+843bf2f48f4d12e6682e@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=843bf2f48f4d12e6682e
> Fixes: 761ed4a94582 ("tty: serial_core: convert uart_close to use tty_port_close")
> Fixes: f7048b15900f ("tty: serial_core: Add name field to uart_port struct")
> Signed-off-by: Igor Putko <igorpetindev@xxxxxxxxx>
> ---
>  drivers/tty/serial/serial_core.c | 10 ++++++++--
>  1 file changed, 8 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
> index 95774b0f1484..030735da6b8c 100644
> --- a/drivers/tty/serial/serial_core.c
> +++ b/drivers/tty/serial/serial_core.c
> @@ -3210,8 +3210,15 @@ static void serial_core_remove_one_port(struct uart_driver *drv,
>         /*
>          * If the port is used as a console, unregister it
>          */
> -       if (uart_console(uport))
> +       if (uart_console(uport)) {
>                 unregister_console(uport->cons);
> +               port->console = false;
> +       }
> +
> +       guard(mutex)(&port->mutex);
> +
> +       if (tty_port_initialized(port))
> +               uart_shutdown(NULL, state);
>
>         /*
>          * Free the port IO and memory resources, if any.
> @@ -3227,7 +3234,6 @@ static void serial_core_remove_one_port(struct uart_driver *drv,
>         uport->type = PORT_UNKNOWN;
>         uport->port_dev = NULL;
>
> -       guard(mutex)(&port->mutex);
>         WARN_ON(atomic_dec_return(&state->refcount) < 0);
>         wait_event(state->remove_wait, !atomic_read(&state->refcount));
>         state->uart_port = NULL;
> --
> 2.47.3
>