From nobody Mon Jun 8 14:35:26 2026 Received: from mail-dy1-f170.google.com (mail-dy1-f170.google.com [74.125.82.170]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 7D7D42E6CC0 for ; Thu, 28 May 2026 23:06:35 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.170 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780009598; cv=none; b=IBySH89mXNYveOFwuieRYiGulJ8QX1MkBDqYGMpKJkc10WgFu321xMn1WhFXuI+t5hXehEWqx1RCacIP/jnfXyWKW7FIjfOQRFpL0d9+GPSFEGA0zZd1mCFVIcuCS1y8L/6QfxRUuBXmWKVEkiko0/gfK2EEZyvN7jzMhlrBkeA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780009598; c=relaxed/simple; bh=ks+rZadk+kPZAouysE15J3frO84jNoGPHcYZM4fvoh8=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Jhk43JEdPPFfGix+5L0b8rQdUgfri+BsVo9+IeqM3bqQUSrAtsHZEeEDqYkNJ9pOb+Q3B0h6wqeVFPVzhuGd1msCPQ8xE6pFB7P981SBLyG5fnp2dFLMZbcbj4aP3o4zdM1DPhZ+Qo+eg7dGEEDclND8A+id0YzW9LTgYHgJI5c= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=h6su1kiM; arc=none smtp.client-ip=74.125.82.170 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="h6su1kiM" Received: by mail-dy1-f170.google.com with SMTP id 5a478bee46e88-304ddfcf72cso1106129eec.0 for ; Thu, 28 May 2026 16:06:35 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780009595; x=1780614395; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=OLSjl6CXuzR38T343RTt9SyGP7hxMKOqUC5yJePUlLg=; b=h6su1kiM6cnxVyLXpO8EXW4jNXRUnM6A8etNY/wwBlqGs+EW9BDlfC/VWc3EbGBQ7T CuxNvYq+RDReN/DkwBrnZbwv5eKnxtjedRQNNUKXsIEDbg+diWOhImVbYWAd//zL4i/O ZCbuwYywgQ/7IfNAJrsaZrVRjDWLXPjoXHhFMB7fzhrKtP9riUSA8m2PaymqLu0wMgdM STlmW0sIZDuLSfRSkGE/CCgiwMjnS2e3gRqhPs0lAhm/XaVRE9Qpgpbs5Fiw38kzjmxy Ie1O7Hdac2l/ihiFauby4tYCIAQYXXe2S9+zXsubzO7sCEUdqDf2bEJK0rjT5sQLR/xB LaAw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780009595; x=1780614395; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=OLSjl6CXuzR38T343RTt9SyGP7hxMKOqUC5yJePUlLg=; b=nGxCBaQfYTlNPNfYbyuSmDsEXRfx+oYrlYiFXo5KeeZaWduSjEgbfmOUqBkLz+Zyyv X0GLuRNpIymFMRKj2pyHkIa3tktD9uZq5j2WLzv1bsil41Lyjjw93HJM8NSsC453KDj7 i+TozK0A5y9u0C9BLHsnm+QghjjHGige5KgeWUHYAPZKrjYc2WW/RCEWWCeTRUbW9uLJ IAxBrnWZyuRo/ac8TOnp76Km+g4RD8qN8CBHhPXrQAgMlKjlaMh10zdvmIVyfzpF48Oj cazZILXCaIYg8YdzllAKI171n7W+e3PvHFC+BZl2QsfXr7zLJ591XRk+VRFfRsRNMKXu lPIQ== X-Forwarded-Encrypted: i=1; AFNElJ8vFXYjiJ0suga87caCx1ZZYU0lf36ZOhk3tEmdAhD1aLXH5BY9QsJP/7Uv/IPX/UrjUJnNYaqERMy2MbI=@vger.kernel.org X-Gm-Message-State: AOJu0Ywqj62slXLWX5tmuQXYSUWlpvIHO+N7zjgvo7/bo7tBPH0b4n9X iQEENL7yegXjz7nKF6AsauyW0Xt5OirAKwNvrkRtkHCMpj9k6VN0Mvoj X-Gm-Gg: Acq92OEDKmtU3izbdWaV/E15EWw3VwI7mStXN4TRm11121vCZwYAi+OT4P/MFDRWiWf sYOzE9FlD65GDsKiDyJiZGCuamwYpA2lLKXjWtcU1OEuWgwOnFhvk1489H4yw+bjxUu7/0VjxoD nbKKX2hNHTDeBRY6pHJyA5UcFiq1uLLERbNoCe9s0oJIW0zbOCt4v+3IhBxH+sttvNOpRtlw3T3 S9QNMo3pNjPo7vYpCLOjDAZnixS4JXEVJcFhGBJrNCL8yFpmfaw1lxmCeiOeOVSfY8UZAkCuk55 vii0bwXF9m4beIguyEL5JASWjLz9kzxSl3jY258iWGiXhGyGDQCRJK0UJ27Z2ws3nlK775FbmRE JOelfLgpJDC9JVFvWnBL9LDb1JudeO5nUon3ikLA3UcNZYTJ3yPK6F0SQcbCz5C2AoZe5PkeK16 mNiJ20yorODAuQ+0c6GHnrbdbalgRQtPbmWAgHcklAWkuM0n4kqMUaIz6H3X6SxduDIUnJUUXuy Ihw5s5snzVk7yQargRw8fQFbfTjhondFxJ0uC59Ed0qYA== X-Received: by 2002:a05:7300:cd97:b0:2ea:b975:3db1 with SMTP id 5a478bee46e88-304eb0f8bdemr260267eec.23.1780009594548; Thu, 28 May 2026 16:06:34 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-304ebcc8016sm223109eec.23.2026.05.28.16.06.33 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 28 May 2026 16:06:33 -0700 (PDT) From: Rosen Penev To: linux-serial@vger.kernel.org Cc: Greg Kroah-Hartman , Jiri Slaby , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , linux-kernel@vger.kernel.org (open list:TTY LAYER AND SERIAL DRIVERS), imx@lists.linux.dev (open list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE), linux-arm-kernel@lists.infradead.org (moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE) Subject: [PATCH] serial: mxs-auart: fix probe error paths and clock handling Date: Thu, 28 May 2026 16:06:16 -0700 Message-ID: <20260528230616.186792-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Content-Type: text/plain; charset="utf-8" Sashiko reported three pre-existing bugs in the mxs-auart driver: - For non-ASM9260 variants, mxs_get_clks() obtained the clock but never prepared/enabled it, leaving register accesses in probe at risk of faulting if the bootloader had gated the clock. - The error path and remove function used pdev->id instead of s->port.line to clear the auart_port[] slot. For DT-probed devices pdev->id is -1, causing an out-of-bounds write and leaving a dangling pointer in the array. - The probe error path called iounmap() while the IRQ was still registered. An interrupt during that window would dereference the unmapped membase. All of this is a consequence of using mixed devm and non devm. Instead of working around these issues, go full devm so that everything can be cleaned up properly. devm_clk_get_enabled allows removing clk_prepare_enable. devm_platform_get_and_ioremap_resource is a bit worrying as it calls request_mem_region. Manual review of the dts files shows no overlapping memory regions, so should be good to go. Use devm in mxs_auart_request_gpio_irq as devm is used in probe. Assisted-by: Opencode:Big-pickle Signed-off-by: Rosen Penev --- drivers/tty/serial/mxs-auart.c | 110 ++++++--------------------------- 1 file changed, 20 insertions(+), 90 deletions(-) diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c index 697318dbb146..8b6463df11b3 100644 --- a/drivers/tty/serial/mxs-auart.c +++ b/drivers/tty/serial/mxs-auart.c @@ -1457,48 +1457,24 @@ static void mxs_init_regs(struct mxs_auart_port *s) static int mxs_get_clks(struct mxs_auart_port *s, struct platform_device *pdev) { - int err; - if (!is_asm9260_auart(s)) { - s->clk =3D devm_clk_get(&pdev->dev, NULL); + s->clk =3D devm_clk_get_enabled(&pdev->dev, NULL); return PTR_ERR_OR_ZERO(s->clk); } =20 - s->clk =3D devm_clk_get(s->dev, "mod"); + s->clk =3D devm_clk_get_enabled(s->dev, "mod"); if (IS_ERR(s->clk)) { dev_err(s->dev, "Failed to get \"mod\" clk\n"); return PTR_ERR(s->clk); } =20 - s->clk_ahb =3D devm_clk_get(s->dev, "ahb"); + s->clk_ahb =3D devm_clk_get_enabled(s->dev, "ahb"); if (IS_ERR(s->clk_ahb)) { dev_err(s->dev, "Failed to get \"ahb\" clk\n"); return PTR_ERR(s->clk_ahb); } =20 - err =3D clk_prepare_enable(s->clk_ahb); - if (err) { - dev_err(s->dev, "Failed to enable ahb_clk!\n"); - return err; - } - - err =3D clk_set_rate(s->clk, clk_get_rate(s->clk_ahb)); - if (err) { - dev_err(s->dev, "Failed to set rate!\n"); - goto disable_clk_ahb; - } - - err =3D clk_prepare_enable(s->clk); - if (err) { - dev_err(s->dev, "Failed to enable clk!\n"); - goto disable_clk_ahb; - } - - return 0; - -disable_clk_ahb: - clk_disable_unprepare(s->clk_ahb); - return err; + return clk_set_rate(s->clk, clk_get_rate(s->clk_ahb)); } =20 static int mxs_auart_init_gpios(struct mxs_auart_port *s, struct device *d= ev) @@ -1529,15 +1505,6 @@ static int mxs_auart_init_gpios(struct mxs_auart_por= t *s, struct device *dev) return 0; } =20 -static void mxs_auart_free_gpio_irq(struct mxs_auart_port *s) -{ - enum mctrl_gpio_idx i; - - for (i =3D 0; i < UART_GPIO_MAX; i++) - if (s->gpio_irq[i] >=3D 0) - free_irq(s->gpio_irq[i], s); -} - static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) { int *irq =3D s->gpio_irq; @@ -1549,21 +1516,13 @@ static int mxs_auart_request_gpio_irq(struct mxs_au= art_port *s) continue; =20 irq_set_status_flags(irq[i], IRQ_NOAUTOEN); - err =3D request_irq(irq[i], mxs_auart_irq_handle, - IRQ_TYPE_EDGE_BOTH, dev_name(s->dev), s); + err =3D devm_request_irq(s->dev, irq[i], mxs_auart_irq_handle, IRQ_TYPE_= EDGE_BOTH, + dev_name(s->dev), s); if (err) dev_err(s->dev, "%s - Can't get %d irq\n", __func__, irq[i]); } =20 - /* - * If something went wrong, rollback. - * Be careful: i may be unsigned. - */ - while (err && (i-- > 0)) - if (irq[i] >=3D 0) - free_irq(irq[i], s); - return err; } =20 @@ -1604,18 +1563,10 @@ static int mxs_auart_probe(struct platform_device *= pdev) if (ret) return ret; =20 - r =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!r) { - ret =3D -ENXIO; - goto out_disable_clks; - } - + s->port.membase =3D devm_platform_get_and_ioremap_resource(pdev, 0, &r); + if (IS_ERR(s->port.membase)) + return PTR_ERR(s->port.membase); s->port.mapbase =3D r->start; - s->port.membase =3D ioremap(r->start, resource_size(r)); - if (!s->port.membase) { - ret =3D -ENOMEM; - goto out_disable_clks; - } s->port.ops =3D &mxs_auart_ops; s->port.iotype =3D UPIO_MEM; s->port.fifosize =3D MXS_AUART_FIFO_SIZE; @@ -1628,23 +1579,20 @@ static int mxs_auart_probe(struct platform_device *= pdev) s->mctrl_prev =3D 0; =20 irq =3D platform_get_irq(pdev, 0); - if (irq < 0) { - ret =3D irq; - goto out_iounmap; - } + if (irq < 0) + return irq; =20 s->port.irq =3D irq; - ret =3D devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0, - dev_name(&pdev->dev), s); + ret =3D devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0, dev_na= me(&pdev->dev), s); if (ret) - goto out_iounmap; + return ret; =20 platform_set_drvdata(pdev, s); =20 ret =3D mxs_auart_init_gpios(s, &pdev->dev); if (ret) { dev_err(&pdev->dev, "Failed to initialize GPIOs.\n"); - goto out_iounmap; + return ret; } =20 /* @@ -1652,15 +1600,17 @@ static int mxs_auart_probe(struct platform_device *= pdev) */ ret =3D mxs_auart_request_gpio_irq(s); if (ret) - goto out_iounmap; + return ret; =20 auart_port[s->port.line] =3D s; =20 mxs_auart_reset_deassert(s); =20 ret =3D uart_add_one_port(&auart_driver, &s->port); - if (ret) - goto out_free_qpio_irq; + if (ret) { + auart_port[s->port.line] =3D NULL; + return ret; + } =20 /* ASM9260 don't have version reg */ if (is_asm9260_auart(s)) { @@ -1673,20 +1623,6 @@ static int mxs_auart_probe(struct platform_device *p= dev) } =20 return 0; - -out_free_qpio_irq: - mxs_auart_free_gpio_irq(s); - auart_port[pdev->id] =3D NULL; - -out_iounmap: - iounmap(s->port.membase); - -out_disable_clks: - if (is_asm9260_auart(s)) { - clk_disable_unprepare(s->clk); - clk_disable_unprepare(s->clk_ahb); - } - return ret; } =20 static void mxs_auart_remove(struct platform_device *pdev) @@ -1694,13 +1630,7 @@ static void mxs_auart_remove(struct platform_device = *pdev) struct mxs_auart_port *s =3D platform_get_drvdata(pdev); =20 uart_remove_one_port(&auart_driver, &s->port); - auart_port[pdev->id] =3D NULL; - mxs_auart_free_gpio_irq(s); - iounmap(s->port.membase); - if (is_asm9260_auart(s)) { - clk_disable_unprepare(s->clk); - clk_disable_unprepare(s->clk_ahb); - } + auart_port[s->port.line] =3D NULL; } =20 static struct platform_driver mxs_auart_driver =3D { --=20 2.54.0