From nobody Mon Jun 8 08:28:17 2026 Received: from mail-pj1-f53.google.com (mail-pj1-f53.google.com [209.85.216.53]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 10FA12DC76C for ; Sat, 30 May 2026 19:55:43 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.216.53 ARC-Seal: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780170945; cv=none; b=TcyJP9MvrAI/BDx/segFg2q+J2JO1VRjTsPxkm/7p1KGv5dxLQvyLVKEDuwUaKCICJlItsR0Ni25t480E2vOVp751MJgSUPlHGD4A7WQhRP6LcNc3DtlcApKFw1C2Lr8dfJwGQ2qQQyYrqQX3PY09GIWsDUf0EV6ahQ8GQhvHhA= ARC-Message-Signature: i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1780170945; c=relaxed/simple; bh=0e6oWsAqwA6Yr7Q3BRMhN0pQGfqxUUBdCSENWtkE9v0=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version:Content-Type; b=rIGVZ9aAa7XQNt7Dx3MXvJx9UB5UIv+Ay1CTWwbZn7fF5fxhCRy7bwIFVf6mTlc5wk7wGvYsbsu7Qk+boYTX90e0yN/LWt4X8hHCQaMNuMRzp4jSEY2zQbHNFVjD8Dd4yLS66oqXJYfWFkHRDz5BUn2nKBstUKrLFDincPnRy8w= ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=WchOw21I; arc=none smtp.client-ip=209.85.216.53 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="WchOw21I" Received: by mail-pj1-f53.google.com with SMTP id 98e67ed59e1d1-36d6bb38b44so347349a91.0 for ; Sat, 30 May 2026 12:55:43 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1780170943; x=1780775743; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=JFbb87WXannbZgAKQJkoODZG0moYWhbBBJifO3Eihyw=; b=WchOw21Itz+G/4cPFLPVIL9aBz2ejBzn2Owu4YMXQOCNHoXK6rTxL9bbIMDnbItHMi IMQcrbUm2R+FgUgODZCGa73lGSykuKQCgf6WFrq5DWXB9Nn1xpB6Oz+CqHfhzx7IO8K/ Fze/J5WKMRIWOy6NOaa49eqaOcVsbhN3EjRQOqaZNuNNqn6xpbxVnSw7T6Mfpbf54cLl 1P7AWY+kBw/faK4N5x/wsVtIk6TLzc2xnw70JZrqfk6SvCv19+11eqQXTVdfz1pX4QGV 8beJTNl/0JBWDW7vebxfHixzpm4slqQWyYiVJdlBvkd3bTcbnxecGWgaA35r4I7FRDDL nTAQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1780170943; x=1780775743; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=JFbb87WXannbZgAKQJkoODZG0moYWhbBBJifO3Eihyw=; b=FB7eIPFzVy2RzyFuvC6nj11aj+aPZvqXRCGNKsPKd1yzBtJ0iwPB660v/utfWDId8a xdFCzO/b+43pBH5CPv50eiMqAY7HnuQLbxWmEuPOel6/CWGPz3gtK6p23DVXLK/Z5Rc3 9oahwFcDmahZoHH92D2BjYl1OdssMU94r8Gse6JlTabp76z74rbR6IW5JeYqIP5InUO2 Tdl2bYFFGjw1YdiHMGnPmism0in7d95zV7lGp1UoaTJPORXzIKPRTRbY2GGCM6Y0SOUu Hx4EcJcbGXCx+eWgfqVnZ3BnU3c6+RPo3CfOY99YrzklR9E4tVMPQNKpsq5rRK6jSjbp 4wjA== X-Forwarded-Encrypted: i=1; AFNElJ8GFg4df+IFvFM2FCDUpBmmlh8HVUckW2gO7W3AqlSIwIGcUjQwUbpHDDsIifgOt4g0IK+qr40Qn8Y0ETM=@vger.kernel.org X-Gm-Message-State: AOJu0YxgvTrlARoLLELVoy/Bq+hS8EfuNt1Sok18M+7mWsktNacEy05+ 9ERLpOkU3Xw3Q4IvyjXON9oDJbmIf/4ZPw0J3u2AFURKFJE00/iP0AST X-Gm-Gg: Acq92OGQYPY0OeHQdB9X0vCF1XRiI+jHamrqau1D5G0wVKIjDZNrdM2S1DgTe+RJvlD m71rQBtMy9jvJCeCabflnnzut/od4IJE200B8zjkACKlXpIVofXnB4Ej90JJO/WLQubV0rjQzFh H2BNF4x8MYyWvPq+j6IU08nlLok6RhFDd6J2oFqE19o9oaBm8q0k4O+nIwx6iTp59uVfvjp1kMa IolGqRigrjTPE39V3DtQML2SNF6mlYeB5Oe19eIfjR9lCPCOkCvc4bE6hpki78K/FAhl9Zl3Og/ 4frZ7YQC4knDtsaSACc/hbyZ4f5NRX6ASdunQ2mk4bdUufVgSnYSiKt6zy7pbcfYFztavT5gVD/ x2j9B0iUz09ZzkHJDFvsdj7KsPpsspWOUegqVjLQzK5HGqcheHoM0Gi9yBXXTJKOuTFT1fj1hmu qKnolxY2Mq+YvZwf7zonDm+EqylrEe/Mj2HMdh1V6WGbT+YXaGGyf5rqehVi9z0n6QjZDQUJyK+ YO3b1Nhrgp6Dpdma67tiHgXu7r5GmJM7sIN9xWW3z175w== X-Received: by 2002:a17:90b:3f88:b0:36b:ba97:419d with SMTP id 98e67ed59e1d1-36c501cdd5dmr4347411a91.13.1780170943254; Sat, 30 May 2026 12:55:43 -0700 (PDT) Received: from ryzen ([2601:644:8000:5b5d:7285:c2ff:fe45:8a32]) by smtp.gmail.com with ESMTPSA id 98e67ed59e1d1-36bc6a34ca9sm5503001a91.9.2026.05.30.12.55.41 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Sat, 30 May 2026 12:55:42 -0700 (PDT) From: Rosen Penev To: linux-serial@vger.kernel.org Cc: Greg Kroah-Hartman , Jiri Slaby , Frank Li , Sascha Hauer , Pengutronix Kernel Team , Fabio Estevam , linux-kernel@vger.kernel.org (open list:TTY LAYER AND SERIAL DRIVERS), imx@lists.linux.dev (open list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE), linux-arm-kernel@lists.infradead.org (moderated list:ARM/FREESCALE IMX / MXC ARM ARCHITECTURE) Subject: [PATCHv2] serial: mxs-auart: fix probe error paths and clock handling Date: Sat, 30 May 2026 12:55:03 -0700 Message-ID: <20260530195525.5059-1-rosenp@gmail.com> X-Mailer: git-send-email 2.54.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sashiko reported three pre-existing bugs in the mxs-auart driver: - For non-ASM9260 variants, mxs_get_clks() obtained the clock but never prepared/enabled it, leaving register accesses in probe at risk of faulting if the bootloader had gated the clock. - The error path and remove function used pdev->id instead of s->port.line to clear the auart_port[] slot. For DT-probed devices pdev->id is -1, causing an out-of-bounds write and leaving a dangling pointer in the array. - The probe error path called iounmap() while the IRQ was still registered. An interrupt during that window would dereference the unmapped membase. Assisted-by: Opencode:Big-pickle Signed-off-by: Rosen Penev --- v2: reduce overly zealous devm conversions drivers/tty/serial/mxs-auart.c | 127 +++++++++++++-------------------- 1 file changed, 49 insertions(+), 78 deletions(-) diff --git a/drivers/tty/serial/mxs-auart.c b/drivers/tty/serial/mxs-auart.c index 697318dbb146..bbe30841ce2d 100644 --- a/drivers/tty/serial/mxs-auart.c +++ b/drivers/tty/serial/mxs-auart.c @@ -1470,34 +1470,22 @@ static int mxs_get_clks(struct mxs_auart_port *s, return PTR_ERR(s->clk); } =20 - s->clk_ahb =3D devm_clk_get(s->dev, "ahb"); + s->clk_ahb =3D devm_clk_get_enabled(s->dev, "ahb"); if (IS_ERR(s->clk_ahb)) { dev_err(s->dev, "Failed to get \"ahb\" clk\n"); return PTR_ERR(s->clk_ahb); } =20 - err =3D clk_prepare_enable(s->clk_ahb); - if (err) { - dev_err(s->dev, "Failed to enable ahb_clk!\n"); - return err; - } - + /* + * Set mod clock rate while it is still disabled so + * CLK_SET_RATE_GATE does not cause clk_set_rate to fail. + * The mod clock will be enabled in mxs_auart_startup() + * and in probe after mxs_get_clks returns. + */ err =3D clk_set_rate(s->clk, clk_get_rate(s->clk_ahb)); - if (err) { + if (err) dev_err(s->dev, "Failed to set rate!\n"); - goto disable_clk_ahb; - } - - err =3D clk_prepare_enable(s->clk); - if (err) { - dev_err(s->dev, "Failed to enable clk!\n"); - goto disable_clk_ahb; - } - - return 0; =20 -disable_clk_ahb: - clk_disable_unprepare(s->clk_ahb); return err; } =20 @@ -1529,15 +1517,6 @@ static int mxs_auart_init_gpios(struct mxs_auart_por= t *s, struct device *dev) return 0; } =20 -static void mxs_auart_free_gpio_irq(struct mxs_auart_port *s) -{ - enum mctrl_gpio_idx i; - - for (i =3D 0; i < UART_GPIO_MAX; i++) - if (s->gpio_irq[i] >=3D 0) - free_irq(s->gpio_irq[i], s); -} - static int mxs_auart_request_gpio_irq(struct mxs_auart_port *s) { int *irq =3D s->gpio_irq; @@ -1549,21 +1528,13 @@ static int mxs_auart_request_gpio_irq(struct mxs_au= art_port *s) continue; =20 irq_set_status_flags(irq[i], IRQ_NOAUTOEN); - err =3D request_irq(irq[i], mxs_auart_irq_handle, - IRQ_TYPE_EDGE_BOTH, dev_name(s->dev), s); + err =3D devm_request_irq(s->dev, irq[i], mxs_auart_irq_handle, IRQ_TYPE_= EDGE_BOTH, + dev_name(s->dev), s); if (err) dev_err(s->dev, "%s - Can't get %d irq\n", __func__, irq[i]); } =20 - /* - * If something went wrong, rollback. - * Be careful: i may be unsigned. - */ - while (err && (i-- > 0)) - if (irq[i] >=3D 0) - free_irq(irq[i], s); - return err; } =20 @@ -1598,24 +1569,22 @@ static int mxs_auart_probe(struct platform_device *= pdev) return -EINVAL; } =20 - s->devtype =3D (enum mxs_auart_type)of_device_get_match_data(&pdev->dev); + s->devtype =3D (unsigned long)of_device_get_match_data(&pdev->dev); =20 ret =3D mxs_get_clks(s, pdev); if (ret) return ret; =20 - r =3D platform_get_resource(pdev, IORESOURCE_MEM, 0); - if (!r) { - ret =3D -ENXIO; - goto out_disable_clks; - } + ret =3D clk_prepare_enable(s->clk); + if (ret) + return ret; =20 - s->port.mapbase =3D r->start; - s->port.membase =3D ioremap(r->start, resource_size(r)); - if (!s->port.membase) { - ret =3D -ENOMEM; - goto out_disable_clks; + s->port.membase =3D devm_platform_get_and_ioremap_resource(pdev, 0, &r); + if (IS_ERR(s->port.membase)) { + ret =3D PTR_ERR(s->port.membase); + goto out_disable_clk; } + s->port.mapbase =3D r->start; s->port.ops =3D &mxs_auart_ops; s->port.iotype =3D UPIO_MEM; s->port.fifosize =3D MXS_AUART_FIFO_SIZE; @@ -1630,21 +1599,17 @@ static int mxs_auart_probe(struct platform_device *= pdev) irq =3D platform_get_irq(pdev, 0); if (irq < 0) { ret =3D irq; - goto out_iounmap; + goto out_disable_clk; } =20 s->port.irq =3D irq; - ret =3D devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0, - dev_name(&pdev->dev), s); - if (ret) - goto out_iounmap; =20 platform_set_drvdata(pdev, s); =20 ret =3D mxs_auart_init_gpios(s, &pdev->dev); if (ret) { dev_err(&pdev->dev, "Failed to initialize GPIOs.\n"); - goto out_iounmap; + goto out_disable_clk; } =20 /* @@ -1652,15 +1617,34 @@ static int mxs_auart_probe(struct platform_device *= pdev) */ ret =3D mxs_auart_request_gpio_irq(s); if (ret) - goto out_iounmap; + goto out_disable_clk; =20 auart_port[s->port.line] =3D s; =20 mxs_auart_reset_deassert(s); =20 + /* Mask all UART interrupts to prevent spurious IRQs from bootloader */ + mxs_write(0, s, REG_INTR); + ret =3D uart_add_one_port(&auart_driver, &s->port); - if (ret) - goto out_free_qpio_irq; + if (ret) { + auart_port[s->port.line] =3D NULL; + goto out_disable_clk; + } + + /* + * Request the main IRQ after uart_add_one_port so that + * s->port.state and s->port.lock are initialized before + * the handler can run in response to a bootloader-left + * interrupt. + */ + ret =3D devm_request_irq(&pdev->dev, irq, mxs_auart_irq_handle, 0, + dev_name(&pdev->dev), s); + if (ret) { + uart_remove_one_port(&auart_driver, &s->port); + auart_port[s->port.line] =3D NULL; + goto out_disable_clk; + } =20 /* ASM9260 don't have version reg */ if (is_asm9260_auart(s)) { @@ -1672,20 +1656,13 @@ static int mxs_auart_probe(struct platform_device *= pdev) (version >> 16) & 0xff, version & 0xffff); } =20 - return 0; - -out_free_qpio_irq: - mxs_auart_free_gpio_irq(s); - auart_port[pdev->id] =3D NULL; + /* Disable clock =E2=80=93 startup will re-enable when the port is opened= */ + clk_disable_unprepare(s->clk); =20 -out_iounmap: - iounmap(s->port.membase); + return 0; =20 -out_disable_clks: - if (is_asm9260_auart(s)) { - clk_disable_unprepare(s->clk); - clk_disable_unprepare(s->clk_ahb); - } +out_disable_clk: + clk_disable_unprepare(s->clk); return ret; } =20 @@ -1694,13 +1671,7 @@ static void mxs_auart_remove(struct platform_device = *pdev) struct mxs_auart_port *s =3D platform_get_drvdata(pdev); =20 uart_remove_one_port(&auart_driver, &s->port); - auart_port[pdev->id] =3D NULL; - mxs_auart_free_gpio_irq(s); - iounmap(s->port.membase); - if (is_asm9260_auart(s)) { - clk_disable_unprepare(s->clk); - clk_disable_unprepare(s->clk_ahb); - } + auart_port[s->port.line] =3D NULL; } =20 static struct platform_driver mxs_auart_driver =3D { --=20 2.54.0