Three fixes for the Moxa PCIe serial driver, found by reading the code
that was split out of 8250_pci.c and extended during the 7.3 merge
window.  That code is in mainline now but has not been in a released
kernel, so the series is against tty-linus.

Patch 1 fixes a NULL pointer dereference during probe: the serial core
calls ->rs485_config() from within serial8250_register_8250_port(),
before pci_set_drvdata() has published the board.  It takes a board
without RS232 support and SER_RS485_ENABLED still set once
uart_get_rs485_mode() has run - on Crescent's ACPI machine the firmware
node clears that flag, which is why it does not crash there.

Patch 2 makes removal unregister only the ports that were registered.
v1 failed the probe instead; as Andy pointed out that is a behavioural
change, and keeping the ports that do work is what pciserial_init_ports()
in 8250_pci.c does, so v2 keeps it and restores only the missing count.

Patch 3 stops set_termios() from dereferencing port->state->port.tty,
which is NULL when the serial core sets the line up for a console or for
kgdboc.

I have no Moxa board here.  Crescent Hsieh tested patch 3 with kgdboc on
a CP-168EL-A, and looked for patch 1's crash on a CP-134EL-A; the rest is
compile-tested only, W=1 allmodconfig build of drivers/tty/serial/8250/
and checkpatch --strict, both clean.

v2:
- 1/3: no code change; the commit message now says the crash needs
  SER_RS485_ENABLED to survive uart_get_rs485_mode() (Crescent Hsieh).
- 2/3: keep the ports that registered successfully, record how many and
  unregister only those, instead of failing the probe (Andy Shevchenko).
  Retitled accordingly.
- 3/3: drop the cflag local and read new->c_cflag directly, and pick up
  Crescent Hsieh's Tested-by.

Link to v1:
https://lore.kernel.org/all/20260818093918.3190686-1-lilinmao@kylinos.cn/

Linmao Li (3):
  serial: 8250_mxpcie: set the driver data before registering ports
  serial: 8250_mxpcie: only unregister the ports that were registered
  serial: 8250_mxpcie: take the line settings from the new termios

 drivers/tty/serial/8250/8250_mxpcie.c | 30 +++++++++++++++------------
 1 file changed, 17 insertions(+), 13 deletions(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.25.1

On Tue, Sep 01, 2026 at 12:15:16PM +0800, Linmao Li wrote:
> Three fixes for the Moxa PCIe serial driver, found by reading the code
> that was split out of 8250_pci.c and extended during the 7.3 merge
> window.  That code is in mainline now but has not been in a released
> kernel, so the series is against tty-linus.
> 
> Patch 1 fixes a NULL pointer dereference during probe: the serial core
> calls ->rs485_config() from within serial8250_register_8250_port(),
> before pci_set_drvdata() has published the board.  It takes a board
> without RS232 support and SER_RS485_ENABLED still set once
> uart_get_rs485_mode() has run - on Crescent's ACPI machine the firmware
> node clears that flag, which is why it does not crash there.
> 
> Patch 2 makes removal unregister only the ports that were registered.
> v1 failed the probe instead; as Andy pointed out that is a behavioural
> change, and keeping the ports that do work is what pciserial_init_ports()
> in 8250_pci.c does, so v2 keeps it and restores only the missing count.
> 
> Patch 3 stops set_termios() from dereferencing port->state->port.tty,
> which is NULL when the serial core sets the line up for a console or for
> kgdboc.
> 
> I have no Moxa board here.  Crescent Hsieh tested patch 3 with kgdboc on
> a CP-168EL-A, and looked for patch 1's crash on a CP-134EL-A; the rest is
> compile-tested only, W=1 allmodconfig build of drivers/tty/serial/8250/
> and checkpatch --strict, both clean.

The series looks good to me.

For the series:

Reviewed-by: Crescent Hsieh <crescentcy.hsieh@moxa.com>

The additional pre-existing issues identified by Sashiko are independent
of this series. I will investigate them further and determine the
appropriate follow-up fixes.

--
Thanks,
Crescent Hsieh

On Tue, Sep 01, 2026 at 12:15:16PM +0800, Linmao Li wrote:
> Three fixes for the Moxa PCIe serial driver, found by reading the code
> that was split out of 8250_pci.c and extended during the 7.3 merge
> window.  That code is in mainline now but has not been in a released
> kernel, so the series is against tty-linus.
> 
> Patch 1 fixes a NULL pointer dereference during probe: the serial core
> calls ->rs485_config() from within serial8250_register_8250_port(),
> before pci_set_drvdata() has published the board.  It takes a board
> without RS232 support and SER_RS485_ENABLED still set once
> uart_get_rs485_mode() has run - on Crescent's ACPI machine the firmware
> node clears that flag, which is why it does not crash there.
> 
> Patch 2 makes removal unregister only the ports that were registered.
> v1 failed the probe instead; as Andy pointed out that is a behavioural
> change, and keeping the ports that do work is what pciserial_init_ports()
> in 8250_pci.c does, so v2 keeps it and restores only the missing count.
> 
> Patch 3 stops set_termios() from dereferencing port->state->port.tty,
> which is NULL when the serial core sets the line up for a console or for
> kgdboc.
> 
> I have no Moxa board here.  Crescent Hsieh tested patch 3 with kgdboc on
> a CP-168EL-A, and looked for patch 1's crash on a CP-134EL-A; the rest is
> compile-tested only, W=1 allmodconfig build of drivers/tty/serial/8250/
> and checkpatch --strict, both clean.

LGTM
Reviewed-by: Andy Shevchenko <andriy.shevchenko@linux.intel.com>

-- 
With Best Regards,
Andy Shevchenko