From: Greg Kroah-Hartman Date: Thu, 2 Jul 2026 14:09:52 +0000 (+0200) Subject: 6.18-stable patches X-Git-Tag: v5.10.260~25 X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=dd12f3a77dd58db5b4c6efe0567d0e41d1bf1e93;p=thirdparty%2Fkernel%2Fstable-queue.git 6.18-stable patches added patches: serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch --- diff --git a/queue-6.18/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch b/queue-6.18/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch new file mode 100644 index 0000000000..261a8795db --- /dev/null +++ b/queue-6.18/serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch @@ -0,0 +1,47 @@ +From 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 Mon Sep 17 00:00:00 2001 +From: Stepan Ionichev +Date: Thu, 14 May 2026 19:37:45 +0500 +Subject: serial: 8250_dw: unregister 8250 port if clk_notifier_register() fails + +From: Stepan Ionichev + +commit 10fc708b4de7f86002d2d735a2dbf3b5b7f65692 upstream. + +dw8250_probe() registers the 8250 port via serial8250_register_8250_port() +and then, if the device has a clock, registers a clock notifier. If +clk_notifier_register() fails, probe returns the error but leaves the +8250 port registered. The matching serial8250_unregister_port() lives +in dw8250_remove(), which is not called when probe fails, so the port +slot stays occupied until the device is rebound or the system is +rebooted. The devm-allocated driver data is freed while the port still +references it (via the saved private_data and serial_in/serial_out +callbacks), so any access to that port slot before a rebind is a +use-after-free hazard. + +Unregister the port on the clk_notifier_register() error path. + +Fixes: cc816969d7b5 ("serial: 8250_dw: Fix common clocks usage race condition") +Cc: stable@vger.kernel.org +Signed-off-by: Stepan Ionichev +Reviewed-by: Andy Shevchenko +Link: https://patch.msgid.link/20260514143746.23671-2-sozdayvek@gmail.com +Signed-off-by: Sasha Levin +Signed-off-by: Greg Kroah-Hartman +--- + drivers/tty/serial/8250/8250_dw.c | 4 +++- + 1 file changed, 3 insertions(+), 1 deletion(-) + +--- a/drivers/tty/serial/8250/8250_dw.c ++++ b/drivers/tty/serial/8250/8250_dw.c +@@ -846,8 +846,10 @@ static int dw8250_probe(struct platform_ + */ + if (data->clk) { + err = clk_notifier_register(data->clk, &data->clk_notifier); +- if (err) ++ if (err) { ++ serial8250_unregister_port(data->data.line); + return dev_err_probe(dev, err, "Failed to set the clock notifier\n"); ++ } + queue_work(system_unbound_wq, &data->clk_work); + } + diff --git a/queue-6.18/series b/queue-6.18/series index 50a3592fab..2c5c0d4d4a 100644 --- a/queue-6.18/series +++ b/queue-6.18/series @@ -103,3 +103,4 @@ nfsv4-pnfs-reject-zero-length-r_addr-in-nfs4_decode_mp_ds_addr.patch nfsv4-clear-exception-state-on-successful-mkdir-retry.patch nfs-prevent-resource-leak-in-nfs_alloc_server.patch ksmbd-fix-out-of-bounds-read-in-smb_check_perm_dacl.patch +serial-8250_dw-unregister-8250-port-if-clk_notifier_register-fails.patch