From 3e3ae95a3d84a6028f37a07ab7ad78bb14689f2e Mon Sep 17 00:00:00 2001 From: "Jiri Slaby (SUSE)" Date: Tue, 13 Oct 2026 08:48:49 +0200 Subject: [PATCH] serial: 8250_lpss: do not touch uninitialized line in ehl_serial_exit() MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit lpss8250_probe() calls lpss->board->exit() on its error path. For the EHL board, that is ehl_serial_exit() and it does: serial8250_get_port(lpss->data.line)->dma = NULL; But when lpss8250_dma_setup() or serial8250_register_8250_port() fails, lpss->data.line was never assigned. As lpss is kzalloc()ed, line is 0 and ehl_serial_exit() clears the dma pointer of an unrelated port -- serial8250_ports[0], i.e. ttyS0, which is often the console. Initialize lpss->data.line to -1 in probe and skip the clearing in ehl_serial_exit() if no port was registered. Fixes: 5318f70da7e8 ("serial: 8250_lpss: Balance reference count for PCI DMA device") Signed-off-by: Jiri Slaby (SUSE) Assisted-by: LLM Cc: "Ilpo Järvinen" Cc: stable@kernel.org Cc: Andy Shevchenko Cc: linux-serial@vger.kernel.org Link: https://patch.msgid.link/f389df34aaa538270313ebd4cea75c2baaf46b95.1791873876.git.jirislaby@kernel.org Signed-off-by: Greg Kroah-Hartman --- drivers/tty/serial/8250/8250_lpss.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/drivers/tty/serial/8250/8250_lpss.c b/drivers/tty/serial/8250/8250_lpss.c index 776ec1ef29d6..325e587ae2c4 100644 --- a/drivers/tty/serial/8250/8250_lpss.c +++ b/drivers/tty/serial/8250/8250_lpss.c @@ -183,9 +183,8 @@ static int ehl_serial_setup(struct lpss8250 *lpss, struct uart_port *port) static void ehl_serial_exit(struct lpss8250 *lpss) { - struct uart_8250_port *up = serial8250_get_port(lpss->data.line); - - up->dma = NULL; + if (lpss->data.line >= 0) + serial8250_get_port(lpss->data.line)->dma = NULL; } #ifdef CONFIG_SERIAL_8250_DMA @@ -329,6 +328,8 @@ static int lpss8250_probe(struct pci_dev *pdev, const struct pci_device_id *id) return ret; lpss->board = (struct lpss8250_board *)id->driver_data; + /* for tests in lpss->board->exit() */ + lpss->data.line = -1; memset(&uart, 0, sizeof(struct uart_8250_port));