The ports are registered before the interrupt is requested. If that request fails, unregistering the UART driver frees its state array while the registered ports still refer to it. Check each port registration and remove the ports already registered before unwinding the UART driver on either failure path. This issue was found by our static analysis tool under development. Fixes: 1d65c0b12656 ("serial: New serial driver SCCNXP") Cc: stable@vger.kernel.org Signed-off-by: Guangshuo Li --- drivers/tty/serial/sccnxp.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/tty/serial/sccnxp.c b/drivers/tty/serial/sccnxp.c index cb31e3aceb62..502f8ebe265b 100644 --- a/drivers/tty/serial/sccnxp.c +++ b/drivers/tty/serial/sccnxp.c @@ -989,7 +989,9 @@ static int sccnxp_probe(struct platform_device *pdev) s->port[i].uartclk = uartclk; s->port[i].ops = &sccnxp_ops; s->port[i].has_sysrq = IS_ENABLED(CONFIG_SERIAL_SCCNXP_CONSOLE); - uart_add_one_port(&s->uart, &s->port[i]); + ret = uart_add_one_port(&s->uart, &s->port[i]); + if (ret) + goto err_remove_ports; /* Set direction to input */ if (s->chip->flags & SCCNXP_HAVE_IO) sccnxp_set_bit(&s->port[i], DIR_OP, 0); @@ -1016,6 +1018,10 @@ static int sccnxp_probe(struct platform_device *pdev) return 0; } +err_remove_ports: + while (i--) + uart_remove_one_port(&s->uart, &s->port[i]); + uart_unregister_driver(&s->uart); err_out: if (!IS_ERR(s->regulator)) -- 2.43.0