Re: [PATCH v2 1/4] uart-routing: Add common UART routing framework

[Changhuang Liang]

Hi, Breno

> On Sat, Sep 05, 2026 at 03:28:58AM -0700, Changhuang Liang wrote:
> > +ssize_t uart_routing_show(struct device *dev, struct device_attribute *attr,
> > +                       char *buf)
> > +{
> > +     const struct uart_routing_selector *sel =
> to_uart_routing_selector(attr);
> > +     struct uart_routing *routing = uart_routing_from_dev(dev);
> > +     unsigned int val, pos;
> > +     int len, ret;
> > +
> > +     ret = regmap_read(routing->regmap, sel->reg, &val);
> 
> It seems routing can be NULL here if the file is read while the device is being
> unbound, and uart_routing_store() has the same problem.
> 
> I hit this while testing v2 on arm64 (next-20261008 with KASAN), and the
> code is unchanged in v3.
> 
>         d=/sys/bus/platform/devices/$DEV
>         drv=/sys/bus/platform/drivers/aspeed-uart-routing
>         while :; do cat $d/uart1; done >/dev/null 2>&1 &
>         while :; do echo $DEV > $drv/unbind; echo $DEV > $drv/bind; done
> 
> and then got:
> 
>     KASAN: null-ptr-deref in range
> [0x0000000000000000-0x0000000000000007]
>     Internal error: Oops: 0000000096000006 [#1]  SMP
>     pc : uart_routing_show+0x64/0x288 [uart_routing]
>     Call trace:
>      uart_routing_show+0x64/0x288 [uart_routing] (P)
>      dev_attr_show+0x64/0xc0
>      sysfs_kf_seq_show+0x21c/0x380
>      kernfs_seq_show+0x138/0x1c8
>      seq_read_iter+0x358/0xa30
>      kernfs_fop_read_iter+0x438/0x500
>      vfs_read+0x484/0x6f0

Thank you for pointing out the issue. I will reproduce and fix it.

Best Regards,
Changhuang