From mboxrd@z Thu Jan 1 00:00:00 1970 Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.remote-ip=100.103.45.18 ARC-Seal: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; cv=none; t=1793208960; b=ZkTGxiyoL1fjzBgZdnAUnWCjTKuMeaw3MhPghe6ygEhbcExbLxdVjTlQ3gC95d0j0Aqa GhOvsIjBhklEPFuEAor5Ym42HlBz0socrNVATmlby04b8pkT01KBj+Gdg/0jyMhefpy+p 50Y+/ltjUf4ZHsOR4VCOGt/0VWcQTvGC9KqLAako/sWjmPo4qnci5WoGCMDtdriW/j+pT Ac4ZPoFCepTkIVJoRvh5SFzGTgTwRI9/n/6wUAceDi4wxppHMkLM5oainxNebfoIuUXvN BM/wxQvdQENN9J+F5lHygCbfeXk2j0pKGGUfEk0aLOZ5nXgxnraGKkhiWrl0vXn1FXw== ARC-Message-Signature: i=1; d=subspace.kernel.org; s=arc20261015; a=rsa-sha256; c=relaxed/relaxed; t=1793208960; h=Received:DKIM-Signature:From:To:Cc:Subject:Date:Message-ID:X-Mailer: In-Reply-To:References:User-Agent:X-stable:X-Patchwork-Hint: MIME-Version:Content-Transfer-Encoding; bh=xa06OF0uT2xLUZtCrI9FheVLAtoJSUr3jeUfh79TNss=; b=beGrXSyLmkBjZLMueny7gy71hi0V8GbX2hJVPkZb21Ce0pvG7ntgVhBtOqUg1/pqVhOR EaauizudKTPDQ/Kz34dBHbBV456IwGJdFHVjcKrq/nHaxL+KoBqdEol2/r3y0rDiLiVi7 4tJX0ONgklqn8NnJ/bUHUbx09qgRmyDDCpHdM/CGtx/cBH2sro7hJlghZrS7VWyZ+thAC H3dliZ9SgrhHouQ9ISCDOetj86mV26g0gDeCNHkME609uEsIyAzTiUh5H9qjiRl8E/bgW 80kvUZLyBJPksP2u6/aXsMX7i10hzMoYThTBmx/5P82S13nNI0jecbqBD6Ik97eccig== ARC-Authentication-Results: i=1; smtp.subspace.kernel.org; dkim=pass header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1g4ZaX2D; arc=none smtp.remote-ip=100.103.45.18 Received: from smtp.kernel.org (quasi.space.kernel.org [100.103.45.18]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature ECDSA (prime256v1)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 33717606A322; Wed, 28 Oct 2026 17:36:00 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key, unprotected) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.a=rsa-sha256 header.s=korg header.b=1g4ZaX2D Received: by smtp.kernel.org (Postfix) with ESMTPSA id 845251F01825; Wed, 28 Oct 2026 17:35:59 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1793208960; bh=xa06OF0uT2xLUZtCrI9FheVLAtoJSUr3jeUfh79TNss=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=1g4ZaX2D4X5am5hGrdFPB72udG4Vx1q0TNVbZED942rmJHHwU40CvKoDBQ/mflZ8o f9Z//d8aTpDL9gv4X/b5gnvP1k+3+gtVOFP+WkQeX17ZHRIMJOPjENS2E2w2Nb3ASp /e/4VO1Dc2GhOoDPLy5b3ukC8WIeaB70N9gbh824= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, syzbot+5fabc1ae99ff40690d84@syzkaller.appspotmail.com, Johan Hovold , Ting-Han Hou , Sasha Levin , stable@kernel.org Subject: [PATCH 5.10 303/516] tty: port: fix tty_port_tty_vhangup() race Date: Wed, 28 Oct 2026 17:57:35 +0100 Message-ID: <20261028170010.667918746@linuxfoundation.org> X-Mailer: git-send-email 2.56.0 In-Reply-To: <20261028170003.522232767@linuxfoundation.org> References: <20261028170003.522232767@linuxfoundation.org> User-Agent: quilt/0.69 X-stable: review X-Patchwork-Hint: ignore X-Mailing-List: patches@lists.linux.dev List-Id: List-Post: List-Help: List-Subscribe: List-Unsubscribe: List-Owner: Precedence: list MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.10-stable review patch. If anyone has any objections, please let me know. ------------------ From: Johan Hovold [ Upstream commit b48820de8c1a596c5b99775524dfce73c6576c5d ] Drivers rely on tty_port_tty_vhangup() to synchronously hang up their ports before tearing down resources as part of deregistration (e.g. on physical disconnect). If tty_port_tty_vhangup() races with another hangup it may however return before the port has been shut down. This is in turn can lead to use-after-free and NULL-pointer dereferences in racing ioctls (including a synchronous hangup) and in processing of racing asynchronous hangups (carrier loss). Add the missing serialisation to tty_port_tty_vhangup() and tty_port_hangup() so that the former does not return until the port has been shut down also when there is a racing hangup. Note that serial core does not use tty_port_hangup(), but it already holds the port mutex when clearing port->tty and shutting down the port in uart_hangup(). Fixes: 7ca0ff9ab321 ("tty: Add a full port_close function") Cc: stable@kernel.org # 2.6.32: 2b5eac0f8c6e: tty: introduce and use tty_port_tty_vhangup() helper Cc: stable@kernel.org # 2.6.32 Reported-by: syzbot+5fabc1ae99ff40690d84@syzkaller.appspotmail.com Link: https://lore.kernel.org/6a944641.4d659fcc.734b4.003c.GAE@google.com Signed-off-by: Johan Hovold Link: https://patch.msgid.link/20260910125114.640880-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman [ Ting-Han: use mutex_lock()/spin_lock_irqsave() instead of guard(), scoped_guard() and the tty_port_tty class, matching the existing code in this version of tty_port.c; tty_port_shutdown() has no kernel-doc here, so there is none to move ] Assisted-by: LLM Signed-off-by: Ting-Han Hou Signed-off-by: Sasha Levin --- drivers/tty/tty_port.c | 54 +++++++++++++++++++++++++++++------------- include/linux/tty.h | 14 ++--------- 2 files changed, 40 insertions(+), 28 deletions(-) diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 296ba1e6e48cb..ebd790bfaf14d 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -312,11 +312,12 @@ void tty_port_tty_set(struct tty_port *port, struct tty_struct *tty) } EXPORT_SYMBOL(tty_port_tty_set); -static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) +static void tty_port_shutdown_locked(struct tty_port *port, struct tty_struct *tty) { - mutex_lock(&port->mutex); + lockdep_assert_held(&port->mutex); + if (port->console) - goto out; + return; if (tty_port_initialized(port)) { tty_port_set_initialized(port, 0); @@ -330,7 +331,12 @@ static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) if (port->ops->shutdown) port->ops->shutdown(port); } -out: +} + +static void tty_port_shutdown(struct tty_port *port, struct tty_struct *tty) +{ + mutex_lock(&port->mutex); + tty_port_shutdown_locked(port, tty); mutex_unlock(&port->mutex); } @@ -348,6 +354,7 @@ void tty_port_hangup(struct tty_port *port) struct tty_struct *tty; unsigned long flags; + mutex_lock(&port->mutex); spin_lock_irqsave(&port->lock, flags); port->count = 0; tty = port->tty; @@ -356,7 +363,8 @@ void tty_port_hangup(struct tty_port *port) port->tty = NULL; spin_unlock_irqrestore(&port->lock, flags); tty_port_set_active(port, 0); - tty_port_shutdown(port, tty); + tty_port_shutdown_locked(port, tty); + mutex_unlock(&port->mutex); tty_kref_put(tty); wake_up_interruptible(&port->open_wait); wake_up_interruptible(&port->delta_msr_wait); @@ -364,24 +372,38 @@ void tty_port_hangup(struct tty_port *port) EXPORT_SYMBOL(tty_port_hangup); /** - * tty_port_tty_hangup - helper to hang up a tty - * + * tty_port_tty_hangup - helper to hang up a tty asynchronously * @port: tty port - * @check_clocal: hang only ttys with CLOCAL unset? + * @check_clocal: hang only ttys with %CLOCAL unset? */ -void __tty_port_tty_hangup(struct tty_port *port, bool check_clocal, bool async) +void tty_port_tty_hangup(struct tty_port *port, bool check_clocal) { struct tty_struct *tty = tty_port_tty_get(port); - if (tty && (!check_clocal || !C_CLOCAL(tty))) { - if (async) - tty_hangup(tty); - else - tty_vhangup(tty); - } + if (tty && (!check_clocal || !C_CLOCAL(tty))) + tty_hangup(tty); tty_kref_put(tty); } -EXPORT_SYMBOL_GPL(__tty_port_tty_hangup); +EXPORT_SYMBOL_GPL(tty_port_tty_hangup); + +/** + * tty_port_tty_vhangup - helper to hang up a tty synchronously + * @port: tty port + */ +void tty_port_tty_vhangup(struct tty_port *port) +{ + struct tty_struct *tty; + + mutex_lock(&port->mutex); + tty = tty_port_tty_get(port); + mutex_unlock(&port->mutex); + + if (tty) { + tty_vhangup(tty); + tty_kref_put(tty); + } +} +EXPORT_SYMBOL_GPL(tty_port_tty_vhangup); /** * tty_port_tty_wakeup - helper to wake up a tty diff --git a/include/linux/tty.h b/include/linux/tty.h index 6a7854c3e54ab..41b31c4e0653d 100644 --- a/include/linux/tty.h +++ b/include/linux/tty.h @@ -623,8 +623,8 @@ extern int tty_port_carrier_raised(struct tty_port *port); extern void tty_port_raise_dtr_rts(struct tty_port *port); extern void tty_port_lower_dtr_rts(struct tty_port *port); extern void tty_port_hangup(struct tty_port *port); -extern void __tty_port_tty_hangup(struct tty_port *port, bool check_clocal, - bool async); +extern void tty_port_tty_hangup(struct tty_port *port, bool check_clocal); +extern void tty_port_tty_vhangup(struct tty_port *port); extern void tty_port_tty_wakeup(struct tty_port *port); extern int tty_port_block_til_ready(struct tty_port *port, struct tty_struct *tty, struct file *filp); @@ -642,16 +642,6 @@ static inline int tty_port_users(struct tty_port *port) return port->count + port->blocked_open; } -static inline void tty_port_tty_hangup(struct tty_port *port, bool check_clocal) -{ - __tty_port_tty_hangup(port, check_clocal, true); -} - -static inline void tty_port_tty_vhangup(struct tty_port *port) -{ - __tty_port_tty_hangup(port, false, false); -} - extern int tty_register_ldisc(int disc, struct tty_ldisc_ops *new_ldisc); extern int tty_unregister_ldisc(int disc); extern int tty_set_ldisc(struct tty_struct *tty, int disc); -- 2.53.0