Re: [PATCH] usb: gadget: u_serial: implement flush_buffer

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] tty: u_serial: UAF in gs_flush_buffer during TTY hangup
--

commit c239a0119a25b9f8fab856b838b114d124d55f62
Author: Mehmet Fide <mehmet.fide@screeningeagle.com>

usb: gadget: u_serial: implement flush_buffer

This patch implements flush_buffer for u_serial to discard buffered output
under the port lock. This aims to prevent gs_close() from blocking for the
full 15-second timeout when the host does not read the port.

> diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
> index cdd1dfc666c4f..2b99e33cbf3af 100644
> --- a/drivers/usb/gadget/function/u_serial.c
> +++ b/drivers/usb/gadget/function/u_serial.c
> @@ -822,6 +822,19 @@ static void gs_flush_chars(struct tty_struct *tty)
>  	spin_unlock_irqrestore(&port->port_lock, flags);
>  }
>  
> +static void gs_flush_buffer(struct tty_struct *tty)
> +{
> +	struct gs_port	*port = tty->driver_data;
> +	unsigned long	flags;
> +
> +	spin_lock_irqsave(&port->port_lock, flags);

[Severity: High]
Could this lead to a use-after-free during TTY hangup?

If a USB gadget unbinds, gserial_disconnect() schedules a hangup via
tty_hangup(), which queues hangup_work. Concurrently, if userspace closes
the TTY, tty_release() calls gs_close(), dropping port->count to 0. This
wakes up gserial_free_port(), which proceeds to kfree(port).

Once tty_release() drops tty_lock(), the scheduled hangup_work executing
__tty_hangup() can acquire tty_lock() and call tty_ldisc_hangup().

Because tty_ldisc_hangup() unconditionally calls tty_driver_flush_buffer()
if a line discipline is present, it will invoke this newly added callback. By
this point, the port structure has already been freed by gserial_free_port(),
so attempting to take port->port_lock here dereferences freed memory.

> +	kfifo_reset(&port->port_write_buf);
> +	spin_unlock_irqrestore(&port->port_lock, flags);
> +
> +	wake_up_interruptible(&port->drain_wait);
> +	tty_wakeup(tty);
> +}
> +

[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261015162732.3170938-1-mehmet.fide@gmail.com?part=1