Re: [PATCH v2] usb: gadget: u_serial: pin ports while TTYs are installed

[sashiko-bot@kernel.org]

> A slab-use-after-free can occur when gserial_free_line() frees struct
> gs_port while it is still reachable through an installed TTY. The
> port->port.count value tracks successful opens, but it is zero before
> gs_open() and again after gs_close(), before TTY cleanup has finished.
> Teardown can therefore free gs_port while tty_init_dev() or release_tty()
> still accesses its tty_port.
> 
> Manage gs_port lifetime with tty_port references. Take a reference in
> gs_install(), drop it in gs_cleanup(), and move the final free to
> gs_port_destruct(). Unregister the TTY device before dropping the owner
> reference.
> 
> Keep each minor reserved until the old port is destroyed so an installed
> TTY for one generation cannot overlap a replacement at the same minor.
> Publish the new port before device registration so the cdev and add uevent
> [ ... ]
> Reported-by: syzbot+fe63e4d633540f230624@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=fe63e4d633540f230624
> Link: https://syzkaller.appspot.com/ai_job?id=ec789387-2e7b-4a8f-a7a1-a47bf7fa57f5
> Cc: stable@kernel.org
> Signed-off-by: Krystian Kaniewski <krystianmkaniewski@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261022091359.1187468-1-krystianmkaniewski@gmail.com?part=1