Re: [PATCH 2/2] tty: vcc: hold port lock when clearing tty pointer in vcc_cleanup

[Greg Kroah-Hartman <gregkh@linuxfoundation.org>]

On Fri, Jul 31, 2026 at 10:32:36AM +0200, Jiri Slaby wrote:
> On 31. 07. 26, 10:15, Greg Kroah-Hartman wrote:
> > From: Joshua Rogers <linux@joshua.hu>
> > 
> > vcc_cleanup() sets port->tty to NULL without holding port->lock, racing
> > with vcc_event() LDC callbacks that read port->tty under port->lock and
> > then use tty->port. This can cause a use-after-free when the callback
> > dereferences tty->port after cleanup has already destroyed and freed it.
> > 
> > Assisted-by: AISLE:Snapshot
> > Cc: stable <stable@kernel.org>
> > Signed-off-by: Joshua Rogers <linux@joshua.hu>
> > Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
> > ---
> >   drivers/tty/vcc.c | 3 +++
> >   1 file changed, 3 insertions(+)
> > 
> > diff --git a/drivers/tty/vcc.c b/drivers/tty/vcc.c
> > index 3947bd2b75ac..03ed8c692acd 100644
> > --- a/drivers/tty/vcc.c
> > +++ b/drivers/tty/vcc.c
> > @@ -983,10 +983,13 @@ static int vcc_install(struct tty_driver *driver, struct tty_struct *tty)
> >   static void vcc_cleanup(struct tty_struct *tty)
> >   {
> >   	struct vcc_port *port;
> > +	unsigned long flags;
> >   	port = vcc_get(tty->index, true);
> >   	if (port) {
> > +		spin_lock_irqsave(&port->lock, flags);
> >   		port->tty = NULL;
> > +		spin_unlock_irqrestore(&port->lock, flags);
> 
> For these, I like
> 
> scope_guard(spinlock_irqsave, &port->lock)
>   port->tty = NULL;

Fair enough, that's much cleaner, LLMs really do not know about that
pattern yet :)

thanks,

greg k-h