Re: [PATCH] tty: port: fix tty_port_tty_vhangup() race

[sashiko-bot@kernel.org]

> Drivers rely on tty_port_tty_vhangup() to synchronously hang up their
> ports before tearing down resources as part of deregistration (e.g. on
> physical disconnect).
> 
> If tty_port_tty_vhangup() races with another hangup it may however
> return before the port has been shut down. This is in turn can lead to
> use-after-free and NULL-pointer dereferences in racing ioctls (including
> a synchronous hangup) and in processing of racing asynchronous hangups
> (carrier loss).
> 
> Add the missing serialisation to tty_port_tty_vhangup() and
> tty_port_hangup() so that the former does not return until the port has
> been shut down also when there is a racing hangup.
> 
> Note that serial core does not use tty_port_hangup(), but it already
> holds the port mutex when clearing port->tty and shutting down the port
> in uart_hangup().
> 
> Fixes: 7ca0ff9ab321 ("tty: Add a full port_close function")
> Cc: stable@vger.kernel.org	# 2.6.32: 2b5eac0f8c6e: tty: introduce and use tty_port_tty_vhangup() helper
> Cc: stable@vger.kernel.org	# 2.6.32
> Reported-by: syzbot+5fabc1ae99ff40690d84@syzkaller.appspotmail.com
> Link: https://lore.kernel.org/6a944641.4d659fcc.734b4.003c.GAE@google.com
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260910125114.640880-1-johan@kernel.org?part=1