Re: [PATCH] tty: n_gsm: keep DLCI 0 object across mux restarts

[Greg KH <gregkh@linuxfoundation.org>]

On Fri, Sep 11, 2026 at 02:58:26PM +0800, henrymei wrote:
> From: Aohan Mei <henrymei@tencent.com>
> 
> gsmtty_install() takes a reference on the object occupying the
> gsm->dlci[0] slot, and gsmtty_cleanup() drops a reference on whatever
> object occupies the slot at cleanup time. The two are expected to
> balance on the same object, but gsm_activate_mux() breaks that: on a
> mux restart (GSMIOC_SETCONF with a need_restart change) it
> unconditionally allocates a fresh DLCI 0 into the slot, orphaning the
> old object which still has install-time references outstanding.
> 
> When the last of those old gsmttys is closed, gsmtty_cleanup() then
> drops its slot reference on the *new* DLCI 0, driving its base kref
> from 1 to 0: gsm_dlci_free() frees it and NULLs the slot while the
> mux stays alive (dead == false), and the old object is leaked. The
> next gsmtty open passes the dead check and dereferences the NULL slot
> in gsmtty_install() (dlci_get(gsm->dlci[0])), crashing the kernel.
> 
> Keep the DLCI 0 object in the slot on reactivation when one is still
> present: it can only still be there because open gsmttys hold
> references on it, and gsm_dlci_free() is the only code that clears the
> slot and only runs at kref 0, so the slot identity can no longer
> change while install-time references are outstanding. Re-take the base
> reference that gsm_cleanup_mux() dropped via gsm_dlci_release(), clear
> the dead flag it set, and refresh the per-object config fields exactly
> like a fresh gsm_dlci_alloc() would, since the restart may carry a
> config change.
> 
> This also restores the invariant that dead == false implies
> gsm->dlci[0] != NULL, making the NULL dereference structurally
> impossible.
> 
> Fixes: 6ab8fba7fcb0 ("tty: n_gsm: Added refcount usage to gsm_mux and gsm_dlci structs")
> Reported-by: TencentOS Corvus AI <corvus@tencent.com>

As sashiko just told you, this isn't going to work.

ONLY touch this file if you can actually test this code, AND you have a
system that uses it.  Otherwise it's not needed to fix up anything that
a LLM might "find" in this file, see the mailing list archives for the
full details.

thanks,

greg k-h