Re: [PATCH 2/2] usb: gadget: u_serial: Fix race condition in TTY wakeup

[Greg KH <gregkh@linuxfoundation.org>]

On Mon, Jun 16, 2025 at 09:21:47PM +0800, Kuen-Han Tsai wrote:
> A race condition occurs when gs_start_io() calls either gs_start_rx() or
> gs_start_tx(), as those functions briefly drop the port_lock for
> usb_ep_queue(). This allows gs_close() and gserial_disconnect() to clear
> port.tty and port_usb, respectively.
> 
> Use the null-safe TTY Port helper function to wake up TTY.
> 
> Cc: stable@vger.kernel.org
> Fixes: 35f95fd7f234 ("TTY: usb/u_serial, use tty from tty_port")
> Signed-off-by: Kuen-Han Tsai <khtsai@google.com>
> ---
> Explanation:
>     CPU1:                            CPU2:
>     gserial_connect() // lock
>                                      gs_close() // await lock
>     gs_start_rx()     // unlock
>     usb_ep_queue()
>                                      gs_close() // lock, reset port_tty and unlock
>     gs_start_rx()     // lock
>     tty_wakeup()      // dereference

Why isn't this up in the changelog?

> 
> Stack traces:
> [   51.494375][  T278] ttyGS1: shutdown
> [   51.494817][  T269] android_work: sent uevent USB_STATE=DISCONNECTED
> [   52.115792][ T1508] usb: [dm_bind] generic ttyGS1: super speed IN/ep1in OUT/ep1out
> [   52.516288][ T1026] android_work: sent uevent USB_STATE=CONNECTED
> [   52.551667][ T1533] gserial_connect: start ttyGS1
> [   52.565634][ T1533] [khtsai] enter gs_start_io, ttyGS1, port->port.tty=0000000046bd4060
> [   52.565671][ T1533] [khtsai] gs_start_rx, unlock port ttyGS1
> [   52.591552][ T1533] [khtsai] gs_start_rx, lock port ttyGS1
> [   52.619901][ T1533] [khtsai] gs_start_rx, unlock port ttyGS1
> [   52.638659][ T1325] [khtsai] gs_close, lock port ttyGS1
> [   52.656842][ T1325] gs_close: ttyGS1 (0000000046bd4060,00000000be9750a5) ...
> [   52.683005][ T1325] [khtsai] gs_close, clear ttyGS1
> [   52.683007][ T1325] gs_close: ttyGS1 (0000000046bd4060,00000000be9750a5) done!
> [   52.708643][ T1325] [khtsai] gs_close, unlock port ttyGS1
> [   52.747592][ T1533] [khtsai] gs_start_rx, lock port ttyGS1
> [   52.747616][ T1533] [khtsai] gs_start_io, ttyGS1, going to call tty_wakeup(), port->port.tty=0000000000000000
> [   52.747629][ T1533] Unable to handle kernel NULL pointer dereference at virtual address 00000000000001f8

What is [khtsai] from?

thanks,

greg k-h