From: Adriano Cordova <adrianox@gmail.com>
To: gregkh@linuxfoundation.org
Cc: johan@kernel.org, jirislaby@kernel.org,
linux-usb@vger.kernel.org, linux-serial@vger.kernel.org,
Adriano Cordova <adrianox@gmail.com>,
syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com,
stable@vger.kernel.org
Subject: [PATCH v2 1/2] USB: serial: fix break_ctl() NULL-pointer dereference
Date: Thu, 3 Sep 2026 00:24:28 -0400 [thread overview]
Message-ID: <20260903042429.130320-2-adrianox@gmail.com> (raw)
In-Reply-To: <20260903042429.130320-1-adrianox@gmail.com>
Don't call into the driver after disconnect, just like serial_write()
already does.
Fixes: 9e98966c7bb9 ("tty: rework break handling")
Reported-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com
Link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
Tested-by: syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com
Cc: stable@vger.kernel.org
Signed-off-by: Adriano Cordova <adrianox@gmail.com>
---
drivers/usb/serial/usb-serial.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/usb/serial/usb-serial.c b/drivers/usb/serial/usb-serial.c
index 17edc057a311..5f42bfe39212 100644
--- a/drivers/usb/serial/usb-serial.c
+++ b/drivers/usb/serial/usb-serial.c
@@ -532,6 +532,9 @@ static int serial_break(struct tty_struct *tty, int break_state)
{
struct usb_serial_port *port = tty->driver_data;
+ if (port->serial->dev->state == USB_STATE_NOTATTACHED)
+ return -ENODEV;
+
dev_dbg(&port->dev, "%s\n", __func__);
if (port->serial->type->break_ctl)
--
2.51.0
next prev parent reply other threads:[~2026-09-03 4:25 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-03 4:24 [PATCH v2 0/2] tty: fix break race Adriano Cordova
2026-09-03 4:24 ` Adriano Cordova [this message]
2026-09-03 4:24 ` [PATCH v2 2/2] " Adriano Cordova
2026-09-03 6:22 ` [PATCH v2 0/2] " Johan Hovold
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260903042429.130320-2-adrianox@gmail.com \
--to=adrianox@gmail.com \
--cc=gregkh@linuxfoundation.org \
--cc=jirislaby@kernel.org \
--cc=johan@kernel.org \
--cc=linux-serial@vger.kernel.org \
--cc=linux-usb@vger.kernel.org \
--cc=stable@vger.kernel.org \
--cc=syzbot+473d7477c523b41d4046@syzkaller.appspotmail.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox