Re: [PATCH v4] usb: gadget: u_serial: fix NULL deref in gs_close() after failed open

[sashiko-bot@kernel.org]

> From: Brian Ellis <brianellis@gotenna.com>
> 
> gs_close() opens with
> 
> 	struct gs_port *port = tty->driver_data;
> 	...
> 	spin_lock_irq(&port->port_lock);
> 
> and never checks port.  gs_open() assigns tty->driver_data only on the
> port.count 0 -> 1 edge, so any failure earlier in gs_open() leaves it NULL,
> and tty_open() calls tty_release(), and hence ->close(), when ->open()
> fails.
> 
> syzbot hit exactly this on arm64.  Fault injection failed the kfifo_alloc()
> of the write buffer in gs_open():
> [ ... ]
> Reported-by: syzbot+782b2f1063e38ba8fa6e@syzkaller.appspotmail.com
> Closes: https://syzkaller.appspot.com/bug?extid=782b2f1063e38ba8fa6e
> Cc: stable@vger.kernel.org
> Assisted-by: LLM
> Signed-off-by: Brian Ellis <brianellis@gotenna.com>

Sashiko has reviewed this patch and found no issues. It looks great!

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261013-u_serial-gs-close-null-v4-1-9ea038501994@gotenna.com?part=1