Re: [PATCH v3 1/2] usb: gadget: u_serial: serialise line setup against line teardown

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential
issue to consider:
- [Low] usb: gadget: u_serial: missing Fixes trailer for commit
  19b10a8828a6
--

commit 7fc863482be78ba089c79dd3a13d5ea59b19a79c
Author: Varun Singh <varun.singh10011@gmail.com>

> usb: gadget: u_serial: serialise line setup against line teardown
>
> Creating a u_serial gadget function can fail with -EEXIST for no reason:
>
>   sysfs: cannot create duplicate filename '/devices/virtual/tty/ttyGS0'
>   gserial_alloc_line_no_console: failed to register tty for port 0, err -17
>
> ports[n].lock protects the ports[n].port slot, but the line's tty device
> is registered and unregistered outside it, so the two can change
> independently:
>
>   gserial_alloc_line_no_console()        gserial_free_line()
>     gs_port_alloc()
>       mutex_lock(ports[n].lock)
>                                            mutex_lock(ports[n].lock)
>                                            ports[n].port = NULL
>                                            mutex_unlock(ports[n].lock)
>       ports[n].port = new
>       mutex_unlock(ports[n].lock)
>     tty_port_register_device(n)            <- device for n still there
>                                            tty_unregister_device(n)
>
> The allocator claims a slot whose old device is still registered, which
> is the -EEXIST above. The reverse order leaves a slot with no device
> node.
>
> Hold ports[n].lock across slot assignment and device registration, and
> across slot clearing and unregistration, so a concurrent caller sees
> either both or neither. gs_port_alloc() is now called with the lock
> held. Neither tty_port_register_device() nor tty_unregister_device()
> takes tty_lock or ports[n].lock, and gserial_free_line() already slept
> under this mutex, so this adds no new lock dependency.
>
> With two gadgets racing for line 0, 25 of 383 function creations failed
> on an unpatched kernel; 0 of 530 with this patch.
>
> Found with the assistance of Claude Opus 5.
>
> Signed-off-by: Varun Singh <varun.singh10011@gmail.com>

[Severity: Low]
Should this bug fix include a Fixes: tag for the commit that introduced
dynamic serial line allocation and teardown without holding
ports[port_num].lock across tty device registration and unregistration?

  Fixes: 19b10a8828a6 ("usb: gadget: allocate & giveback serial ports instead hard code them")

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261109141110.3538-1-varun.singh10011@gmail.com?part=1