[PATCH 0/2] ipack: ipoctal: fix races and UAFs during module removal

[Pei Xiao <xiaopei01@kylinos.cn>]

When the ipoctal device is removed while a userspace process still
holds a tty fd open, several races and use-after-free bugs can be
triggered.  This series addresses the following issues:

1. UAF of struct ipoctal: the remove callback freed ipoctal via
   kfree() while in-flight tty ops could still be accessing it.

2. NULL dereference in ipoctal_write_tty(): __ipoctal_remove() freed
   xmit_buf while a concurrent write() could still dereference it.

3. UAF in ipoctal_cleanup(): ipack_put_carrier(ipoctal->dev) walked
   through ipoctal->dev to reach the carrier module, but the
   ipack_device could have already been freed by then.

4. Page faults due to devm_ioremap() regions being unmapped while
   tty ops still access hardware registers.

5. TOCTOU race between the removed-flag check and the subsequent
   hardware access in each tty op.

Patch 1 introduces kref-based lifetime management, caches the
carrier owner module pointer to avoid chasing a dangling dev->bus
pointer, adds a "removed" flag with checks in all tty ops that
touch hardware, and adds a NULL guard on xmit_buf in the write path.

Patch 2 adds a read-write semaphore (remove_sem) to close the
TOCTOU window: the tty ops hold the read lock for the duration of
the hardware access, while __ipoctal_remove() acquires the write
lock when setting the removed flag, ensuring that once removed is
true no in-flight tty op is still inside a critical section.

Reported-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
Link: https://lore.kernel.org/lkml/178144969601.60470.1257088106279546587@gmail.com/

Pei Xiao (2):
  ipack: ipoctal: fix UAF, null-ptr-deref, and use-after-free in cleanup
    on remove
  ipack: ipoctal: add rwsem to guard against TOCTOU in remove path

 drivers/ipack/devices/ipoctal.c | 60 ++++++++++++++++++++++++++++++---
 1 file changed, 56 insertions(+), 4 deletions(-)

--
2.25.1