Re: [PATCH net v2 1/1] serial: caif: fix remaining ser->tty UAF in TX path

[Vadim Fedorenko <vadim.fedorenko@linux.dev>]

On 15/02/2026 02:51, Shuangpeng Bai wrote:
> A reproducer exposes a KASAN use-after-free in caif_serial's TX path
> (e.g., via tty_write_room() / tty->ops->write()) on top of commit
> <308e7e4d0a84> ("serial: caif: fix use-after-free in caif_serial
> ldisc_close()").
> 
> That commit moved tty_kref_put() to ser_release(). There is still a race
> because the TX path may fetch ser->tty and use it while ser_release()
> drops the last tty reference:
> 
>      CPU 0 (ser_release worker)         CPU 1 (xmit)
>      -------------------------        ------------
>                                        caif_xmit()
>                                        handle_tx()
>                                          tty = ser->tty
> 
>      ser_release()
>        tty = ser->tty
>        dev_close(ser->dev)
>        unregister_netdevice(ser->dev)
>        debugfs_deinit(ser)
>        tty_kref_put(tty)        // may drop the last ref
>                       <-- race window -->
>                                          tty->ops->write(tty, ...)  // UAF
> 
> Fix it by serializing accesses to ser->tty with a dedicated lock. The TX
> path grabs a tty kref under the lock and drops it after the TX attempt,
> while ser_release() clears ser->tty under the same lock before putting the
> old tty reference. This prevents the TX path from observing a freed tty
> object via ser->tty.
> 
> With this change applied, the reproducer no longer triggers the UAF in my
> test.
> 
> One concern is that handle_tx() can be a hot path. This fix adds a short
> lock-held section plus an extra tty kref get/put per TX run. Feedback on
> the performance impact, or suggestions for a lower-overhead approach, are
> welcome.

I'm not quite sure we actually need spinlock here. It looks like just 
adding simple helper tty_kref_get_unless_zero() and using it in 
handle_xt() will solve the problem?