Message-ID: <sashiko-outbox-211328@kernel.org>
From: sashiko-bot@kernel.org
Subject: Re: [PATCH v2] serial: core: fix use-after-free after driver module
 unload
Reply-To: sashiko-reviews@lists.linux.dev
To: "Johan Hovold" <johan@kernel.org>
Cc: linux-serial@vger.kernel.org
In-Reply-To: <20261112142209.454331-1-johan@kernel.org>
References: <20261112142209.454331-1-johan@kernel.org>
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Date: Thu, 12 Nov 2026 14:31:40 +0000
Precedence: list

> Deregistering a uart driver frees the driver uart state including the
> tty ports themselves.
>=20
> Restore the uart driver module as owner of the tty driver so that the
> uart state and resources like the tty driver name do not go away while a
> tty is still open.
>=20
> This specifically avoids use-after-free when accessing the tty port and
> crashes when accessing the tty driver name (e.g. in the tty printk
> macros) when a tty is closed after its driver module has been unloaded.
>=20
> It also makes sure that the uart state is still valid when waking up any
> waiters after releasing the final uart port reference in
> uart_port_deref().
>=20
> Note that a few drivers deregister their uart drivers also when a
> (platform) device is manually unbound through sysfs (but if you use that
> interface, you get to keep the pieces).
>=20
> Fixes: 2f16669d322e ("TTY: remove re-assignments to tty_driver members")
> Cc: stable@vger.kernel.org	# 3.4
> Cc: Jiri Slaby <jirislaby@kernel.org>
> Signed-off-by: Johan Hovold <johan@kernel.org>

Sashiko has reviewed this patch and found no issues.

--=20
Sashiko AI review =C2=B7 https://sashiko.dev/#/patchset/20261112142209.4543=
31-1-johan@kernel.org?part=3D1