Re: [PATCH net v5] serial: caif: hold tty->link reference in ldisc_open and ser_release

[Jiayuan Chen]

On Thu, Mar 05, 2026 at 10:40:06PM +0800, Shuangpeng Bai wrote:
> A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
> when caif_serial's TX path calls tty_write_room(). The faulting access
> is on tty->link->port.
> 
> Hold an extra kref on tty->link for the lifetime of the caif_serial line
> discipline: get it in ldisc_open() and drop it in ser_release(), and
> also drop it on the ldisc_open() error path.
> 
> With this change applied, the reproducer no longer triggers the UAF in
> my testing.
> 
> Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f
> Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@xxxxxxxxx
> Fixes: e31d5a05948e ("caif: tty's are kref objects so take a reference")
> Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@xxxxxxxxx>

>From a design perspective, ideally tty_kref_get()/tty_kref_put() should
automatically get/put tty->link as well when it exists, so that any holder
of a tty reference implicitly keeps the peer alive.

But that would be too invasive a change to the tty core.

As-is, this patch is sufficient to fix the problem.

Reviewed-by: Jiayuan Chen <jiayuan.chen@xxxxxxxxx>