Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

[Qingfang Deng]

Hi, David

On Wed, 18 Feb 2026 16:23:30 +0100, David Sterba wrote:
> On Tue, Feb 17, 2026 at 09:03:25AM +0100, Jiri Slaby wrote:
> > Hi,
> > 
> > On 09. 02. 26, 11:21, David Sterba wrote:
> > > On Sun, Feb 08, 2026 at 06:25:38PM +0100, Jiri Kosina wrote:
> > >> On Sun, 8 Feb 2026, Greg KH wrote:
> > >>
> > >>>> I don't have the real hardware. In order to reproduce the bug, I simulate
> > >>>> the IPWireless PCMCIA card in the qemu by allocating and configuring the
> > >>>> necessary resources(I/O ports, memory regions, interrupts and so on) to
> > >>>> correspond with the hardware expected by the driver in the initialization
> > >>>> code of the virtual device.
> > >>>
> > >>> I wonder if this device even is still around, given that pcmcia is all
> > >>> but dead for a very long time.
> > >>
> > >> I doubt that this device is still around anywhere where reasonably new
> > >> kernels (including LTS) would matter.
> > >>
> > >> I don't think I've seen this device (which was back then donated to me by
> > >> T-Mobile CZ in order to get it supported in Linux, and I am not sure how
> > >> much global adoption it got afterwards) for, let's say, past 15 years :)
> > >>
> > >> I think (let's see what David, ho took the maintainership over for me
> > >> afterwards, has to say) we'd better deprecate and drop the whole thing,
> > >> rather than trying to pretend that it's still actively being taken care
> > >> of.
> > > 
> > > https://lore.kernel.org/all/20230223172403.GW10580@xxxxxxx/ last time
> > > the question of keeping the driver was asked (2023). Back then I was
> > > able to find the cards on second hand market but now I can't on a local
> > > market and there's exactly one hit on global eBay.
> > > 
> > > Local linux related or telco support forums seem to mention the driver
> > > until 2011 (root.cz, abclinuxu.cz, t-mobile.cz). It does not prove
> > > nobody is using it but I think the chances are quite low to justify
> > > keeping the driver.  It is simple enough to be built as an external
> > > module eventually, I can help with that in case somebody really needs
> > > that.
> > 
> > So, would you want to submit the removal? Or anyone else, if you don't 
> > want to lose time with this? (I can do that, if noone wants to.)
> 
> Let me do it after rc1 so I can finish the journey of this driver which
> was my first nontrivial contribution to linux kernel.

I found a memory leak in the driver:

- https://lore.kernel.org/linux-serial/20260306034058.386747-1-dqfext@xxxxxxxxx/T/

The bug has been present since the first version of this driver, but it
seems no one has noticed it until now. So I believe the driver has not
been actively used.

Regards,
Qingfang