Re: [PATCH] tty: serialize device registration and removal

[Greg Kroah-Hartman]

On Fri, Jul 31, 2026 at 10:22:20PM +0800, Chengfeng Ye wrote:
> tty_cdev_add() stores a newly allocated cdev in driver->cdevs[index]
> before initializing and registering it. tty_unregister_device() reads and
> deletes the same pointer without serialization.
> 
> The race can proceed as follows:
> 
>   registration                     removal
>   ------------                     -------
>   driver->cdevs[index] = cdev
>                                    cdev_del(driver->cdevs[index])
>                                    kobject_put() frees cdev
>   driver->cdevs[index]->ops = &tty_fops
> 
> The final write accesses freed memory. Concurrent registration can also
> replace the slot while another caller is still using its cdev.
> 
> KASAN reported:
> 
>   BUG: KASAN: slab-use-after-free in tty_cdev_add+0x5c7/0x670
>   Write of size 8 at addr ffff88810b298c48
> 
>   Call Trace:
>    tty_cdev_add+0x5c7/0x670
>    tty_register_device_attr+0x458/0x810
>    gsm_activate_mux+0x105/0x2e0
>    gsmld_ioctl+0x92f/0x14d0

Hah, that's funny :)

Look in the mailing list archives for why we don't touch n_gsm issues,
ESPECIALLY by changing core tty code to work around the known
bugs/problems in that code base.

Your LLM should know not to run this code, please tell it to never do
so.

Also, you forgot to add an Assisted-by: tag :(

thanks,

greg k-h