Re: [PATCH net 1/2] ppp: ppp_async: simplify tty disc_data access

[Eric Dumazet]

On Fri, Aug 28, 2026 at 9:33 AM Qingfang Deng <qingfang.deng@xxxxxxxxx> wrote:
>
> tty_ldisc_hangup() invokes the hangup callback while holding only a read
> lock on tty->ldisc_sem, so it can run concurrently with other line
> discipline callbacks. This currently forces async PPP to maintain
> separate lifetime protection around tty->disc_data.
>
> Line discipline close is called under the write lock during hangup
> processing. Remove the hangup callback and rely on close for teardown,
> as done for SLIP by commit 23c53269f2ba ("slip: remove slip_hangup() to
> fix use-after-free in slip_receive_buf()"). This serializes teardown
> with all other line discipline operations.
>
> disc_data_lock, refcount and completion are redundant with that
> serialization. Remove them and access tty->disc_data directly.
>
> This also eliminates a lockdep warning reported by syzbot. The warning
> does not indicate a real deadlock because the write side runs only in
> process context with hardirqs disabled.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Reported-by: syzbot+8e808eb853386f575d86@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://lore.kernel.org/all/0000000000002fbad30611e25849@xxxxxxxxxx/
> Signed-off-by: Qingfang Deng <qingfang.deng@xxxxxxxxx>
> ---
>  drivers/net/ppp/ppp_async.c | 82 ++++---------------------------------
>  1 file changed, 7 insertions(+), 75 deletions(-)

Sweet.

Reviewed-by: Eric Dumazet <edumazet@xxxxxxxxxx>