Re: [PATCH] usb: gadget: u_serial: fix NULL deref in gs_close() after failed open

[Prashanth K]

On 9/11/2026 1:23 AM, Brian Ellis via B4 Relay wrote:
> From: Brian Ellis <brianellis@xxxxxxxxxxx>
> 
> gs_close() dereferences tty->driver_data without checking it:
> 
> 	struct gs_port *port = tty->driver_data;
> 	struct gserial	*gser;
> 
> 	spin_lock_irq(&port->port_lock);
> 

[...]

> diff --git a/drivers/usb/gadget/function/u_serial.c b/drivers/usb/gadget/function/u_serial.c
> index cdd1dfc66..5bbb4d04b 100644
> --- a/drivers/usb/gadget/function/u_serial.c
> +++ b/drivers/usb/gadget/function/u_serial.c
> @@ -695,6 +695,13 @@ static void gs_close(struct tty_struct *tty, struct file *file)
>  	struct gs_port *port = tty->driver_data;
>  	struct gserial	*gser;
>  
> +	/*
> +	 * tty_open() calls tty_release(), and hence this, when ->open()
> +	 * failed before gs_open() had set tty->driver_data.
> +	 */

The patch looks good.
Minor nitpick, can you rephrase this comment?

> +	if (!port)
> +		return;
> +
>  	spin_lock_irq(&port->port_lock);
>  
>  	if (port->port.count != 1) {
> 
> ---
> base-commit: be4219dd98608736e13e0b790ef742b76a13254d
> change-id: 20260910-u_serial-gs-close-null-a80a436666e8
> 
> Best regards,

Regards,
Prashanth K