Re: [PATCH net v2 1/1] serial: caif: fix remaining ser->tty UAF in TX path

[Hillf Danton]

On Mon, 16 Feb 2026 08:24:23 +0800 Hillf Danton wrote:
>On Sun, 15 Feb 2026 14:22:02 -0500 Shuangpeng Bai wrote:
>>> On Feb 15, 2026, at 03:55, Hillf Danton <hdanton@xxxxxxxx> wrote:
>>> On Sat, 14 Feb 2026 21:51:41 -0500 Shuangpeng Bai wrote:
>>>> A reproducer exposes a KASAN use-after-free in caif_serial's TX path
>>>> (e.g., via tty_write_room() / tty->ops->write()) on top of commit
>>>> <308e7e4d0a84> ("serial: caif: fix use-after-free in caif_serial
>>>> ldisc_close()").
>>>> 
>>>> That commit moved tty_kref_put() to ser_release(). There is still a race
>>>> because the TX path may fetch ser->tty and use it while ser_release()
>>>> drops the last tty reference:
>>>> 
>>>>    CPU 0 (ser_release worker)         CPU 1 (xmit)
>>>>    -------------------------        ------------
>>>>                                      caif_xmit()
>>>>                                      handle_tx()
>>>>                                        tty = ser->tty
>>>> 
>>>>    ser_release()
>>>>      tty = ser->tty
>>>>      dev_close(ser->dev)
>>>>      unregister_netdevice(ser->dev)
>>>>      debugfs_deinit(ser)
>>>>      tty_kref_put(tty)        // may drop the last ref
>>>>                     <-- race window -->
>>>>                                        tty->ops->write(tty, ...)  // UAF
>>>> 
>>> What is unclear is -- why is the xmit callback still active after
>>> unregister_netdevice().
>>
>> In my understanding, no new ndo_start_xmit should begin after
>> unregister_netdevice() has completed, but an in-flight TX still needs
>> proper synchronization with teardown.
>>
> Could you shed some light on that sync Eric? Is it missed?
>
So far I found a syzbot report [1] where ser->dev can not be closed with an
active xmit cb.

[1] Subject: [syzbot] [net?] BUG: soft lockup in ser_release (4)
https://lore.kernel.org/lkml/6758196a.050a0220.a30f1.01c9.GAE@xxxxxxxxxx/