Re: [PATCH] tty: ipwireless: Fix use-after-free in tasklet during device removal

[Greg KH]

On Mon, Mar 09, 2026 at 07:18:18PM +0800, Qingfang Deng wrote:
> Hi, David
> 
> On Wed, 18 Feb 2026 16:23:30 +0100, David Sterba wrote:
> > On Tue, Feb 17, 2026 at 09:03:25AM +0100, Jiri Slaby wrote:
> > > Hi,
> > > 
> > > On 09. 02. 26, 11:21, David Sterba wrote:
> > > > On Sun, Feb 08, 2026 at 06:25:38PM +0100, Jiri Kosina wrote:
> > > >> On Sun, 8 Feb 2026, Greg KH wrote:
> > > >>
> > > >>>> I don't have the real hardware. In order to reproduce the bug, I simulate
> > > >>>> the IPWireless PCMCIA card in the qemu by allocating and configuring the
> > > >>>> necessary resources(I/O ports, memory regions, interrupts and so on) to
> > > >>>> correspond with the hardware expected by the driver in the initialization
> > > >>>> code of the virtual device.
> > > >>>
> > > >>> I wonder if this device even is still around, given that pcmcia is all
> > > >>> but dead for a very long time.
> > > >>
> > > >> I doubt that this device is still around anywhere where reasonably new
> > > >> kernels (including LTS) would matter.
> > > >>
> > > >> I don't think I've seen this device (which was back then donated to me by
> > > >> T-Mobile CZ in order to get it supported in Linux, and I am not sure how
> > > >> much global adoption it got afterwards) for, let's say, past 15 years :)
> > > >>
> > > >> I think (let's see what David, ho took the maintainership over for me
> > > >> afterwards, has to say) we'd better deprecate and drop the whole thing,
> > > >> rather than trying to pretend that it's still actively being taken care
> > > >> of.
> > > > 
> > > > https://lore.kernel.org/all/20230223172403.GW10580@xxxxxxx/ last time
> > > > the question of keeping the driver was asked (2023). Back then I was
> > > > able to find the cards on second hand market but now I can't on a local
> > > > market and there's exactly one hit on global eBay.
> > > > 
> > > > Local linux related or telco support forums seem to mention the driver
> > > > until 2011 (root.cz, abclinuxu.cz, t-mobile.cz). It does not prove
> > > > nobody is using it but I think the chances are quite low to justify
> > > > keeping the driver.  It is simple enough to be built as an external
> > > > module eventually, I can help with that in case somebody really needs
> > > > that.
> > > 
> > > So, would you want to submit the removal? Or anyone else, if you don't 
> > > want to lose time with this? (I can do that, if noone wants to.)
> > 
> > Let me do it after rc1 so I can finish the journey of this driver which
> > was my first nontrivial contribution to linux kernel.
> 
> I found a memory leak in the driver:
> 
> - https://lore.kernel.org/linux-serial/20260306034058.386747-1-dqfext@xxxxxxxxx/T/
> 
> The bug has been present since the first version of this driver, but it
> seems no one has noticed it until now. So I believe the driver has not
> been actively used.

A small memory leak like that will probably not be noticed at all, so I
don't think that shows how many people are using the driver, sorry.

greg k-h