Re: [PATCH v3] tty: ldisc: fix deadlock between ldisc_sem and rtnl_mutex

[Zhou, Yun]

On 7/30/2026 10:50 PM, Greg KH wrote:
> On Fri, Jul 24, 2026 at 04:46:48PM +0800, Yun Zhou wrote:
> > syzbot reported a circular lock dependency involving tty ldisc_sem and
> > the networking rtnl_mutex. The full chain is:
> >
> >    rtnl_mutex --> nft_commit_mutex --> ... --> ep->mtx --> ldisc_sem --> rtnl_mutex
> >
> > The last edge (ldisc_sem -> rtnl_mutex) is created because tty line
> > discipline .open() callbacks (slcan, slip) call register_netdev() which
> > acquires rtnl_mutex, and .open() runs under ldisc_sem write lock in
> > tty_set_ldisc().
> >
> > Fix by moving the .open() call outside the ldisc_sem write lock. The
> > ldisc .open() is initialization of the NEW discipline after the old one
> > has been closed - there is no need for ldisc_sem protection at this
> > point since:
> >
> >   - tty_lock is held throughout, preventing concurrent tty_set_ldisc,
> >     hangup, or close
> >   - tty->ldisc is set to NULL during the window. tty_ldisc_ref_wait()
> >     waits for the transition to complete. tty_ldisc_ref() returns NULL
> >     which callers already handle.
> >   - tty buffer data stays queued until the ldisc is installed
> >
> > The sequence becomes:
> >    1. Hold ldisc_sem(write): close old ldisc, set tty->ldisc = NULL
> >    2. Release ldisc_sem(write)
> >    3. Call new_ldisc->ops->open() without ldisc_sem
> >    4. Re-acquire ldisc_sem(write): install new ldisc (or restore old)
> >    5. Release ldisc_sem(write)
> >
> > Reported-by: syzbot+de610eeef174bd59a8a3@xxxxxxxxxxxxxxxxxxxxxxxxx
> > Closes: https://syzkaller.appspot.com/bug?extid=de610eeef174bd59a8a3
> > Signed-off-by: Yun Zhou <yun.zhou@xxxxxxxxxxxxx>
> > ---
>
> Sashiko has some comments:
>          https://sashiko.dev/#/patchset/20260724084648.3879356-1-yun.zhou@xxxxxxxxxxxxx
> are they correct?

I've already responded to Sashiko about the "New issue" - this scenario 
does not exist [1] . I'm not sure why my reply didn't CC you - my bad.

https://sashiko.dev/#/message/3894bbdd-1930-4ad4-8b28-431a162aece0%40windriver.com

As for the pre-existing issue, it's very hard to trigger and practically 
impossible in real-world scenarios. If we really need to fix it, I'll 
send a separate patch series for it later.

BR,
Yun