Forwarded: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv

[syzbot]

For archival purposes, forwarding an incoming command email to
linux-kernel@xxxxxxxxxxxxxxx, syzkaller-bugs@xxxxxxxxxxxxxxxx.

***

Subject: [PATCH] usb: serial: keyspan: add debug prints to trace NULL p_priv
Author: kartikey406@xxxxxxxxx

#syz test: git://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master



Add pr_info() calls in keyspan_break_ctl() and keyspan_port_remove()
to trace the lifetime of the per-port private data (p_priv) around
port removal. This is a debugging aid to confirm a suspected race
where a port is unbound (freeing p_priv) while a stale tty fd is
still open, leading to a NULL pointer dereference in
keyspan_break_ctl() when break_ctl is issued afterward.

Not for upstream inclusion - debug only.

Link: https://syzkaller.appspot.com/bug?extid=473d7477c523b41d4046
Signed-off-by: Deepanshu Kartikey <kartikey406@xxxxxxxxx>
---
 drivers/usb/serial/keyspan.c | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/drivers/usb/serial/keyspan.c b/drivers/usb/serial/keyspan.c
index 4d3746c7a94e..36626c0cc0a9 100644
--- a/drivers/usb/serial/keyspan.c
+++ b/drivers/usb/serial/keyspan.c
@@ -601,9 +601,9 @@ static int keyspan_break_ctl(struct tty_struct *tty, int break_state)
 {
 	struct usb_serial_port *port = tty->driver_data;
 	struct keyspan_port_private 	*p_priv;
-
 	p_priv = usb_get_serial_port_data(port);
-
+	pr_info("keyspan: break_ctl port=%d p_priv=%px disconnected=%d\n",
+        port->port_number, p_priv, port->serial->disconnected);
 	if (break_state == -1)
 		p_priv->break_on = 1;
 	else
@@ -2975,7 +2975,8 @@ static void keyspan_port_remove(struct usb_serial_port *port)
 	int i;
 
 	p_priv = usb_get_serial_port_data(port);
-
+	pr_info("keyspan: port_remove port=%d freeing p_priv=%px\n",
+        port->port_number, p_priv);
 	usb_kill_urb(p_priv->inack_urb);
 	usb_kill_urb(p_priv->outcont_urb);
 	for (i = 0; i < 2; i++) {
-- 
2.43.0