Re: [PATCH] USB: serial: keyspan: fix use-after-free in keyspan_close

[Johan Hovold]

On Mon, Aug 31, 2026 at 08:07:01AM +0530, Deepanshu Kartikey wrote:
> keyspan_port_remove() frees the port's private data (p_priv) while
> keyspan_close() may still be running concurrently on another task,
> e.g. triggered by an explicit TIOCVHANGUP ioctl on an already-open
> tty racing with device disconnect. This results in keyspan_close()
> dereferencing freed memory.
> 
> Fix this by adding a mutex to keyspan_serial_private that serializes
> keyspan_close() against keyspan_port_remove(): the latter clears the
> port's private data pointer under the lock before freeing it, and
> the former re-fetches and checks that pointer under the same lock
> before use.
> 
> Reported-by: syzbot+5fabc1ae99ff40690d84@xxxxxxxxxxxxxxxxxxxxxxxxx
> Closes: https://syzkaller.appspot.com/bug?extid=5fabc1ae99ff40690d84

This isn't a driver specific issue. I've just sent a fix for the tty
port implementation here:

	https://lore.kernel.org/r/20260910125114.640880-1-johan@xxxxxxxxxx

Johan