Re: [PATCH] tty: fix saved termios reset race

[Johan Hovold]

On Wed, Sep 30, 2026 at 11:19:38AM +0200, Johan Hovold wrote:
> Resetting saved termios state on device registration is needed where a
> minor number can be reused for an entirely different device and where
> the old settings may prevent the port from even being opened (e.g. when
> CLOCAL is not set).
> 
> Not all TTY drivers guarantee that the minor number is no longer in use
> when registering devices however, something which can lead to a
> use-after-free when closing a TTY (and saving its termios) races with
> re-registration.
> 
> Add a new TTY_DRIVER_RESET_SAVED_TERMIOS flag to request that any saved
> termios state is reset on registration and only set it for drivers that
> make sure that the minor number is no longer in use.
> 
> Fixes: 93857edd9829 ("tty: reset termios state on device registration")
> Reported-by: Chengfeng Ye <nicoyip.dev@xxxxxxxxx>
> Link: https://lore.kernel.org/20260926184154.3017929-1-nicoyip.dev@xxxxxxxxx
> Cc: stable@xxxxxxxxxxxxxxx	# 4.12
> Signed-off-by: Johan Hovold <johan@xxxxxxxxxx>
> ---
 
>  	if (!(driver->flags & TTY_DRIVER_DYNAMIC_ALLOC)) {
> -		/*
> -		 * Free any saved termios data so that the termios state is
> -		 * reset when reusing a minor number.
> -		 */
> -		tp = driver->termios[index];
> -		if (tp) {
> -			driver->termios[index] = NULL;
> -			kfree(tp);
> +		if (driver->flags && TTY_DRIVER_RESET_SAVED_TERMIOS) {

This was of course meant to be a bitwise & as Sashiko noted.

I'll wait a bit before sending a v2.

Johan