Re: [PATCH] tty: Serialize saved termios access with device registration

[Chengfeng Ye]

Hi Johan,

On Wed, Sep 30, 2026 at 5:20 PM Johan Hovold <johan@xxxxxxxxxx> wrote:
>
> On Sun, Sep 27, 2026 at 02:41:54AM +0800, Chengfeng Ye wrote:
> > tty_register_device_attr() frees saved termios data when reusing a minor
> > number without serializing with tty_init_termios() or tty_save_termios().
> > The tty_mutex held by the open and close paths does not protect against
> > this registration-side free.
> >
> > For example, an n_gsm mux reconfiguration can register a device while its
> > previous tty is being released. tty_save_termios() loads the saved pointer,
> > registration clears the array entry and frees the object, and
> > tty_save_termios() then writes through its stale pointer.
>
> Thanks for reporting this. The intention here was that the TTY drivers
> would not be reusing a minor number while it is still in use, but that
> is clearly not adhered to everywhere.
>
> > The saved-termios
> > copy in tty_init_termios() is vulnerable to the same lifetime race.
>
> How could this happen? TTY drivers should hang up their ports during
> deregistration so this shouldn't be an issue unless we have a driver bug
> (which we do in n_gsm apparently).

Right, I did not reproduce or otherwise establish a valid interleaving
involving tty_init_termios(), and the KASAN report only demonstrates
the use-after-free in tty_save_termios(). That statement came from an
LLM-generated draft, sorry for the confusion.

> > KASAN reported:
> >
> >   BUG: KASAN: slab-use-after-free in tty_save_termios+0x39a/0x3d0
> >   Write of size 44 at addr ffff8881012e8180 by task poc/114
> >
> >   Call Trace:
> >    tty_save_termios+0x39a/0x3d0
> >    release_tty+0xb3/0x7a0
> >    tty_release_struct+0xa0/0xd0
> >    tty_release+0xc1b/0x11b0
> >    __fput+0x2f8/0x9e0
> >    fput_close_sync+0xe2/0x190
> >    __x64_sys_close+0x78/0xd0
> >
> >   Allocated by task 110:
> >    tty_save_termios+0x2c1/0x3d0
> >    release_tty+0xb3/0x7a0
> >    tty_release_struct+0xa0/0xd0
> >    tty_release+0xc1b/0x11b0
> >
> >   Freed by task 113:
> >    kfree+0x131/0x3c0
> >    tty_register_device_attr+0x498/0x8b0
> >    gsm_activate_mux+0xfb/0x210
> >    gsmld_ioctl+0x92f/0x14d0
> >    tty_ioctl+0x915/0x1240
> >    __x64_sys_ioctl+0x134/0x1c0
> >
> > Serialize the saved-termios copies and reset with a private mutex. Taking
> > tty_mutex during registration would invert existing driver lock ordering:
> > UART registration holds port->mutex, while tty_find_polling_driver() holds
> > tty_mutex when calling uart_poll_init(), which takes port->mutex. Keep the
> > new lock confined to the saved-termios operations, with no driver callbacks
> > inside the critical sections.
>
> I'm a bit torn about this, but I think we should avoid adding another
> mutex in favouring of making the saved termios reset opt-in.
>
> Clearing the saved termios state on device registration doesn't make
> much sense if a minor number may still be in use as an open TTY would
> prevent the termios from being reset.
>
> I've just posted a patch for this here:
>
>         https://lore.kernel.org/r/20260930091938.1715754-1-johan@xxxxxxxxxx
>
> Johan

Thank you for preparing the fix. Making the saved-termios reset opt-in
is a much cleaner way to address the demonstrated issue.

Best regards,
Chengfeng