Re: [BUG] usb: gadget: u_serial: use-after-free of gserial in gs_write()/gs_flush_chars() remote-wakeup path

[Greg Kroah-Hartman]

On Mon, Oct 19, 2026 at 01:34:46PM +1000, Yu Zhang wrote:
> Hi,
> 
> gs_write() and gs_flush_chars() cache
> 
> 	struct gserial *gser = port->port_usb;
> 
> at function entry, before taking port->port_lock. In the
> "if (port->suspended)" branch they drop port_lock and call
> gserial_wakeup_host(gser) on that cached pointer, with no re-check of
> port->port_usb -- unlike the sibling gs_start_tx() path in the very same
> functions, which is guarded by "if (port->port_usb)" after re-acquiring
> the lock.

Great, can you submit a patch for this after testing this on linux-next
to verify it's not already resolved?

thanks,

greg k-h