Re: [PATCH] tty: n_gsm: serialize mux configuration

[Greg KH]

On Tue, Nov 10, 2026 at 10:55:38AM +0300, Artem Novikov wrote:
> From: Artem Novikov <naa@xxxxxxxxx>
> 
> Concurrent GSMIOC_SETCONF calls can both decide to restart the same mux.
> gsm_cleanup_mux() releases gsm->mutex before gsm_config() calls
> gsm_activate_mux(), so cleanup and activation from different calls can
> overlap. The activation paths can register the same gsmtty minors, and
> registration rollback can race with another registration or cleanup.
> GSMIOC_SETCONF_EXT can restart the mux through the same paths.
> 
> A 5.10.246-syzkaller report shows a NULL dereference in the unregister
> path:

Unless you have this hardware, and have tested it on that hardware, I
can't take any patches for this code, no matter how horrible you get
syzbot to abuse this driver (also that is a VERY old kernel tree, always
test Linus's latest.)

Please see the archives for why this is the policy here.

thanks,

greg k-h