From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from r3-17.sinamail.sina.com.cn (r3-17.sinamail.sina.com.cn [202.108.3.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 6CA942F39BE for ; Tue, 17 Feb 2026 00:00:03 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=202.108.3.17 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771286408; cv=none; b=Y6feVusgbAibjQNJEoFW53eJTxJg6rjULiv45tugxDpRFbo1c9/67G+Tq15E5tTpD6VPQZYkFobkj7syei6fSvj3AlF8DB2Y1lk1wLlwivYIXZ4hMTQcqfgjyr80WFPPDwq290B+vbsNfAxLt3tAmTPrTHxVt3AJNPknqhAD+bw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1771286408; c=relaxed/simple; bh=ZPScBGlH+YhvzeHK/qDaYZPWySLexkj6mj+sQx6QuZM=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=uQLeNKQjavukEtDfq04vJ2mXvb5dToI+KGE3OLBKK2KOhzgYpUYHSye8ff8zpGukFg1AIWn78NhEgEoO69I9QfxEWn6PHEDXbvGXB6WqeDvML+mgeTTyl7DFzx59J2rLx5eS/ggXOHkezvtd7b7hNL8OzrPYWFXWO+x7mDcm3YY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com; spf=pass smtp.mailfrom=sina.com; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b=GT1Z+tEf; arc=none smtp.client-ip=202.108.3.17 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=sina.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=sina.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=sina.com header.i=@sina.com header.b="GT1Z+tEf" DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=sina.com; s=201208; t=1771286404; bh=mOAMk3ZHywajhbdBeCXYW3iBJGag5uKMzd/2eHh/unI=; h=From:Subject:Date:Message-ID; b=GT1Z+tEfYnWOeEKCUth5DW1YBB6i289AO9MLJoZpq94vRE58dX1p0bGci8jRj7Gii icRP4sBh7texkwsfhaw77ttPOaN7DFJ572msjcvQAM4O7ET22x6hsfZtIOUllpOo1p ZxbZJ/nHiXkaooXM24IVlfP/yzsIUnY7zemZbfBU= X-SMAIL-HELO: localhost.localdomain Received: from unknown (HELO localhost.localdomain)([114.249.62.144]) by sina.com (10.54.253.34) with ESMTP id 6993AF7900001FBB; Mon, 17 Feb 2026 07:59:55 +0800 (CST) X-Sender: hdanton@sina.com X-Auth-ID: hdanton@sina.com Authentication-Results: sina.com; spf=none smtp.mailfrom=hdanton@sina.com; dkim=none header.i=none; dmarc=none action=none header.from=hdanton@sina.com X-SMAIL-MID: 4670536292010 X-SMAIL-UIID: 40A822055A1B42F6AEC58703146F2440-20260217-075955-1 From: Hillf Danton To: Shuangpeng Cc: netdev@vger.kernel.org, edumazet@google.com, linux-kernel@vger.kernel.org, Jiayuan Chen Subject: Re: [PATCH net v2 1/1] serial: caif: fix remaining ser->tty UAF in TX path Date: Tue, 17 Feb 2026 07:59:36 +0800 Message-ID: <20260216235944.3212-1-hdanton@sina.com> In-Reply-To: <20260216002425.3101-1-hdanton@sina.com> References: Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit On Mon, 16 Feb 2026 08:24:23 +0800 Hillf Danton wrote: >On Sun, 15 Feb 2026 14:22:02 -0500 Shuangpeng Bai wrote: >>> On Feb 15, 2026, at 03:55, Hillf Danton wrote: >>> On Sat, 14 Feb 2026 21:51:41 -0500 Shuangpeng Bai wrote: >>>> A reproducer exposes a KASAN use-after-free in caif_serial's TX path >>>> (e.g., via tty_write_room() / tty->ops->write()) on top of commit >>>> <308e7e4d0a84> ("serial: caif: fix use-after-free in caif_serial >>>> ldisc_close()"). >>>> >>>> That commit moved tty_kref_put() to ser_release(). There is still a race >>>> because the TX path may fetch ser->tty and use it while ser_release() >>>> drops the last tty reference: >>>> >>>> CPU 0 (ser_release worker) CPU 1 (xmit) >>>> ------------------------- ------------ >>>> caif_xmit() >>>> handle_tx() >>>> tty = ser->tty >>>> >>>> ser_release() >>>> tty = ser->tty >>>> dev_close(ser->dev) >>>> unregister_netdevice(ser->dev) >>>> debugfs_deinit(ser) >>>> tty_kref_put(tty) // may drop the last ref >>>> <-- race window --> >>>> tty->ops->write(tty, ...) // UAF >>>> >>> What is unclear is -- why is the xmit callback still active after >>> unregister_netdevice(). >> >> In my understanding, no new ndo_start_xmit should begin after >> unregister_netdevice() has completed, but an in-flight TX still needs >> proper synchronization with teardown. >> > Could you shed some light on that sync Eric? Is it missed? > So far I found a syzbot report [1] where ser->dev can not be closed with an active xmit cb. [1] Subject: [syzbot] [net?] BUG: soft lockup in ser_release (4) https://lore.kernel.org/lkml/6758196a.050a0220.a30f1.01c9.GAE@google.com/