[PATCH] serial core: fix use-after-free after driver module unload

[PATCH] serial core: fix use-after-free after driver module unload

[Johan Hovold]

Deregistering a uart driver frees the driver uart state including the
tty ports themselves.

Take a reference to the uart driver module at install() so that the
uart state and resources like the tty driver name do not go away while a
tty is still open.

This specifically avoids use-after-free when accessing the tty port and
crashes when accessing the tty driver name (e.g. in the tty printk
macros) when a tty is closed after its driver module has been unloaded.

It also makes sure that the uart state is still valid when waking up any
waiters after releasing the final uart port reference in
uart_port_deref().

Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Johan Hovold <johan@kernel.org>
---

I hit this when investigating a deregistration race that can lead to a
deadlock:

	https://lore.kernel.org/lkml/avSAyV6QE0Id3rAk@hovoldconsulting.com/

Johan


 drivers/tty/serial/serial_core.c | 18 +++++++++++++++++-
 1 file changed, 17 insertions(+), 1 deletion(-)

diff --git a/drivers/tty/serial/serial_core.c b/drivers/tty/serial/serial_core.c
index 2e53d194ecfe..289f767cc068 100644
--- a/drivers/tty/serial/serial_core.c
+++ b/drivers/tty/serial/serial_core.c
@@ -1930,10 +1930,25 @@ static int uart_install(struct tty_driver *driver, struct tty_struct *tty)
 {
 	struct uart_driver *drv = driver->driver_state;
 	struct uart_state *state = drv->state + tty->index;
+	int ret;
+
+	if (!try_module_get(drv->owner))
+		return -ENODEV;
 
 	tty->driver_data = state;
 
-	return tty_standard_install(driver, tty);
+	ret = tty_standard_install(driver, tty);
+	if (ret)
+		module_put(drv->owner);
+
+	return ret;
+}
+
+static void uart_cleanup(struct tty_struct *tty)
+{
+	struct uart_driver *drv = tty->driver->driver_state;
+
+	module_put(drv->owner);
 }
 
 /*
@@ -2733,6 +2748,7 @@ static void uart_poll_put_char(struct tty_driver *driver, int line, char ch)
 
 static const struct tty_operations uart_ops = {
 	.install	= uart_install,
+	.cleanup	= uart_cleanup,
 	.open		= uart_open,
 	.close		= uart_close,
 	.write		= uart_write,
-- 
2.56.1

Re: [PATCH] serial core: fix use-after-free after driver module unload

[Johan Hovold]

On Thu, Nov 12, 2026 at 11:05:41AM +0100, Johan Hovold wrote:
> Deregistering a uart driver frees the driver uart state including the
> tty ports themselves.

I apparently forgot the colon after "serial" in Subject. Perhaps it can
be added when the patch is applied.

Johan