Re: [PATCH] usb: gadget: u_serial: pin ports while TTYs are installed

[Mehmet Fide]

Hi Krystian,

I sent a narrower fix for the same problem [1]. This patch also covers
the two holes Sashiko found in mine, so I will withdraw it.

Tested in QEMU with dummy_hcd on usb-next with KASAN and lockdep, and on
a Colibri VF50 on 7.2-rc1, with delays injected into gs_open() and
gs_close(). Without the patch, freeing the line during a close gives a
use-after-free, and a close after a failed open a NULL deref. With it
there are no reports, also over 40 add/remove cycles against
concurrent opens.

Tested-by: Mehmet Fide <mehmet.fide@xxxxxxxxxxxxxxxxxx>

Two notes:

1. Since Johan's 8df07fe93573 ("tty: fix saved termios reset race"),
   registration no longer frees the saved termios for u_serial, so that
   reason in the commit message is out of date. Publishing the port
   after registration is still right.

2. The NULL checks in gs_open() and gs_close() cannot trigger, since
   gs_install() fails first. The gs_close() one is what Brian Ellis' v4
   [2] adds, and this patch makes that one unnecessary.

[1] https://lore.kernel.org/linux-usb/20261019085855.3259716-1-mehmet.fide@xxxxxxxxx/
[2] https://lore.kernel.org/linux-usb/20261013-u_serial-gs-close-null-v4-1-9ea038501994@xxxxxxxxxxx/

Thanks,
Mehmet