Commit 288598d8 authored by Shuangpeng Bai's avatar Shuangpeng Bai Committed by Jakub Kicinski
Browse files

serial: caif: hold tty->link reference in ldisc_open and ser_release 

A reproducer triggers a KASAN slab-use-after-free in pty_write_room()
when caif_serial's TX path calls tty_write_room(). The faulting access
is on tty->link->port.

Hold an extra kref on tty->link for the lifetime of the caif_serial line
discipline: get it in ldisc_open() and drop it in ser_release(), and
also drop it on the ldisc_open() error path.

With this change applied, the reproducer no longer triggers the UAF in
my testing.

Link: https://gist.github.com/shuangpengbai/c898debad6bdf170a84be7e6b3d8707f
Link: https://lore.kernel.org/netdev/20260301220525.1546355-1-shuangpeng.kernel@gmail.com


Fixes: e31d5a05 ("caif: tty's are kref objects so take a reference")
Signed-off-by: default avatarShuangpeng Bai <shuangpeng.kernel@gmail.com>
Reviewed-by: default avatarJiayuan Chen <jiayuan.chen@linux.dev>
Link: https://patch.msgid.link/20260306034006.3395740-1-shuangpeng.kernel@gmail.com


Signed-off-by: default avatarJakub Kicinski <kuba@kernel.org>
parent 87d12685

drivers/net/caif/caif_serial.c

+3 −0
Original line number Diff line number Diff line
@@ -297,6 +297,7 @@ static void ser_release(struct work_struct *work) 
			dev_close(ser->dev);

			unregister_netdevice(ser->dev);

			debugfs_deinit(ser);

			tty_kref_put(tty->link);

			tty_kref_put(tty);

		}

		rtnl_unlock();
@@ -331,6 +332,7 @@ static int ldisc_open(struct tty_struct *tty) 


	ser = netdev_priv(dev);

	ser->tty = tty_kref_get(tty);

	tty_kref_get(tty->link);

	ser->dev = dev;

	debugfs_init(ser, tty);

	tty->receive_room = 4096;
@@ -339,6 +341,7 @@ static int ldisc_open(struct tty_struct *tty) 
	rtnl_lock();

	result = register_netdevice(dev);

	if (result) {

		tty_kref_put(tty->link);

		tty_kref_put(tty);

		rtnl_unlock();

		free_netdev(dev);