The receive worker walks gsm->dlci[] without gsm->mutex while a concurrent GSMIOC_SETCONF -> gsm_cleanup_mux() frees the DLCIs, so the control handlers can dereference a freed gsm_dlci. v1's NULL check only narrowed the window; this series fixes the use-after-free itself by pinning each DLCI the dispatch dereferences with its existing tty_port reference (dlci_get/put), so the data path stays lock-free.
v3: - Drop the cmpxchg() in gsm_dlci_free(); the pin alone fixes the UAF (Greg). - Keep the addr bounds check at each call site, not in the helper (Daniel). - Correct the Fixes: tag to the refcount commit (Daniel). - Add the AI-assist tag to patch 1 and trim the comments (Daniel). Verification (KASAN, panic_on_warn=1): a reproducer targeting the MSC handler crashes the unpatched kernel and survives 200+ race rounds on this series. The selftest passes on both the clean and patched kernel (pass:3 fail:0 skip:0). Weiming Shi (2): tty: n_gsm: fix use-after-free in gsm_queue() control frame dispatch selftests: tty: add base regression test for n_gsm line discipline drivers/tty/n_gsm.c | 73 +++- tools/testing/selftests/tty/.gitignore | 1 + tools/testing/selftests/tty/Makefile | 2 +- tools/testing/selftests/tty/config | 1 + tools/testing/selftests/tty/tty_n_gsm_test.c | 344 +++++++++++++++++++ 5 files changed, 414 insertions(+), 7 deletions(-) create mode 100644 tools/testing/selftests/tty/tty_n_gsm_test.c -- 2.43.0
