[PATCH 0/2] USB: serial: fix port tear down use-after-free

Johan Hovold posted 2 patches 1 month, 1 week ago
There is a newer version of this series
drivers/usb/serial/usb-serial.c | 19 +++++++++++++++----
1 file changed, 15 insertions(+), 4 deletions(-)
[PATCH 0/2] USB: serial: fix port tear down use-after-free
Posted by Johan Hovold 1 month, 1 week ago
When addressing a port probe ordering issue in digi_acceleport recently
I realised that we have a corresponding general problem during
disconnect, but I didn't have time to address it straight away.

Now syzbot has managed to trigger one of its symptoms and people have
already started submitting incomplete band-aids so here is a proper
fix.

When testing the fix I also noticed that we have an ordering issue when
deregistering drivers that can result in similar use-after-free.

Johan


Johan Hovold (2):
  USB: serial: fix port tear down use-after-free
  USB: serial: fix driver deregistration order

 drivers/usb/serial/usb-serial.c | 19 +++++++++++++++----
 1 file changed, 15 insertions(+), 4 deletions(-)

-- 
2.54.0
Re: [PATCH 0/2] USB: serial: fix port tear down use-after-free
Posted by Greg Kroah-Hartman 1 month, 1 week ago
On Thu, Aug 20, 2026 at 04:54:00PM +0200, Johan Hovold wrote:
> When addressing a port probe ordering issue in digi_acceleport recently
> I realised that we have a corresponding general problem during
> disconnect, but I didn't have time to address it straight away.
> 
> Now syzbot has managed to trigger one of its symptoms and people have
> already started submitting incomplete band-aids so here is a proper
> fix.
> 
> When testing the fix I also noticed that we have an ordering issue when
> deregistering drivers that can result in similar use-after-free.

Nice catch:


Reviewed-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>