Re: [PATCH] tty: n_gsm: keep DLCI 0 object across mux restarts

On Fri, Sep 11, 2026 at 02:58:26PM +0800, henrymei wrote:

From: Aohan Mei <redacted>

gsmtty_install() takes a reference on the object occupying the
gsm->dlci[0] slot, and gsmtty_cleanup() drops a reference on whatever
object occupies the slot at cleanup time. The two are expected to
balance on the same object, but gsm_activate_mux() breaks that: on a
mux restart (GSMIOC_SETCONF with a need_restart change) it
unconditionally allocates a fresh DLCI 0 into the slot, orphaning the
old object which still has install-time references outstanding.

When the last of those old gsmttys is closed, gsmtty_cleanup() then
drops its slot reference on the *new* DLCI 0, driving its base kref
from 1 to 0: gsm_dlci_free() frees it and NULLs the slot while the
mux stays alive (dead == false), and the old object is leaked. The
next gsmtty open passes the dead check and dereferences the NULL slot
in gsmtty_install() (dlci_get(gsm->dlci[0])), crashing the kernel.

Keep the DLCI 0 object in the slot on reactivation when one is still
present: it can only still be there because open gsmttys hold
references on it, and gsm_dlci_free() is the only code that clears the
slot and only runs at kref 0, so the slot identity can no longer
change while install-time references are outstanding. Re-take the base
reference that gsm_cleanup_mux() dropped via gsm_dlci_release(), clear
the dead flag it set, and refresh the per-object config fields exactly
like a fresh gsm_dlci_alloc() would, since the restart may carry a
config change.

This also restores the invariant that dead == false implies
gsm->dlci[0] != NULL, making the NULL dereference structurally
impossible.

Fixes: 6ab8fba7fcb0 ("tty: n_gsm: Added refcount usage to gsm_mux and gsm_dlci structs")
Reported-by: TencentOS Corvus AI <redacted>

As sashiko just told you, this isn't going to work.

ONLY touch this file if you can actually test this code, AND you have a
system that uses it.  Otherwise it's not needed to fix up anything that
a LLM might "find" in this file, see the mailing list archives for the
full details.

thanks,

greg k-h