From: Johan Hovold <johan@kernel.org> stable inclusion from stable-v6.6.160 commit 16032c980d8f71642fcdc99309c571df3fcf3328 category: bugfix bugzilla: https://atomgit.com/src-openeuler/kernel/issues/20424 CVE: CVE-2026-98753 Reference: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=... -------------------------------- [ Upstream commit 56964f6a31238fb41d5830bb42520c5b10ff7d8f ] Make sure to restore the TTY_IO_ERROR flag if activation fails to prevent I/O attempts on a port that is gone or powered down. This specifically avoids issues like kernel panic due to unclocked accesses or NULL-pointer dereferences when accessing powered down or deregistered ports when a TTY ioctl races with hangup and open. Note that the flag is set again in tty_port_close() but not restoring it on activation failure leaves a window where drivers fail to handle the ioctl-hangup race. Fixes: a9a37ec33a1b ("tty: tty_port: Move the IO_ERROR clear") Cc: stable <stable@kernel.org> # 2.6.33 Signed-off-by: Johan Hovold <johan@kernel.org> Link: https://patch.msgid.link/20260908084000.218528-1-johan@kernel.org Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> [ sashal: Adapted to existing explicit mutex unlocking instead of automatic cleanup. ] Signed-off-by: Sasha Levin <sashal@kernel.org> Signed-off-by: Gu Bowen <gubowen5@huawei.com> --- drivers/tty/tty_port.c | 1 + 1 file changed, 1 insertion(+) diff --git a/drivers/tty/tty_port.c b/drivers/tty/tty_port.c index 21430e64b412..7ee96882e0e4 100644 --- a/drivers/tty/tty_port.c +++ b/drivers/tty/tty_port.c @@ -781,6 +781,7 @@ int tty_port_open(struct tty_port *port, struct tty_struct *tty, int retval = port->ops->activate(port, tty); if (retval) { + set_bit(TTY_IO_ERROR, &tty->flags); mutex_unlock(&port->mutex); return retval; } -- 2.43.0