The patch below does not apply to the 4.19-stable tree.
If someone wants it applied there, or to any other stable or longterm
tree, then please email the backport, including the original git commit
id to <stable@xxxxxxxxxxxxxxx>.
Possible dependencies:
4bb1a53be85f ("tty: n_gsm: initialize more members at gsm_alloc_mux()")
734966043860 ("tty: n_gsm: fix resource allocation order in gsm_activate_mux()")
0af021678d5d ("tty: n_gsm: fix deadlock and link starvation in outgoing data path")
bec0224816d1 ("tty: n_gsm: fix non flow control frames during mux flow off")
c568f7086c6e ("tty: n_gsm: fix missing timer to handle stalled links")
556fc8ac0651 ("tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output()")
01aecd917114 ("tty: n_gsm: fix tty registration before control channel open")
925ea0fa5277 ("tty: n_gsm: Fix packet data hex dump output")
f4f7d6328721 ("tty: n_gsm: fix software flow control handling")
c19ffe00fed6 ("tty: n_gsm: fix invalid use of MSC in advanced option")
a8c5b8255f8a ("tty: n_gsm: fix broken virtual tty handling")
48473802506d ("tty: n_gsm: fix missing update of modem controls after DLCI open")
73029a4d7161 ("tty: n_gsm: fix reset fifo race condition")
398867f59f95 ("tty: n_gsm: fix wrong command frame length field encoding")
17eac6520285 ("tty: n_gsm: fix missing explicit ldisc flush")
deefc58bafb4 ("tty: n_gsm: fix wrong DLCI release order")
7a0e4b1733b6 ("tty: n_gsm: fix frame reception handling")
06d5afd4d640 ("tty: n_gsm: fix wrong signal octet encoding in convergence layer type 2")
284260f278b7 ("tty: n_gsm: fix mux cleanup after unregister tty device")
1ec92e974277 ("tty: n_gsm: fix decoupled mux resource")
thanks,
greg k-h
------------------ original commit in Linus's tree ------------------
>From 4bb1a53be85fcb1e24c14860e326a00cdd362c28 Mon Sep 17 00:00:00 2001
From: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Date: Sat, 27 Aug 2022 22:47:19 +0900
Subject: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()
syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.
Since object initialization should be done right after allocation in order
to avoid accessing uninitialized memory, move initialization of
timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
gsm_alloc_mux().
Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
Reported-by: syzbot <syzbot+cf155def4e717db68a12@xxxxxxxxxxxxxxxxxxxxxxxxx>
Tested-by: syzbot <syzbot+cf155def4e717db68a12@xxxxxxxxxxxxxxxxxxxxxxxxx>
Cc: stable <stable@xxxxxxxxxx>
Acked-by: Jiri Slaby <jirislaby@xxxxxxxxxx>
Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@xxxxxxxxxxxxxxxxxxx
Signed-off-by: Greg Kroah-Hartman <gregkh@xxxxxxxxxxxxxxxxxxx>
diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 38688cb16c20..d6598ca3640f 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
if (dlci == NULL)
return -ENOMEM;
- timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
- timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
- INIT_WORK(&gsm->tx_work, gsmld_write_task);
- init_waitqueue_head(&gsm->event);
- spin_lock_init(&gsm->control_lock);
- spin_lock_init(&gsm->tx_lock);
-
if (gsm->encoding == 0)
gsm->receive = gsm0_receive;
else
@@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
kref_init(&gsm->ref);
INIT_LIST_HEAD(&gsm->tx_ctrl_list);
INIT_LIST_HEAD(&gsm->tx_data_list);
+ timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
+ timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+ INIT_WORK(&gsm->tx_work, gsmld_write_task);
+ init_waitqueue_head(&gsm->event);
+ spin_lock_init(&gsm->control_lock);
+ spin_lock_init(&gsm->tx_lock);
gsm->t1 = T1;
gsm->t2 = T2;
@@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty)
gsmld_attach_gsm(tty, gsm);
- timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
- timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
- INIT_WORK(&gsm->tx_work, gsmld_write_task);
-
return 0;
}
