lkml.org 
[lkml]   [2022]   [Aug]   [29]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
SubjectRe: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()
From
On 27. 08. 22, 15:47, Tetsuo Handa wrote:
> syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
> commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.
>
> Since object initialization should be done right after allocation in order
> to avoid accessing uninitialized memory, move initialization of
> timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
> gsm_alloc_mux().

LGTM, I wonder why this was not like this forever.

Acked-by: Jiri Slaby <jirislaby@kernel.org>

> Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
> Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
> Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
> Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
> Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> ---
> drivers/tty/n_gsm.c | 17 ++++++-----------
> 1 file changed, 6 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index caa5c14ed57f..70cd90474679 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
> if (dlci == NULL)
> return -ENOMEM;
>
> - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> - INIT_WORK(&gsm->tx_work, gsmld_write_task);
> - init_waitqueue_head(&gsm->event);
> - spin_lock_init(&gsm->control_lock);
> - spin_lock_init(&gsm->tx_lock);
> -
> if (gsm->encoding == 0)
> gsm->receive = gsm0_receive;
> else
> @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
> kref_init(&gsm->ref);
> INIT_LIST_HEAD(&gsm->tx_ctrl_list);
> INIT_LIST_HEAD(&gsm->tx_data_list);
> + timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> + timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> + INIT_WORK(&gsm->tx_work, gsmld_write_task);
> + init_waitqueue_head(&gsm->event);
> + spin_lock_init(&gsm->control_lock);
> + spin_lock_init(&gsm->tx_lock);
>
> gsm->t1 = T1;
> gsm->t2 = T2;
> @@ -2946,10 +2945,6 @@ static int gsmld_open(struct tty_struct *tty)
>
> gsmld_attach_gsm(tty, gsm);
>
> - timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> - timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> - INIT_WORK(&gsm->tx_work, gsmld_write_task);
> -
> return 0;
> }
>

--
js
suse labs

\
 
 \ /
  Last update: 2022-08-29 09:11    [W:0.050 / U:0.256 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site