]> git.baikalelectronics.ru Git - kernel.git/commit
tty: n_gsm: initialize more members at gsm_alloc_mux()
authorTetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Sat, 27 Aug 2022 13:47:19 +0000 (22:47 +0900)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Tue, 30 Aug 2022 12:35:04 +0000 (14:35 +0200)
commitbd3aa2e7b6a2c0270c4c936a0669d9f8010bff5d
treee2d7a9b750c6e4b79b5d46e7b9e7e87c8c2e229d
parentc8e215271e6b9f3274e46276056e78012e436cf2
tty: n_gsm: initialize more members at gsm_alloc_mux()

syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
commit 5326d1492ede5e82 ("tty: n_gsm: fix race condition in gsmld_write()")
allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.

Since object initialization should be done right after allocation in order
to avoid accessing uninitialized memory, move initialization of
timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
gsm_alloc_mux().

Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
Fixes: 5326d1492ede5e82 ("tty: n_gsm: fix race condition in gsmld_write()")
Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Cc: stable <stable@kernel.org>
Acked-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/n_gsm.c