tty: n_gsm: fix resource allocation order in gsm_activate_mux()

[ Upstream commit 9662669e9a62e533a4ab1aaa4e1a5b93252665e9 ]

Within gsm_activate_mux() all timers and locks are initiated before the
actual resource for the control channel is allocated. This can lead to race
conditions.

Allocate the control channel DLCI object first to avoid race conditions.

Fixes: 99551fa31543 ("tty: n_gsm line discipline")
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220701122332.2039-2-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 23fcb34240accceffe857442d7f39c56ab7b3625..b5ce10b0656f48b9ae52f51c273826a03b3ca256 100644 (file)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2435,6 +2435,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        struct gsm_dlci *dlci;
        int ret;
 
+       dlci = gsm_dlci_alloc(gsm, 0);
+       if (dlci == NULL)
+               return -ENOMEM;
+
        timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
        timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
        init_waitqueue_head(&gsm->event);
@@ -2450,9 +2454,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        if (ret)
                return ret;
 
-       dlci = gsm_dlci_alloc(gsm, 0);
-       if (dlci == NULL)
-               return -ENOMEM;
        gsm->has_devices = true;
        gsm->dead = false;              /* Tty opens are now permissible */
        return 0;