tty: n_gsm: fix resource allocation order in gsm_activate_mux()

Within gsm_activate_mux() all timers and locks are initiated before the
actual resource for the control channel is allocated. This can lead to race
conditions.

Allocate the control channel DLCI object first to avoid race conditions.

Fixes: 99551fa31543 ("tty: n_gsm line discipline")
Signed-off-by: Daniel Starke <daniel.starke@siemens.com>
Link: https://lore.kernel.org/r/20220701122332.2039-2-daniel.starke@siemens.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 79869f2b570c017c46f40a150ce1f3c77e842fc5..ba399a6605732ba5ddb09d9cee853e668776a6ba 100644 (file)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2497,6 +2497,10 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        struct gsm_dlci *dlci;
        int ret;
 
+       dlci = gsm_dlci_alloc(gsm, 0);
+       if (dlci == NULL)
+               return -ENOMEM;
+
        timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
        timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
        INIT_WORK(&gsm->tx_work, gsmld_write_task);
@@ -2513,9 +2517,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        if (ret)
                return ret;
 
-       dlci = gsm_dlci_alloc(gsm, 0);
-       if (dlci == NULL)
-               return -ENOMEM;
        gsm->has_devices = true;
        gsm->dead = false;              /* Tty opens are now permissible */
        return 0;