Re: [PATCH] tty: n_gsm: initialize more members at gsm_alloc_mux()

[Jiri Slaby]

On 27. 08. 22, 15:47, Tetsuo Handa wrote:
> syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
> commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.
>
> Since object initialization should be done right after allocation in order
> to avoid accessing uninitialized memory, move initialization of
> timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
> gsm_alloc_mux().

LGTM, I wonder why this was not like this forever.

Acked-by: Jiri Slaby <jirislaby@xxxxxxxxxx>

> Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
> Reported-by: syzbot <syzbot+cf155def4e717db68a12@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Signed-off-by: Tetsuo Handa <penguin-kernel@xxxxxxxxxxxxxxxxxxx>
> Tested-by: syzbot <syzbot+cf155def4e717db68a12@xxxxxxxxxxxxxxxxxxxxxxxxx>
> Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
> ---
>   drivers/tty/n_gsm.c | 17 ++++++-----------
>   1 file changed, 6 insertions(+), 11 deletions(-)
>
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index caa5c14ed57f..70cd90474679 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
>   	if (dlci == NULL)
>   		return -ENOMEM;
>   
> -	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> -	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> -	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> -	init_waitqueue_head(&gsm->event);
> -	spin_lock_init(&gsm->control_lock);
> -	spin_lock_init(&gsm->tx_lock);
> -
>   	if (gsm->encoding == 0)
>   		gsm->receive = gsm0_receive;
>   	else
> @@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
>   	kref_init(&gsm->ref);
>   	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
>   	INIT_LIST_HEAD(&gsm->tx_data_list);
> +	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> +	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> +	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> +	init_waitqueue_head(&gsm->event);
> +	spin_lock_init(&gsm->control_lock);
> +	spin_lock_init(&gsm->tx_lock);
>   
>   	gsm->t1 = T1;
>   	gsm->t2 = T2;
> @@ -2946,10 +2945,6 @@ static int gsmld_open(struct tty_struct *tty)
>   
>   	gsmld_attach_gsm(tty, gsm);
>   
> -	timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
> -	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
> -	INIT_WORK(&gsm->tx_work, gsmld_write_task);
> -
>   	return 0;
>   }
>   

--
js
suse labs