Yi Yang 2a52344643 tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux ... commit 3c4f8333b5 upstream. In commit 9b9c8195f3 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable <stable@kernel.org> Fixes: 9b9c8195f3 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f0 ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang <yiyang13@huawei.com> Co-developed-by: Qiumiao Zhang <zhangqiumiao1@huawei.com> Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com> Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2023-08-26 14:23:31 +02:00
..
hvc	hvc/xen: prevent concurrent accesses to the shared ring	2023-03-30 12:47:48 +02:00
ipwireless
serdev
serial	tty: serial: fsl_lpuart: reduce RX watermark to 0 on LS1028A	2023-08-26 14:23:29 +02:00
vt	vc_screen: reload load of struct vc_data pointer in vcs_write() to avoid UAF	2023-05-24 17:36:54 +01:00
amiserial.c
ehv_bytechan.c
goldfish.c	tty: drivers/tty/, stop using tty_schedule_flip()	2022-07-29 17:25:31 +02:00
Kconfig
Makefile
mips_ejtag_fdc.c
moxa.c	tty: drivers/tty/, stop using tty_schedule_flip()	2022-07-29 17:25:31 +02:00
moxa.h
mxser.c
n_gsm.c	tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux	2023-08-26 14:23:31 +02:00
n_hdlc.c
n_null.c
n_tty.c	tty: fix hang on tty device with no_room set	2023-08-03 10:22:29 +02:00
nozomi.c
pty.c	tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()	2022-07-29 17:25:32 +02:00
synclink_gt.c
sysrq.c	workqueue: Introduce show_one_worker_pool and show_one_workqueue.	2023-05-11 23:00:35 +09:00
tty_audit.c
tty_baudrate.c
tty_buffer.c	tty: use new tty_insert_flip_string_and_push_buffer() in pty_write()	2022-07-29 17:25:32 +02:00
tty_io.c	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH	2023-05-11 23:00:16 +09:00
tty_ioctl.c	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH	2023-05-11 23:00:16 +09:00
tty_jobctrl.c
tty_ldisc.c
tty_ldsem.c
tty_mutex.c
tty_port.c
tty.h	tty: Prevent writing chars during tcsetattr TCSADRAIN/FLUSH	2023-05-11 23:00:16 +09:00
ttynull.c
vcc.c