From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2074A11703 for ; Mon, 21 Aug 2023 19:55:57 +0000 (UTC) Received: by smtp.kernel.org (Postfix) with ESMTPSA id 9184AC433CA; Mon, 21 Aug 2023 19:55:56 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1692647757; bh=LnkpRnJnWU1sZ5WrsUfhTTyHKxcSnzQCUitT9Ux9z9c=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=tUS8QZReXb8CzOShNFFYR9tUp2gkZvLki5+xPYONMXIcZ/jEigAifOHmZ5CHuwK6O nJ3+Ye+q7oUGhogDIDjEkLkBr8k/Tm3RB8EAafG0ipN+XX6qkXtkJlyQPMFDS8NUl5 OLVeR4U5GM2YT+paBGywJa+C9IndrZZlbjoHX0HE= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, stable , Yi Yang , Qiumiao Zhang Subject: [PATCH 6.1 098/194] tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux Date: Mon, 21 Aug 2023 21:41:17 +0200 Message-ID: <20230821194126.999515826@linuxfoundation.org> X-Mailer: git-send-email 2.41.0 In-Reply-To: <20230821194122.695845670@linuxfoundation.org> References: <20230821194122.695845670@linuxfoundation.org> User-Agent: quilt/0.67 Precedence: bulk X-Mailing-List: patches@lists.linux.dev List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit From: Yi Yang commit 3c4f8333b582487a2d1e02171f1465531cde53e3 upstream. In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF problem is not completely fixed. There is a race condition in gsm_cleanup_mux(), which caused this UAF. The UAF problem is triggered by the following race: task[5046] task[5054] ----------------------- ----------------------- gsm_cleanup_mux(); dlci = gsm->dlci[0]; mutex_lock(&gsm->mutex); gsm_cleanup_mux(); dlci = gsm->dlci[0]; //Didn't take the lock gsm_dlci_release(gsm->dlci[i]); gsm->dlci[i] = NULL; mutex_unlock(&gsm->mutex); mutex_lock(&gsm->mutex); dlci->dead = true; //UAF Fix it by assigning values after mutex_lock(). Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000 Cc: stable Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux") Fixes: aa371e96f05d ("tty: n_gsm: fix restart handling via CLD command") Signed-off-by: Yi Yang Co-developed-by: Qiumiao Zhang Signed-off-by: Qiumiao Zhang Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com Signed-off-by: Greg Kroah-Hartman --- drivers/tty/n_gsm.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) --- a/drivers/tty/n_gsm.c +++ b/drivers/tty/n_gsm.c @@ -2481,12 +2481,13 @@ static void gsm_error(struct gsm_mux *gs static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) { int i; - struct gsm_dlci *dlci = gsm->dlci[0]; + struct gsm_dlci *dlci; struct gsm_msg *txq, *ntxq; gsm->dead = true; mutex_lock(&gsm->mutex); + dlci = gsm->dlci[0]; if (dlci) { if (disc && dlci->state != DLCI_CLOSED) { gsm_dlci_begin_close(dlci);