[PATCH tty] tty: n_gsm: fix use-after-free in gsm_queue vs gsm_cleanup_mux race

[Zhenghang Xiao <kipreyyy@gmail.com>]

gsm_queue() reads gsm->dlci[address] into a local pointer in the
flush_to_ldisc workqueue without any lock. Concurrently,
gsm_cleanup_mux() (triggered by GSMIOC_SETCONF ioctl) frees DLCIs under
gsm->mutex — which the receive path never holds. The cached pointer in
gsm_queue() becomes dangling, and the subsequent dlci->data() call
dereferences freed memory.

Fix this by:
1. Checking gsm->dead at the start of gsmld_receive_buf() to reject
   frame processing after cleanup has begun.
2. Moving tty_ldisc_flush() before the DLCI release loop in
   gsm_cleanup_mux(). tty_ldisc_flush() acquires the tty buffer lock
   (buf->lock), which serializes against any in-flight flush_to_ldisc
   work. After it returns, in-flight receive processing has completed,
   and subsequent calls see gsm->dead and return early.

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
---
 drivers/tty/n_gsm.c | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index c13e050de83b..8322fffbaeba 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3156,12 +3156,18 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
 		gsm_unregister_devices(gsm_tty_driver, gsm->num);
 		gsm->has_devices = false;
 	}
+	/*
+	 * Flush the ldisc before releasing DLCIs. tty_ldisc_flush() waits
+	 * for any in-flight flush_to_ldisc work to complete via buf->lock,
+	 * and the gsm->dead check added to gsmld_receive_buf() rejects any
+	 * future receive processing. This ensures gsm_queue() cannot access
+	 * a DLCI being freed.
+	 */
+	tty_ldisc_flush(gsm->tty);
 	for (i = NUM_DLCI - 1; i >= 0; i--)
 		if (gsm->dlci[i])
 			gsm_dlci_release(gsm->dlci[i]);
 	mutex_unlock(&gsm->mutex);
-	/* Now wipe the queues */
-	tty_ldisc_flush(gsm->tty);
 
 	guard(spinlock_irqsave)(&gsm->tx_lock);
 	list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
@@ -3604,6 +3610,9 @@ static void gsmld_receive_buf(struct tty_struct *tty, const u8 *cp,
 	struct gsm_mux *gsm = tty->disc_data;
 	u8 flags = TTY_NORMAL;
 
+	if (gsm->dead)
+		return;
+
 	if (debug & DBG_DATA)
 		gsm_hex_dump_bytes(__func__, cp, count);
 
-- 
2.50.1 (Apple Git-155)