Re: [PATCH tty] tty: n_gsm: fix use-after-free in gsm_queue vs gsm_cleanup_mux race

[Greg KH <gregkh@linuxfoundation.org>]

On Tue, May 26, 2026 at 06:29:24PM +0800, Zhenghang Xiao wrote:
> gsm_queue() reads gsm->dlci[address] into a local pointer in the
> flush_to_ldisc workqueue without any lock. Concurrently,
> gsm_cleanup_mux() (triggered by GSMIOC_SETCONF ioctl) frees DLCIs under
> gsm->mutex — which the receive path never holds. The cached pointer in
> gsm_queue() becomes dangling, and the subsequent dlci->data() call
> dereferences freed memory.
> 
> Fix this by:
> 1. Checking gsm->dead at the start of gsmld_receive_buf() to reject
>    frame processing after cleanup has begun.
> 2. Moving tty_ldisc_flush() before the DLCI release loop in
>    gsm_cleanup_mux(). tty_ldisc_flush() acquires the tty buffer lock
>    (buf->lock), which serializes against any in-flight flush_to_ldisc
>    work. After it returns, in-flight receive processing has completed,
>    and subsequent calls see gsm->dead and return early.
> 
> Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
> Signed-off-by: Zhenghang Xiao <kipreyyy@gmail.com>
> ---
>  drivers/tty/n_gsm.c | 13 +++++++++++--
>  1 file changed, 11 insertions(+), 2 deletions(-)

Cool, how did you test this?


> 
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index c13e050de83b..8322fffbaeba 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -3156,12 +3156,18 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
>  		gsm_unregister_devices(gsm_tty_driver, gsm->num);
>  		gsm->has_devices = false;
>  	}
> +	/*
> +	 * Flush the ldisc before releasing DLCIs. tty_ldisc_flush() waits
> +	 * for any in-flight flush_to_ldisc work to complete via buf->lock,
> +	 * and the gsm->dead check added to gsmld_receive_buf() rejects any
> +	 * future receive processing. This ensures gsm_queue() cannot access
> +	 * a DLCI being freed.
> +	 */
> +	tty_ldisc_flush(gsm->tty);
>  	for (i = NUM_DLCI - 1; i >= 0; i--)
>  		if (gsm->dlci[i])
>  			gsm_dlci_release(gsm->dlci[i]);
>  	mutex_unlock(&gsm->mutex);
> -	/* Now wipe the queues */
> -	tty_ldisc_flush(gsm->tty);
>  
>  	guard(spinlock_irqsave)(&gsm->tx_lock);
>  	list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
> @@ -3604,6 +3610,9 @@ static void gsmld_receive_buf(struct tty_struct *tty, const u8 *cp,
>  	struct gsm_mux *gsm = tty->disc_data;
>  	u8 flags = TTY_NORMAL;
>  
> +	if (gsm->dead)
> +		return;
> +

What prevents dead from changing right after you test this?

thanks,

greg k-h