Re: [PATCH 5.15] tty: n_gsm: Fix use-after-free in gsm_cleanup_mux

[Sasha Levin <sashal@kernel.org>]

[ Sasha's backport helper bot ]

Hi,

The upstream commit SHA1 provided is correct: 9462f4ca56e7d2430fdb6dcc8498244acbfc4489

WARNING: Author mismatch between patch and upstream commit:
Backport author: <mingli.yu@eng.windriver.com>
Commit author: Longlong Xia <xialonglong@kylinos.cn>


Status in newer kernel trees:
6.12.y | Present (exact SHA1)
6.11.y | Present (different SHA1: 0eec592c6a74)
6.6.y | Present (different SHA1: c29f192e0d44)
6.1.y | Present (different SHA1: bf171b5e86e4)
5.15.y | Not found

Note: The patch differs from the upstream commit:
---
--- -	2024-11-28 06:08:35.250028823 -0500
+++ /tmp/tmp.0bKgeyF8zy	2024-11-28 06:08:35.245548384 -0500
@@ -1,3 +1,5 @@
+commit 9462f4ca56e7d2430fdb6dcc8498244acbfc4489 upstream.
+
 BUG: KASAN: slab-use-after-free in gsm_cleanup_mux+0x77b/0x7b0
 drivers/tty/n_gsm.c:3160 [n_gsm]
 Read of size 8 at addr ffff88815fe99c00 by task poc/3379
@@ -51,20 +53,37 @@
 Suggested-by: Jiri Slaby <jirislaby@kernel.org>
 Link: https://lore.kernel.org/r/20240926130213.531959-1-xialonglong@kylinos.cn
 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
+[Mingli: Backport to fix CVE-2024-50073, no guard macro defined resolution]
+Signed-off-by: Mingli Yu <mingli.yu@windriver.com>
 ---
- drivers/tty/n_gsm.c | 2 ++
- 1 file changed, 2 insertions(+)
+ drivers/tty/n_gsm.c | 4 ++++
+ 1 file changed, 4 insertions(+)
 
 diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
-index 5d37a09849163..252849910588f 100644
+index aae9f73585bd..1becbdf7c470 100644
 --- a/drivers/tty/n_gsm.c
 +++ b/drivers/tty/n_gsm.c
-@@ -3157,6 +3157,8 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
+@@ -2443,6 +2443,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
+ 	int i;
+ 	struct gsm_dlci *dlci;
+ 	struct gsm_msg *txq, *ntxq;
++	unsigned long flags;
+ 
+ 	gsm->dead = true;
+ 	mutex_lock(&gsm->mutex);
+@@ -2471,9 +2472,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
  	mutex_unlock(&gsm->mutex);
  	/* Now wipe the queues */
  	tty_ldisc_flush(gsm->tty);
 +
-+	guard(spinlock_irqsave)(&gsm->tx_lock);
- 	list_for_each_entry_safe(txq, ntxq, &gsm->tx_ctrl_list, list)
++	spin_lock_irqsave(&gsm->tx_lock, flags);
+ 	list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list)
  		kfree(txq);
- 	INIT_LIST_HEAD(&gsm->tx_ctrl_list);
+ 	INIT_LIST_HEAD(&gsm->tx_list);
++	spin_unlock_irqrestore(&gsm->tx_lock, flags);
+ }
+ 
+ /**
+-- 
+2.34.1
+
---

Results of testing on various branches:

| Branch                    | Patch Apply | Build Test |
|---------------------------|-------------|------------|
| stable/linux-5.15.y       |  Success    |  Success   |