[lvc-project] Patch "tty: n_gsm: initialize more members at gsm_alloc_mux()" has been added to the 5.10-stable tree

[gregkh at linuxfoundation.org]

This is a note to let you know that I've just added the patch titled

    tty: n_gsm: initialize more members at gsm_alloc_mux()

to the 5.10-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     tty-n_gsm-initialize-more-members-at-gsm_alloc_mux.patch
and it can be found in the queue-5.10 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable at vger.kernel.org> know about it.


>From foo at baz Thu Sep  8 01:52:19 PM CEST 2022
From: Fedor Pchelkin <pchelkin at ispras.ru>
Date: Tue,  6 Sep 2022 21:22:11 +0300
Subject: tty: n_gsm: initialize more members at gsm_alloc_mux()
To: Greg Kroah-Hartman <gregkh at linuxfoundation.org>, stable at vger.kernel.org
Cc: Fedor Pchelkin <pchelkin at ispras.ru>, Alexey Khoroshilov <khoroshilov at ispras.ru>, lvc-project at linuxtesting.org, Jiri Slaby <jirislaby at kernel.org>, Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>, syzbot <syzbot+cf155def4e717db68a12 at syzkaller.appspotmail.com>, stable <stable at kernel.org>
Message-ID: <20220906182212.25261-2-pchelkin at ispras.ru>

From: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>

commit 4bb1a53be85fcb1e24c14860e326a00cdd362c28 upstream.

syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
commit 32dd59f ("tty: n_gsm: fix race condition in gsmld_write()")
allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.

Since object initialization should be done right after allocation in order
to avoid accessing uninitialized memory, move initialization of
timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
gsm_alloc_mux().

Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12 [1]
Fixes: 32dd59f ("tty: n_gsm: fix race condition in gsmld_write()")
Reported-by: syzbot <syzbot+cf155def4e717db68a12 at syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+cf155def4e717db68a12 at syzkaller.appspotmail.com>
Cc: stable <stable at kernel.org>
Acked-by: Jiri Slaby <jirislaby at kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel at I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKURA.ne.jp
Signed-off-by: Fedor Pchelkin <pchelkin at ispras.ru>
Signed-off-by: Greg Kroah-Hartman <gregkh at linuxfoundation.org>
---
 drivers/tty/n_gsm.c |    9 ++++-----
 1 file changed, 4 insertions(+), 5 deletions(-)

--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2200,11 +2200,6 @@ static int gsm_activate_mux(struct gsm_m
 {
 	struct gsm_dlci *dlci;
 
-	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
-	init_waitqueue_head(&gsm->event);
-	spin_lock_init(&gsm->control_lock);
-	spin_lock_init(&gsm->tx_lock);
-
 	if (gsm->encoding == 0)
 		gsm->receive = gsm0_receive;
 	else
@@ -2306,6 +2301,10 @@ static struct gsm_mux *gsm_alloc_mux(voi
 	mutex_init(&gsm->mutex);
 	kref_init(&gsm->ref);
 	INIT_LIST_HEAD(&gsm->tx_list);
+	timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+	init_waitqueue_head(&gsm->event);
+	spin_lock_init(&gsm->control_lock);
+	spin_lock_init(&gsm->tx_lock);
 
 	gsm->t1 = T1;
 	gsm->t2 = T2;


Patches currently in stable-queue which might be from pchelkin at ispras.ru are

queue-5.10/tty-n_gsm-initialize-more-members-at-gsm_alloc_mux.patch
queue-5.10/tty-n_gsm-avoid-call-of-sleeping-functions-from-atomic-context.patch