[lvc-project] [PATCH 1/2] tty: n_gsm: avoid reactivation without previous cleanup

[Dmitry Antipov]

Initially reported by syzbot at as memory leak, actual issue is an attempt
to configure DLCI 0 (via 'ioctl(..., GSMIOC_SETCONF_EXT, ...)') more than
once without previous cleanup (likely requested with GSM_FL_RESTART). To
prevent such a scenario, including racy attempts to do it from multiple
threads, adjust 'gsm_activate_mux()' to grab GSM mux's mutex and throw
-EBUSY if DLCI 0 was configured already.

Reported-by: syzbot+b5d1f455d385b2c7da3c at syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
---
 drivers/tty/n_gsm.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index c13e050de83b..ce447477ccf3 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -3186,6 +3186,11 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
 	struct gsm_dlci *dlci;
 	int ret;
 
+	guard(mutex)(&gsm->mutex);
+
+	if (unlikely(gsm->dlci[0]))
+		return -EBUSY;
+
 	dlci = gsm_dlci_alloc(gsm, 0);
 	if (dlci == NULL)
 		return -ENOMEM;
-- 
2.55.0