[lvc-project] [PATCH 1/2] tty: n_gsm: avoid reactivation without previous cleanup

[Greg Kroah-Hartman]

On Mon, Jul 06, 2026 at 05:20:15PM +0300, Dmitry Antipov wrote:
> Initially reported by syzbot at as memory leak, actual issue is an attempt
> to configure DLCI 0 (via 'ioctl(..., GSMIOC_SETCONF_EXT, ...)') more than
> once without previous cleanup (likely requested with GSM_FL_RESTART). To
> prevent such a scenario, including racy attempts to do it from multiple
> threads, adjust 'gsm_activate_mux()' to grab GSM mux's mutex and throw
> -EBUSY if DLCI 0 was configured already.
> 
> Reported-by: syzbot+b5d1f455d385b2c7da3c at syzkaller.appspotmail.com

We've had loads of syzbot "issues" reported in this code, and unless it
actually shows up in a real device or operation, I'd just leave it alone
please as there are lots of subtle issues involved in it.

Have you tested this in real hardware?

> Closes: https://syzkaller.appspot.com/bug?extid=b5d1f455d385b2c7da3c
> Signed-off-by: Dmitry Antipov <dmantipov at yandex.ru>
> ---
>  drivers/tty/n_gsm.c | 5 +++++
>  1 file changed, 5 insertions(+)
> 
> diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
> index c13e050de83b..ce447477ccf3 100644
> --- a/drivers/tty/n_gsm.c
> +++ b/drivers/tty/n_gsm.c
> @@ -3186,6 +3186,11 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
>  	struct gsm_dlci *dlci;
>  	int ret;
>  
> +	guard(mutex)(&gsm->mutex);
> +
> +	if (unlikely(gsm->dlci[0]))
> +		return -EBUSY;

Why unlikely()?  Can you measure it with/without that?  If not, it
should never be used.

thanks,

greg k-h