NothingOSS/android_kernel_msm-6.1_nothing_sm7635
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

UPSTREAM: tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux

Browse source 
commit 3c4f8333b582487a2d1e02171f1465531cde53e3 upstream.

In commit 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux"), the UAF
problem is not completely fixed. There is a race condition in
gsm_cleanup_mux(), which caused this UAF.

The UAF problem is triggered by the following race:
task[5046]                     task[5054]
-----------------------        -----------------------
gsm_cleanup_mux();
dlci = gsm->dlci[0];
mutex_lock(&gsm->mutex);
                               gsm_cleanup_mux();
			       dlci = gsm->dlci[0]; //Didn't take the lock
gsm_dlci_release(gsm->dlci[i]);
gsm->dlci[i] = NULL;
mutex_unlock(&gsm->mutex);
                               mutex_lock(&gsm->mutex);
			       dlci->dead = true; //UAF

Fix it by assigning values after mutex_lock().

Bug: 291178675
Link: https://syzkaller.appspot.com/text?tag=CrashReport&x=176188b5a80000
Cc: stable <stable@kernel.org>
Fixes: 9b9c8195f3f0 ("tty: n_gsm: fix UAF in gsm_cleanup_mux")
Fixes: aa371e96f0 ("tty: n_gsm: fix restart handling via CLD command")
Signed-off-by: Yi Yang <yiyang13@huawei.com>
Co-developed-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Signed-off-by: Qiumiao Zhang <zhangqiumiao1@huawei.com>
Link: https://lore.kernel.org/r/20230811031121.153237-1-yiyang13@huawei.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
(cherry picked from commit 31311a9a4b)
Signed-off-by: Lee Jones <joneslee@google.com>
Change-Id: I460a0f21f4121531d7732e09643a451382dfa2da
This commit is contained in:
Yi Yang 2023-08-11 11:11:21 +08:00 • committed by Treehugger Robot
parent 40b46d8656
commit 1e4c6e5048
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/tty/n_gsm.c
View file

@ -2481,12 +2481,13 @@ static void gsm_error(struct gsm_mux *gsm)
static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)
{ {
int i; int i;
struct gsm_dlci *dlci = gsm->dlci[0]; struct gsm_dlci *dlci;
struct gsm_msg *txq, *ntxq; struct gsm_msg *txq, *ntxq;
gsm->dead = true; gsm->dead = true;
mutex_lock(&gsm->mutex); mutex_lock(&gsm->mutex);
dlci = gsm->dlci[0];
if (dlci) { if (dlci) {
if (disc && dlci->state != DLCI_CLOSED) { if (disc && dlci->state != DLCI_CLOSED) {
gsm_dlci_begin_close(dlci); gsm_dlci_begin_close(dlci);