Unverified Commit 5e5fe476 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!13041 tty: n_gsm: Fix use-after-free in gsm_cleanup_mux 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yi Yang <yiyang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/H6SU5QUZ2GF7AJEZH2AWCKSSMJ6TRCSQ/ 
 
https://gitee.com/src-openeuler/kernel/issues/IB0EQM 
 
Link:https://gitee.com/openeuler/kernel/pulls/13041

 

Reviewed-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 111f5b92 72560d72

drivers/tty/n_gsm.c

+4 −0
Original line number Diff line number Diff line
@@ -2043,6 +2043,7 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) 
	int i;

	struct gsm_dlci *dlci;

	struct gsm_msg *txq, *ntxq;

	unsigned long flags;



	gsm->dead = 1;

	mutex_lock(&gsm->mutex);
@@ -2077,9 +2078,12 @@ static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc) 
			gsm_dlci_release(gsm->dlci[i]);

	mutex_unlock(&gsm->mutex);

	/* Now wipe the queues */



	spin_lock_irqsave(&gsm->tx_lock, flags);

	list_for_each_entry_safe(txq, ntxq, &gsm->tx_list, list)

		kfree(txq);

	INIT_LIST_HEAD(&gsm->tx_list);

	spin_unlock_irqrestore(&gsm->tx_lock, flags);

}



/**