Unverified Commit f1fdfcca authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!3562 tty: n_gsm: fix the UAF caused by race condition in gsm_cleanup_mux 

Merge Pull Request from: @ci-robot 
 
PR sync from: Yi Yang <yiyang13@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/FCTMB2NEXBM5ONMFT2BVYN2GICY4XB3I/ 
 
https://gitee.com/src-openeuler/kernel/issues/I8QFUO 
 
Link:https://gitee.com/openeuler/kernel/pulls/3562

 

Reviewed-by: default avatarLu Jialin <lujialin4@huawei.com>
Signed-off-by: default avatarJialin Zhang <zhangjialin11@huawei.com>
parents 046b0191 e1591d50

drivers/tty/n_gsm.c

+2 −1
Original line number Diff line number Diff line
@@ -2159,12 +2159,13 @@ static void gsm_error(struct gsm_mux *gsm, 
static void gsm_cleanup_mux(struct gsm_mux *gsm, bool disc)

{

	int i;

	struct gsm_dlci *dlci = gsm->dlci[0];

	struct gsm_dlci *dlci;

	struct gsm_msg *txq, *ntxq;



	gsm->dead = true;

	mutex_lock(&gsm->mutex);



	dlci = gsm->dlci[0];

	if (dlci) {

		if (disc && dlci->state != DLCI_CLOSED) {

			gsm_dlci_begin_close(dlci);