tty: n_gsm: initialize more members at gsm_alloc_mux()

syzbot is reporting use of uninitialized spinlock at gsmld_write() [1], for
commit 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
allows accessing gsm->tx_lock before gsm_activate_mux() initializes it.

Since object initialization should be done right after allocation in order
to avoid accessing uninitialized memory, move initialization of
timer/work/waitqueue/spinlock from gsmld_open()/gsm_activate_mux() to
gsm_alloc_mux().

Link: https://syzkaller.appspot.com/bug?extid=cf155def4e717db68a12
Fixes: 32dd59f96924f45e ("tty: n_gsm: fix race condition in gsmld_write()")
Reported-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Tested-by: syzbot <syzbot+cf155def4e717db68a12@syzkaller.appspotmail.com>
Cc: stable <stable@kernel.org>
Acked-by: Jiri Slaby <jirislaby@kernel.org>
Signed-off-by: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
Link: https://lore.kernel.org/r/2110618e-57f0-c1ce-b2ad-b6cacef3f60e@I-love.SAKURA.ne.jp
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index 38688cb16c20bdc5a8d9c71d2b098f55e17bb49e..d6598ca3640f1cb40619770017d4007a927f847f 100644 (file)
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2501,13 +2501,6 @@ static int gsm_activate_mux(struct gsm_mux *gsm)
        if (dlci == NULL)
                return -ENOMEM;
 
-       timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
-       timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
-       INIT_WORK(&gsm->tx_work, gsmld_write_task);
-       init_waitqueue_head(&gsm->event);
-       spin_lock_init(&gsm->control_lock);
-       spin_lock_init(&gsm->tx_lock);
-
        if (gsm->encoding == 0)
                gsm->receive = gsm0_receive;
        else
@@ -2612,6 +2605,12 @@ static struct gsm_mux *gsm_alloc_mux(void)
        kref_init(&gsm->ref);
        INIT_LIST_HEAD(&gsm->tx_ctrl_list);
        INIT_LIST_HEAD(&gsm->tx_data_list);
+       timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
+       timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
+       INIT_WORK(&gsm->tx_work, gsmld_write_task);
+       init_waitqueue_head(&gsm->event);
+       spin_lock_init(&gsm->control_lock);
+       spin_lock_init(&gsm->tx_lock);
 
        gsm->t1 = T1;
        gsm->t2 = T2;
@@ -2947,10 +2946,6 @@ static int gsmld_open(struct tty_struct *tty)
 
        gsmld_attach_gsm(tty, gsm);
 
-       timer_setup(&gsm->kick_timer, gsm_kick_timer, 0);
-       timer_setup(&gsm->t2_timer, gsm_control_retransmit, 0);
-       INIT_WORK(&gsm->tx_work, gsmld_write_task);
-
        return 0;
 }