From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-dy1-f174.google.com (mail-dy1-f174.google.com [74.125.82.174]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 55123332EC1 for ; Tue, 16 Jun 2026 17:33:05 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=74.125.82.174 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781631187; cv=none; b=Hk/Ng26APedk1SFv9jVEUq8nFBxtMKuratBWGfHXAk69ShkyMX66OZfqrMa6xzUIYhvH88kPi6E8B9gf54+vE0a0/h/DfOxLNWqa7MzpAWam38Ar+1f2fMEM0boKXVmhcVcYA9oQcERdzddp2ZavrQJGlq8NMksQtNZaOvK5OhQ= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1781631187; c=relaxed/simple; bh=+q/g007+aO/UHimxmV0Ih/bgR3YyUAWftdajmVeUjbQ=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Ly5KTb2ujqGbXyBzW1psPrK23bPUvnLtV8fGdvKi3ZcmXQm9JV5ftnEfccl6ktS7eMJDvcWLVwMSs5fwj8agTa/VYREMYO1KtuQ+/2yq7uDTPzoKj08lgGmK4Qlwy3y6AAgW1oMAfzj2duvZ+EUI7pj+eEJif9r7zOeKwaouVcY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=b32hocRz; arc=none smtp.client-ip=74.125.82.174 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="b32hocRz" Received: by mail-dy1-f174.google.com with SMTP id 5a478bee46e88-307d0405e07so7434427eec.1 for ; Tue, 16 Jun 2026 10:33:05 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20251104; t=1781631184; x=1782235984; darn=vger.kernel.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=WMNZjiW8tS8vPiFakgGpgrB0JBuBFIJhbYt8HcOFzdU=; b=b32hocRz04br2LMqils4rylgbLdgemBzQvJslTEqgMdR24JQRsFMVbHJUYSOFq4AKL PmmLla+bEm1kF11VtvNOoqIOId3Pn/f2QjPgo0KyB1wHs3DiweFc+bWy0fZdC2RZmh4i /cVc7p27K07e5oG1Qb9HWX38tQIBYKu8RXnIaopZG0K17mOAXOu0RU8pLkgA5YamxYRz InsNGvirT0Sf93PcHksDHGkx+tPZ2S6d76a/o4GZh8BLxkX3uP3u4ewEGp6TNkffQtLn P6S6YvaY/N+B+/mzS1FzPR26uJ3cxwOjch5V3dJZlxYjghfzwBNQN635yulVAyloLzvs lpKQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20251104; t=1781631184; x=1782235984; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-gg:x-gm-message-state:from:to:cc:subject:date :message-id:reply-to; bh=WMNZjiW8tS8vPiFakgGpgrB0JBuBFIJhbYt8HcOFzdU=; b=fi/26RnxkbIPWkV12Sk5EGQjVgRTwctBDibU9z9yEJnVrHxwBOqeHGD8LdOZY/LKVs 5MFr8B2ZONWkv44vmNmmAP6FQlzoqVo9nACnAIv8lTpeLAd4NLFL11afYxqWJjYKlBXp tOSbw5Bp1mFc5wOC0jGi1uKz9/y88937SrZFu8UtIrbaOY/rcYlr7E/uFwxyxuSJBnNd l21ZPBylaedAIYOuf/cnMc2Ec1wwlb5jV8sX2YURfSKZ3Ekc9clLU8eRfvy2ZAW5lltg LCVGrYlLlJHL4TDbOYdVu7GFLk0owyrGpQiDzsh3IwJujWytgMU62IVJNxuQNUO0auLM 4c3w== X-Forwarded-Encrypted: i=1; AFNElJ9dMiXFOWEdlRmfs9aI5s9jZeM/7cQB9IQdUa10Eo+bpiMQgwAnGUnr8jbVs5oiKG3sZHe6s+10puJYE4U=@vger.kernel.org X-Gm-Message-State: AOJu0Yx22b3lUzxSsPExvQsM/ZC0I4Zz68UBFz83usRbtIml9C9wDrEd qeJcXCAD2Pohdg2ghdV4uK4KZ42+6lCuI32x2eT7STRWTa5NfTTV5y47 X-Gm-Gg: Acq92OHpirbZLGWdtUeJShaA3chDTCkOpETxiM8HoOZga0gsDFd4CM39zuGBrAZAa9g QpljG84iDmLh79QOwi2aI40M2NClwN1aaR3VyDm/yq/sl5S1slzuw/0mkYNjJ9juel0Sjkp6cb4 9GGbNo+l3MXcevNNrSimqpHa6lVGA2rn3i+tTklQZUbM+CjCC1nvjbL3KtJEi+5YFobgGRlGDjL aOnI8S32g65vkH2rY1HPf3n4nPTTI9QxbsZVLIpABL3oIPhNU+H3W3m98IFZkrAaNnLKl7iONFL UanZWtm6xAVA/1dlWaASyIHGm3KufeThHvW3oLO6rqQGATG0wFM14gSfWBEb6sT7zYVrTIwUwg3 lMIH31lfYaLT189A/xkBwxhsU8dpkWAomiswE64Hs5hbXMFym+oq0GueqlOg3m5xiUbufDLGopM F9k46NQhJvKQ+9TkeeZQ6+v7x+QDgB3IKHB3PsLidhAsvBQfpS6YSVQNkJ6SRH0aE9rxaL X-Received: by 2002:a05:7300:4347:b0:304:8364:e95c with SMTP id 5a478bee46e88-30bc9f12a25mr177854eec.15.1781631184354; Tue, 16 Jun 2026 10:33:04 -0700 (PDT) Received: from fx.tailc0aff1.ts.net ([206.206.192.132]) by smtp.gmail.com with ESMTPSA id 5a478bee46e88-30ba6b7f840sm5431554eec.19.2026.06.16.10.33.03 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Tue, 16 Jun 2026 10:33:03 -0700 (PDT) From: Weiming Shi To: Greg Kroah-Hartman , Jiri Slaby , Shuah Khan Cc: "Starke, Daniel" , Xiang Mei , linux-serial@vger.kernel.org, linux-kselftest@vger.kernel.org, linux-kernel@vger.kernel.org, Weiming Shi Subject: [PATCH v2 0/2] tty: n_gsm: fix gsm_queue() UAF and add a base regression test Date: Tue, 16 Jun 2026 10:32:38 -0700 Message-ID: <20260616173240.3665059-1-bestswngs@gmail.com> X-Mailer: git-send-email 2.43.0 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit The receive worker walks gsm->dlci[] without gsm->mutex while a concurrent GSMIOC_SETCONF -> gsm_cleanup_mux() frees the DLCIs, so the control handlers can dereference a freed gsm_dlci. v1's NULL check only narrowed the window; v2 fixes the use-after-free itself. The fix pins each DLCI the dispatch dereferences with its existing tty_port reference (option 2), so the data path stays lock-free. See the patch 1 commit message for details, including why the late destructor uses cmpxchg() so it cannot wipe a re-created mux (Daniel's teardown concern). Changes since v1: - Fix the UAF by reference-pinning instead of a NULL check in the handlers; no gsm->mutex in the data path (Greg, Daniel). - Pin every DLCI the dispatch touches, not just the addressed one: MSC/RLS/PN operate on gsm->dlci[k] named in the payload. - Add a base selftest (patch 2), as Greg asked. Verification (KASAN, panic_on_warn=1): the originally reported splat is the gsm_control_reply() / CMD_TEST path (see the Link in patch 1). A reproducer targeting the MSC handler crashes the unpatched kernel and survives 270 race rounds on v2. The selftest passes on both the clean and patched kernel (pass:3 fail:0 skip:0). Weiming Shi (2): tty: n_gsm: fix use-after-free in gsm_queue() control frame dispatch selftests: tty: add base regression test for n_gsm line discipline drivers/tty/n_gsm.c | 105 +++++- tools/testing/selftests/tty/.gitignore | 1 + tools/testing/selftests/tty/Makefile | 2 +- tools/testing/selftests/tty/config | 1 + tools/testing/selftests/tty/tty_n_gsm_test.c | 344 +++++++++++++++++++ 5 files changed, 443 insertions(+), 10 deletions(-) create mode 100644 tools/testing/selftests/tty/tty_n_gsm_test.c -- 2.43.0