All of
 help / color / mirror / Atom feed
From: "D. Starke" <>
Cc:, Daniel Starke <>
Subject: [PATCH v2 9/9] tty: n_gsm: fix race condition in gsmld_write()
Date: Thu, 19 May 2022 09:07:57 +0200	[thread overview]
Message-ID: <> (raw)
In-Reply-To: <>

From: Daniel Starke <>

The function may be used by the user directly and also by the n_gsm
internal functions. They can lead into a race condition which results in
interleaved frames if both are writing at the same time. The receiving side
is not able to decode those interleaved frames correctly.

Add a lock around the low side tty write to avoid race conditions and frame
interleaving between user originated writes and n_gsm writes.

Fixes: e1eaea46bb40 ("tty: n_gsm line discipline")
Signed-off-by: Daniel Starke <>
 drivers/tty/n_gsm.c | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

See patch 6 regarding changes since to v1.

diff --git a/drivers/tty/n_gsm.c b/drivers/tty/n_gsm.c
index cc349f5a37fb..640c0f0aa7b1 100644
--- a/drivers/tty/n_gsm.c
+++ b/drivers/tty/n_gsm.c
@@ -2999,11 +2999,24 @@ static ssize_t gsmld_read(struct tty_struct *tty, struct file *file,
 static ssize_t gsmld_write(struct tty_struct *tty, struct file *file,
 			   const unsigned char *buf, size_t nr)
-	int space = tty_write_room(tty);
+	struct gsm_mux *gsm = tty->disc_data;
+	unsigned long flags;
+	int space;
+	int ret;
+	if (!gsm)
+		return -ENODEV;
+	ret = -ENOBUFS;
+	spin_lock_irqsave(&gsm->tx_lock, flags);
+	space = tty_write_room(tty);
 	if (space >= nr)
-		return tty->ops->write(tty, buf, nr);
-	set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
-	return -ENOBUFS;
+		ret = tty->ops->write(tty, buf, nr);
+	else
+		set_bit(TTY_DO_WRITE_WAKEUP, &tty->flags);
+	spin_unlock_irqrestore(&gsm->tx_lock, flags);
+	return ret;

  parent reply	other threads:[~2022-05-19  7:10 UTC|newest]

Thread overview: 11+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2022-05-19  7:07 [PATCH v2 1/9] tty: n_gsm: fix user open not possible at responder until initiator open D. Starke
2022-05-19  7:07 ` [PATCH v2 2/9] tty: n_gsm: fix tty registration before control channel open D. Starke
2022-05-19  7:07 ` [PATCH v2 3/9] tty: n_gsm: fix wrong queuing behavior in gsm_dlci_data_output() D. Starke
2022-05-19  7:07 ` [PATCH v2 4/9] tty: n_gsm: fix missing timer to handle stalled links D. Starke
2022-05-23 11:49   ` Jiri Slaby
2022-05-19  7:07 ` [PATCH v2 5/9] tty: n_gsm: fix non flow control frames during mux flow off D. Starke
2022-05-19  7:07 ` [PATCH v2 6/9] tty: n_gsm: fix deadlock and link starvation in outgoing data path D. Starke
2022-05-19  7:07 ` [PATCH v2 7/9] tty: n_gsm: fix packet re-transmission without open control channel D. Starke
2022-05-19  7:07 ` [PATCH v2 8/9] tty: n_gsm: fix resource allocation order in gsm_activate_mux() D. Starke
2022-05-19  7:07 ` D. Starke [this message]
2022-05-19 16:17 ` [PATCH v2 1/9] tty: n_gsm: fix user open not possible at responder until initiator open Greg KH

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.