linux-kernel - [PATCH] usb: serial: usb_wwan: Fix data races by protecting dtr/rts state with a mutex

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <20250626153156.50131-1-abinashsinghlalotra@gmail.com>
Date: Thu, 26 Jun 2025 21:01:56 +0530
From: Abinash Singh <abinashlalotra@...il.com>
To: oneukum@...e.com
Cc: abinashlalotra@...il.com,
	abinashsinghlalotra@...il.com,
	gregkh@...uxfoundation.org,
	johan@...nel.org,
	linux-kernel@...r.kernel.org,
	linux-usb@...r.kernel.org
Subject: [PATCH] usb: serial: usb_wwan: Fix data races by protecting dtr/rts state with a mutex

Fix two previously noted locking-related issues in usb_wwan by introducing
a mutex to serialize access to the shared `rts_state` and `dtr_state`
fields in `struct usb_wwan_port_private`.

- In `usb_wwan_dtr_rts()`, the fields are now updated under the new
  `portdata->lock` to prevent concurrent access.
- In `usb_wwan_tiocmset()`, the same lock is used to protect both updates
  to the modem control lines and the subsequent `usb_wwan_send_setup()`
  call.

The mutex is initialized during `usb_wwan_port_probe()` when the port
private data is allocated. This ensures consistent state and avoids
data races when multiple threads attempt to modify control line state.

This change resolves the two old `FIXME` comments and improves thread
safety for modem control signal handling.

Signed-off-by: Abinash Singh <abinashsinghlalotra@...il.com>
---
Thank You very much for your feedback .
You don't have to say sorry , your feedback
is valueable for me.


v2 :
	initialized the mutex during probing
	droping lock after returning from usb_wwan_send_setup()

Regards
Abinash
---
 drivers/usb/serial/usb-wwan.h |  1 +
 drivers/usb/serial/usb_wwan.c | 12 ++++++++----
 2 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/drivers/usb/serial/usb-wwan.h b/drivers/usb/serial/usb-wwan.h
index 519101945769..e8d042d9014f 100644
--- a/drivers/usb/serial/usb-wwan.h
+++ b/drivers/usb/serial/usb-wwan.h
@@ -59,6 +59,7 @@ struct usb_wwan_port_private {
 	int ri_state;
 
 	unsigned long tx_start_time[N_OUT_URB];
+	struct mutex lock;
 };
 
 #endif /* __LINUX_USB_USB_WWAN */
diff --git a/drivers/usb/serial/usb_wwan.c b/drivers/usb/serial/usb_wwan.c
index 0017f6e969e1..cd80fbd1dc6f 100644
--- a/drivers/usb/serial/usb_wwan.c
+++ b/drivers/usb/serial/usb_wwan.c
@@ -80,11 +80,12 @@ void usb_wwan_dtr_rts(struct usb_serial_port *port, int on)
 		return;
 
 	portdata = usb_get_serial_port_data(port);
-	/* FIXME: locking */
+	mutex_lock(&portdata->lock);
 	portdata->rts_state = on;
 	portdata->dtr_state = on;
 
 	usb_wwan_send_setup(port);
+	mutex_unlock(&portdata->lock);
 }
 EXPORT_SYMBOL(usb_wwan_dtr_rts);
 
@@ -113,6 +114,7 @@ int usb_wwan_tiocmset(struct tty_struct *tty,
 	struct usb_serial_port *port = tty->driver_data;
 	struct usb_wwan_port_private *portdata;
 	struct usb_wwan_intf_private *intfdata;
+	int ret;
 
 	portdata = usb_get_serial_port_data(port);
 	intfdata = usb_get_serial_data(port->serial);
@@ -120,7 +122,7 @@ int usb_wwan_tiocmset(struct tty_struct *tty,
 	if (!intfdata->use_send_setup)
 		return -EINVAL;
 
-	/* FIXME: what locks portdata fields ? */
+	mutex_lock(&portdata->lock);
 	if (set & TIOCM_RTS)
 		portdata->rts_state = 1;
 	if (set & TIOCM_DTR)
@@ -130,7 +132,9 @@ int usb_wwan_tiocmset(struct tty_struct *tty,
 		portdata->rts_state = 0;
 	if (clear & TIOCM_DTR)
 		portdata->dtr_state = 0;
-	return usb_wwan_send_setup(port);
+	ret = usb_wwan_send_setup(port);
+	mutex_unlock(&portdata->lock);
+	return ret;
 }
 EXPORT_SYMBOL(usb_wwan_tiocmset);
 
@@ -452,7 +456,7 @@ int usb_wwan_port_probe(struct usb_serial_port *port)
 	portdata = kzalloc(sizeof(*portdata), GFP_KERNEL);
 	if (!portdata)
 		return -ENOMEM;
-
+	mutex_init(&portdata->lock);
 	init_usb_anchor(&portdata->delayed);
 
 	for (i = 0; i < N_IN_URB; i++) {
-- 
2.43.0