Commit fde55c45 authored by Alan's avatar Alan Committed by David S. Miller

mkiss: fix scribble on freed memory

commit d79f16c0 fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.

As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 07a5d384
...@@ -797,6 +797,11 @@ static void mkiss_close(struct tty_struct *tty) ...@@ -797,6 +797,11 @@ static void mkiss_close(struct tty_struct *tty)
*/ */
if (!atomic_dec_and_test(&ax->refcnt)) if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem); down(&ax->dead_sem);
/*
* Halt the transmit queue so that a new transmit cannot scribble
* on our buffers
*/
netif_stop_queue(ax->dev);
/* Free all AX25 frame buffers. */ /* Free all AX25 frame buffers. */
kfree(ax->rbuff); kfree(ax->rbuff);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment