summaryrefslogtreecommitdiff
path: root/drivers
diff options
context:
space:
mode:
authorAlan <gnomes@lxorguk.ukuu.org.uk>2016-01-06 17:55:02 +0300
committerDavid S. Miller <davem@davemloft.net>2016-01-06 23:06:27 +0300
commitfde55c45d2175bd3e33aa28ee31e4ea6efa354e1 (patch)
tree6f6c4b0883f9eeda92c08641a9254c42f1f1c49b /drivers
parent07a5d38453599052aff0877b16bb9c1585f08609 (diff)
downloadlinux-fde55c45d2175bd3e33aa28ee31e4ea6efa354e1.tar.xz
mkiss: fix scribble on freed memory
commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable scribble on free memory but added a new one which allows the user to scribble even more and user controlled data into freed space. As with 6pack we need to halt the queue before we free the buffers, because the transmit logic is not protected by the semaphore. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/hamradio/mkiss.c5
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 0b72b9de5207..85828f153445 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -797,6 +797,11 @@ static void mkiss_close(struct tty_struct *tty)
*/
if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem);
+ /*
+ * Halt the transmit queue so that a new transmit cannot scribble
+ * on our buffers
+ */
+ netif_stop_queue(ax->dev);
/* Free all AX25 frame buffers. */
kfree(ax->rbuff);