mkiss: fix scribble on freed memory
commit d79f16c046
fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.
As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
parent
07a5d38453
commit
fde55c45d2
|
@ -797,6 +797,11 @@ static void mkiss_close(struct tty_struct *tty)
|
|||
*/
|
||||
if (!atomic_dec_and_test(&ax->refcnt))
|
||||
down(&ax->dead_sem);
|
||||
/*
|
||||
* Halt the transmit queue so that a new transmit cannot scribble
|
||||
* on our buffers
|
||||
*/
|
||||
netif_stop_queue(ax->dev);
|
||||
|
||||
/* Free all AX25 frame buffers. */
|
||||
kfree(ax->rbuff);
|
||||
|
|
Loading…
Reference in a new issue