* [PATCH] mkiss: fix scribble on freed memory
@ 2016-01-06 14:55 Alan
2016-01-06 20:08 ` David Miller
2016-01-06 20:29 ` Sergei Shtylyov
0 siblings, 2 replies; 3+ messages in thread
From: Alan @ 2016-01-06 14:55 UTC (permalink / raw)
To: netdev, davem
commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scribble on free memory but added a new one which allows the user to
scribble even more and user controlled data into freed space.
As with 6pack we need to halt the queue before we free the buffers, because
the transmit logic is not protected by the semaphore.
Signed-off-by: Alan Cox <alan@linux.intel.com>
---
drivers/net/hamradio/mkiss.c | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/drivers/net/hamradio/mkiss.c b/drivers/net/hamradio/mkiss.c
index 0b72b9d..85828f1 100644
--- a/drivers/net/hamradio/mkiss.c
+++ b/drivers/net/hamradio/mkiss.c
@@ -797,6 +797,11 @@ static void mkiss_close(struct tty_struct *tty)
*/
if (!atomic_dec_and_test(&ax->refcnt))
down(&ax->dead_sem);
+ /*
+ * Halt the transmit queue so that a new transmit cannot scribble
+ * on our buffers
+ */
+ netif_stop_queue(ax->dev);
/* Free all AX25 frame buffers. */
kfree(ax->rbuff);
^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] mkiss: fix scribble on freed memory
2016-01-06 14:55 [PATCH] mkiss: fix scribble on freed memory Alan
@ 2016-01-06 20:08 ` David Miller
2016-01-06 20:29 ` Sergei Shtylyov
1 sibling, 0 replies; 3+ messages in thread
From: David Miller @ 2016-01-06 20:08 UTC (permalink / raw)
To: gnomes; +Cc: netdev, davem
From: Alan <gnomes@lxorguk.ukuu.org.uk>
Date: Wed, 06 Jan 2016 14:55:02 +0000
> commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
> scribble on free memory but added a new one which allows the user to
> scribble even more and user controlled data into freed space.
>
> As with 6pack we need to halt the queue before we free the buffers, because
> the transmit logic is not protected by the semaphore.
>
> Signed-off-by: Alan Cox <alan@linux.intel.com>
Applied and queued up for -stable, thanks Alan.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] mkiss: fix scribble on freed memory
2016-01-06 14:55 [PATCH] mkiss: fix scribble on freed memory Alan
2016-01-06 20:08 ` David Miller
@ 2016-01-06 20:29 ` Sergei Shtylyov
1 sibling, 0 replies; 3+ messages in thread
From: Sergei Shtylyov @ 2016-01-06 20:29 UTC (permalink / raw)
To: Alan, netdev, davem
Hello.
On 1/6/2016 5:55 PM, Alan wrote:
> commit d79f16c046086f4fe0d42184a458e187464eb83e fixed a user triggerable
scripts/checkpatch.pl now enforces certain format of the commit citing.
> scribble on free memory but added a new one which allows the user to
> scribble even more and user controlled data into freed space.
>
> As with 6pack we need to halt the queue before we free the buffers, because
> the transmit logic is not protected by the semaphore.
>
> Signed-off-by: Alan Cox <alan@linux.intel.com>
[...]
MBR, Sergei
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2016-01-06 20:29 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-01-06 14:55 [PATCH] mkiss: fix scribble on freed memory Alan
2016-01-06 20:08 ` David Miller
2016-01-06 20:29 ` Sergei Shtylyov
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).