summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorOne Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk>2016-01-05 11:51:25 +0000
committerDavid S. Miller <davem@davemloft.net>2016-01-06 01:25:01 -0500
commit60aa3b080a3d2b408af2ca114edb3efc84ad1838 (patch)
tree6150db6b5626e1994ff23db0ac66a255556b83bc
parent55795ef5469290f89f04e12e662ded604909e462 (diff)
downloadlinux-60aa3b080a3d2b408af2ca114edb3efc84ad1838.tar.bz2
6pack: fix free memory scribbles
commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free memory scribble but in doing so replaced it with a different one that allows the user to control the data and scribble even more. sixpack_close is called by the tty layer in tty context. The tty context is protected by sp_get() and sp_put(). However network layer activity via sp_xmit() is not protected this way. We must therefore stop the queue otherwise the user gets to dump a buffer mostly of their choice into freed kernel pages. Signed-off-by: Alan Cox <alan@linux.intel.com> Signed-off-by: David S. Miller <davem@davemloft.net>
-rw-r--r--drivers/net/hamradio/6pack.c6
1 files changed, 6 insertions, 0 deletions
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 9f0b1c342b77..5a1e98547031 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -683,6 +683,12 @@ static void sixpack_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&sp->refcnt))
down(&sp->dead_sem);
+ /* We must stop the queue to avoid potentially scribbling
+ * on the free buffers. The sp->dead_sem is not sufficient
+ * to protect us from sp->xbuff access.
+ */
+ netif_stop_queue(sp->dev);
+
del_timer_sync(&sp->tx_t);
del_timer_sync(&sp->resync_t);