diff options
author | One Thousand Gnomes <gnomes@lxorguk.ukuu.org.uk> | 2016-01-05 11:51:25 +0000 |
---|---|---|
committer | David S. Miller <davem@davemloft.net> | 2016-01-06 01:25:01 -0500 |
commit | 60aa3b080a3d2b408af2ca114edb3efc84ad1838 (patch) | |
tree | 6150db6b5626e1994ff23db0ac66a255556b83bc /arch/arm/net | |
parent | 55795ef5469290f89f04e12e662ded604909e462 (diff) | |
download | linux-60aa3b080a3d2b408af2ca114edb3efc84ad1838.tar.bz2 |
6pack: fix free memory scribbles
commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free
memory scribble but in doing so replaced it with a different one that allows
the user to control the data and scribble even more.
sixpack_close is called by the tty layer in tty context. The tty context is
protected by sp_get() and sp_put(). However network layer activity via
sp_xmit() is not protected this way. We must therefore stop the queue
otherwise the user gets to dump a buffer mostly of their choice into freed
kernel pages.
Signed-off-by: Alan Cox <alan@linux.intel.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'arch/arm/net')
0 files changed, 0 insertions, 0 deletions