提交 f1ee89d5 编写于 作者: J Jiri Slaby 提交者: David S. Miller

ATM: solos-pci, remove use after free

Stanse found we do in console_show:
  kfree_skb(skb);
  return skb->len;
which is not good. Fix that by remembering the len and use it in the
function instead.
Signed-off-by: NJiri Slaby <jslaby@suse.cz>
Cc: Chas Williams <chas@cmf.nrl.navy.mil>
Acked-by: NEric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: NDavid S. Miller <davem@davemloft.net>
上级 03c698c9
......@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
struct solos_card *card = atmdev->dev_data;
struct sk_buff *skb;
unsigned int len;
spin_lock(&card->cli_queue_lock);
skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
......@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
if(skb == NULL)
return sprintf(buf, "No data.\n");
memcpy(buf, skb->data, skb->len);
dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
len = skb->len;
memcpy(buf, skb->data, len);
dev_dbg(&card->dev->dev, "len: %d\n", len);
kfree_skb(skb);
return skb->len;
return len;
}
static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册