Commit 60aa3b08 authored by One Thousand Gnomes's avatar One Thousand Gnomes Committed by David S. Miller

6pack: fix free memory scribbles

commit acf673a3 fixed a user triggerable free
memory scribble but in doing so replaced it with a different one that allows
the user to control the data and scribble even more.

sixpack_close is called by the tty layer in tty context. The tty context is
protected by sp_get() and sp_put(). However network layer activity via
sp_xmit() is not protected this way. We must therefore stop the queue
otherwise the user gets to dump a buffer mostly of their choice into freed
kernel pages.
Signed-off-by: default avatarAlan Cox <alan@linux.intel.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 55795ef5
...@@ -683,6 +683,12 @@ static void sixpack_close(struct tty_struct *tty) ...@@ -683,6 +683,12 @@ static void sixpack_close(struct tty_struct *tty)
if (!atomic_dec_and_test(&sp->refcnt)) if (!atomic_dec_and_test(&sp->refcnt))
down(&sp->dead_sem); down(&sp->dead_sem);
/* We must stop the queue to avoid potentially scribbling
* on the free buffers. The sp->dead_sem is not sufficient
* to protect us from sp->xbuff access.
*/
netif_stop_queue(sp->dev);
del_timer_sync(&sp->tx_t); del_timer_sync(&sp->tx_t);
del_timer_sync(&sp->resync_t); del_timer_sync(&sp->resync_t);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment