diff options
| author | Jiri Slaby <jslaby@suse.cz> | 2010-10-10 21:50:44 +0000 |
|---|---|---|
| committer | David S. Miller <davem@davemloft.net> | 2010-10-11 11:05:41 -0700 |
| commit | f1ee89d5b007620353fb7dec1d34db4baa1a5571 (patch) | |
| tree | 3c56b6fb6c249c736dc2baad852e151f7d06430d /drivers/atm | |
| parent | 03c698c93fc15d976738a853a7ccb6ea26396003 (diff) | |
| download | kernel_goldelico_gta04-f1ee89d5b007620353fb7dec1d34db4baa1a5571.zip kernel_goldelico_gta04-f1ee89d5b007620353fb7dec1d34db4baa1a5571.tar.gz kernel_goldelico_gta04-f1ee89d5b007620353fb7dec1d34db4baa1a5571.tar.bz2 | |
ATM: solos-pci, remove use after free
Stanse found we do in console_show:
kfree_skb(skb);
return skb->len;
which is not good. Fix that by remembering the len and use it in the
function instead.
Signed-off-by: Jiri Slaby <jslaby@suse.cz>
Cc: Chas Williams <chas@cmf.nrl.navy.mil>
Acked-by: Eric Dumazet <eric.dumazet@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
Diffstat (limited to 'drivers/atm')
| -rw-r--r-- | drivers/atm/solos-pci.c | 8 |
1 files changed, 5 insertions, 3 deletions
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c index f916ddf..f46138a 100644 --- a/drivers/atm/solos-pci.c +++ b/drivers/atm/solos-pci.c @@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr, struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev); struct solos_card *card = atmdev->dev_data; struct sk_buff *skb; + unsigned int len; spin_lock(&card->cli_queue_lock); skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]); @@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr, if(skb == NULL) return sprintf(buf, "No data.\n"); - memcpy(buf, skb->data, skb->len); - dev_dbg(&card->dev->dev, "len: %d\n", skb->len); + len = skb->len; + memcpy(buf, skb->data, len); + dev_dbg(&card->dev->dev, "len: %d\n", len); kfree_skb(skb); - return skb->len; + return len; } static int send_command(struct solos_card *card, int dev, const char *buf, size_t size) |