diff options
| author | Alexander Popov <alex.popov@linux.com> | 2017-02-28 19:54:40 +0300 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 11:00:10 +0200 |
| commit | f834058d996291849ff03d690393fbf8e50be60c (patch) | |
| tree | 718f146b95059137d1cb614dbd083a800e734a3e /include/linux/errqueue.h | |
| parent | 319d1aead7a2ef4283868594fb3c63da81f65dda (diff) | |
tty: n_hdlc: get rid of racy n_hdlc.tbuf
commit 82f2341c94d270421f383641b7cd670e474db56b upstream.
Currently N_HDLC line discipline uses a self-made singly linked list for
data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after
an error.
The commit be10eb7589337e5defbe214dae038a53dd21add8
("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf.
After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put
one data buffer to tx_free_buf_list twice. That causes double free in
n_hdlc_release().
Let's use standard kernel linked list and get rid of n_hdlc.tbuf:
in case of tx error put current data buffer after the head of tx_buf_list.
Change-Id: I82071092f122d8c26fe22ce1835812427cc5d282
Signed-off-by: Alexander Popov <alex.popov@linux.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Signed-off-by: Ben Hutchings <ben@decadent.org.uk>
Diffstat (limited to 'include/linux/errqueue.h')
0 files changed, 0 insertions, 0 deletions