mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 08:08:54 +00:00
02388bf87f
In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is fetched twice from userspace. The first fetch is used to peek at the protocol of the message and reset the huptimer if necessary; while the second fetch copies in the whole buffer. However, given that buf resides in userspace memory, a user process can race to change its memory content across fetches. By doing so, we can either avoid resetting the huptimer for any type of packets (by first setting proto to PPP_LCP and later change to the actual type) or force resetting the huptimer for LCP packets. This patch changes this double-fetch behavior into two single fetches decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0). A more detailed discussion can be found at https://marc.info/?l=linux-kernel&m=150586376926123&w=2 Signed-off-by: Meng Xu <mengxu.gatech@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| isdn_audio.c | ||
| isdn_audio.h | ||
| isdn_bsdcomp.c | ||
| isdn_common.c | ||
| isdn_common.h | ||
| isdn_concap.c | ||
| isdn_concap.h | ||
| isdn_net.c | ||
| isdn_net.h | ||
| isdn_ppp.c | ||
| isdn_ppp.h | ||
| isdn_tty.c | ||
| isdn_tty.h | ||
| isdn_ttyfax.c | ||
| isdn_ttyfax.h | ||
| isdn_v110.c | ||
| isdn_v110.h | ||
| isdn_x25iface.c | ||
| isdn_x25iface.h | ||
| isdnhdlc.c | ||
| Kconfig | ||
| Makefile | ||