mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-04 16:15:11 +00:00
7418e6520f
In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and HFCPCI_l1hw() may be concurrently executed. HFCPCI_l1hw() line 1173: if (!cs->tx_skb) hfcpci_interrupt() line 942: spin_lock_irqsave(); line 1066: dev_kfree_skb_irq(cs->tx_skb); Thus, a possible concurrency use-after-free bug may occur in HFCPCI_l1hw(). To fix these bugs, the calls to spin_lock_irqsave() and spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the access to cs->tx_skb. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> |
||
|---|---|---|
| .. | ||
| amd7930_fn.c | ||
| amd7930_fn.h | ||
| arcofi.c | ||
| arcofi.h | ||
| asuscom.c | ||
| avm_a1.c | ||
| avm_a1p.c | ||
| avm_pci.c | ||
| avma1_cs.c | ||
| bkm_a4t.c | ||
| bkm_a8.c | ||
| bkm_ax.h | ||
| callc.c | ||
| config.c | ||
| diva.c | ||
| elsa.c | ||
| elsa_cs.c | ||
| elsa_ser.c | ||
| enternow_pci.c | ||
| fsm.c | ||
| fsm.h | ||
| gazel.c | ||
| hfc4s8s_l1.c | ||
| hfc4s8s_l1.h | ||
| hfc_2bds0.c | ||
| hfc_2bds0.h | ||
| hfc_2bs0.c | ||
| hfc_2bs0.h | ||
| hfc_pci.c | ||
| hfc_pci.h | ||
| hfc_sx.c | ||
| hfc_sx.h | ||
| hfc_usb.c | ||
| hfc_usb.h | ||
| hfcscard.c | ||
| hisax.h | ||
| hisax_cfg.h | ||
| hisax_debug.h | ||
| hisax_fcpcipnp.c | ||
| hisax_fcpcipnp.h | ||
| hisax_if.h | ||
| hisax_isac.c | ||
| hisax_isac.h | ||
| hscx.c | ||
| hscx.h | ||
| hscx_irq.c | ||
| icc.c | ||
| icc.h | ||
| ipac.h | ||
| ipacx.c | ||
| ipacx.h | ||
| isac.c | ||
| isac.h | ||
| isar.c | ||
| isar.h | ||
| isdnl1.c | ||
| isdnl1.h | ||
| isdnl2.c | ||
| isdnl2.h | ||
| isdnl3.c | ||
| isdnl3.h | ||
| isurf.c | ||
| ix1_micro.c | ||
| jade.c | ||
| jade.h | ||
| jade_irq.c | ||
| Kconfig | ||
| l3_1tr6.c | ||
| l3_1tr6.h | ||
| l3dss1.c | ||
| l3dss1.h | ||
| l3ni1.c | ||
| l3ni1.h | ||
| lmgr.c | ||
| Makefile | ||
| mic.c | ||
| netjet.c | ||
| netjet.h | ||
| niccy.c | ||
| nj_s.c | ||
| nj_u.c | ||
| q931.c | ||
| s0box.c | ||
| saphir.c | ||
| sedlbauer.c | ||
| sedlbauer_cs.c | ||
| sportster.c | ||
| st5481.h | ||
| st5481_b.c | ||
| st5481_d.c | ||
| st5481_init.c | ||
| st5481_usb.c | ||
| tei.c | ||
| teleint.c | ||
| teles0.c | ||
| teles3.c | ||
| teles_cs.c | ||
| telespci.c | ||
| w6692.c | ||
| w6692.h | ||