diff options
| author | Alexander Popov <[email protected]> | 2017-02-28 19:54:40 +0300 |
|---|---|---|
| committer | Greg Kroah-Hartman <[email protected]> | 2017-03-07 18:54:30 +0100 |
| commit | 82f2341c94d270421f383641b7cd670e474db56b (patch) | |
| tree | 4304aaf49524d6c78802117591bf8d5c5ef0fde2 /lib/test-string_helpers.c | |
| parent | c1ae3cfa0e89fa1a7ecc4c99031f5e9ae99d9201 (diff) | |
tty: n_hdlc: get rid of racy n_hdlc.tbuf
Currently N_HDLC line discipline uses a self-made singly linked list for
data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after
an error.
The commit be10eb7589337e5defbe214dae038a53dd21add8
("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf.
After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put
one data buffer to tx_free_buf_list twice. That causes double free in
n_hdlc_release().
Let's use standard kernel linked list and get rid of n_hdlc.tbuf:
in case of tx error put current data buffer after the head of tx_buf_list.
Signed-off-by: Alexander Popov <[email protected]>
Cc: stable <[email protected]>
Signed-off-by: Greg Kroah-Hartman <[email protected]>
Diffstat (limited to 'lib/test-string_helpers.c')
0 files changed, 0 insertions, 0 deletions