From: Alan <gno...@lxorguk.ukuu.org.uk>
Date: Tue, 05 Jan 2016 11:51:25 +0000
> commit acf673a3187edf72068ee2f92f4dc47d66baed47 fixed a user triggerable free
> memory scribble but in doing so replaced it with a different one that allows
> the user to control the data and scribble even more.
>
> sixpack_close is called by the tty layer in tty context. The tty context is
> protected by sp_get() and sp_put(). However network layer activity via
> sp_xmit() is not protected this way. We must therefore stop the queue
> otherwise the user gets to dump a buffer mostly of their choice into freed
> kernel pages.
>
> Signed-off-by: Alan Cox <a...@linux.intel.com>
Applied, thanks Alan.
> + /* We must stop the queue to avoid potentially scribbling
> + on the free buffers. The sp->dead_sem is not sufficient
> + to protect us from sp->xbuff access */
Please next time format comments:
/* Like
* this.
*/
Thanks again!
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majord...@vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
