Re: [PATCH 2/4] tty: n_gsm: Prevent a potential use after free

2018-04-27 Thread Tony Lindgren
Hi, * Dan Carpenter [180426 05:55]: > We're freeing the gsm->dlci[] array elements but leaving the freed > pointers hanging around. > > My concern here is if we use the ioctl to change the config, it triggers > a restart in gsmld_config(). In that case, we would only reset the > first ->dlci[0]

[PATCH 2/4] tty: n_gsm: Prevent a potential use after free

2018-04-25 Thread Dan Carpenter
We're freeing the gsm->dlci[] array elements but leaving the freed pointers hanging around. My concern here is if we use the ioctl to change the config, it triggers a restart in gsmld_config(). In that case, we would only reset the first ->dlci[0] element and not the others so it does look to me