Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

NETROM: Fix use of static buffer 

The static variable used by nr_call_to_digi might result in corruption if
multiple threads are trying to usee a node or neighbour via ioctl.  Fixed
by having the caller pass a structure in.  This is safe because nr_add_node
rsp. nr_add_neigh will allocate a permanent structure, if needed.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ralf Baechle 2009-08-17 18:05:32 -07:00 committed by David S. Miller
parent 68eac4602b
commit c6ba973b8f
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
net/netrom/nr_route.c
View File

@ -630,23 +630,23 @@ out:
return dev;
}
static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters)
static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
ax25_address *digipeaters)
{
static ax25_digi ax25_digi;
int i;
if (ndigis == 0)
return NULL;
for (i = 0; i < ndigis; i++) {
ax25_digi.calls[i] = digipeaters[i];
ax25_digi.repeated[i] = 0;
digi->calls[i] = digipeaters[i];
digi->repeated[i] = 0;
}
ax25_digi.ndigi = ndigis;
ax25_digi.lastrepeat = -1;
digi->ndigi = ndigis;
digi->lastrepeat = -1;
return &ax25_digi;
return digi;
}
/*
@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
{
struct nr_route_struct nr_route;
struct net_device *dev;
ax25_digi digi;
int ret;
switch (cmd) {
@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
ret = nr_add_node(&nr_route.callsign,
nr_route.mnemonic,
&nr_route.neighbour,
nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
nr_call_to_digi(&digi, nr_route.ndigis,
nr_route.digipeaters),
dev, nr_route.quality,
nr_route.obs_count);
break;
case NETROM_NEIGH:
ret = nr_add_neigh(&nr_route.callsign,
nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters),
nr_call_to_digi(&digi, nr_route.ndigis,
nr_route.digipeaters),
dev, nr_route.quality);
break;
default: