Alexander Popov 4167230bef tty: n_hdlc: get rid of racy n_hdlc.tbuf ... commit 82f2341c94d270421f383641b7cd670e474db56b upstream. Currently N_HDLC line discipline uses a self-made singly linked list for data buffers and has n_hdlc.tbuf pointer for buffer retransmitting after an error. The commit be10eb7589 ("tty: n_hdlc add buffer flushing") introduced racy access to n_hdlc.tbuf. After tx error concurrent flush_tx_queue() and n_hdlc_send_frames() can put one data buffer to tx_free_buf_list twice. That causes double free in n_hdlc_release(). Let's use standard kernel linked list and get rid of n_hdlc.tbuf: in case of tx error put current data buffer after the head of tx_buf_list. Signed-off-by: Alexander Popov <alex.popov@linux.com> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Signed-off-by: Ben Hutchings <ben@decadent.org.uk>		2017-04-22 23:02:57 +02:00
..
hvc	…
ipwireless	…
serial	This is the 3.10.102 stable release	2017-04-18 17:22:08 +02:00
vt	…
Kconfig	…
Makefile	…
amiserial.c	…
bfin_jtag_comm.c	…
cyclades.c	…
ehv_bytechan.c	…
goldfish.c	…
isicom.c	…
metag_da.c	…
moxa.c	…
moxa.h	…
mxser.c	…
mxser.h	…
n_gsm.c	…
n_hdlc.c	tty: n_hdlc: get rid of racy n_hdlc.tbuf	2017-04-22 23:02:57 +02:00
n_r3964.c	…
n_smux.c	…
n_tracerouter.c	…
n_tracesink.c	…
n_tracesink.h	…
n_tty.c	…
nozomi.c	…
pty.c	…
rocket.c	…
rocket.h	…
rocket_int.h	…
smux_ctl.c	…
smux_debug.c	…
smux_loopback.c	…
smux_loopback.h	…
smux_private.h	…
smux_test.c	…
synclink.c	…
synclink_gt.c	…
synclinkmp.c	…
sysrq.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
tty_audit.c	…
tty_buffer.c	…
tty_io.c	tty: Fix unsafe ldisc reference via ioctl(TIOCGETD)	2016-09-06 12:24:29 -07:00
tty_ioctl.c	…
tty_ldisc.c	BACKPORT: tty: Prevent ldisc drivers from re-using stale tty fields	2016-12-12 00:13:43 -08:00
tty_ldsem.c	Import latest Samsung release	2017-04-18 03:43:52 +02:00
tty_mutex.c	…
tty_port.c	…