Unverified Commit 212ca308 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11113 mISDN: Fix a use after free in hfcmulti_tx() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/MVJ3YS45DGIQYERVNPX34WUQG2SHDDYA/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAKPV2 
 
Link:https://gitee.com/openeuler/kernel/pulls/11113

 

Reviewed-by: default avatarLiu YongQiang <liuyongqiang13@huawei.com>
Signed-off-by: default avatarZhang Changzhong <zhangchangzhong@huawei.com>
parents 05b69c92 c4a6e84d

drivers/isdn/hardware/mISDN/hfcmulti.c

+4 −3
Original line number Diff line number Diff line
@@ -1945,7 +1945,7 @@ hfcmulti_dtmf(struct hfc_multi *hc) 
static void

hfcmulti_tx(struct hfc_multi *hc, int ch)

{

	int i, ii, temp, len = 0;

	int i, ii, temp, tmp_len, len = 0;

	int Zspace, z1, z2; /* must be int for calculation */

	int Fspace, f1, f2;

	u_char *d;
@@ -2166,14 +2166,15 @@ hfcmulti_tx(struct hfc_multi *hc, int ch) 
		HFC_wait_nodebug(hc);

	}



	tmp_len = (*sp)->len;

	dev_kfree_skb(*sp);

	/* check for next frame */

	if (bch && get_next_bframe(bch)) {

		len = (*sp)->len;

		len = tmp_len;

		goto next_frame;

	}

	if (dch && get_next_dframe(dch)) {

		len = (*sp)->len;

		len = tmp_len;

		goto next_frame;

	}