Unverified Commit f7cda317 authored by openeuler-ci-bot's avatar openeuler-ci-bot Committed by Gitee
Browse files

!11092 mISDN: Fix a use after free in hfcmulti_tx() 

Merge Pull Request from: @ci-robot 
 
PR sync from: Zhang Changzhong <zhangchangzhong@huawei.com>
https://mailweb.openeuler.org/hyperkitty/list/kernel@openeuler.org/message/NYJYB5C6RACK4WSFYPP6TEBBXTB4EKUP/ 
 
https://gitee.com/src-openeuler/kernel/issues/IAKPV2 
 
Link:https://gitee.com/openeuler/kernel/pulls/11092

 

Reviewed-by: default avatarYang Yingliang <yangyingliang@huawei.com>
Signed-off-by: default avatarYang Yingliang <yangyingliang@huawei.com>
parents b17777fc 2c90fd7a

drivers/isdn/hardware/mISDN/hfcmulti.c

+4 −3
Original line number Diff line number Diff line
@@ -1931,7 +1931,7 @@ hfcmulti_dtmf(struct hfc_multi *hc) 
static void

hfcmulti_tx(struct hfc_multi *hc, int ch)

{

	int i, ii, temp, len = 0;

	int i, ii, temp, tmp_len, len = 0;

	int Zspace, z1, z2; /* must be int for calculation */

	int Fspace, f1, f2;

	u_char *d;
@@ -2152,14 +2152,15 @@ hfcmulti_tx(struct hfc_multi *hc, int ch) 
		HFC_wait_nodebug(hc);

	}



	tmp_len = (*sp)->len;

	dev_kfree_skb(*sp);

	/* check for next frame */

	if (bch && get_next_bframe(bch)) {

		len = (*sp)->len;

		len = tmp_len;

		goto next_frame;

	}

	if (dch && get_next_dframe(dch)) {

		len = (*sp)->len;

		len = tmp_len;

		goto next_frame;

	}