FGCOM/dahdi-linux
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dahdi_dynamic_loc: Change and check the dyn->pvt pointer under lock.

Browse Source 
Fixes a crash on unload if the sync_tick callback was running at the same time
the dynamic local span was destroyed. It was possible for
dahdi_dynamic_local_transmit to dereference a pointer that may have already
been freed.

Signed-off-by: Shaun Ruffell <sruffell@digium.com>

Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10627

git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/branches/2.6@10632 a0bf4364-ded3-4de4-8d8a-66a801d63aff
This commit is contained in:
Shaun Ruffell
2012-04-03 20:10:20 +00:00
parent 89ea0430df
commit 0ecf2c67c8
1 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/dahdi/dahdi_dynamic_loc.c
View File

@@ -78,10 +78,11 @@ static LIST_HEAD(dynamic_local_list);
static void
dahdi_dynamic_local_transmit(struct dahdi_dynamic *dyn, u8 *msg, size_t msglen)
{
struct dahdi_dynamic_local *const d = dyn->pvt;
struct dahdi_dynamic_local *d;
unsigned long flags;
spin_lock_irqsave(&local_lock, flags);
d = dyn->pvt;
if (d && d->peer && d->peer->span) {
if (test_bit(DAHDI_FLAGBIT_REGISTERED, &d->peer->span->flags))
dahdi_dynamic_receive(d->peer->span, msg, msglen);
@@ -130,11 +131,12 @@ static int digit2int(char d)
static void dahdi_dynamic_local_destroy(struct dahdi_dynamic *dyn)
{
struct dahdi_dynamic_local *d = dyn->pvt;
struct dahdi_dynamic_local *d;
unsigned long flags;
struct dahdi_dynamic_local *cur;
spin_lock_irqsave(&local_lock, flags);
d = dyn->pvt;
list_for_each_entry(cur, &dynamic_local_list, node) {
if (cur->peer == d)
cur->peer = NULL;