FGCOM/dahdi-linux
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

wcb4xxp: Prevent null pointer dereference on spanconfig

Browse Source 
In the rare case where spanconfig is called while there is pending data
on the hdlc channel, the hdlc_getbuf interrupt could try to read from
the hdlc buffer before the channel was fully setup. This could
potentially result in a null pointer dereference. This condition has
existed since the creation of the wcb4xxp driver.

Signed-off-by: Russ Meyerriecks <rmeyerriecks@digium.com>
Signed-off-by: Shaun Ruffell <sruffell@digium.com>

Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10079

git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/branches/2.4@10080 a0bf4364-ded3-4de4-8d8a-66a801d63aff
This commit is contained in:
Russ Meyerriecks
2011-07-22 18:03:48 +00:00
committed by Shaun Ruffell
parent 35c833afef
commit 53cbba5c8b
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
drivers/dahdi/wcb4xxp/base.c
View File

@@ -2303,6 +2303,9 @@ static int b4xxp_chanconfig(struct dahdi_chan *chan, int sigtype)
if (alreadyrunning && bspan->sigchan) {
hdlc_stop(b4, fifo);
atomic_set(&bspan->hdlc_pending, 0);
bspan->sigactive = 0;
smp_mb();
bspan->sigchan = NULL;
}