Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 57f2104f authored by Russ Gorby's avatar Russ Gorby Committed by Greg Kroah-Hartman
Browse files

tty: n_gsm: improper skb_pull() use was leaking framed data 



gsm_dlci_data_output_framed() was doing:
memcpy(dp, skb_pull(dlci->skb, len), len);

The problem is skb_pull() returns the post-increment data ptr
so the first chunk of dlci->skb->data is leaked.

Signed-off-by: default avatarRuss Gorby <russ.gorby@intel.com>
Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@suse.de>
parent 7263287a

drivers/tty/n_gsm.c

+2 −1
Original line number Original line Diff line number Diff line
@@ -875,7 +875,8 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm, 
		*dp++ = last << 7 | first << 6 | 1;	/* EA */

		*dp++ = last << 7 | first << 6 | 1;	/* EA */

		len--;

		len--;

	}

	}

	memcpy(dp, skb_pull(dlci->skb, len), len);

	memcpy(dp, dlci->skb->data, len);

	skb_pull(dlci->skb, len);

	__gsm_data_queue(dlci, msg);

	__gsm_data_queue(dlci, msg);

	if (last)

	if (last)

		dlci->skb = NULL;

		dlci->skb = NULL;