Commit 3d45296a authored Jan 29, 2016 by WANG Cong Committed by David S. Miller Jan 29, 2016

irda: fix a potential use-after-free in ircomm_param_request



self->ctrl_skb is protected by self->spinlock, we should not
access it out of the lock. Move the debugging printk inside.

Reported-by: Dmitry Vyukov <dvyukov@google.com>
Cc: Samuel Ortiz <samuel@sortiz.org>
Signed-off-by: Cong Wang <xiyou.wangcong@gmail.com>
Signed-off-by: David S. Miller <davem@davemloft.net>

parent ae9d723e

net/irda/ircomm/ircomm_param.c

+1 −2

Original line number	Diff line number	Diff line
		@@ -134,11 +134,10 @@ int ircomm_param_request(struct ircomm_tty_cb *self, __u8 pi, int flush)
		return -1;
		}
		skb_put(skb, count);
		pr_debug("%s(), skb->len=%d\n", __func__, skb->len);

		spin_unlock_irqrestore(&self->spinlock, flags);

		pr_debug("%s(), skb->len=%d\n", __func__ , skb->len);

		if (flush) {
		/* ircomm_tty_do_softint will take care of the rest */
		schedule_work(&self->tqueue);