diff options
| author | Russ Meyerriecks <rmeyerreicks@digium.com> | 2011-07-22 17:56:07 +0000 |
|---|---|---|
| committer | Russ Meyerriecks <rmeyerreicks@digium.com> | 2011-07-22 17:56:07 +0000 |
| commit | b5a349b6d73fc7849b8e49b2c2982ec7965834c0 (patch) | |
| tree | de62df9b7e587b416b81fd30441eec29e708289a /drivers/dahdi/wcb4xxp | |
| parent | 33aa2f24162af859619b545aa6af8e908cf4cb49 (diff) | |
wcb4xxp: Prevent null pointer dereference on spanconfig
In the rare case where spanconfig is called while there is pending data
on the hdlc channel, the hdlc_getbuf interrupt could try to read from
the hdlc buffer before the channel was fully setup. This could
potentially result in a null pointer dereference. This condition has
existed since the creation of the wcb4xxp driver.
Signed-off-by: Russ Meyerriecks <rmeyerriecks@digium.com>
Signed-off-by: Shaun Ruffell <sruffell@digium.com>
git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/trunk@10079 a0bf4364-ded3-4de4-8d8a-66a801d63aff
Diffstat (limited to 'drivers/dahdi/wcb4xxp')
| -rw-r--r-- | drivers/dahdi/wcb4xxp/base.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/drivers/dahdi/wcb4xxp/base.c b/drivers/dahdi/wcb4xxp/base.c index 4842440..b8f7f1d 100644 --- a/drivers/dahdi/wcb4xxp/base.c +++ b/drivers/dahdi/wcb4xxp/base.c @@ -2375,6 +2375,9 @@ b4xxp_chanconfig(struct file *file, struct dahdi_chan *chan, int sigtype) if (alreadyrunning && bspan->sigchan) { hdlc_stop(b4, fifo); + atomic_set(&bspan->hdlc_pending, 0); + bspan->sigactive = 0; + smp_mb(); bspan->sigchan = NULL; } |