From a1f0bc9a642394fd4e0667141392350151e962fd Mon Sep 17 00:00:00 2001 From: Shaun Ruffell Date: Tue, 3 Apr 2012 20:10:20 +0000 Subject: dahdi_dynamic_loc: Change and check the dyn->pvt pointer under lock. Fixes a crash on unload if the sync_tick callback was running at the same time the dynamic local span was destroyed. It was possible for dahdi_dynamic_local_transmit to dereference a pointer that may have already been freed. Signed-off-by: Shaun Ruffell Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10627 git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/branches/2.6@10632 a0bf4364-ded3-4de4-8d8a-66a801d63aff --- drivers/dahdi/dahdi_dynamic_loc.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/dahdi/dahdi_dynamic_loc.c b/drivers/dahdi/dahdi_dynamic_loc.c index 98cb7b1..4086bd8 100644 --- a/drivers/dahdi/dahdi_dynamic_loc.c +++ b/drivers/dahdi/dahdi_dynamic_loc.c @@ -78,10 +78,11 @@ static LIST_HEAD(dynamic_local_list); static void dahdi_dynamic_local_transmit(struct dahdi_dynamic *dyn, u8 *msg, size_t msglen) { - struct dahdi_dynamic_local *const d = dyn->pvt; + struct dahdi_dynamic_local *d; unsigned long flags; spin_lock_irqsave(&local_lock, flags); + d = dyn->pvt; if (d && d->peer && d->peer->span) { if (test_bit(DAHDI_FLAGBIT_REGISTERED, &d->peer->span->flags)) dahdi_dynamic_receive(d->peer->span, msg, msglen); @@ -130,11 +131,12 @@ static int digit2int(char d) static void dahdi_dynamic_local_destroy(struct dahdi_dynamic *dyn) { - struct dahdi_dynamic_local *d = dyn->pvt; + struct dahdi_dynamic_local *d; unsigned long flags; struct dahdi_dynamic_local *cur; spin_lock_irqsave(&local_lock, flags); + d = dyn->pvt; list_for_each_entry(cur, &dynamic_local_list, node) { if (cur->peer == d) cur->peer = NULL; -- cgit v1.2.3