From bd19b79cb1efd0be7a3244557d5cbe647f9d5252 Mon Sep 17 00:00:00 2001 From: Shaun Ruffell Date: Thu, 18 Jun 2009 18:03:26 +0000 Subject: wctdm, wctdm24xxp, wcfxo: Fix calls to dahdi_hooksig. When JAPAN, AUDIO_RINGCHECK, or ZERO_BATT_RING compile time options are selected it is possible to get a kernel panic due to an invalid pointer passed to the dahdi_hooksig function. (closes issue #15350) Patch by: alecdavis git-svn-id: http://svn.asterisk.org/svn/dahdi/linux/trunk@6692 a0bf4364-ded3-4de4-8d8a-66a801d63aff --- drivers/dahdi/wcfxo.c | 4 ++-- drivers/dahdi/wctdm.c | 8 ++++---- drivers/dahdi/wctdm24xxp/base.c | 4 ++-- 3 files changed, 8 insertions(+), 8 deletions(-) diff --git a/drivers/dahdi/wcfxo.c b/drivers/dahdi/wcfxo.c index de956af..7f8a210 100644 --- a/drivers/dahdi/wcfxo.c +++ b/drivers/dahdi/wcfxo.c @@ -488,7 +488,7 @@ DAHDI_IRQ_HANDLER(wcfxo_interrupt) wc->battery = 0; #ifdef JAPAN if ((!wc->ohdebounce) && wc->offhook) { - dahdi_hooksig(&wc->chan, DAHDI_RXSIG_ONHOOK); + dahdi_hooksig(wc->chan, DAHDI_RXSIG_ONHOOK); if (debug) printk(KERN_DEBUG "Signalled On Hook\n"); #ifdef ZERO_BATT_RING @@ -516,7 +516,7 @@ DAHDI_IRQ_HANDLER(wcfxo_interrupt) #ifdef ZERO_BATT_RING if (wc->onhook) { wc->onhook = 0; - dahdi_hooksig(&wc->chan, DAHDI_RXSIG_OFFHOOK); + dahdi_hooksig(wc->chan, DAHDI_RXSIG_OFFHOOK); if (debug) printk(KERN_DEBUG "Signalled Off Hook\n"); } diff --git a/drivers/dahdi/wctdm.c b/drivers/dahdi/wctdm.c index 2859164..d6722a8 100644 --- a/drivers/dahdi/wctdm.c +++ b/drivers/dahdi/wctdm.c @@ -378,14 +378,14 @@ static inline void ring_check(struct wctdm *wc, int card) if (debug) printk(KERN_DEBUG "RING on %d/%d!\n", wc->span.spanno, card + 1); if (!wc->mod[card].fxo.offhook) - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_RING); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_RING); wc->mod[card].fxo.ring = 1; } if (wc->mod[card].fxo.ring && !wc->mod[card].fxo.pegcount) { /* No more ring */ if (debug) printk(KERN_DEBUG "NO RING on %d/%d!\n", wc->span.spanno, card + 1); - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_OFFHOOK); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_OFFHOOK); wc->mod[card].fxo.ring = 0; } } @@ -864,7 +864,7 @@ static inline void wctdm_voicedaa_check_hook(struct wctdm *wc, int card) printk(KERN_DEBUG "NO BATTERY on %d/%d!\n", wc->span.spanno, card + 1); #ifdef JAPAN if (!wc->ohdebounce && wc->offhook) { - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_ONHOOK); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_ONHOOK); if (debug) printk(KERN_DEBUG "Signalled On Hook\n"); #ifdef ZERO_BATT_RING @@ -908,7 +908,7 @@ static inline void wctdm_voicedaa_check_hook(struct wctdm *wc, int card) #ifdef ZERO_BATT_RING if (wc->onhook) { wc->onhook = 0; - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_OFFHOOK); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_OFFHOOK); if (debug) printk(KERN_DEBUG "Signalled Off Hook\n"); } diff --git a/drivers/dahdi/wctdm24xxp/base.c b/drivers/dahdi/wctdm24xxp/base.c index c4d6b12..e4f8bf1 100644 --- a/drivers/dahdi/wctdm24xxp/base.c +++ b/drivers/dahdi/wctdm24xxp/base.c @@ -1426,7 +1426,7 @@ static inline void wctdm_voicedaa_check_hook(struct wctdm *wc, int card) printk(KERN_DEBUG "NO BATTERY on %d/%d!\n", wc->span.spanno, card + 1); #ifdef JAPAN if (!wc->ohdebounce && wc->offhook) { - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_ONHOOK); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_ONHOOK); if (debug) printk(KERN_DEBUG "Signalled On Hook\n"); #ifdef ZERO_BATT_RING @@ -1470,7 +1470,7 @@ static inline void wctdm_voicedaa_check_hook(struct wctdm *wc, int card) #ifdef ZERO_BATT_RING if (wc->onhook) { wc->onhook = 0; - dahdi_hooksig(&wc->chans[card], DAHDI_RXSIG_OFFHOOK); + dahdi_hooksig(wc->chans[card], DAHDI_RXSIG_OFFHOOK); if (debug) printk(KERN_DEBUG "Signalled Off Hook\n"); } -- cgit v1.2.3