FGCOM/dahdi-linux
2
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

dahdi: Do not access invalid memory if invalid local span number is passed to spantype attribute.

Browse Source 
This fixes potential kernel panic due to accessing invalid memory if passing
invalid local span number to 'spantype' attribute via sysfs.

Signed-off-by: Shaun Ruffell <sruffell@digium.com>
This commit is contained in:
Shaun Ruffell 2014-01-14 15:13:28 -06:00
parent 47dcc9377c
commit 860eb4ab48
1 changed files with 13 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
drivers/dahdi/dahdi-sysfs.c
View File

@ -629,7 +629,8 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
{ {
struct dahdi_device *const ddev = to_ddev(dev); struct dahdi_device *const ddev = to_ddev(dev);
int ret; int ret;
struct dahdi_span *span; struct dahdi_span *span = NULL;
struct dahdi_span *cur;
unsigned int local_span_number; unsigned int local_span_number;
char spantype_name[80]; char spantype_name[80];
enum spantypes spantype; enum spantypes spantype;
@ -645,9 +646,18 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
return -EINVAL; return -EINVAL;
} }
list_for_each_entry(span, &ddev->spans, device_node) { list_for_each_entry(cur, &ddev->spans, device_node) {
if (local_spanno(span) == local_span_number) if (local_spanno(cur) == local_span_number) {
span = cur;
break; break;
}
}
if (!span || (local_spanno(span) != local_span_number)) {
module_printk(KERN_WARNING,
"%d is not a valid local span number "
"for this device.\n", local_span_number);
return -EINVAL;
} }
if (test_bit(DAHDI_FLAGBIT_REGISTERED, &span->flags)) { if (test_bit(DAHDI_FLAGBIT_REGISTERED, &span->flags)) {
@ -656,12 +666,6 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
return -EINVAL; return -EINVAL;
} }
if (local_spanno(span) != local_span_number) {
module_printk(KERN_WARNING,
"%d is not a valid local span number "
"for this device.\n", local_span_number);
return -EINVAL;
}
if (!span->ops->set_spantype) { if (!span->ops->set_spantype) {
module_printk(KERN_WARNING, "Span %s does not support " module_printk(KERN_WARNING, "Span %s does not support "