tty: n_gsm: improper skb_pull() use was leaking framed data
gsm_dlci_data_output_framed() was doing: memcpy(dp, skb_pull(dlci->skb, len), len); The problem is skb_pull() returns the post-increment data ptr so the first chunk of dlci->skb->data is leaked. Signed-off-by: Russ Gorby <russ.gorby@intel.com> Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
This commit is contained in:
parent
7263287af9
commit
57f2104f39
1 changed files with 2 additions and 1 deletions
|
@ -875,7 +875,8 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
|
|||
*dp++ = last << 7 | first << 6 | 1; /* EA */
|
||||
len--;
|
||||
}
|
||||
memcpy(dp, skb_pull(dlci->skb, len), len);
|
||||
memcpy(dp, dlci->skb->data, len);
|
||||
skb_pull(dlci->skb, len);
|
||||
__gsm_data_queue(dlci, msg);
|
||||
if (last)
|
||||
dlci->skb = NULL;
|
||||
|
|
Reference in a new issue