dect
/
linux-2.6
Archived
13
0
Fork 0
Code Releases Activity

NETROM: Fix use of static buffer 

The static variable used by nr_call_to_digi might result in corruption if
multiple threads are trying to usee a node or neighbour via ioctl.  Fixed
by having the caller pass a structure in.  This is safe because nr_add_node
rsp. nr_add_neigh will allocate a permanent structure, if needed.

Signed-off-by: Ralf Baechle <ralf@linux-mips.org>
Signed-off-by: David S. Miller <davem@davemloft.net>
This commit is contained in:
Ralf Baechle 2009-08-17 18:05:32 -07:00 committed by David S. Miller
parent 68eac4602b
commit c6ba973b8f
1 changed files with 12 additions and 9 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
net/netrom/nr_route.c
View File

@ -630,23 +630,23 @@ out:
return dev; return dev;
} }
static ax25_digi *nr_call_to_digi(int ndigis, ax25_address *digipeaters) static ax25_digi *nr_call_to_digi(ax25_digi *digi, int ndigis,
ax25_address *digipeaters)
{ {
static ax25_digi ax25_digi;
int i; int i;
if (ndigis == 0) if (ndigis == 0)
return NULL; return NULL;
for (i = 0; i < ndigis; i++) { for (i = 0; i < ndigis; i++) {
ax25_digi.calls[i] = digipeaters[i]; digi->calls[i] = digipeaters[i];
ax25_digi.repeated[i] = 0; digi->repeated[i] = 0;
} }
ax25_digi.ndigi = ndigis; digi->ndigi = ndigis;
ax25_digi.lastrepeat = -1; digi->lastrepeat = -1;
return &ax25_digi; return digi;
} }
/* /*
@ -656,6 +656,7 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
{ {
struct nr_route_struct nr_route; struct nr_route_struct nr_route;
struct net_device *dev; struct net_device *dev;
ax25_digi digi;
int ret; int ret;
switch (cmd) { switch (cmd) {
@ -673,13 +674,15 @@ int nr_rt_ioctl(unsigned int cmd, void __user *arg)
ret = nr_add_node(&nr_route.callsign, ret = nr_add_node(&nr_route.callsign,
nr_route.mnemonic, nr_route.mnemonic,
&nr_route.neighbour, &nr_route.neighbour,
nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters), nr_call_to_digi(&digi, nr_route.ndigis,
nr_route.digipeaters),
dev, nr_route.quality, dev, nr_route.quality,
nr_route.obs_count); nr_route.obs_count);
break; break;
case NETROM_NEIGH: case NETROM_NEIGH:
ret = nr_add_neigh(&nr_route.callsign, ret = nr_add_neigh(&nr_route.callsign,
nr_call_to_digi(nr_route.ndigis, nr_route.digipeaters), nr_call_to_digi(&digi, nr_route.ndigis,
nr_route.digipeaters),
dev, nr_route.quality); dev, nr_route.quality);
break; break;
default: default: