From 07a8ef6ac4dc7574568ec70f5655f466a013153d Mon Sep 17 00:00:00 2001 From: Karsten Keil Date: Tue, 27 Jun 2006 13:24:07 +0000 Subject: [PATCH] fix a double free/access after free problem. Thanks to James Harper for tracking down. --- drivers/isdn/hardware/mISDN/avm_fritz.c | 3 ++- drivers/isdn/hardware/mISDN/isar.c | 3 ++- 2 files changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/isdn/hardware/mISDN/avm_fritz.c b/drivers/isdn/hardware/mISDN/avm_fritz.c index fb4a620..e0c9f22 100644 --- a/drivers/isdn/hardware/mISDN/avm_fritz.c +++ b/drivers/isdn/hardware/mISDN/avm_fritz.c @@ -804,7 +804,8 @@ hdlc_down(mISDNinstance_t *inst, struct sk_buff *skb) spin_unlock_irqrestore(inst->hwlock, flags); skb_trim(skb, 0); if (hh->prim != (PH_CONTROL | REQUEST)) - ret = mISDN_queueup_newhead(inst, 0, hh->prim | CONFIRM, 0, skb); + if (!mISDN_queueup_newhead(inst, 0, hh->prim | CONFIRM, 0, skb)) + return(0); } else { printk(KERN_WARNING "hdlc_down unknown prim(%x)\n", hh->prim); ret = -EINVAL; diff --git a/drivers/isdn/hardware/mISDN/isar.c b/drivers/isdn/hardware/mISDN/isar.c index ba553cd..33af4a5 100644 --- a/drivers/isdn/hardware/mISDN/isar.c +++ b/drivers/isdn/hardware/mISDN/isar.c @@ -1656,7 +1656,8 @@ isar_down(mISDNinstance_t *inst, struct sk_buff *skb) spin_unlock_irqrestore(inst->hwlock, flags); skb_trim(skb, 0); if (hh->prim != (PH_CONTROL | REQUEST)) - ret = mISDN_queueup_newhead(inst, 0, hh->prim | CONFIRM, 0, skb); + if (!mISDN_queueup_newhead(inst, 0, hh->prim | CONFIRM, 0, skb)) + return(0); } else if (hh->prim == (PH_CONTROL | REQUEST)) { int *val; int len;