| commit | 57f2104f39995bac332ddc492fbf60aa28e0c35e | |
| author | Russ Gorby <russ.gorby@intel.com> | |
| Tue, 14 Jun 2011 20:23:29 +0000 (14 13:23 -0700) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Thu, 16 Jun 2011 19:00:15 +0000 (16 12:00 -0700) | ||
| tree | ec5cc4b87ae3e3abc2749ec5010ba668231a017e | treesnapshot (tar.gz zip) |
| parent | 7263287af93db4d5cf324a30546f2143419b7900 | commitdiff |
tty: n_gsm: improper skb_pull() use was leaking framed data
gsm_dlci_data_output_framed() was doing:
memcpy(dp, skb_pull(dlci->skb, len), len);
The problem is skb_pull() returns the post-increment data ptr
so the first chunk of dlci->skb->data is leaked.
Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
gsm_dlci_data_output_framed() was doing:
memcpy(dp, skb_pull(dlci->skb, len), len);
The problem is skb_pull() returns the post-increment data ptr
so the first chunk of dlci->skb->data is leaked.
Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| drivers/tty/n_gsm.c | diffblobblamehistory |