korg/linux
0
0
Fork 0
mirror of https://mirrors.bfsu.edu.cn/git/linux.git synced 2024-11-28 22:54:05 +08:00
Code Issues Packages Projects Releases Wiki Activity

s390/3270: fix use after free of tty3270_screen structure

Browse Source 
The deactivation and freeing of the tty view of the 3270 device
can race with a tty3270_update invocation via the update timer.
To fix this move the del_timer_sync call for the update timer from
tty3270_free_view to tty3270_free prior to the tty3270_free_screen
call.

Signed-off-by: Martin Schwidefsky <schwidefsky@de.ibm.com>
This commit is contained in:
Martin Schwidefsky 2013-12-04 14:29:11 +01:00
parent c63badebfe
commit 03439e7d0a
1 changed files with 2 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/s390/char/tty3270.c
View File

@ -125,10 +125,7 @@ static void tty3270_resize_work(struct work_struct *work);
*/ */
static void tty3270_set_timer(struct tty3270 *tp, int expires) static void tty3270_set_timer(struct tty3270 *tp, int expires)
{ {
if (expires == 0) mod_timer(&tp->timer, jiffies + expires);
del_timer(&tp->timer);
else
mod_timer(&tp->timer, jiffies + expires);
} }
/* /*
@ -744,7 +741,6 @@ tty3270_free_view(struct tty3270 *tp)
{ {
int pages; int pages;
del_timer_sync(&tp->timer);
kbd_free(tp->kbd); kbd_free(tp->kbd);
raw3270_request_free(tp->kreset); raw3270_request_free(tp->kreset);
raw3270_request_free(tp->read); raw3270_request_free(tp->read);
@ -877,6 +873,7 @@ tty3270_free(struct raw3270_view *view)
{ {
struct tty3270 *tp = container_of(view, struct tty3270, view); struct tty3270 *tp = container_of(view, struct tty3270, view);
del_timer_sync(&tp->timer);
tty3270_free_screen(tp->screen, tp->view.rows); tty3270_free_screen(tp->screen, tp->view.rows);
tty3270_free_view(tp); tty3270_free_view(tp);
} }