Jia-Ju Bai 7418e6520f isdn: hisax: hfc_pci: Fix a possible concurrency use-after-free bug in HFCPCI_l1hw() ... In drivers/isdn/hisax/hfc_pci.c, the functions hfcpci_interrupt() and HFCPCI_l1hw() may be concurrently executed. HFCPCI_l1hw() line 1173: if (!cs->tx_skb) hfcpci_interrupt() line 942: spin_lock_irqsave(); line 1066: dev_kfree_skb_irq(cs->tx_skb); Thus, a possible concurrency use-after-free bug may occur in HFCPCI_l1hw(). To fix these bugs, the calls to spin_lock_irqsave() and spin_unlock_irqrestore() are added in HFCPCI_l1hw(), to protect the access to cs->tx_skb. Signed-off-by: Jia-Ju Bai <baijiaju1990@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net>		2018-12-28 21:27:31 -08:00
..
amd7930_fn.c
amd7930_fn.h
arcofi.c
arcofi.h
asuscom.c
avm_a1.c
avm_a1p.c
avm_pci.c
avma1_cs.c
bkm_a4t.c
bkm_a8.c
bkm_ax.h
callc.c
config.c
diva.c
elsa_cs.c
elsa_ser.c
elsa.c
enternow_pci.c
fsm.c
fsm.h
gazel.c
hfc_2bds0.c
hfc_2bds0.h
hfc_2bs0.c
hfc_2bs0.h
hfc_pci.c
hfc_pci.h
hfc_sx.c
hfc_sx.h
hfc_usb.c
hfc_usb.h
hfc4s8s_l1.c
hfc4s8s_l1.h
hfcscard.c
hisax_cfg.h
hisax_debug.h
hisax_fcpcipnp.c
hisax_fcpcipnp.h
hisax_if.h
hisax_isac.c
hisax_isac.h
hisax.h
hscx_irq.c
hscx.c
hscx.h
icc.c
icc.h
ipac.h
ipacx.c
ipacx.h
isac.c
isac.h
isar.c
isar.h
isdnl1.c
isdnl1.h
isdnl2.c
isdnl2.h
isdnl3.c
isdnl3.h
isurf.c
ix1_micro.c
jade_irq.c
jade.c
jade.h
Kconfig
l3_1tr6.c
l3_1tr6.h
l3dss1.c
l3dss1.h
l3ni1.c
l3ni1.h
lmgr.c
Makefile
mic.c
netjet.c
netjet.h
niccy.c
nj_s.c
nj_u.c
q931.c
s0box.c
saphir.c
sedlbauer_cs.c
sedlbauer.c
sportster.c
st5481_b.c
st5481_d.c
st5481_init.c
st5481_usb.c
st5481.h
tei.c
teleint.c
teles_cs.c
teles3.c
teles0.c
telespci.c
w6692.c
w6692.h