Skip to content

Commit

Permalink
tty: n_gsm: improper skb_pull() use was leaking framed data
Browse files Browse the repository at this point in the history
gsm_dlci_data_output_framed() was doing:
memcpy(dp, skb_pull(dlci->skb, len), len);

The problem is skb_pull() returns the post-increment data ptr
so the first chunk of dlci->skb->data is leaked.

Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  • Loading branch information
Russ Gorby authored and Greg Kroah-Hartman committed Jun 16, 2011
1 parent 7263287 commit 57f2104
Showing 1 changed file with 2 additions and 1 deletion.
3 changes: 2 additions & 1 deletion drivers/tty/n_gsm.c
Original file line number Diff line number Diff line change
Expand Up @@ -875,7 +875,8 @@ static int gsm_dlci_data_output_framed(struct gsm_mux *gsm,
*dp++ = last << 7 | first << 6 | 1; /* EA */
len--;
}
memcpy(dp, skb_pull(dlci->skb, len), len);
memcpy(dp, dlci->skb->data, len);
skb_pull(dlci->skb, len);
__gsm_data_queue(dlci, msg);
if (last)
dlci->skb = NULL;
Expand Down

0 comments on commit 57f2104

Please sign in to comment.