n_gsm: avoid accessing freed memory during CMD_FCOFF condition
authorRuss Gorby <russ.gorby@intel.com>
Mon, 13 Aug 2012 12:44:59 +0000 (13:44 +0100)
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>
Thu, 16 Aug 2012 19:03:30 +0000 (12:03 -0700)
commitb4338e1efc339986cf6c0a3652906e914a86e2d3
treeb7cad6cedd3a74c6c9f01ed74720999d2a16637e
parent5e44708f75b0f8712da715d6babb0c21089b2317
n_gsm: avoid accessing freed memory during CMD_FCOFF condition

gsm_data_kick was recently modified to allow messages on the
tx queue bound for DLCI0 to flow even during FCOFF conditions.
Unfortunately we introduced a bug discovered by code inspection
where subsequent list traversers can access freed memory if
the DLCI0 messages were not all at the head of the list.

Replaced singly linked tx list w/ a list_head and used
provided interfaces for traversing and deleting members.

Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Cc: Riding School <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
drivers/tty/n_gsm.c