ATM: solos-pci, remove use after free

[net-next-2.6.git] / drivers / atm / solos-pci.c

diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 6174965d9a4dfea0455390355ce3fe90c0c8e2d2..f46138ab38b6c310fffc589681f727840a05c646 100644 (file)
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -444,6 +444,7 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
        struct atm_dev *atmdev = container_of(dev, struct atm_dev, class_dev);
        struct solos_card *card = atmdev->dev_data;
        struct sk_buff *skb;
+       unsigned int len;
 
        spin_lock(&card->cli_queue_lock);
        skb = skb_dequeue(&card->cli_queue[SOLOS_CHAN(atmdev)]);
@@ -451,11 +452,12 @@ static ssize_t console_show(struct device *dev, struct device_attribute *attr,
        if(skb == NULL)
                return sprintf(buf, "No data.\n");
 
-       memcpy(buf, skb->data, skb->len);
-       dev_dbg(&card->dev->dev, "len: %d\n", skb->len);
+       len = skb->len;
+       memcpy(buf, skb->data, len);
+       dev_dbg(&card->dev->dev, "len: %d\n", len);
 
        kfree_skb(skb);
-       return skb->len;
+       return len;
 }
 
 static int send_command(struct solos_card *card, int dev, const char *buf, size_t size)
@@ -781,7 +783,8 @@ static struct atm_vcc *find_vcc(struct atm_dev *dev, short vpi, int vci)
        sk_for_each(s, node, head) {
                vcc = atm_sk(s);
                if (vcc->dev == dev && vcc->vci == vci &&
-                   vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE)
+                   vcc->vpi == vpi && vcc->qos.rxtp.traffic_class != ATM_NONE &&
+                   test_bit(ATM_VF_READY, &vcc->flags))
                        goto out;
        }
        vcc = NULL;
@@ -907,6 +910,10 @@ static void pclose(struct atm_vcc *vcc)
        clear_bit(ATM_VF_ADDR, &vcc->flags);
        clear_bit(ATM_VF_READY, &vcc->flags);
 
+       /* Hold up vcc_destroy_socket() (our caller) until solos_bh() in the
+          tasklet has finished processing any incoming packets (and, more to
+          the point, using the vcc pointer). */
+       tasklet_unlock_wait(&card->tlet);
        return;
 }