[dahdi-commits] dahdi/linux.git branch "2.8.y" updated.

[SVN commits to the DAHDI project]

branch "2.8.y" has been updated
       via  d485a6ff21ddf0a7070e675c568c183235e4105b (commit)
      from  c03330ae9dcb0b1fca52d6aa194f740eec3a0719 (commit)

Summary of changes:
 drivers/dahdi/dahdi-sysfs.c |   22 +++++++++++++---------
 1 file changed, 13 insertions(+), 9 deletions(-)


- Log -----------------------------------------------------------------
commit d485a6ff21ddf0a7070e675c568c183235e4105b
Author: Shaun Ruffell <sruffell at digium.com>
Date:   Tue Jan 14 15:13:28 2014 -0600

    dahdi: Do not access invalid memory if invalid local span number is passed to spantype attribute.
    
    This fixes potential kernel panic due to accessing invalid memory if passing
    invalid local span number to 'spantype' attribute via sysfs.
    
    Signed-off-by: Shaun Ruffell <sruffell at digium.com>
    (cherry picked from commit 860eb4ab48edb1277b8ca95ace034b1a2581f98d)

diff --git a/drivers/dahdi/dahdi-sysfs.c b/drivers/dahdi/dahdi-sysfs.c
index 322a496..fea0cc1 100644
--- a/drivers/dahdi/dahdi-sysfs.c
+++ b/drivers/dahdi/dahdi-sysfs.c
@@ -629,7 +629,8 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
 {
 	struct dahdi_device *const ddev = to_ddev(dev);
 	int ret;
-	struct dahdi_span *span;
+	struct dahdi_span *span = NULL;
+	struct dahdi_span *cur;
 	unsigned int local_span_number;
 	char spantype_name[80];
 	enum spantypes spantype;
@@ -645,9 +646,18 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	list_for_each_entry(span, &ddev->spans, device_node) {
-		if (local_spanno(span) == local_span_number)
+	list_for_each_entry(cur, &ddev->spans, device_node) {
+		if (local_spanno(cur) == local_span_number) {
+			span = cur;
 			break;
+		}
+	}
+
+	if (!span || (local_spanno(span) != local_span_number)) {
+		module_printk(KERN_WARNING,
+				"%d is not a valid local span number "
+				"for this device.\n", local_span_number);
+		return -EINVAL;
 	}
 
 	if (test_bit(DAHDI_FLAGBIT_REGISTERED, &span->flags)) {
@@ -656,12 +666,6 @@ dahdi_spantype_store(struct device *dev, struct device_attribute *attr,
 		return -EINVAL;
 	}
 
-	if (local_spanno(span) != local_span_number) {
-		module_printk(KERN_WARNING,
-				"%d is not a valid local span number "
-				"for this device.\n", local_span_number);
-		return -EINVAL;
-	}
 
 	if (!span->ops->set_spantype) {
 		module_printk(KERN_WARNING, "Span %s does not support "

-----------------------------------------------------------------------


-- 
dahdi/linux.git