[svn-commits] sruffell: linux/trunk r10627 - /linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c

[SVN commits to the Digium repositories]

Author: sruffell
Date: Tue Apr  3 14:44:45 2012
New Revision: 10627

URL: http://svnview.digium.com/svn/dahdi?view=rev&rev=10627
Log:
dahdi_dynamic_loc: Change and check the dyn->pvt pointer under lock.

Fixes a crash on unload if the sync_tick callback was running at the same time
the dynamic local span was destroyed. It was possible for
dahdi_dynamic_local_transmit to dereference a pointer that may have already
been freed.

Signed-off-by: Shaun Ruffell <sruffell at digium.com>

Modified:
    linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c

Modified: linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c
URL: http://svnview.digium.com/svn/dahdi/linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c?view=diff&rev=10627&r1=10626&r2=10627
==============================================================================
--- linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c (original)
+++ linux/trunk/drivers/dahdi/dahdi_dynamic_loc.c Tue Apr  3 14:44:45 2012
@@ -78,10 +78,11 @@
 static void
 dahdi_dynamic_local_transmit(struct dahdi_dynamic *dyn, u8 *msg, size_t msglen)
 {
-	struct dahdi_dynamic_local *const d = dyn->pvt;
+	struct dahdi_dynamic_local *d;
 	unsigned long flags;
 
 	spin_lock_irqsave(&local_lock, flags);
+	d = dyn->pvt;
 	if (d && d->peer && d->peer->span) {
 		if (test_bit(DAHDI_FLAGBIT_REGISTERED, &d->peer->span->flags))
 			dahdi_dynamic_receive(d->peer->span, msg, msglen);
@@ -130,11 +131,12 @@
 
 static void dahdi_dynamic_local_destroy(struct dahdi_dynamic *dyn)
 {
-	struct dahdi_dynamic_local *d = dyn->pvt;
+	struct dahdi_dynamic_local *d;
 	unsigned long flags;
 	struct dahdi_dynamic_local *cur;
 
 	spin_lock_irqsave(&local_lock, flags);
+	d = dyn->pvt;
 	list_for_each_entry(cur, &dynamic_local_list, node) {
 		if (cur->peer == d)
 			cur->peer = NULL;