[dahdi-commits] rmeyerriecks: linux/trunk r10079 - /linux/trunk/drivers/dahdi/wcb4xxp/base.c

[SVN commits to the DAHDI project]

Author: rmeyerriecks
Date: Fri Jul 22 12:56:07 2011
New Revision: 10079

URL: http://svnview.digium.com/svn/dahdi?view=rev&rev=10079
Log:
wcb4xxp: Prevent null pointer dereference on spanconfig

In the rare case where spanconfig is called while there is pending data
on the hdlc channel, the hdlc_getbuf interrupt could try to read from
the hdlc buffer before the channel was fully setup. This could
potentially result in a null pointer dereference. This condition has
existed since the creation of the wcb4xxp driver.

Signed-off-by: Russ Meyerriecks <rmeyerriecks at digium.com>
Signed-off-by: Shaun Ruffell <sruffell at digium.com>

Modified:
    linux/trunk/drivers/dahdi/wcb4xxp/base.c

Modified: linux/trunk/drivers/dahdi/wcb4xxp/base.c
URL: http://svnview.digium.com/svn/dahdi/linux/trunk/drivers/dahdi/wcb4xxp/base.c?view=diff&rev=10079&r1=10078&r2=10079
==============================================================================
--- linux/trunk/drivers/dahdi/wcb4xxp/base.c (original)
+++ linux/trunk/drivers/dahdi/wcb4xxp/base.c Fri Jul 22 12:56:07 2011
@@ -2375,6 +2375,9 @@
 
 		if (alreadyrunning && bspan->sigchan) {
 			hdlc_stop(b4, fifo);
+			atomic_set(&bspan->hdlc_pending, 0);
+			bspan->sigactive = 0;
+			smp_mb();
 			bspan->sigchan = NULL;
 		}