[dahdi-commits] sruffell: branch linux/2.4 r10080 - /linux/branches/2.4/drivers/dahdi/wcb4xxp/

[SVN commits to the DAHDI project]

Author: sruffell
Date: Fri Jul 22 13:03:48 2011
New Revision: 10080

URL: http://svnview.digium.com/svn/dahdi?view=rev&rev=10080
Log:
wcb4xxp: Prevent null pointer dereference on spanconfig

In the rare case where spanconfig is called while there is pending data
on the hdlc channel, the hdlc_getbuf interrupt could try to read from
the hdlc buffer before the channel was fully setup. This could
potentially result in a null pointer dereference. This condition has
existed since the creation of the wcb4xxp driver.

Signed-off-by: Russ Meyerriecks <rmeyerriecks at digium.com>
Signed-off-by: Shaun Ruffell <sruffell at digium.com>

Origin: http://svnview.digium.com/svn/dahdi?view=rev&rev=10079

Modified:
    linux/branches/2.4/drivers/dahdi/wcb4xxp/base.c

Modified: linux/branches/2.4/drivers/dahdi/wcb4xxp/base.c
URL: http://svnview.digium.com/svn/dahdi/linux/branches/2.4/drivers/dahdi/wcb4xxp/base.c?view=diff&rev=10080&r1=10079&r2=10080
==============================================================================
--- linux/branches/2.4/drivers/dahdi/wcb4xxp/base.c (original)
+++ linux/branches/2.4/drivers/dahdi/wcb4xxp/base.c Fri Jul 22 13:03:48 2011
@@ -2303,6 +2303,9 @@
 
 		if (alreadyrunning && bspan->sigchan) {
 			hdlc_stop(b4, fifo);
+			atomic_set(&bspan->hdlc_pending, 0);
+			bspan->sigactive = 0;
+			smp_mb();
 			bspan->sigchan = NULL;
 		}