xiaomi-sm8450/android_kernel_xiaomi_sm8450
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

synclink fix ldisc buffer argument

Browse Source 
Fix call to line discipline receive_buf by synclink drivers.
Dummy flag buffer argument is ignored by N_HDLC line discipline but might
be of insufficient size if accessed by a different line discipline
selected by mistake. flag buffer allocation now matches max size of data
buffer. Unused char_buf buffers are removed.

Signed-off-by: Paul Fulghum <paulkf@microgate.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
Paul Fulghum
2012-12-03 11:13:24 -06:00
committed by Greg Kroah-Hartman
parent 55c7c0fdc5
commit a6b68a69fa
4 changed files with 47 additions and 8 deletions
Download Patch File Download Diff File Expand all files Collapse all files

18
drivers/tty/synclink_gt.c
View File

@@ -317,8 +317,7 @@ struct slgt_info {
unsigned char *tx_buf;
int tx_count;
char flag_buf[MAX_ASYNC_BUFFER_SIZE];
char char_buf[MAX_ASYNC_BUFFER_SIZE];
char *flag_buf;
bool drop_rts_on_tx_done;
struct _input_signal_events input_signal_events;
@@ -3355,11 +3354,24 @@ static int block_til_ready(struct tty_struct *tty, struct file *filp,
return retval;
}
/*
* allocate buffers used for calling line discipline receive_buf
* directly in synchronous mode
* note: add 5 bytes to max frame size to allow appending
* 32-bit CRC and status byte when configured to do so
*/
static int alloc_tmp_rbuf(struct slgt_info *info)
{
info->tmp_rbuf = kmalloc(info->max_frame_size + 5, GFP_KERNEL);
if (info->tmp_rbuf == NULL)
return -ENOMEM;
/* unused flag buffer to satisfy receive_buf calling interface */
info->flag_buf = kzalloc(info->max_frame_size + 5, GFP_KERNEL);
if (!info->flag_buf) {
kfree(info->tmp_rbuf);
info->tmp_rbuf = NULL;
return -ENOMEM;
}
return 0;
}
@@ -3367,6 +3379,8 @@ static void free_tmp_rbuf(struct slgt_info *info)
{
kfree(info->tmp_rbuf);
info->tmp_rbuf = NULL;
kfree(info->flag_buf);
info->flag_buf = NULL;
}
/*