Meng Xu d9cb4dc022 isdn/i4l: fetch the ppp_write buffer in one shot ... [ Upstream commit 02388bf87f72e1d47174cd8f81c34443920eb5a0 ] In isdn_ppp_write(), the header (i.e., protobuf) of the buffer is fetched twice from userspace. The first fetch is used to peek at the protocol of the message and reset the huptimer if necessary; while the second fetch copies in the whole buffer. However, given that buf resides in userspace memory, a user process can race to change its memory content across fetches. By doing so, we can either avoid resetting the huptimer for any type of packets (by first setting proto to PPP_LCP and later change to the actual type) or force resetting the huptimer for LCP packets. This patch changes this double-fetch behavior into two single fetches decided by condition (lp->isdn_device < 0 || lp->isdn_channel <0). A more detailed discussion can be found at https://marc.info/?l=linux-kernel&m=150586376926123&w=2 Signed-off-by: Meng Xu <mengxu.gatech@gmail.com> Signed-off-by: David S. Miller <davem@davemloft.net> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>		2017-10-21 17:09:02 +02:00
..
isdn_audio.c
isdn_audio.h
isdn_bsdcomp.c
isdn_common.c	isdn/i4l: fix buffer overflow	2017-08-06 19:19:41 -07:00
isdn_common.h
isdn_concap.c
isdn_concap.h
isdn_net.c	isdn/i4l: fix buffer overflow	2017-08-06 19:19:41 -07:00
isdn_net.h
isdn_ppp.c	isdn/i4l: fetch the ppp_write buffer in one shot	2017-10-21 17:09:02 +02:00
isdn_ppp.h
isdn_tty.c	tty: Remove tty_wait_until_sent_from_close()	2015-10-17 21:11:29 -07:00
isdn_tty.h
isdn_ttyfax.c
isdn_ttyfax.h
isdn_v110.c
isdn_v110.h
isdn_x25iface.c
isdn_x25iface.h
isdnhdlc.c
Kconfig
Makefile