[2.4] [2.5] Fix PPPoATM crash on disconnection (tasklet_disable; kfree(tasklet))
Subsystems (3)
PATCH 1/1 [2.4] [2.5] Fix PPPoATM crash on disconnection (tasklet_disable; kfree(tasklet))
PPPoATM uses tasklet_disable() on a tasklet inside a struct and then frees the struct, leaving a pointer to the freed tasklet inside tasklet lists.
This patch replaces tasklet_disable() with tasklet_kill().
This bug is present in both 2.4.18 and 2.5.15 (and the patch applies to both).
net/atm/pppoatm.c +1 -1
@@ -125,7 +125,7 @@ pvcc =atmvcc_to_pvcc (atmvcc); atmvcc->push = pvcc->old_push; atmvcc->pop = pvcc->old_pop; -tasklet_disable (&pvcc->wakeup_tasklet); +tasklet_kill (&pvcc->wakeup_tasklet);ppp_unregister_channel (&pvcc->chan); atmvcc->user_back =NULL ;kfree (pvcc);