tree b7cad6cedd3a74c6c9f01ed74720999d2a16637e
parent 5e44708f75b0f8712da715d6babb0c21089b2317
author Russ Gorby <russ.gorby@intel.com> 1344861899 +0100
committer Greg Kroah-Hartman <gregkh@linuxfoundation.org> 1345143810 -0700

n_gsm: avoid accessing freed memory during CMD_FCOFF condition

gsm_data_kick was recently modified to allow messages on the
tx queue bound for DLCI0 to flow even during FCOFF conditions.
Unfortunately we introduced a bug discovered by code inspection
where subsequent list traversers can access freed memory if
the DLCI0 messages were not all at the head of the list.

Replaced singly linked tx list w/ a list_head and used
provided interfaces for traversing and deleting members.

Signed-off-by: Russ Gorby <russ.gorby@intel.com>
Tested-by: Yin, Fengwei <fengwei.yin@intel.com>
Signed-off-by: Alan Cox <alan@linux.intel.com>
Cc: Riding School <stable@vger.kernel.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>