]> git.baikalelectronics.ru Git - kernel.git/commit
firewire: core: fix use-after-free regression in FCP handler
authorStefan Richter <stefanr@s5r6.in-berlin.de>
Sun, 24 Jan 2010 15:45:03 +0000 (16:45 +0100)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Tue, 26 Jan 2010 19:54:50 +0000 (20:54 +0100)
commitb17b4587c51a9f1ca7ebf338c90183a5573d96b7
treeb807edaafec3c00e442d41d9091b9783a53820f9
parentd1e3d42da33077e1b2c4be0c5ad41abc71814bda
firewire: core: fix use-after-free regression in FCP handler

Commit 7f61d9a6 "firewire: fix use of multiple AV/C devices, allow
multiple FCP listeners" introduced a regression into 2.6.33-rc3:
The core freed payloads of incoming requests to FCP_Request or
FCP_Response before a userspace driver accessed them.

We need to copy such payloads for each registered userspace client
and free the copies according to the lifetime rules of non-FCP client
request resources.

(This could possibly be optimized by reference counts instead of
copies.)

The presently only kernelspace driver which listens for FCP requests,
firedtv, was not affected because it already copies FCP frames into an
own buffer before returning to firewire-core's FCP handler dispatcher.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
drivers/firewire/core-cdev.c