Skip to main content

Browse the archive

https://github.com/torvalds/linux
05 April 2024, 19:05:47 UTC
Revision 281e20323ab72180137824a298ee9e21e6f9acf6 authored by Stefan Richter on 24 January 2010, 15:45:03 UTC, committed by Stefan Richter on 26 January 2010, 19:54:50 UTC 
firewire: core: fix use-after-free regression in FCP handler
 
Commit db5d247a "firewire: fix use of multiple AV/C devices, allow
multiple FCP listeners" introduced a regression into 2.6.33-rc3:
The core freed payloads of incoming requests to FCP_Request or
FCP_Response before a userspace driver accessed them.

We need to copy such payloads for each registered userspace client
and free the copies according to the lifetime rules of non-FCP client
request resources.

(This could possibly be optimized by reference counts instead of
copies.)

The presently only kernelspace driver which listens for FCP requests,
firedtv, was not affected because it already copies FCP frames into an
own buffer before returning to firewire-core's FCP handler dispatcher.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
1 parent 6d3faf6
History
Tip revision: 281e20323ab72180137824a298ee9e21e6f9acf6 authored by Stefan Richter on 24 January 2010, 15:45:03 UTC
firewire: core: fix use-after-free regression in FCP handler
Tip revision: 281e203
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 843 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.8 KB
Kbuild -rw-r--r-- 2.4 KB
MAINTAINERS -rw-r--r-- 160.2 KB
Makefile -rw-r--r-- 52.0 KB
README -rw-r--r-- 17.0 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top