alistair23-linux/drivers/firewire
Stefan Richter 281e20323a firewire: core: fix use-after-free regression in FCP handler
Commit db5d247a "firewire: fix use of multiple AV/C devices, allow
multiple FCP listeners" introduced a regression into 2.6.33-rc3:
The core freed payloads of incoming requests to FCP_Request or
FCP_Response before a userspace driver accessed them.

We need to copy such payloads for each registered userspace client
and free the copies according to the lifetime rules of non-FCP client
request resources.

(This could possibly be optimized by reference counts instead of
copies.)

The presently only kernelspace driver which listens for FCP requests,
firedtv, was not affected because it already copies FCP frames into an
own buffer before returning to firewire-core's FCP handler dispatcher.

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
2010-01-26 20:54:50 +01:00
..
core-card.c firewire: core: add_descriptor size check 2010-01-26 20:54:50 +01:00
core-cdev.c firewire: core: fix use-after-free regression in FCP handler 2010-01-26 20:54:50 +01:00
core-device.c driver model: constify attribute groups 2009-09-15 09:50:47 -07:00
core-iso.c firewire: core: fix crash in iso resource management 2009-09-05 15:59:34 +02:00
core-topology.c Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/jikos/trivial 2009-12-09 19:43:33 -08:00
core-transaction.c firewire: fix use of multiple AV/C devices, allow multiple FCP listeners 2009-12-29 19:58:16 +01:00
core.h firewire: core: optimize Topology Map creation 2009-10-14 23:10:48 +02:00
Kconfig firewire, ieee1394: update Kconfig help 2009-12-29 19:58:17 +01:00
Makefile firewire: net: add Kconfig item, rename driver 2009-06-14 14:26:29 +02:00
net.c drivers: Kill now superfluous ->last_rx stores 2009-09-02 23:07:36 -07:00
ohci.c firewire: ohci: always use packet-per-buffer mode for isochronous reception 2009-12-29 19:58:17 +01:00
ohci.h
sbp2.c firewire: normalize style of queue_work wrappers 2009-10-14 23:10:48 +02:00