lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity
8481664d37
android_kernel_xiaomi_sm8350/drivers/firewire
History
Stefan Richter 10a4c73551 firewire: fix panic in handle_at_packet 
This fixes a use-after-free bug in the handling of split transactions.
The AT DMA handler of the request was occasionally executed after the
AR DMA handler of the response.  The AT DMA handler then accessed an
already freed packet.

Reported by Johannes Berg.
http://bugzilla.kernel.org/show_bug.cgi?id=9617

Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: Johannes Berg <johannes@sipsolutions.net>
Signed-off-by: Jarod Wilson <jwilson@redhat.com>
2008-03-20 18:13:05 +01:00
..
fw-card.c firewire: fix crash in automatic module unloading 2008-03-02 12:35:46 +01:00
fw-cdev.c firewire: fix NULL pointer deref. and resource leak 2008-02-21 19:05:56 +01:00
fw-device.c firewire: fix crash in automatic module unloading 2008-03-02 12:35:46 +01:00
fw-device.h firewire: fix crash in automatic module unloading 2008-03-02 12:35:46 +01:00
fw-iso.c
fw-ohci.c firewire: fw-ohci: shut up false compiler warning on PPC32 2008-03-14 00:57:00 +01:00
fw-ohci.h
fw-sbp2.c firewire: fw-sbp2: fix for SYM13FW500 bridge (Datafab disk) 2008-03-14 00:56:59 +01:00
fw-topology.c firewire: warn on fatal condition in topology code 2008-03-14 00:56:59 +01:00
fw-topology.h firewire: a header cleanup 2007-10-17 00:00:09 +02:00
fw-transaction.c firewire: fix panic in handle_at_packet 2008-03-20 18:13:05 +01:00
fw-transaction.h firewire: endianess annotations 2008-03-14 00:56:58 +01:00
Kconfig firewire: update Kconfig help text 2008-03-14 00:56:59 +01:00
Makefile