Skip to content
Commit 10a4c735 authored by Stefan Richter's avatar Stefan Richter
Browse files

firewire: fix panic in handle_at_packet



This fixes a use-after-free bug in the handling of split transactions.
The AT DMA handler of the request was occasionally executed after the
AR DMA handler of the response.  The AT DMA handler then accessed an
already freed packet.

Reported by Johannes Berg.
http://bugzilla.kernel.org/show_bug.cgi?id=9617

Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
Tested-by: default avatarJohannes Berg <johannes@sipsolutions.net>
Signed-off-by: default avatarJarod Wilson <jwilson@redhat.com>
parent a978b30a
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment