From efbf390a2d940315efff174455243e61f23c03b9 Mon Sep 17 00:00:00 2001 From: Stefan Richter Date: Sat, 23 Feb 2008 12:24:57 +0100 Subject: firewire: endianess annotations Kills warnings from 'make C=1 CHECKFLAGS="-D__CHECK_ENDIAN__" modules': drivers/firewire/fw-transaction.c:771:10: warning: incorrect type in assignment (different base types) drivers/firewire/fw-transaction.c:771:10: expected unsigned int [unsigned] [usertype] drivers/firewire/fw-transaction.c:771:10: got restricted unsigned int [usertype] drivers/firewire/fw-transaction.h:93:10: warning: incorrect type in assignment (different base types) drivers/firewire/fw-transaction.h:93:10: expected unsigned int [unsigned] [usertype] drivers/firewire/fw-transaction.h:93:10: got restricted unsigned int [usertype] drivers/firewire/fw-ohci.c:1490:8: warning: restricted degrades to integer drivers/firewire/fw-ohci.c:1490:35: warning: restricted degrades to integer drivers/firewire/fw-ohci.c:1516:5: warning: cast to restricted type Signed-off-by: Stefan Richter Signed-off-by: Jarod Wilson --- drivers/firewire/fw-transaction.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'drivers/firewire/fw-transaction.c') diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c index 7fcc59dedf08..99529e59a0b1 100644 --- a/drivers/firewire/fw-transaction.c +++ b/drivers/firewire/fw-transaction.c @@ -751,7 +751,7 @@ handle_topology_map(struct fw_card *card, struct fw_request *request, void *payload, size_t length, void *callback_data) { int i, start, end; - u32 *map; + __be32 *map; if (!TCODE_IS_READ_REQUEST(tcode)) { fw_send_response(card, request, RCODE_TYPE_ERROR); -- cgit v1.2.3-59-g8ed1b From 10a4c735515a5afc317abe4d697a4c95f6d9d764 Mon Sep 17 00:00:00 2001 From: Stefan Richter Date: Sun, 16 Mar 2008 00:56:41 +0100 Subject: firewire: fix panic in handle_at_packet This fixes a use-after-free bug in the handling of split transactions. The AT DMA handler of the request was occasionally executed after the AR DMA handler of the response. The AT DMA handler then accessed an already freed packet. Reported by Johannes Berg. http://bugzilla.kernel.org/show_bug.cgi?id=9617 Signed-off-by: Stefan Richter Tested-by: Johannes Berg Signed-off-by: Jarod Wilson --- drivers/firewire/fw-transaction.c | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'drivers/firewire/fw-transaction.c') diff --git a/drivers/firewire/fw-transaction.c b/drivers/firewire/fw-transaction.c index 99529e59a0b1..e6f1bda38940 100644 --- a/drivers/firewire/fw-transaction.c +++ b/drivers/firewire/fw-transaction.c @@ -736,6 +736,12 @@ fw_core_handle_response(struct fw_card *card, struct fw_packet *p) break; } + /* + * The response handler may be executed while the request handler + * is still pending. Cancel the request handler. + */ + card->driver->cancel_packet(card, &t->packet); + t->callback(card, rcode, data, data_length, t->callback_data); } EXPORT_SYMBOL(fw_core_handle_response); -- cgit v1.2.3-59-g8ed1b