1. 29 Jan, 2010 3 commits
  2. 28 Jan, 2010 7 commits
  3. 27 Jan, 2010 29 commits
  4. 26 Jan, 2010 1 commit
    • Stefan Richter's avatar
      firewire: core: fix use-after-free regression in FCP handler · 281e2032
      Stefan Richter authored
      Commit db5d247a "firewire: fix use of multiple AV/C devices, allow
      multiple FCP listeners" introduced a regression into 2.6.33-rc3:
      The core freed payloads of incoming requests to FCP_Request or
      FCP_Response before a userspace driver accessed them.
      
      We need to copy such payloads for each registered userspace client
      and free the copies according to the lifetime rules of non-FCP client
      request resources.
      
      (This could possibly be optimized by reference counts instead of
      copies.)
      
      The presently only kernelspace driver which listens for FCP requests,
      firedtv, was not affected because it already copies FCP frames into an
      own buffer before returning to firewire-core's FCP handler dispatcher.
      Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
      281e2032