github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-27 11:02:03 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

firewire fixes for 7.3-rc5

Browse Source 
Fix a race in the cdev layer that can cause a fw_iso_resource_auto object
 to transition back to a previous state. This can happen when a file
 descriptor is closed while the work item for the object is running. The
 race can leak several memory objects, including client object itself.
 This fix should be applied to 7.2 kernel or later.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQQE66IEYNDXNBPeGKSsLtaWM8LwEwUCarWseAAKCRCsLtaWM8Lw
 E2x/AQCr6GAMO1G8/7mUgEj3X4CHCzkS/N3bVwb6TJ18/e5gxgEAuM9Ry+FU6IP4
 0NCz6dbcn9dta3YGnlfgAQ9HtTMwnAg=
 =BLzx
 -----END PGP SIGNATURE-----

Merge tag 'firewire-fixes-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Takashi Sakamoto:
 "Fix a race in the cdev layer that can cause a fw_iso_resource_auto
  object to transition back to a previous state. This can happen when a
  file descriptor is closed while the work item for the object is
  running. The race can leak several memory objects, including client
  object itself"

* tag 'firewire-fixes-7.3-rc5' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: cdev: fix back-transition for iso_resource_auto client resource
This commit is contained in:
Linus Torvalds 2026-09-24 17:09:56 -07:00
commit 165768bb70
1 changed files with 4 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

6
drivers/firewire/core-cdev.c
View File

@ -1397,8 +1397,10 @@ static void iso_resource_auto_work(struct work_struct *work)
} else {
// Transit from allocation to reallocation, except if the client requested
// deallocation in the meantime.
scoped_guard(spinlock_irq, &client->lock)
r->todo = ISO_RES_AUTO_REALLOC;
scoped_guard(spinlock_irq, &client->lock) {
if (r->todo == ISO_RES_AUTO_ALLOC)
r->todo = ISO_RES_AUTO_REALLOC;
}
if (channel >= 0)
r->params.channels_mask = BIT_ULL(channel);