github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-07 06:17:02 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

firewire: cdev: hold client reference for fw_iso_resource_auto lifetime

Browse Source 
The fw_iso_resource_auto object can outlive the operation that created
it since hte main operation for it is done in a work item. This work and
release paths access members of the client structure, therefore the
client structure must remain valid for the lifetime of an
fw_iso_resource_auto object.

Hold a reference to the client structure for the lifetime of the
fw_iso_resource_auto object.

Link: https://lore.kernel.org/r/20260923172328.277232-2-o-takashi@sakamocchi.jp
Signed-off-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
This commit is contained in:
Takashi Sakamoto 2026-09-24 02:23:27 +09:00
parent f95344968c
commit a689a10b51
1 changed files with 5 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/firewire/core-cdev.c
View File

@ -1397,6 +1397,7 @@ static void iso_resource_auto_work(struct work_struct *work)
// xarray and prepare for deletion, unless the client is shutting down.
scoped_guard(spinlock_irq, &client->lock) {
if (!client->in_shutdown && xa_erase(&client->resource_xa, index)) {
// For the incrementation by add_client_resource().
client_put(client);
free = true;
}
@ -1438,6 +1439,9 @@ static void iso_resource_auto_work(struct work_struct *work)
kfree(r->e_alloc);
kfree(r->e_dealloc);
kfree(r);
// For the incrementation by ioctl_allocate_iso_resource().
client_put(client);
}
out:
client_put(client);
@ -1483,6 +1487,7 @@ static int ioctl_allocate_iso_resource(struct client *client, union ioctl_arg *a
if (err < 0)
return err;
request->handle = r->resource.handle;
client_get(client);
retain_and_null_ptr(e1);
retain_and_null_ptr(e2);