mirror of
https://github.com/torvalds/linux.git
synced 2026-10-23 23:51:02 +02:00
7f9f2d6abc
For a split transaction, either fw_core_handle_response() or
split_transaction_timeout_callback() may manipulate the same transaction
entry in the pending transaction list. The return value of timer_delete()
is used to determine which function handles the entry. If the transaction
is a split transaction and timer_delete() returns zero, the timeout
callback may already be running. In this case, the response handler must
leave the entry in the list for the timeout callback to remove.
A previous code refactoring broke this behavior, introducing a race
condition in which both functions could process the same transaction.
This could lead to a use-after-free on the transaction initiator side.
Fix the regression by ensuring that the response handler does not process
the transaction when timer_delete() returns zero. The timeout callback is
responsible for removing the entry from the pending transaction list.
Fixes:
|
||
|---|---|---|
| .. | ||
| .kunitconfig | ||
| core-card.c | ||
| core-cdev.c | ||
| core-device.c | ||
| core-iso.c | ||
| core-topology.c | ||
| core-trace.c | ||
| core-transaction.c | ||
| core.h | ||
| device-attribute-test.c | ||
| init_ohci1394_dma.c | ||
| Kconfig | ||
| Makefile | ||
| net.c | ||
| node-tree-test.c | ||
| nosy-user.h | ||
| nosy.c | ||
| nosy.h | ||
| ohci-serdes-test.c | ||
| ohci.c | ||
| ohci.h | ||
| packet-header-definitions.h | ||
| packet-serdes-test.c | ||
| phy-packet-definitions.h | ||
| sbp2.c | ||
| self-id-sequence-helper-test.c | ||
| uapi-test.c | ||