aboutsummaryrefslogtreecommitdiff
path: root/drivers/firewire
diff options
context:
space:
mode:
authorStefan Richter <stefanr@s5r6.in-berlin.de>2014-02-18 22:25:15 +0100
committerGreg Kroah-Hartman <gregkh@linuxfoundation.org>2014-03-23 21:38:16 -0700
commitf5befc2c193dbe92826a382e16cb50e8640a4f62 (patch)
tree0263351d1b42fe6b515c7e77a3a4fbd21f564174 /drivers/firewire
parentd6a6d1f38ce55aa5a7d8aab972176660b19fd7ab (diff)
downloadlinux-linaro-stable-f5befc2c193dbe92826a382e16cb50e8640a4f62.tar.gz
firewire: net: fix use after free
commit 8987583366ae9e03c306c2b7d73bdb952df1d08d upstream. Commit 8408dc1c14c1 "firewire: net: use dev_printk API" introduced a use-after-free in a failure path. fwnet_transmit_packet_failed(ptask) may free ptask, then the dev_err() call dereferenced it. The fix is straightforward; simply reorder the two calls. Reported-by: Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Diffstat (limited to 'drivers/firewire')
-rw-r--r--drivers/firewire/net.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c
index 815b0fcbe918..7bdb6fe63236 100644
--- a/drivers/firewire/net.c
+++ b/drivers/firewire/net.c
@@ -929,8 +929,6 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
if (rcode == RCODE_COMPLETE) {
fwnet_transmit_packet_done(ptask);
} else {
- fwnet_transmit_packet_failed(ptask);
-
if (printk_timed_ratelimit(&j, 1000) || rcode != last_rcode) {
dev_err(&ptask->dev->netdev->dev,
"fwnet_write_complete failed: %x (skipped %d)\n",
@@ -938,8 +936,10 @@ static void fwnet_write_complete(struct fw_card *card, int rcode,
errors_skipped = 0;
last_rcode = rcode;
- } else
+ } else {
errors_skipped++;
+ }
+ fwnet_transmit_packet_failed(ptask);
}
}