HomeFreeBSD

FireWire: Don't allow a tlabel to reference an xfer after free.

Description

FireWire: Don't allow a tlabel to reference an xfer after free.

sys/dev/firewire/firewire.c:

  • fw_xfer_unload(): Since we are about to free this xfer, call fw_tl_free() to remove the xfer from its tlabel's list, if it has a tlabel.
  • In every occasion when a xfer is removed from a tlabel's list, reset xfer->tl to -1 while holding fc->tlabel_lock, so that the xfer isn't mis-identified as belonging to a tlabel.

This doesn't fix all the use-after-free problems for M_FWMEM, but is an
incremental towards that goal.

Reviewed by: kan, sbruno
Sponsored by: Spectra Logic

Details

Provenance
willAuthored on Apr 8 2013, 11:16 PM
Parents
rG69cbcb210d95: Fix this to compile when ATH_DEBUG_ALQ is defined but ATH_DEBUG isn't.
Branches
Unknown
Tags
Unknown

Event Timeline