Date: Thu, 04 Apr 2013 14:33:00 -0700 From: Sean Bruno <seanwbruno@gmail.com> To: Will Andrews <will@firepipe.net> Cc: Alexander Kabaev <kan@freebsd.org>, hackers@freebsd.org Subject: Re: CFR: FireWire: Don't allow a tlabel to reference an xfer after free Message-ID: <1365111180.1404.23.camel@localhost> In-Reply-To: <CADBaqmgJY=N0bodBA%2BkyjkQuNnM%2BqvLML1UZvJU_JY=PLwg5hQ@mail.gmail.com> References: <CADBaqmgJY=N0bodBA%2BkyjkQuNnM%2BqvLML1UZvJU_JY=PLwg5hQ@mail.gmail.com>
next in thread | previous in thread | raw e-mail | index | archive | help
[-- Attachment #1 --] On Thu, 2013-03-28 at 11:25 -0600, Will Andrews wrote: > Diff: http://people.freebsd.org/~will/patches/fix-fwmem-use-after-free.diff > > >From the commit log: > > FireWire: Don't allow a tlabel to reference an xfer after free. > > sys/dev/firewire/firewire.c: > - fw_xfer_unload(): Since we are about to free this xfer, call > fw_tl_free() to remove the xfer from its tlabel's list, if > it has a tlabel. > - In every occasion when a xfer is removed from a tlabel's list, > reset xfer->tl to -1 while holding fc->tlabel_lock, so that the > xfer isn't mis-identified as belonging to a tlabel. > > > Thanks, > --Will. > _______________________________________________ Ack. Looks like a valid commit. sean [-- Attachment #2 --] -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.13 (FreeBSD) iQEcBAABAgAGBQJRXfGMAAoJEBkJRdwI6BaH6lYH/2+bSKUqX+NqebUk3JOyHtH2 Z+OpeZu7gsl+/+btIH+QEfQ3BAd4viFUBFLo9hoP9xIB9t0Sty2LZVhCtAAoYrcP kPqoCo4n/wkSTc6sfq3MAkT1KRguK/Fr/r25Mx1kS/6osX8ECy400tZemG7bYEZC 17p+2MXghTx6uZ9aML3rPWLGsgVETL3paaPyUx4+wZN8uzV2xbNU9r/g88mTDtB4 qxFb72Al+/ip5LChY41KKtpqjiUKSl0VPXXU+OwBX1/Yow2gHGK1BsH1J1B9uzFI DpNCArfd7pH664V9AaH5VUsnz+t+tYYRst51x54wK29UFY82Ew46nkzlAT4dpAQ= =94tn -----END PGP SIGNATURE-----
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?1365111180.1404.23.camel>