Commit 47a2ee5d authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge tag 'firewire-fixes-6.4-rc2' of... 

Merge tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394

Pull firewire fix from Takashi Sakamoto:

 - fix early release of request packet

* tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
  firewire: net: fix unexpected release of object for asynchronous request packet
parents cc3c44c9 f7dcc5e3

drivers/firewire/net.c

+11 −10
Original line number Diff line number Diff line
@@ -706,21 +706,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r, 
	int rcode;



	if (destination == IEEE1394_ALL_NODES) {

		kfree(r);



		return;

	}



	if (offset != dev->handler.offset)

		// Although the response to the broadcast packet is not necessarily required, the

		// fw_send_response() function should still be called to maintain the reference

		// counting of the object. In the case, the call of function just releases the

		// object as a result to decrease the reference counting.

		rcode = RCODE_COMPLETE;

	} else if (offset != dev->handler.offset) {

		rcode = RCODE_ADDRESS_ERROR;

	else if (tcode != TCODE_WRITE_BLOCK_REQUEST)

	} else if (tcode != TCODE_WRITE_BLOCK_REQUEST) {

		rcode = RCODE_TYPE_ERROR;

	else if (fwnet_incoming_packet(dev, payload, length,

	} else if (fwnet_incoming_packet(dev, payload, length,

					 source, generation, false) != 0) {

		dev_err(&dev->netdev->dev, "incoming packet failure\n");

		rcode = RCODE_CONFLICT_ERROR;

	} else

	} else {

		rcode = RCODE_COMPLETE;

	}



	fw_send_response(card, r, rcode);

}