Commit f7dcc5e3 authored by Takashi Sakamoto's avatar Takashi Sakamoto
Browse files

firewire: net: fix unexpected release of object for asynchronous request packet 



The lifetime of object for asynchronous request packet is now maintained
by reference counting, while current implementation of firewire-net
releases the passed object in the handler.

This commit fixes the bug.

Reported-by: default avatarDan Carpenter <error27@gmail.com>
Link: https://lore.kernel.org/lkml/Y%2Fymx6WZIAlrtjLc@workstation/
Fixes: 13a55d6b ("firewire: core: use kref structure to maintain lifetime of data for fw_request structure")
Link: https://lore.kernel.org/lkml/20230510031205.782032-1-o-takashi@sakamocchi.jp/


Signed-off-by: default avatarTakashi Sakamoto <o-takashi@sakamocchi.jp>
parent ac9a7868

drivers/firewire/net.c

+11 −10
Original line number Diff line number Diff line
@@ -706,21 +706,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r, 
	int rcode;



	if (destination == IEEE1394_ALL_NODES) {

		kfree(r);



		return;

	}



	if (offset != dev->handler.offset)

		// Although the response to the broadcast packet is not necessarily required, the

		// fw_send_response() function should still be called to maintain the reference

		// counting of the object. In the case, the call of function just releases the

		// object as a result to decrease the reference counting.

		rcode = RCODE_COMPLETE;

	} else if (offset != dev->handler.offset) {

		rcode = RCODE_ADDRESS_ERROR;

	else if (tcode != TCODE_WRITE_BLOCK_REQUEST)

	} else if (tcode != TCODE_WRITE_BLOCK_REQUEST) {

		rcode = RCODE_TYPE_ERROR;

	else if (fwnet_incoming_packet(dev, payload, length,

	} else if (fwnet_incoming_packet(dev, payload, length,

					 source, generation, false) != 0) {

		dev_err(&dev->netdev->dev, "incoming packet failure\n");

		rcode = RCODE_CONFLICT_ERROR;

	} else

	} else {

		rcode = RCODE_COMPLETE;

	}



	fw_send_response(card, r, rcode);

}