]> bbs.cooldavid.org Git - net-next-2.6.git/commit
firewire: ohci: fix race when reading count in AR descriptor
authorClemens Ladisch <clemens@ladisch.de>
Mon, 25 Oct 2010 09:43:05 +0000 (11:43 +0200)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Sat, 30 Oct 2010 21:37:20 +0000 (23:37 +0200)
commit693fa7792e9db9f32da9436e633976fbacd04b55
tree227078047db9c8f3497133769b1b9b1f7b681fa1
parent837596a61ba8f9bb53bb7aa27d17328ff9b2bcd5
firewire: ohci: fix race when reading count in AR descriptor

If the controller is storing a split packet and therefore changing
d->res_count to zero between the two reads by the driver, we end up with
an end pointer that is not at a packet boundary, and therefore overflow
the buffer when handling the split packet.

To fix this, read the field once, atomically.  The compiler usually
merges the two reads anyway, but for correctness, we have to enforce it.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
drivers/firewire/ohci.c