Attachment 307286 Details for Bug 244576 – firewire: fw-ohci: use of uninitialized data in AR handler

[patch] firewire: fw-ohci: use of uninitialized data in AR handler

726-firewire-fw-ohci-use-of-uninitialized-data-in-ar-req-handler.patch (text/plain), 1.06 KB, created by Stefan Richter on 2008-05-31 17:39:43 UTC

(hide)

Description:

Filename:

MIME Type:

Creator: Stefan Richter

Created: 2008-05-31 17:39:43 UTC

Size: 1.06 KB

patch

obsolete

>Date: Sat, 31 May 2008 19:36:06 +0200 (CEST)
>From: Stefan Richter <stefanr@s5r6.in-berlin.de>
>Subject: firewire: fw-ohci: use of uninitialized data in AR handler
>
>header_length and payload_length are filled with random data if an
>unknown tcode was read from the AR buffer (i.e. if the AR buffer
>contained invalid data).
>
>We still need a better strategy to recover from this, but at least
>handle_ar_packet now doesn't return out of bound buffer addresses
>anymore.
>
>Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de>
>---
> drivers/firewire/fw-ohci.c |    5 +++++
> 1 file changed, 5 insertions(+)
>
>Index: linux/drivers/firewire/fw-ohci.c
>===================================================================
>--- linux.orig/drivers/firewire/fw-ohci.c
>+++ linux/drivers/firewire/fw-ohci.c
>@@ -548,6 +548,11 @@ static __le32 *handle_ar_packet(struct a
> 		p.header_length = 12;
> 		p.payload_length = 0;
> 		break;
>+
>+	default:
>+		/* FIXME: Stop context, discard everything, and restart? */
>+		p.header_length = 0;
>+		p.payload_length = 0;
> 	}
> 
> 	p.payload = (void *) buffer + p.header_length;

Actions: View | Diff

Attachments on bug 244576: 307285 | 307286 | 307296 | 309401 | 309402