Linux kernel mirror (for testing)
git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
kernel
os
linux
Merge tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394
Pull firewire fix from Takashi Sakamoto:
- fix early release of request packet
* tag 'firewire-fixes-6.4-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/ieee1394/linux1394:
firewire: net: fix unexpected release of object for asynchronous request packet
+11
-10
+11
-10
drivers/firewire/net.c
+11
-10
drivers/firewire/net.c
···
706
706
int rcode;
707
707
708
708
if (destination == IEEE1394_ALL_NODES) {
709
-
kfree(r);
710
-
711
-
return;
712
-
}
713
-
714
-
if (offset != dev->handler.offset)
709
+
// Although the response to the broadcast packet is not necessarily required, the
710
+
// fw_send_response() function should still be called to maintain the reference
711
+
// counting of the object. In the case, the call of function just releases the
712
+
// object as a result to decrease the reference counting.
713
+
rcode = RCODE_COMPLETE;
714
+
} else if (offset != dev->handler.offset) {
715
715
rcode = RCODE_ADDRESS_ERROR;
716
-
else if (tcode != TCODE_WRITE_BLOCK_REQUEST)
716
+
} else if (tcode != TCODE_WRITE_BLOCK_REQUEST) {
717
717
rcode = RCODE_TYPE_ERROR;
718
-
else if (fwnet_incoming_packet(dev, payload, length,
719
-
source, generation, false) != 0) {
718
+
} else if (fwnet_incoming_packet(dev, payload, length,
719
+
source, generation, false) != 0) {
720
720
dev_err(&dev->netdev->dev, "incoming packet failure\n");
721
721
rcode = RCODE_CONFLICT_ERROR;
722
-
} else
722
+
} else {
723
723
rcode = RCODE_COMPLETE;
724
+
}
724
725
725
726
fw_send_response(card, r, rcode);
726
727
}