diff --git a/patches.kernel.org/6.3.3-208-firewire-net-fix-unexpected-release-of-object-f.patch b/patches.kernel.org/6.3.3-208-firewire-net-fix-unexpected-release-of-object-f.patch new file mode 100644 index 0000000..627481f --- /dev/null +++ b/patches.kernel.org/6.3.3-208-firewire-net-fix-unexpected-release-of-object-f.patch @@ -0,0 +1,67 @@ +From: Takashi Sakamoto +Date: Wed, 10 May 2023 10:35:33 +0900 +Subject: [PATCH] firewire: net: fix unexpected release of object for + asynchronous request packet +References: bsc#1012628 +Patch-mainline: 6.3.3 +Git-commit: f7dcc5e33c1e4b0d278a30f7d2f0c9a63d7b40ca + +commit f7dcc5e33c1e4b0d278a30f7d2f0c9a63d7b40ca upstream. + +The lifetime of object for asynchronous request packet is now maintained +by reference counting, while current implementation of firewire-net +releases the passed object in the handler. + +This commit fixes the bug. + +Reported-by: Dan Carpenter +Link: https://lore.kernel.org/lkml/Y%2Fymx6WZIAlrtjLc@workstation/ +Fixes: 13a55d6bb15f ("firewire: core: use kref structure to maintain lifetime of data for fw_request structure") +Link: https://lore.kernel.org/lkml/20230510031205.782032-1-o-takashi@sakamocchi.jp/ +Signed-off-by: Takashi Sakamoto +Signed-off-by: Greg Kroah-Hartman +Signed-off-by: Jiri Slaby +--- + drivers/firewire/net.c | 21 +++++++++++---------- + 1 file changed, 11 insertions(+), 10 deletions(-) + +diff --git a/drivers/firewire/net.c b/drivers/firewire/net.c +index af22be84..538bd677 100644 +--- a/drivers/firewire/net.c ++++ b/drivers/firewire/net.c +@@ -706,21 +706,22 @@ static void fwnet_receive_packet(struct fw_card *card, struct fw_request *r, + int rcode; + + if (destination == IEEE1394_ALL_NODES) { +- kfree(r); +- +- return; +- } +- +- if (offset != dev->handler.offset) ++ // Although the response to the broadcast packet is not necessarily required, the ++ // fw_send_response() function should still be called to maintain the reference ++ // counting of the object. In the case, the call of function just releases the ++ // object as a result to decrease the reference counting. ++ rcode = RCODE_COMPLETE; ++ } else if (offset != dev->handler.offset) { + rcode = RCODE_ADDRESS_ERROR; +- else if (tcode != TCODE_WRITE_BLOCK_REQUEST) ++ } else if (tcode != TCODE_WRITE_BLOCK_REQUEST) { + rcode = RCODE_TYPE_ERROR; +- else if (fwnet_incoming_packet(dev, payload, length, +- source, generation, false) != 0) { ++ } else if (fwnet_incoming_packet(dev, payload, length, ++ source, generation, false) != 0) { + dev_err(&dev->netdev->dev, "incoming packet failure\n"); + rcode = RCODE_CONFLICT_ERROR; +- } else ++ } else { + rcode = RCODE_COMPLETE; ++ } + + fw_send_response(card, r, rcode); + } +-- +2.35.3 + diff --git a/series.conf b/series.conf index 0a35fbd..81706f5 100644 --- a/series.conf +++ b/series.conf @@ -941,6 +941,7 @@ patches.kernel.org/6.3.3-205-drm-amdgpu-drop-gfx_v11_0_cp_ecc_error_irq_func.patch patches.kernel.org/6.3.3-206-drm-amdgpu-disable-sdma-ecc-irq-only-when-sdma-.patch patches.kernel.org/6.3.3-207-drm-amd-pm-avoid-potential-UBSAN-issue-on-legac.patch + patches.kernel.org/6.3.3-208-firewire-net-fix-unexpected-release-of-object-f.patch ######################################################## # Build fixes that apply to the vanilla kernel too.