提交 e81cbebd 编写于 作者: C Clemens Ladisch 提交者: Stefan Richter

firewire: ohci: prevent iso completion callbacks after context stop

To prevent the iso packet callback from being called after
fw_iso_context_stop() has returned, make sure that the
context's tasklet has finished executing before that.

This fixes access-after-free bugs that have so far been
observed only in the upcoming snd-firewire-speakers driver,
but can theoretically also happen in the firedtv driver.
Signed-off-by: NClemens Ladisch <clemens@ladisch.de>
Signed-off-by: NStefan Richter <stefanr@s5r6.in-berlin.de>
上级 5aaffc65
...@@ -2764,6 +2764,7 @@ static int ohci_stop_iso(struct fw_iso_context *base) ...@@ -2764,6 +2764,7 @@ static int ohci_stop_iso(struct fw_iso_context *base)
} }
flush_writes(ohci); flush_writes(ohci);
context_stop(&ctx->context); context_stop(&ctx->context);
tasklet_kill(&ctx->context.tasklet);
return 0; return 0;
} }
......
Markdown is supported
0% .
You are about to add 0 people to the discussion. Proceed with caution.
先完成此消息的编辑!
想要评论请 注册