Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fae60312 authored by Stefan Richter's avatar Stefan Richter
Browse files

firewire: fix NULL pointer deref. and resource leak 



By supplying ioctl()s in the wrong order, a userspace client was able to
trigger NULL pointer dereferences.  Furthermore, by calling
ioctl_create_iso_context more than once, new contexts could be created
without ever freeing the previously created contexts.

Thanks to Anders Blomdell for the report.

Signed-off-by: default avatarStefan Richter <stefanr@s5r6.in-berlin.de>
parent 09d7328e

drivers/firewire/fw-cdev.c

+7 −2
Original line number Diff line number Diff line
@@ -646,6 +646,10 @@ static int ioctl_create_iso_context(struct client *client, void *buffer) 
	struct fw_cdev_create_iso_context *request = buffer;

	struct fw_iso_context *context;



	/* We only support one context at this time. */

	if (client->iso_context != NULL)

		return -EBUSY;



	if (request->channel > 63)

		return -EINVAL;
@@ -792,8 +796,9 @@ static int ioctl_start_iso(struct client *client, void *buffer) 
{

	struct fw_cdev_start_iso *request = buffer;



	if (request->handle != 0)

	if (client->iso_context == NULL || request->handle != 0)

		return -EINVAL;



	if (client->iso_context->type == FW_ISO_CONTEXT_RECEIVE) {

		if (request->tags == 0 || request->tags > 15)

			return -EINVAL;
@@ -810,7 +815,7 @@ static int ioctl_stop_iso(struct client *client, void *buffer) 
{

	struct fw_cdev_stop_iso *request = buffer;



	if (request->handle != 0)

	if (client->iso_context == NULL || request->handle != 0)

		return -EINVAL;



	return fw_iso_context_stop(client->iso_context);