linux/drivers
Christian Lamparter e2fe154e91 p54usb: fix nasty use after free
In theory, the firmware acks the received a data frame, before signaling the driver to free it again.
However Artur Skawina <art.08.09@gmail.com> has shown that it can happen in reverse order as well.
This is very bad and could lead to memory corruptions, oopses and panics.

Thanks to Artur Skawina <art.08.09@gmail.com> for reporting and debugging this issue.

Signed-off-by: Christian Lamparter <chunkeey@web.de>
Tested-by: Artur Skawina <art.08.09@gmail.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
2009-01-22 13:55:02 -05:00
..
accessibility
acpi Merge branch 'misc' into release 2009-01-16 14:45:34 -05:00
amba
ata sata_fsl: Return non-zero on error in probe() 2009-01-16 10:23:58 -05:00
atm
auxdisplay
base Revert "driver core: create a private portion of struct device" 2009-01-09 15:06:12 -08:00
block powerpc/ps3: Printing fixups for l64 to ll64 conversion drivers/block 2009-01-16 16:15:13 +11:00
bluetooth
cdrom
char hvc_console: Remove tty->low_latency 2009-01-16 16:15:16 +11:00
clocksource
connector
cpufreq Merge branch 'cpus4096-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/linux-2.6-tip 2009-01-10 06:12:18 -08:00
cpuidle
crypto
dca
dio m68k: dio - Kill resource_size_t format warnings 2009-01-12 20:56:42 +01:00
dma
edac
eisa
firewire firewire: core: fix sleep in atomic context due to driver core change 2009-01-09 23:22:32 +01:00
firmware dell_rbu: use scnprintf() instead of less secure sprintf() 2009-01-17 14:27:18 -08:00
gpio gpio: fix probe() error return in gpio driver probes 2009-01-15 16:39:35 -08:00
gpu drm/i915: lock correct mutex around object unreference. 2009-01-16 18:45:22 +10:00
hid
hwmon Merge branch 'hwmon-for-linus' of git://jdelvare.pck.nerim.net/jdelvare-2.6 2009-01-15 16:40:12 -08:00
i2c powerpc/83xx: Move mcu_mpc8349emitx driver out of drivers/i2c/chips/ 2009-01-13 17:46:31 -06:00
ide ide: fix suspend regression 2009-01-14 19:19:04 +01:00
idle
ieee1394
infiniband Merge branches 'ehca', 'ipoib' and 'mlx4' into for-linus 2009-01-16 15:05:54 -08:00
input input: PCF50633 input driver 2009-01-11 01:34:25 +01:00
isdn i4l: minor cleanups 2009-01-14 14:42:21 -08:00
leds lis3lv02d: merge with leds hp disk 2009-01-15 16:39:40 -08:00
lguest
macintosh
mca
md md: don't retry recovery of raid1 that fails due to error on source drive. 2009-01-09 08:31:11 +11:00
media
memstick memstick: annotate endianness of attribute structs 2009-01-09 16:54:41 -08:00
message [SCSI] mpt fusion: Add Firmware debug support 2009-01-13 10:36:02 -06:00
mfd Merge master.kernel.org:/home/rmk/linux-2.6-arm 2009-01-13 14:52:35 -08:00
misc Merge branch 'misc' into release 2009-01-16 14:45:34 -05:00
mmc Merge branch 'next' of git://git.kernel.org/pub/scm/linux/kernel/git/djbw/async_tx 2009-01-09 11:52:14 -08:00
mtd Merge git://git.infradead.org/mtd-2.6 2009-01-09 12:37:15 -08:00
net p54usb: fix nasty use after free 2009-01-22 13:55:02 -05:00
nubus
of drivers/of: Add the of_find_i2c_device_by_node function. 2009-01-09 15:49:06 -07:00
oprofile Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/rric/oprofile 2009-01-09 12:43:06 -08:00
parisc fix early_serial_setup() regression 2009-01-13 14:03:43 -08:00
parport
pci ACPI PCI hotplug: harden against panic regression 2009-01-16 15:20:00 -05:00
pcmcia powerpc: Change u64/s64 to a long long integer type 2009-01-13 14:47:59 +11:00
platform Merge branch 'misc' into release 2009-01-16 14:45:34 -05:00
pnp Merge branch 'linus' into release 2009-01-09 03:39:43 -05:00
power power_supply: PCF50633 battery charger driver 2009-01-11 01:34:24 +01:00
ps3 powerpc/ps3: Printing fixups for l64 to ll64 conversion drivers/ps3 2009-01-16 16:15:14 +11:00
rapidio
regulator move wm8400-regulator's probe function to .devinit.text 2009-01-17 13:46:40 +00:00
rtc rtc: rtc-twl4030 don't mask alarm interrupts on shutdown 2009-01-15 16:39:36 -08:00
s390 qeth: fix usage of netdev_ops 2009-01-11 00:05:16 -08:00
sbus
scsi Merge branch 'merge' of git://git.kernel.org/pub/scm/linux/kernel/git/benh/powerpc 2009-01-16 08:41:09 -08:00
serial serial: Add 16850 uart type support to OF uart driver 2009-01-16 16:15:17 +11:00
sh
sn
spi atmel_spi: allow transfer when max_speed_hz = 0 2009-01-15 16:39:35 -08:00
ssb
staging
tc
telephony
thermal
uio
usb drivers/usb/core/hub.c: fix CONFIG_USB_OTG=y build 2009-01-15 16:39:41 -08:00
uwb
video powerpc/ps3: printing fixups for l64 to ll64 conversion drivers/video 2009-01-16 16:15:15 +11:00
virtio
w1
watchdog [WATCHDOG] Pika Warp appliance watchdog timer 2009-01-12 20:08:56 +00:00
xen
zorro m68k: zorro - Use %pR to print resources 2009-01-12 20:56:43 +01:00
Kconfig
Makefile Merge branch 'drivers-platform' into release 2009-01-09 04:56:56 -05:00