firewire: ohci: fix buffer overflow in AR split packet handling
authorClemens Ladisch <clemens@ladisch.de>
Mon, 25 Oct 2010 09:41:53 +0000 (11:41 +0200)
committerStefan Richter <stefanr@s5r6.in-berlin.de>
Sat, 30 Oct 2010 21:37:19 +0000 (23:37 +0200)
commit85f7ffd5d2b320f73912b15fe8cef34bae297daf
treed9151979bb3834bd1254239a42247a668f059133
parentf6f94e2ab1b33f0082ac22d71f66385a60d8157f
firewire: ohci: fix buffer overflow in AR split packet handling

When the controller had to split a received asynchronous packet into two
buffers, the driver tries to reassemble it by copying both parts into
the first page.  However, if size + rest > PAGE_SIZE, i.e., if the yet
unhandled packets before the split packet, the split packet itself, and
any received packets after the split packet are together larger than one
page, then the memory after the first page would get overwritten.

To fix this, do not try to copy the data of all unhandled packets at
once, but copy the possibly needed data every time when handling
a packet.

This gets rid of most of the infamous crashes and data corruptions when
using firewire-net.

Signed-off-by: Clemens Ladisch <clemens@ladisch.de>
Cc: 2.6.22-2.6.36 <stable@kernel.org>
Tested-by: Maxim Levitsky <maximlevitsky@gmail.com>
Signed-off-by: Stefan Richter <stefanr@s5r6.in-berlin.de> (cast PAGE_SIZE to size_t)
drivers/firewire/ohci.c