rpms/kernel/devel kernel.spec, 1.454, 1.455 linux-2.6-firewire-git-pending.patch, 1.7, 1.8

[Jarod Wilson (jwilson)]

Author: jwilson

Update of /cvs/pkgs/rpms/kernel/devel
In directory cvs-int.fedora.redhat.com:/tmp/cvs-serv9768

Modified Files:
	kernel.spec linux-2.6-firewire-git-pending.patch 
Log Message:
* Wed Feb 27 2008 Jarod Wilson <jwilson at redhat.com>
- firewire-sbp2: fix refcounting bug that prevented module unload
- firewire-sbp2: fix use-after-free bug



Index: kernel.spec
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/kernel.spec,v
retrieving revision 1.454
retrieving revision 1.455
diff -u -r1.454 -r1.455
--- kernel.spec	27 Feb 2008 04:41:28 -0000	1.454
+++ kernel.spec	27 Feb 2008 21:43:12 -0000	1.455
@@ -1139,7 +1139,8 @@
 #ApplyPatch linux-2.6-firewire-git-update.patch
 C=$(wc -l $RPM_SOURCE_DIR/linux-2.6-firewire-git-pending.patch | awk '{print $1}')
 if [ "$C" -gt 10 ]; then
-ApplyPatch linux-2.6-firewire-git-pending.patch
+echo foo
+#ApplyPatch linux-2.6-firewire-git-pending.patch
 fi
 
 # usb video
@@ -1733,8 +1734,9 @@
 %kernel_variant_files -a /%{image_install_path}/xen*-%{KVERREL} -e /etc/ld.so.conf.d/kernelcap-%{KVERREL}.conf %{with_xen} xen
 
 %changelog
-* Tue Feb 26 2008 Jarod Wilson <jwilson at redhat.com>
+* Wed Feb 27 2008 Jarod Wilson <jwilson at redhat.com>
 - firewire-sbp2: fix refcounting bug that prevented module unload
+- firewire-sbp2: fix use-after-free bug
 
 * Tue Feb 26 2008 Dave Jones <davej at redhat.com>
 - 2.6.25-rc3-git1

linux-2.6-firewire-git-pending.patch:

Index: linux-2.6-firewire-git-pending.patch
===================================================================
RCS file: /cvs/pkgs/rpms/kernel/devel/linux-2.6-firewire-git-pending.patch,v
retrieving revision 1.7
retrieving revision 1.8
diff -u -r1.7 -r1.8
--- linux-2.6-firewire-git-pending.patch	27 Feb 2008 04:41:28 -0000	1.7
+++ linux-2.6-firewire-git-pending.patch	27 Feb 2008 21:43:12 -0000	1.8
@@ -524,13 +524,15 @@
 Update:  Refreshed to be applicable after patch "firewire: fw-sbp2:
 better fix for NULL pointer dereference in scsi_remove_device".
 
+Update 2:  Update 1 had a use-after-free bug. #-|
+
 
  drivers/firewire/fw-card.c        |   10 +++++++++-
  drivers/firewire/fw-device.c      |   21 ++++++---------------
  drivers/firewire/fw-device.h      |   16 ++++++++++++++--
- drivers/firewire/fw-sbp2.c        |    3 +++
+ drivers/firewire/fw-sbp2.c        |    4 ++++
  drivers/firewire/fw-transaction.h |    2 ++
- 5 files changed, 34 insertions(+), 18 deletions(-)
+ 5 files changed, 35 insertions(+), 18 deletions(-)
 
 Index: linux/drivers/firewire/fw-card.c
 ===================================================================
@@ -630,15 +632,23 @@
 ===================================================================
 --- linux.orig/drivers/firewire/fw-sbp2.c
 +++ linux/drivers/firewire/fw-sbp2.c
-@@ -791,6 +791,7 @@ static void sbp2_release_target(struct k
+@@ -769,6 +769,7 @@ static void sbp2_release_target(struct k
+ 	struct Scsi_Host *shost =
+ 		container_of((void *)tgt, struct Scsi_Host, hostdata[0]);
+ 	struct scsi_device *sdev;
++	struct fw_device *device = fw_device(tgt->unit->device.parent);
+ 
+ 	/* prevent deadlocks */
+ 	sbp2_unblock(tgt);
+@@ -791,6 +792,7 @@ static void sbp2_release_target(struct k
  
  	put_device(&tgt->unit->device);
  	scsi_host_put(shost);
-+	fw_device_put(fw_device(tgt->unit->device.parent));
++	fw_device_put(device);
  }
  
  static struct workqueue_struct *sbp2_wq;
-@@ -1088,6 +1089,8 @@ static int sbp2_probe(struct device *dev
+@@ -1088,6 +1090,8 @@ static int sbp2_probe(struct device *dev
  	if (scsi_add_host(shost, &unit->device) < 0)
  		goto fail_shost_put;
  
@@ -698,10 +708,11 @@
 
 -- 
 Stefan Richter
--=====-==--- --=- ==-=-
+-=====-==--- --=- ==-==
 http://arcgraph.de/sr/
 
 
+
 The card->kref became obsolete since patch "firewire: fix crash in
 automatic module unloading" added another counter of card users.
 
@@ -952,16 +963,16 @@
 ===================================================================
 --- linux.orig/drivers/firewire/fw-sbp2.c
 +++ linux/drivers/firewire/fw-sbp2.c
-@@ -789,7 +789,7 @@ static void sbp2_release_target(struct k
+@@ -790,7 +790,7 @@ static void sbp2_release_target(struct k
  	scsi_remove_host(shost);
  	fw_notify("released %s\n", tgt->bus_id);
  
 -	put_device(&tgt->unit->device);
 +	fw_unit_put(tgt->unit);
  	scsi_host_put(shost);
- 	fw_device_put(fw_device(tgt->unit->device.parent));
+ 	fw_device_put(device);
  }
-@@ -1090,7 +1090,7 @@ static int sbp2_probe(struct device *dev
+@@ -1091,7 +1091,7 @@ static int sbp2_probe(struct device *dev
  		goto fail_shost_put;
  
  	fw_device_get(device);
@@ -970,3 +981,10 @@
  
  	/* Initialize to values that won't match anything in our table. */
  	firmware_revision = 0xff000000;
+
+-- 
+Stefan Richter
+-=====-==--- --=- ==---
+http://arcgraph.de/sr/
+
+