Tlabel is a 6 bits wide datum. Wrap it after 63 rather than 31 for more
safety against transaction label exhaustion and potential responders'
transaction layer bugs. (As noted by Guus Sliepen, this change requires
an expansion of tlabel_mask to 64 bits.)
Signed-off-by: Stefan Richter <[email protected]>
---
drivers/firewire/core-transaction.c | 8 ++++----
include/linux/firewire.h | 3 ++-
2 files changed, 6 insertions(+), 5 deletions(-)
Index: b/drivers/firewire/core-transaction.c
===================================================================
--- a/drivers/firewire/core-transaction.c
+++ b/drivers/firewire/core-transaction.c
@@ -82,7 +82,7 @@ static int close_transaction(struct fw_t
list_for_each_entry(t, &card->transaction_list, link) {
if (t == transaction) {
list_del(&t->link);
- card->tlabel_mask &= ~(1 << t->tlabel);
+ card->tlabel_mask &= ~(1ULL << t->tlabel);
break;
}
}
@@ -288,14 +288,14 @@ void fw_send_request(struct fw_card *car
spin_lock_irqsave(&card->lock, flags);
tlabel = card->current_tlabel;
- if (card->tlabel_mask & (1 << tlabel)) {
+ if (card->tlabel_mask & (1ULL << tlabel)) {
spin_unlock_irqrestore(&card->lock, flags);
callback(card, RCODE_SEND_ERROR, NULL, 0, callback_data);
return;
}
- card->current_tlabel = (card->current_tlabel + 1) & 0x1f;
- card->tlabel_mask |= (1 << tlabel);
+ card->current_tlabel = (card->current_tlabel + 1) & 0x3f;
+ card->tlabel_mask |= (1ULL << tlabel);
t->node_id = destination_id;
t->tlabel = tlabel;
Index: b/include/linux/firewire.h
===================================================================
--- a/include/linux/firewire.h
+++ b/include/linux/firewire.h
@@ -98,7 +98,8 @@ struct fw_card {
int node_id;
int generation;
- int current_tlabel, tlabel_mask;
+ int current_tlabel;
+ u64 tlabel_mask;
struct list_head transaction_list;
struct timer_list flush_timer;
unsigned long reset_jiffies;
--
Stefan Richter
-=====-==--= -==- -===-
http://arcgraph.de/sr/