On Sun, Nov 26, 2006 at 06:00:53PM +0800, Eugene Teo wrote:This patch adds a missing sctp_spin_unlock_irqrestore when returning
from "if(space_left<addrlen)" condition.
if (copy_to_user(*to, &temp, addrlen)) {
- sctp_spin_unlock_irqrestore(&sctp_local_addr_lock,
- flags);
- return -EFAULT;
+ err = -EFAULT;
+ goto unlock;
+ sctp_spin_unlock_irqrestore(&sctp_local_addr_lock, flags);
+ return err;
}
You do realize that it's obviously still badly broken, don't you?
copy_to_user() under a spinlock is a recipe for deadlock, especially
if you've got interrupts disabled...