[patch 5/6] x86: UV - XPC NULL deref when mesq becomes empty.

[Robin Holt]

Under heavy load conditions, our set of xpc messages may become exhausted.
The code handles this correctly with the exception of the management code.

To: Ingo Molnar <mingo@xxxxxxx>
Signed-off-by: Robin Holt <holt@xxxxxxx>
Cc: Jack Steiner <steiner@xxxxxxx>
Cc: lkml <linux-kernel@xxxxxxxxxxxxxxx>

---

 drivers/misc/sgi-xp/xpc_uv.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
Index: linux-2.6.27/drivers/misc/sgi-xp/xpc_uv.c
===================================================================
--- linux-2.6.27.orig/drivers/misc/sgi-xp/xpc_uv.c	2009-10-29 10:43:23.000000000 -0500
+++ linux-2.6.27/drivers/misc/sgi-xp/xpc_uv.c	2009-10-29 13:23:19.000000000 -0500
@@ -947,11 +947,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_he
 		head->first = first->next;
 		if (head->first == NULL)
 			head->last = NULL;
+
+		head->n_entries--;
+		BUG_ON(head->n_entries < 0);
+
+		first->next = NULL;
 	}
-	head->n_entries--;
-	BUG_ON(head->n_entries < 0);
 	spin_unlock_irqrestore(&head->lock, irq_flags);
-	first->next = NULL;
 	return first;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/