[patch 6/8] x86: UV - XPC NULL deref when mesq becomes empty.

[Robin Holt]

Under heavy load conditions, our set of xpc messages may become exhausted.
The code handles this correctly with the exception of the management
code which hits a NULL pointer dereference.

To: Ingo Molnar <mingo@xxxxxxx>
To: tglx@xxxxxxxxxxxxx
Signed-off-by: Robin Holt <holt@xxxxxxx>
Cc: Jack Steiner <steiner@xxxxxxx>
Cc: linux-kernel@xxxxxxxxxxxxxxx

---

 drivers/misc/sgi-xp/xpc_uv.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
Index: linux-x86/drivers/misc/sgi-xp/xpc_uv.c
===================================================================
--- linux-x86.orig/drivers/misc/sgi-xp/xpc_uv.c	2009-11-18 21:41:23.000000000 -0600
+++ linux-x86/drivers/misc/sgi-xp/xpc_uv.c	2009-11-18 21:41:26.000000000 -0600
@@ -949,11 +949,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_he
 		head->first = first->next;
 		if (head->first == NULL)
 			head->last = NULL;
+
+		head->n_entries--;
+		BUG_ON(head->n_entries < 0);
+
+		first->next = NULL;
 	}
-	head->n_entries--;
-	BUG_ON(head->n_entries < 0);
 	spin_unlock_irqrestore(&head->lock, irq_flags);
-	first->next = NULL;
 	return first;
 }
 

--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/