[patch 5/6] x86: UV - XPC NULL deref when mesq becomes empty.

[Robin Holt <holt@sgi.com>]

[-- Attachment #1: xpc_fix_xpc_get_fifo_entry_uv --]
[-- Type: text/plain, Size: 1062 bytes --]


Under heavy load conditions, our set of xpc messages may become exhausted.
The code handles this correctly with the exception of the management code.

To: Ingo Molnar <mingo@elte.hu>
Signed-off-by: Robin Holt <holt@sgi.com>
Cc: Jack Steiner <steiner@sgi.com>
Cc: lkml <linux-kernel@vger.kernel.org>

---

 drivers/misc/sgi-xp/xpc_uv.c |    8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)
Index: linux-2.6.27/drivers/misc/sgi-xp/xpc_uv.c
===================================================================
--- linux-2.6.27.orig/drivers/misc/sgi-xp/xpc_uv.c	2009-10-29 10:43:23.000000000 -0500
+++ linux-2.6.27/drivers/misc/sgi-xp/xpc_uv.c	2009-10-29 13:23:19.000000000 -0500
@@ -947,11 +947,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_he
 		head->first = first->next;
 		if (head->first == NULL)
 			head->last = NULL;
+
+		head->n_entries--;
+		BUG_ON(head->n_entries < 0);
+
+		first->next = NULL;
 	}
-	head->n_entries--;
-	BUG_ON(head->n_entries < 0);
 	spin_unlock_irqrestore(&head->lock, irq_flags);
-	first->next = NULL;
 	return first;
 }