| commit | 7286f0757fcfc724e3f4a11fa838cf6870181b24 | |
| author | Robin Holt <holt@sgi.com> | |
| Tue, 26 Oct 2010 21:21:15 +0000 (26 14:21 -0700) | ||
| committer | Greg Kroah-Hartman <gregkh@suse.de> | |
| Mon, 22 Nov 2010 19:03:18 +0000 (22 11:03 -0800) | ||
| tree | 81e6cca440b6d0f2ae451d1a9a46bc57aabd9691 | treesnapshot (tar.gz zip) |
| parent | 14607581fa524a38a6ad012181bfcb8de154f5d3 | commitdiff |
sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down
commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream.
Under some workloads, some channel messages have been observed being
delayed on the sending side past the point where the receiving side has
been able to tear down its partition structures.
This condition is already detected in xpc_handle_activate_IRQ_uv(), but
that information is not given to xpc_handle_activate_mq_msg_uv(). As a
result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist
and references them, causing a NULL-pointer deref.
Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream.
Under some workloads, some channel messages have been observed being
delayed on the sending side past the point where the receiving side has
been able to tear down its partition structures.
This condition is already detected in xpc_handle_activate_IRQ_uv(), but
that information is not given to xpc_handle_activate_mq_msg_uv(). As a
result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist
and references them, causing a NULL-pointer deref.
Signed-off-by: Robin Holt <holt@sgi.com>
Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| drivers/misc/sgi-xp/xpc_uv.c | diffblobblamehistory |