git.ipfire.org Git - thirdparty/kernel/stable-queue.git/blob

   1 From 09358972bff5ce99de496bbba97c85d417b3c054 Mon Sep 17 00:00:00 2001
   2 From: Robin Holt <holt@sgi.com>
   3 Date: Tue, 26 Oct 2010 14:21:15 -0700
   4 Subject: sgi-xp: incoming XPC channel messages can come in after the channel's partition structures have been torn down
   5
   6 From: Robin Holt <holt@sgi.com>
   7
   8 commit 09358972bff5ce99de496bbba97c85d417b3c054 upstream.
   9
  10 Under some workloads, some channel messages have been observed being
  11 delayed on the sending side past the point where the receiving side has
  12 been able to tear down its partition structures.
  13
  14 This condition is already detected in xpc_handle_activate_IRQ_uv(), but
  15 that information is not given to xpc_handle_activate_mq_msg_uv().  As a
  16 result, xpc_handle_activate_mq_msg_uv() assumes the structures still exist
  17 and references them, causing a NULL-pointer deref.
  18
  19 Signed-off-by: Robin Holt <holt@sgi.com>
  20 Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
  21 Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
  22 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  23
  24 ---
  25  drivers/misc/sgi-xp/xpc_uv.c |   17 +++++++++++++++++
  26  1 file changed, 17 insertions(+)
  27
  28 --- a/drivers/misc/sgi-xp/xpc_uv.c
  29 +++ b/drivers/misc/sgi-xp/xpc_uv.c
  30 @@ -417,6 +417,7 @@ xpc_process_activate_IRQ_rcvd_uv(void)
  31  static void
  32  xpc_handle_activate_mq_msg_uv(struct xpc_partition *part,
  33                               struct xpc_activate_mq_msghdr_uv *msg_hdr,
  34 +                             int part_setup,
  35                               int *wakeup_hb_checker)
  36  {
  37         unsigned long irq_flags;
  38 @@ -481,6 +482,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc
  39         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREQUEST_UV: {
  40                 struct xpc_activate_mq_msg_chctl_closerequest_uv *msg;
  41
  42 +               if (!part_setup)
  43 +                       break;
  44 +
  45                 msg = container_of(msg_hdr, struct
  46                                    xpc_activate_mq_msg_chctl_closerequest_uv,
  47                                    hdr);
  48 @@ -497,6 +501,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc
  49         case XPC_ACTIVATE_MQ_MSG_CHCTL_CLOSEREPLY_UV: {
  50                 struct xpc_activate_mq_msg_chctl_closereply_uv *msg;
  51
  52 +               if (!part_setup)
  53 +                       break;
  54 +
  55                 msg = container_of(msg_hdr, struct
  56                                    xpc_activate_mq_msg_chctl_closereply_uv,
  57                                    hdr);
  58 @@ -511,6 +518,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc
  59         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREQUEST_UV: {
  60                 struct xpc_activate_mq_msg_chctl_openrequest_uv *msg;
  61
  62 +               if (!part_setup)
  63 +                       break;
  64 +
  65                 msg = container_of(msg_hdr, struct
  66                                    xpc_activate_mq_msg_chctl_openrequest_uv,
  67                                    hdr);
  68 @@ -528,6 +538,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc
  69         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENREPLY_UV: {
  70                 struct xpc_activate_mq_msg_chctl_openreply_uv *msg;
  71
  72 +               if (!part_setup)
  73 +                       break;
  74 +
  75                 msg = container_of(msg_hdr, struct
  76                                    xpc_activate_mq_msg_chctl_openreply_uv, hdr);
  77                 args = &part->remote_openclose_args[msg->ch_number];
  78 @@ -545,6 +558,9 @@ xpc_handle_activate_mq_msg_uv(struct xpc
  79         case XPC_ACTIVATE_MQ_MSG_CHCTL_OPENCOMPLETE_UV: {
  80                 struct xpc_activate_mq_msg_chctl_opencomplete_uv *msg;
  81
  82 +               if (!part_setup)
  83 +                       break;
  84 +
  85                 msg = container_of(msg_hdr, struct
  86                                 xpc_activate_mq_msg_chctl_opencomplete_uv, hdr);
  87                 spin_lock_irqsave(&part->chctl_lock, irq_flags);
  88 @@ -621,6 +637,7 @@ xpc_handle_activate_IRQ_uv(int irq, void
  89
  90                         part_referenced = xpc_part_ref(part);
  91                         xpc_handle_activate_mq_msg_uv(part, msg_hdr,
  92 +                                                     part_referenced,
  93                                                       &wakeup_hb_checker);
  94                         if (part_referenced)
  95                                 xpc_part_deref(part);