From: Greg Kroah-Hartman <gregkh@suse.de>
Date: Tue, 1 Jun 2010 22:39:49 +0000 (-0700)
Subject: .31 patch
X-Git-Tag: v2.6.31.14~54
X-Git-Url: http://git.ipfire.org/?a=commitdiff_plain;h=4c3549be597be8f124ff3357c86183caaf129622;p=thirdparty%2Fkernel%2Fstable-queue.git

.31 patch
---

diff --git a/queue-2.6.31/posix_timer-fix-error-path-in-timer_create.patch b/queue-2.6.31/posix_timer-fix-error-path-in-timer_create.patch
new file mode 100644
index 00000000000..ac2b5df630a
--- /dev/null
+++ b/queue-2.6.31/posix_timer-fix-error-path-in-timer_create.patch
@@ -0,0 +1,57 @@
+From 45e0fffc8a7778282e6a1514a6ae3e7ae6545111 Mon Sep 17 00:00:00 2001
+From: Andrey Vagin <avagin@openvz.org>
+Date: Mon, 24 May 2010 12:15:33 -0700
+Subject: posix_timer: Fix error path in timer_create
+
+From: Andrey Vagin <avagin@openvz.org>
+
+commit 45e0fffc8a7778282e6a1514a6ae3e7ae6545111 upstream.
+
+Move CLOCK_DISPATCH(which_clock, timer_create, (new_timer)) after all
+posible EFAULT erros.
+
+*_timer_create may allocate/get resources.
+(for example posix_cpu_timer_create does get_task_struct)
+
+[ tglx: fold the remove crappy comment patch into this ]
+
+Signed-off-by: Andrey Vagin <avagin@openvz.org>
+Cc: Oleg Nesterov <oleg@tv-sign.ru>
+Cc: Pavel Emelyanov <xemul@openvz.org>
+Reviewed-by: Stanislaw Gruszka <sgruszka@redhat.com>
+Signed-off-by: Andrew Morton <akpm@linux-foundation.org>
+Signed-off-by: Thomas Gleixner <tglx@linutronix.de>
+Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
+
+---
+ kernel/posix-timers.c |   11 ++++-------
+ 1 file changed, 4 insertions(+), 7 deletions(-)
+
+--- a/kernel/posix-timers.c
++++ b/kernel/posix-timers.c
+@@ -524,14 +524,7 @@ SYSCALL_DEFINE3(timer_create, const cloc
+ 	new_timer->it_id = (timer_t) new_timer_id;
+ 	new_timer->it_clock = which_clock;
+ 	new_timer->it_overrun = -1;
+-	error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer));
+-	if (error)
+-		goto out;
+ 
+-	/*
+-	 * return the timer_id now.  The next step is hard to
+-	 * back out if there is an error.
+-	 */
+ 	if (copy_to_user(created_timer_id,
+ 			 &new_timer_id, sizeof (new_timer_id))) {
+ 		error = -EFAULT;
+@@ -562,6 +555,10 @@ SYSCALL_DEFINE3(timer_create, const cloc
+ 	new_timer->sigq->info.si_tid   = new_timer->it_id;
+ 	new_timer->sigq->info.si_code  = SI_TIMER;
+ 
++	error = CLOCK_DISPATCH(which_clock, timer_create, (new_timer));
++	if (error)
++		goto out;
++
+ 	spin_lock_irq(&current->sighand->siglock);
+ 	new_timer->it_signal = current->signal;
+ 	list_add(&new_timer->list, &current->signal->posix_timers);
diff --git a/queue-2.6.31/series b/queue-2.6.31/series
index 101c3747369..75a74942b20 100644
--- a/queue-2.6.31/series
+++ b/queue-2.6.31/series
@@ -1,3 +1,4 @@
 alsa-mixart-range-checking-proc-file.patch
 reiserfs-fix-permissions-on-.reiserfs_priv.patch
 reiserfs-fix-corruption-during-shrinking-of-xattrs.patch
+posix_timer-fix-error-path-in-timer_create.patch