From: Ursula Braun <braunu@xxxxxxxxxx>
A race has been detected in iucv_callback_txdone().
skb_unlink has to be done inside the locked area.
In addition checkings for successful allocations are inserted.
Signed-off-by: Ursula Braun <braunu@xxxxxxxxxx>
---
net/iucv/af_iucv.c | 8 +++++++-
1 file changed, 7 insertions(+), 1 deletion(-)
diff -urpN linux-2.6/net/iucv/af_iucv.c linux-2.6-patched/net/iucv/af_iucv.c
--- linux-2.6/net/iucv/af_iucv.c 2008-02-07 13:24:12.000000000 +0100
+++ linux-2.6-patched/net/iucv/af_iucv.c 2008-02-07 13:24:38.000000000 +0100
@@ -482,6 +482,10 @@ static int iucv_sock_connect(struct sock
/* Create path. */
iucv->path = iucv_path_alloc(IUCV_QUEUELEN_DEFAULT,
IPRMDATA, GFP_KERNEL);
+ if (!iucv->path) {
+ err = -ENOMEM;
+ goto done;
+ }
err = iucv_path_connect(iucv->path, &af_iucv_handler,
sa->siucv_user_id, NULL, user_data, sk);
if (err) {
@@ -1094,6 +1098,8 @@ static void iucv_callback_rx(struct iucv
save_message:
save_msg = kzalloc(sizeof(struct sock_msg_q), GFP_ATOMIC | GFP_DMA);
+ if (!save_msg)
+ return;
save_msg->path = path;
save_msg->msg = *msg;
@@ -1118,10 +1124,10 @@ static void iucv_callback_txdone(struct
this = list_skb;
list_skb = list_skb->next;
} while (memcmp(&msg->tag, this->cb, 4) && list_skb);
+ __skb_unlink(this, list);
spin_unlock_irqrestore(&list->lock, flags);
- skb_unlink(this, &iucv_sk(sk)->send_skb_q);
kfree_skb(this);
}
--
-
To unsubscribe from this list: send the line "unsubscribe linux-s390" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
