git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
xenbus: don't BUG() on user mode induced condition
[pandora-kernel.git]
/
drivers
/
xen
/
xenfs
/
xenbus.c
diff --git
a/drivers/xen/xenfs/xenbus.c
b/drivers/xen/xenfs/xenbus.c
index
bbd000f
..
e6a63ee
100644
(file)
--- a/
drivers/xen/xenfs/xenbus.c
+++ b/
drivers/xen/xenfs/xenbus.c
@@
-310,11
+310,18
@@
static int xenbus_write_transaction(unsigned msg_type,
rc = -ENOMEM;
goto out;
}
rc = -ENOMEM;
goto out;
}
+ } else {
+ list_for_each_entry(trans, &u->transactions, list)
+ if (trans->handle.id == u->u.msg.tx_id)
+ break;
+ if (&trans->list == &u->transactions)
+ return -ESRCH;
}
reply = xenbus_dev_request_and_reply(&u->u.msg);
if (IS_ERR(reply)) {
}
reply = xenbus_dev_request_and_reply(&u->u.msg);
if (IS_ERR(reply)) {
- kfree(trans);
+ if (msg_type == XS_TRANSACTION_START)
+ kfree(trans);
rc = PTR_ERR(reply);
goto out;
}
rc = PTR_ERR(reply);
goto out;
}
@@
-324,12
+331,7
@@
static int xenbus_write_transaction(unsigned msg_type,
list_add(&trans->list, &u->transactions);
} else if (msg_type == XS_TRANSACTION_END) {
list_add(&trans->list, &u->transactions);
} else if (msg_type == XS_TRANSACTION_END) {
- list_for_each_entry(trans, &u->transactions, list)
- if (trans->handle.id == u->u.msg.tx_id)
- break;
- BUG_ON(&trans->list == &u->transactions);
list_del(&trans->list);
list_del(&trans->list);
-
kfree(trans);
}
kfree(trans);
}