Commit 8aa651e2 authored by Linus Torvalds's avatar Linus Torvalds
Browse files

Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/dlm 

* 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/teigland/dlm:
  dlm: free socket in error exit path
  dlm: fix plock use-after-free
  dlm: Fix uninitialised variable warning in lock.c
parents d878fe23 a89d63a1

fs/dlm/lock.c

+1 −1
Original line number Diff line number Diff line
@@ -435,7 +435,7 @@ static int search_rsb(struct dlm_ls *ls, char *name, int len, int b, 
static int find_rsb(struct dlm_ls *ls, char *name, int namelen,

		    unsigned int flags, struct dlm_rsb **r_ret)

{

	struct dlm_rsb *r, *tmp;

	struct dlm_rsb *r = NULL, *tmp;

	uint32_t hash, bucket;

	int error = -EINVAL;

fs/dlm/lowcomms.c

+3 −1
Original line number Diff line number Diff line
@@ -902,7 +902,7 @@ static void tcp_connect_to_sock(struct connection *con) 
	int result = -EHOSTUNREACH;

	struct sockaddr_storage saddr, src_addr;

	int addr_len;

	struct socket *sock;

	struct socket *sock = NULL;



	if (con->nodeid == 0) {

		log_print("attempt to connect sock 0 foiled");
@@ -962,6 +962,8 @@ static void tcp_connect_to_sock(struct connection *con) 
	if (con->sock) {

		sock_release(con->sock);

		con->sock = NULL;

	} else if (sock) {

		sock_release(sock);

	}

	/*

	 * Some errors are fatal and this list might need adjusting. For other

fs/dlm/plock.c

+10 −7
Original line number Diff line number Diff line
@@ -353,7 +353,7 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, 
{

	struct dlm_plock_info info;

	struct plock_op *op;

	int found = 0;

	int found = 0, do_callback = 0;



	if (count != sizeof(info))

		return -EINVAL;
@@ -366,21 +366,24 @@ static ssize_t dev_write(struct file *file, const char __user *u, size_t count, 


	spin_lock(&ops_lock);

	list_for_each_entry(op, &recv_list, list) {

		if (op->info.fsid == info.fsid && op->info.number == info.number &&

		if (op->info.fsid == info.fsid &&

		    op->info.number == info.number &&

		    op->info.owner == info.owner) {

			struct plock_xop *xop = (struct plock_xop *)op;

			list_del_init(&op->list);

			found = 1;

			op->done = 1;

			memcpy(&op->info, &info, sizeof(info));

			if (xop->callback)

				do_callback = 1;

			else

				op->done = 1;

			found = 1;

			break;

		}

	}

	spin_unlock(&ops_lock);



	if (found) {

		struct plock_xop *xop;

		xop = (struct plock_xop *)op;

		if (xop->callback)

		if (do_callback)

			dlm_plock_callback(op);

		else

			wake_up(&recv_wq);