x86: uv: xpc NULL deref when mesq becomes empty

[net-next-2.6.git] / drivers / misc / sgi-xp / xpc_uv.c

diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index bbf0e2ee6fd9c43bcca3c5c8423f424fcfa7ecc2..19bd7b0ede91d7282e42f2e7e5255f750a5f334a 100644 (file)
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -949,11 +949,13 @@ xpc_get_fifo_entry_uv(struct xpc_fifo_head_uv *head)
                head->first = first->next;
                if (head->first == NULL)
                        head->last = NULL;
+
+               head->n_entries--;
+               BUG_ON(head->n_entries < 0);
+
+               first->next = NULL;
        }
-       head->n_entries--;
-       BUG_ON(head->n_entries < 0);
        spin_unlock_irqrestore(&head->lock, irq_flags);
-       first->next = NULL;
        return first;
 }