From: Hans-Joachim Picht <hpicht@redhat.com>
Date: Fri, 27 Feb 2009 20:52:10 +0100
Subject: [s390] af_iucv: free iucv path/socket in path_pending cb
Message-id: 20090227195210.GR2447@redhat.com
O-Subject: [RHEL5 U4 PATCH 4/7] s390 - af_iucv: Free iucv path/socket in path_pending callbac
Bugzilla: 487697

Description
============

Free iucv path after iucv_path_sever() calls in iucv_callback_connreq()
(path_pending() iucv callback).
If iucv_path_accept() fails, free path and free/kill newly created socket.

Bugzilla
=========

BZ 487697
https://bugzilla.redhat.com/show_bug.cgi?id=487697

Upstream status of the patch:
=============================

This patch is included in linux-2.6 as
git commit 65dbd7c2778f1921ef1ee2a73e47a2a126fed30f

Test status:
============

The patch has been tested and fixes the problem.
The fix has been verified by the IBM test department.

Please ACK.

With best regards,

	--Hans

diff --git a/net/iucv/af_iucv.c b/net/iucv/af_iucv.c
index 5597666..86b1aa1 100644
--- a/net/iucv/af_iucv.c
+++ b/net/iucv/af_iucv.c
@@ -1032,12 +1032,14 @@ static int iucv_callback_connreq(struct iucv_path *path,
 	ASCEBC(user_data, sizeof(user_data));
 	if (sk->sk_state != IUCV_LISTEN) {
 		err = iucv_path_sever(path, user_data);
+		iucv_path_free(path);
 		goto fail;
 	}
 
 	/* Check for backlog size */
 	if (sk_acceptq_is_full(sk)) {
 		err = iucv_path_sever(path, user_data);
+		iucv_path_free(path);
 		goto fail;
 	}
 
@@ -1045,6 +1047,7 @@ static int iucv_callback_connreq(struct iucv_path *path,
 	nsk = iucv_sock_alloc(NULL, SOCK_STREAM, GFP_ATOMIC);
 	if (!nsk) {
 		err = iucv_path_sever(path, user_data);
+		iucv_path_free(path);
 		goto fail;
 	}
 
@@ -1068,6 +1071,8 @@ static int iucv_callback_connreq(struct iucv_path *path,
 	err = iucv_path_accept(path, &af_iucv_handler, nuser_data, nsk);
 	if (err) {
 		err = iucv_path_sever(path, user_data);
+		iucv_path_free(path);
+		iucv_sock_kill(nsk);
 		goto fail;
 	}