Bug fix IPOIB CM dereferencing invalid pointer
When ipoib_neigh_free gets called it needs to set to NULL
its ->cm->neigh member So that a completion with error reaching
ipoib_cm_handle_tx_wc will not access an invalid pointer.
Signed-off-by: Eli Cohen <[EMAIL PROTECTED]>
---
This is what I really meant to send
drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 ++++
1 files changed, 4 insertions(+), 0 deletions(-)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index a03a65e..0c66723 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -869,6 +869,10 @@ void ipoib_neigh_free(struct net_device *dev, struct
ipoib_neigh *neigh)
}
if (ipoib_cm_get(neigh))
ipoib_cm_destroy_tx(ipoib_cm_get(neigh));
+
+ if (neigh->cm)
+ neigh->cm->neigh = NULL;
+
kfree(neigh);
}
--
1.5.3.6
_______________________________________________
general mailing list
[email protected]
http://lists.openfabrics.org/cgi-bin/mailman/listinfo/general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
