Bug fix IPOIB CM dereferencing invalid pointer
When ipoib_neigh_free gets called it needs to set to NULL
its ->cm member so that a completion with error reaching
ipoib_cm_handle_tx_wc will not access an invalid pointer.
Signed-off-by: Eli Cohen <[EMAIL PROTECTED]>
---
drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 ++
1 files changed, 2 insertions(+), 0 deletions(-)
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c
b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index a03a65e..95c7714 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -869,6 +869,8 @@ void ipoib_neigh_free(struct net_device *dev, struct
ipoib_neigh *neigh)
}
if (ipoib_cm_get(neigh))
ipoib_cm_destroy_tx(ipoib_cm_get(neigh));
+
+ neigh->cm = NULL;
kfree(neigh);
}
--
1.5.3.6
_______________________________________________
general mailing list
[email protected]
http://lists.openfabrics.org/cgi-bin/mailman/listinfo/general
To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
