Actually I see that tx->neigh is already set to NULL in ipoib_cm_destroy_tx so this fixes nothing. Although when I did this my system stopped crashing. I guess I have to dig farther. By the way this happens when I run netperf UDP and the connection is closed during the test runs.
On Wed, 2007-11-28 at 18:05 +0200, Eli Cohen wrote: > Bug fix IPOIB CM dereferencing invalid pointer > > When ipoib_neigh_free gets called it needs to set to NULL > its ->cm->neigh member So that a completion with error reaching > ipoib_cm_handle_tx_wc will not access an invalid pointer. > > Signed-off-by: Eli Cohen <[EMAIL PROTECTED]> > --- > > This is what I really meant to send > > > drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 ++++ > 1 files changed, 4 insertions(+), 0 deletions(-) > > diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c > b/drivers/infiniband/ulp/ipoib/ipoib_main.c > index a03a65e..0c66723 100644 > --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c > +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c > @@ -869,6 +869,10 @@ void ipoib_neigh_free(struct net_device *dev, struct > ipoib_neigh *neigh) > } > if (ipoib_cm_get(neigh)) > ipoib_cm_destroy_tx(ipoib_cm_get(neigh)); > + > + if (neigh->cm) > + neigh->cm->neigh = NULL; > + > kfree(neigh); > } > _______________________________________________ general mailing list [email protected] http://lists.openfabrics.org/cgi-bin/mailman/listinfo/general To unsubscribe, please visit http://openib.org/mailman/listinfo/openib-general
