Commit:     d04d01b113be5b88418eb30087753c3de0a39fd8
Parent:     73b9e9870f5780cb554b68bbcfa47782b27a3e04
Author:     Michael S. Tsirkin <[EMAIL PROTECTED]>
AuthorDate: Thu Mar 22 14:40:16 2007 -0700
Committer:  Roland Dreier <[EMAIL PROTECTED]>
CommitDate: Thu Mar 22 14:40:16 2007 -0700

    IPoIB: Fix use-after-free in path_rec_completion()
    The connected mode code added the possibility that an neigh struct
    gets freed in the list_for_each_entry() loop in path_rec_completion(),
    which causes a use-after-free.  Fix this by changing to the _safe
    variant of the list walking macro.
    This was spotted by the Coverity checker (CID 1567).
    Signed-off-by: Michael S. Tsirkin <[EMAIL PROTECTED]>
    Signed-off-by: Roland Dreier <[EMAIL PROTECTED]>
 drivers/infiniband/ulp/ipoib/ipoib_main.c |    4 ++--
 1 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c 
index f9dbc6f..0741c6d 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -380,7 +380,7 @@ static void path_rec_completion(int status,
        struct net_device *dev = path->dev;
        struct ipoib_dev_priv *priv = netdev_priv(dev);
        struct ipoib_ah *ah = NULL;
-       struct ipoib_neigh *neigh;
+       struct ipoib_neigh *neigh, *tn;
        struct sk_buff_head skqueue;
        struct sk_buff *skb;
        unsigned long flags;
@@ -418,7 +418,7 @@ static void path_rec_completion(int status,
                while ((skb = __skb_dequeue(&path->queue)))
                        __skb_queue_tail(&skqueue, skb);
-               list_for_each_entry(neigh, &path->neigh_list, list) {
+               list_for_each_entry_safe(neigh, tn, &path->neigh_list, list) {
                        neigh->ah = path->ah;
                        memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw,
To unsubscribe from this list: send the line "unsubscribe git-commits-head" in
the body of a message to [EMAIL PROTECTED]
More majordomo info at

Reply via email to