lk/linux-kernel-test
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

IB/ipoib: Fix RCU pointer dereference of wrong object

Browse Source 
Commit b63b70d877 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_neigh_free() (which is
called from a few errors flows in the driver), rcu_dereference() is
invoked with the wrong pointer object, which results in a crash.

Signed-off-by: Shlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
This commit is contained in:
Shlomo Pongratz
2012-08-13 14:39:50 +00:00
committed by Roland Dreier
parent fa16ebed31
commit 6c723a68c6
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
drivers/infiniband/ulp/ipoib/ipoib_main.c
View File

@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
for (n = rcu_dereference_protected(*np, for (n = rcu_dereference_protected(*np,
lockdep_is_held(&ntbl->rwlock)); lockdep_is_held(&ntbl->rwlock));
n != NULL; n != NULL;
n = rcu_dereference_protected(neigh->hnext, n = rcu_dereference_protected(*np,
lockdep_is_held(&ntbl->rwlock))) { lockdep_is_held(&ntbl->rwlock))) {
if (n == neigh) { if (n == neigh) {
/* found */ /* found */