hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

RDMA/nes: Free IRQ before killing tasklet 

Move the free_irq() call in nes_remove() to before the tasklet_kill();
otherwise there is a window after tasklet_kill() where a new interrupt
can be handled and reschedule the tasklet, leading to a use-after-free
crash.

Cc: <stable@kernel.org>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Roland Dreier 2008-04-16 21:09:34 -07:00
parent 940801b27e
commit 4cd1e5eb3c
1 changed files with 2 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
drivers/infiniband/hw/nes/nes.c
View File

@ -744,13 +744,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
list_del(&nesdev->list); list_del(&nesdev->list);
nes_destroy_cqp(nesdev); nes_destroy_cqp(nesdev);
free_irq(pcidev->irq, nesdev);
tasklet_kill(&nesdev->dpc_tasklet); tasklet_kill(&nesdev->dpc_tasklet);
/* Deallocate the Adapter Structure */ /* Deallocate the Adapter Structure */
nes_destroy_adapter(nesdev->nesadapter); nes_destroy_adapter(nesdev->nesadapter);
free_irq(pcidev->irq, nesdev);
if (nesdev->msi_enabled) { if (nesdev->msi_enabled) {
pci_disable_msi(pcidev); pci_disable_msi(pcidev);
} }