hollalinux
/
linux-sg2042
mirror of https://github.com/sophgo/linux-riscv.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity

IB/mthca: Fix access to freed memory in catastrophic event handling 

catas_reset() uses a pointer to mthca_dev, but mthca_dev is not valid
after the call to __mthca_restart_one().

Based on a similar patch for mlx4 (634354d7, "mlx4: Fix access to
freed memory") by Vitaliy Gusev <vgusev@openvz.org>

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
This commit is contained in:
Jack Morgenstein 2009-09-24 11:55:41 -07:00 committed by Roland Dreier
parent 86d710146f
commit d686159e50
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/infiniband/hw/mthca/mthca_catas.c
View File

@ -68,11 +68,16 @@ static void catas_reset(struct work_struct *work)
spin_unlock_irq(&catas_lock); spin_unlock_irq(&catas_lock);
list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) { list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) {
struct pci_dev *pdev = dev->pdev;
ret = __mthca_restart_one(dev->pdev); ret = __mthca_restart_one(dev->pdev);
/* 'dev' now is not valid */
if (ret) if (ret)
mthca_err(dev, "Reset failed (%d)\n", ret); printk(KERN_ERR "mthca %s: Reset failed (%d)\n",
else pci_name(pdev), ret);
mthca_dbg(dev, "Reset succeeded\n"); else {
struct mthca_dev *d = pci_get_drvdata(pdev);
mthca_dbg(d, "Reset succeeded\n");
}
} }
mutex_unlock(&mthca_device_mutex); mutex_unlock(&mthca_device_mutex);