diff options
| author | Shlomo Pongratz <shlomop@mellanox.com> | 2012-08-13 16:39:50 +0200 |
|---|---|---|
| committer | Roland Dreier <roland@purestorage.com> | 2012-08-15 00:21:44 +0200 |
| commit | 6c723a68c661008adf415ee90efe5f737e928ce0 (patch) | |
| tree | bc525e4ced2a854c0f774c4adf56ada985cbe746 /drivers/infiniband/ulp/ipoib | |
| parent | IB/ipoib: Add missing locking when CM object is deleted (diff) | |
| download | linux-6c723a68c661008adf415ee90efe5f737e928ce0.tar.xz linux-6c723a68c661008adf415ee90efe5f737e928ce0.zip | |
IB/ipoib: Fix RCU pointer dereference of wrong object
Commit b63b70d87741 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_neigh_free() (which is
called from a few errors flows in the driver), rcu_dereference() is
invoked with the wrong pointer object, which results in a crash.
Signed-off-by: Shlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband/ulp/ipoib')
| -rw-r--r-- | drivers/infiniband/ulp/ipoib/ipoib_main.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c index 97920b77a5d0..3e2085a3ee47 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c @@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh) for (n = rcu_dereference_protected(*np, lockdep_is_held(&ntbl->rwlock)); n != NULL; - n = rcu_dereference_protected(neigh->hnext, + n = rcu_dereference_protected(*np, lockdep_is_held(&ntbl->rwlock))) { if (n == neigh) { /* found */ |