Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit d686159e authored by Jack Morgenstein's avatar Jack Morgenstein Committed by Roland Dreier
Browse files

IB/mthca: Fix access to freed memory in catastrophic event handling 



catas_reset() uses a pointer to mthca_dev, but mthca_dev is not valid
after the call to __mthca_restart_one().

Based on a similar patch for mlx4 (634354d7, "mlx4: Fix access to
freed memory") by Vitaliy Gusev <vgusev@openvz.org>

Signed-off-by: default avatarJack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
parent 86d71014

drivers/infiniband/hw/mthca/mthca_catas.c

+8 −3
Original line number Diff line number Diff line
@@ -68,11 +68,16 @@ static void catas_reset(struct work_struct *work) 
	spin_unlock_irq(&catas_lock);



	list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) {

		struct pci_dev *pdev = dev->pdev;

		ret = __mthca_restart_one(dev->pdev);

		/* 'dev' now is not valid */

		if (ret)

			mthca_err(dev, "Reset failed (%d)\n", ret);

		else

			mthca_dbg(dev, "Reset succeeded\n");

			printk(KERN_ERR "mthca %s: Reset failed (%d)\n",

			       pci_name(pdev), ret);

		else {

			struct mthca_dev *d = pci_get_drvdata(pdev);

			mthca_dbg(d, "Reset succeeded\n");

		}

	}



	mutex_unlock(&mthca_device_mutex);