Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6c723a68 authored by Shlomo Pongratz's avatar Shlomo Pongratz Committed by Roland Dreier
Browse files

IB/ipoib: Fix RCU pointer dereference of wrong object 



Commit b63b70d8 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_neigh_free() (which is
called from a few errors flows in the driver), rcu_dereference() is
invoked with the wrong pointer object, which results in a crash.

Signed-off-by: default avatarShlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: default avatarOr Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: default avatarRoland Dreier <roland@purestorage.com>
parent fa16ebed

drivers/infiniband/ulp/ipoib/ipoib_main.c

+1 −1
Original line number Diff line number Diff line
@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh) 
	for (n = rcu_dereference_protected(*np,

					    lockdep_is_held(&ntbl->rwlock));

	     n != NULL;

	     n = rcu_dereference_protected(neigh->hnext,

	     n = rcu_dereference_protected(*np,

					lockdep_is_held(&ntbl->rwlock))) {

		if (n == neigh) {

			/* found */