Commit 71d98b46 authored Feb 17, 2009 by Jack Morgenstein Committed by Roland Dreier Feb 17, 2009

IPoIB: In unicast_arp_send(), only free newly-created paths



If path_rec_start() returns error, call path_free() only if the path
was newly-created.  If we free an existing path whose valid flag was zero,
(but do not detach it from the list) we cause corruption of the
path list (of which it is a member), and get a kernel crash.

The simplest solution is to not free an existing path -- just leave it
in the list as-is (i.e., with its valid flag cleared).

Thanks to Yossi Etigin of Voltaire for identifying the problem flow
which caused the kernel crash.

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Moni Shua <monis@voltaire.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

parent f3b8436a

drivers/infiniband/ulp/ipoib/ipoib_main.c

+7 −2

Original line number	Diff line number	Diff line
		@@ -660,8 +660,12 @@ static void unicast_arp_send(struct sk_buff skb, struct net_device dev,

		path = __path_find(dev, phdr->hwaddr + 4);
		if (!path \|\| !path->valid) {
		if (!path)
		int new_path = 0;

		if (!path) {
		path = path_rec_create(dev, phdr->hwaddr + 4);
		new_path = 1;
		}
		if (path) {
		/* put pseudoheader back on for next time */
		skb_push(skb, sizeof *phdr);
		@@ -669,6 +673,7 @@ static void unicast_arp_send(struct sk_buff skb, struct net_device dev,

		if (!path->query && path_rec_start(dev, path)) {
		spin_unlock_irqrestore(&priv->lock, flags);
		if (new_path)
		path_free(dev, path);
		return;
		} else