aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorShlomo Pongratz <shlomop@mellanox.com>2012-08-13 10:39:50 -0400
committerRoland Dreier <roland@purestorage.com>2012-08-14 18:21:44 -0400
commit6c723a68c661008adf415ee90efe5f737e928ce0 (patch)
treebc525e4ced2a854c0f774c4adf56ada985cbe746 /drivers/infiniband
parentfa16ebed31f336e41970f3f0ea9e8279f6be2d27 (diff)
IB/ipoib: Fix RCU pointer dereference of wrong object
Commit b63b70d87741 ("IPoIB: Use a private hash table for path lookup in xmit path") introduced a bug where in ipoib_neigh_free() (which is called from a few errors flows in the driver), rcu_dereference() is invoked with the wrong pointer object, which results in a crash. Signed-off-by: Shlomo Pongratz <shlomop@mellanox.com> Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com> Signed-off-by: Roland Dreier <roland@purestorage.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/ulp/ipoib/ipoib_main.c2
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index 97920b77a5d0..3e2085a3ee47 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
1052 for (n = rcu_dereference_protected(*np, 1052 for (n = rcu_dereference_protected(*np,
1053 lockdep_is_held(&ntbl->rwlock)); 1053 lockdep_is_held(&ntbl->rwlock));
1054 n != NULL; 1054 n != NULL;
1055 n = rcu_dereference_protected(neigh->hnext, 1055 n = rcu_dereference_protected(*np,
1056 lockdep_is_held(&ntbl->rwlock))) { 1056 lockdep_is_held(&ntbl->rwlock))) {
1057 if (n == neigh) { 1057 if (n == neigh) {
1058 /* found */ 1058 /* found */