diff options
| author |   Krishna Kumar <krkumar2@in.ibm.com> | 2006-11-09 09:30:34 +0530 |
|---|---|---|
| committer |   Roland Dreier <rolandd@cisco.com> | 2006-11-29 15:33:07 -0800 |
| commit | 33ba0fa9f315ce32fbb86fa671c131f5355b52a1 (patch) | |
| tree | 3b6bd7f9efe82fe4e7298497c312b9ee71f4911c /drivers/infiniband/core/device.c | |
| parent | IB: Convert kmem_cache_t -> struct kmem_cache (diff) | |
| download | linux-dev-33ba0fa9f315ce32fbb86fa671c131f5355b52a1.tar.xz linux-dev-33ba0fa9f315ce32fbb86fa671c131f5355b52a1.zip | |
RDMA/iwcm: Fix memory corruption bug in cm_work_handler()
Possible memory corruption scenario: after putting the work entry back
on the work_free_list, we call process_event() which dereferences
work->event, which could have been modified to another value
meanwhile.
Signed-off-by: Krishna Kumar <krkumar2@in.ibm.com>
Acked-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/core/device.c')
0 files changed, 0 insertions, 0 deletions