diff options
| author |   Jack Morgenstein <jackm@dev.mellanox.co.il> | 2009-09-24 11:55:41 -0700 |
|---|---|---|
| committer |   Roland Dreier <rolandd@cisco.com> | 2009-09-24 11:55:41 -0700 |
| commit | d686159e50c57788001001e9537aa8b4bbc38001 (patch) | |
| tree | bba34fdf2c79b671df4523119153242e327f8f4e /drivers/infiniband | |
| parent | Merge git://git.linux-nfs.org/projects/trondmy/nfs-2.6 (diff) | |
| download | linux-dev-d686159e50c57788001001e9537aa8b4bbc38001.tar.xz linux-dev-d686159e50c57788001001e9537aa8b4bbc38001.zip | |
IB/mthca: Fix access to freed memory in catastrophic event handling
catas_reset() uses a pointer to mthca_dev, but mthca_dev is not valid
after the call to __mthca_restart_one().
Based on a similar patch for mlx4 (634354d7, "mlx4: Fix access to
freed memory") by Vitaliy Gusev <vgusev@openvz.org>
Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/mthca/mthca_catas.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c index 056b2a4c6970..0aa0110e4b6c 100644 --- a/drivers/infiniband/hw/mthca/mthca_catas.c +++ b/drivers/infiniband/hw/mthca/mthca_catas.c @@ -68,11 +68,16 @@ static void catas_reset(struct work_struct *work) spin_unlock_irq(&catas_lock); list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) { + struct pci_dev *pdev = dev->pdev; ret = __mthca_restart_one(dev->pdev); + /* 'dev' now is not valid */ if (ret) - mthca_err(dev, "Reset failed (%d)\n", ret); - else - mthca_dbg(dev, "Reset succeeded\n"); + printk(KERN_ERR "mthca %s: Reset failed (%d)\n", + pci_name(pdev), ret); + else { + struct mthca_dev *d = pci_get_drvdata(pdev); + mthca_dbg(d, "Reset succeeded\n"); + } } mutex_unlock(&mthca_device_mutex); |