IB/ipoib: Fix RCU pointer dereference of wrong object
authorShlomo Pongratz <shlomop@mellanox.com>
Mon, 13 Aug 2012 14:39:50 +0000 (14:39 +0000)
committerRoland Dreier <roland@purestorage.com>
Tue, 14 Aug 2012 22:21:44 +0000 (15:21 -0700)
Commit b63b70d87741 ("IPoIB: Use a private hash table for path lookup
in xmit path") introduced a bug where in ipoib_neigh_free() (which is
called from a few errors flows in the driver), rcu_dereference() is
invoked with the wrong pointer object, which results in a crash.

Signed-off-by: Shlomo Pongratz <shlomop@mellanox.com>
Signed-off-by: Or Gerlitz <ogerlitz@mellanox.com>
Signed-off-by: Roland Dreier <roland@purestorage.com>
drivers/infiniband/ulp/ipoib/ipoib_main.c

index 97920b7..3e2085a 100644 (file)
@@ -1052,7 +1052,7 @@ void ipoib_neigh_free(struct ipoib_neigh *neigh)
        for (n = rcu_dereference_protected(*np,
                                            lockdep_is_held(&ntbl->rwlock));
             n != NULL;
-            n = rcu_dereference_protected(neigh->hnext,
+            n = rcu_dereference_protected(*np,
                                        lockdep_is_held(&ntbl->rwlock))) {
                if (n == neigh) {
                        /* found */