[ofa-general] [PATCHv2] IB/mthca: fix use-after-free

[Michael S. Tsirkin]

From: Ali Ayoub <ali at mellanox.co.il>
Subject: [PATCH] IB/mthca: fix use-after-free

Fix use-after-free on hardware restart.

Signed-off-by: Michael S. Tsirkin <mst at dev.mellanox.co.il>

---

Previous version would do NULL-pointer dereference
if pci_get_drvdata returns NULL. BTW, when does this happen?

diff --git a/drivers/infiniband/hw/mthca/mthca_main.c b/drivers/infiniband/hw/mthca/mthca_main.c
index 773145e..aa563e6 100644
--- a/drivers/infiniband/hw/mthca/mthca_main.c
+++ b/drivers/infiniband/hw/mthca/mthca_main.c
@@ -1250,12 +1250,14 @@ static void __mthca_remove_one(struct pci_dev *pdev)
 int __mthca_restart_one(struct pci_dev *pdev)
 {
 	struct mthca_dev *mdev;
+	int hca_type;
 
 	mdev = pci_get_drvdata(pdev);
 	if (!mdev)
 		return -ENODEV;
+	hca_type = mdev->hca_type;
 	__mthca_remove_one(pdev);
-	return __mthca_init_one(pdev, mdev->hca_type);
+	return __mthca_init_one(pdev, hca_type);
 }
 
 static int __devinit mthca_init_one(struct pci_dev *pdev,
-- 
MST