[ofa-general] [PATCH] Bug fix IPOIB CM dereferencing invalid pointer - resend

[Eli Cohen]

Actually I see that tx->neigh is already set to NULL in
ipoib_cm_destroy_tx so this fixes nothing. Although when I did this my
system stopped crashing. I guess I have to dig farther. By the way this
happens when I run netperf UDP and the connection is closed during the
test runs.

On Wed, 2007-11-28 at 18:05 +0200, Eli Cohen wrote:
> Bug fix IPOIB CM dereferencing invalid pointer
> 
> When ipoib_neigh_free gets called it needs to set to NULL
> its ->cm->neigh member So that a completion with error reaching
> ipoib_cm_handle_tx_wc will not access an invalid pointer.
> 
> Signed-off-by: Eli Cohen <eli at mellanox.co.il>
> ---
> 
> This is what I really meant to send
> 
> 
>  drivers/infiniband/ulp/ipoib/ipoib_main.c |    4 ++++
>  1 files changed, 4 insertions(+), 0 deletions(-)
> 
> diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
> index a03a65e..0c66723 100644
> --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
> +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
> @@ -869,6 +869,10 @@ void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
>  	}
>  	if (ipoib_cm_get(neigh))
>  		ipoib_cm_destroy_tx(ipoib_cm_get(neigh));
> +
> +	if (neigh->cm)
> +		neigh->cm->neigh = NULL;
> +
>  	kfree(neigh);
>  }
>