<br><font size=2 face="sans-serif">This patch sets caller's ah to NULL
when calling ipoib_put_ah(), and deletes neigh from the list before kfree(neigh).</font>
<br>
<br><font size=2 face="sans-serif">Please review this patch.</font>
<br>
<div>
<br><font size=2 face="sans-serif">diff -urN infiniband/ulp/ipoib/ipoib_main.c
infiniband-ah/ulp/ipoib/ipoib_main.c<br>
--- infiniband/ulp/ipoib/ipoib_main.c        2005-02-17
17:24:56.000000000 +0000<br>
+++ infiniband-ah/ulp/ipoib/ipoib_main.c        2005-02-18
01:15:44.000000000 +0000<br>
@@ -225,16 +225,20 @@<br>
                 dev_kfree_skb_irq(skb);<br>
 <br>
         list_for_each_entry_safe(neigh, tn,
&path->neigh_list, list) {<br>
-                if
(neigh->ah)<br>
+                if
(neigh->ah) {<br>
                  
      ipoib_put_ah(neigh->ah);<br>
+                
       neigh->bh = NULL;<br>
+                }<br>
+                list_del(&neigh->list);<br>
                 *to_ipoib_neigh(neigh->neighbour)
= NULL;<br>
                 neigh->neighbour->ops->destructor
= NULL;<br>
                 kfree(neigh);<br>
         }<br>
 <br>
-        if (path->ah)<br>
+        if (path->ah) {<br>
                 ipoib_put_ah(path->ah);<br>
-<br>
+                path->ah
= NULL;<br>
+        }<br>
         rb_erase(&path->rb_node, &priv->path_tree);<br>
         list_del(&path->list);<br>
         kfree(path);<br>
diff -urN infiniband/ulp/ipoib/ipoib_multicast.c infiniband-ah/ulp/ipoib/ipoib_multicast.c<br>
--- infiniband/ulp/ipoib/ipoib_multicast.c        2005-02-17
17:24:56.000000000 +0000<br>
+++ infiniband-ah/ulp/ipoib/ipoib_multicast.c        2005-02-18
00:36:56.000000000 +0000<br>
@@ -101,7 +101,11 @@</font>
<br><font size=2 face="sans-serif">         spin_lock_irqsave(&priv->lock,
flags);<br>
 <br>
         list_for_each_entry_safe(neigh, tmp,
&mcast->neigh_list, list) {<br>
-                ipoib_put_ah(neigh->ah);<br>
+                if
(neigh->ah) {<br>
+                
       ipoib_put_ah(neigh->ah);<br>
+                
       neigh->bh = NULL;<br>
+                }<br>
+                list_del(&neigh->list);<br>
                 *to_ipoib_neigh(neigh->neighbour)
= NULL;<br>
                 neigh->neighbour->ops->destructor
= NULL;<br>
                 kfree(neigh);<br>
@@ -109,8 +113,10 @@<br>
 <br>
         spin_unlock_irqrestore(&priv->lock,
flags);<br>
 <br>
-        if (mcast->ah)<br>
+        if (mcast->ah) {<br>
                 ipoib_put_ah(mcast->ah);<br>
+                mcast->ah
= NULL;<br>
+        }<br>
 <br>
         while (!skb_queue_empty(&mcast->pkt_queue))
{<br>
                 struct
sk_buff *skb = skb_dequeue(&mcast->pkt_queue);</font>
<br>
<br>
<br>
<br><font size=2 face="sans-serif"><br>
</font>
<br><font size=2 face="sans-serif">Thanks<br>
Shirley Ma<br>
IBM Linux Technology Center<br>
15300 SW Koll Parkway<br>
Beaverton, OR 97006-6063<br>
Phone(Fax): (503) 578-7638</font></div>