[openib-general] destroying an AH from user space causes segmentation fault

[Dotan Barak]

I'm using driver revision 2851 with HCA 23108.

Here is a back trace from a core dump of this seg fault:


Loaded symbols for /usr/local/lib/infiniband/mthca.so
#0  0x4001ef8b in mthca_free_av (ah=0x804db70) at ah.c:171

warning: Source file is more recent than executable.

171                     i = ((void *) ah->av - page->buf) / sizeof *ah->av;
(gdb) bt
#0  0x4001ef8b in mthca_free_av (ah=0x804db70) at ah.c:171
#1  0x40021d1d in mthca_destroy_ah (ah=0x804db70) at mthca.h:242
#2  0x4001bfdf in ibv_destroy_ah (ah=0x0) at verbs.c:194
#3  0x080491b7 in main (argc=1, argv=0xbf97a4b4) at sa_ping.c:361
(gdb) p ah
$1 = (struct mthca_ah *) 0x804db70
(gdb) p page
$2 = (struct mthca_ah_page *) 0x0



i attached a small test that reproduces this failure.

 <<destroy_av.c>> 
Dotan Barak
Software Verification Engineer
Mellanox Technologies LTD
mailto:dotanb at mellanox.co.il
Tel: +972-4-9097200 Ext: 231 Fax: +972-4-9593245
P.O. Box 86 Yokneam 20692 ISRAEL.
Home: +972-4-8289408  Cell: 052-4222383

[ May the fork be with you ]

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.openfabrics.org/pipermail/general/attachments/20050721/9a539d48/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: destroy_av.c
Type: application/octet-stream
Size: 3119 bytes
Desc: not available
URL: <http://lists.openfabrics.org/pipermail/general/attachments/20050721/9a539d48/attachment.obj>