[openib-general] Re: [PATCH] ipoib_mcast_restart_task

[Michael S. Tsirkin]

Quoting r. Roland Dreier <rdreier at cisco.com>:
> Subject: Re: [PATCH] ipoib_mcast_restart_task
> 
>     Michael> Roland, Eli spotted the following race that might explain
>     Michael> part of the crashes in sendonly complete.
> 
> Actually I don't see how this could explain it.  The oops seems to be
> happening when the CPU follows the mcast pointer to get mcast->dev,
> and even if mcast has been freed, it should still point to valid
> kernel memory.

Not sure I read you. It'd still be use after free, won't it?

-- 
Michael S. Tsirkin
Staff Engineer, Mellanox Technologies