[ofa-general] [PATCH] Bug fix IPOIB CM dereferencing invalid pointer - resend

[Eli Cohen]

Bug fix IPOIB CM dereferencing invalid pointer

When ipoib_neigh_free gets called it needs to set to NULL
its ->cm->neigh member So that a completion with error reaching
ipoib_cm_handle_tx_wc will not access an invalid pointer.

Signed-off-by: Eli Cohen <eli at mellanox.co.il>
---

This is what I really meant to send


 drivers/infiniband/ulp/ipoib/ipoib_main.c |    4 ++++
 1 files changed, 4 insertions(+), 0 deletions(-)

diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c
index a03a65e..0c66723 100644
--- a/drivers/infiniband/ulp/ipoib/ipoib_main.c
+++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c
@@ -869,6 +869,10 @@ void ipoib_neigh_free(struct net_device *dev, struct ipoib_neigh *neigh)
 	}
 	if (ipoib_cm_get(neigh))
 		ipoib_cm_destroy_tx(ipoib_cm_get(neigh));
+
+	if (neigh->cm)
+		neigh->cm->neigh = NULL;
+
 	kfree(neigh);
 }
 
-- 
1.5.3.6