IB/mthca: Fix access to freed memory in catastrophic event handling

catas_reset() uses a pointer to mthca_dev, but mthca_dev is not valid
after the call to __mthca_restart_one().

Based on a similar patch for mlx4 (634354d7, "mlx4: Fix access to
freed memory") by Vitaliy Gusev <vgusev@openvz.org>

Signed-off-by: Jack Morgenstein <jackm@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>

diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c
index 056b2a4c69700f9fdb7cb6640213804e5f850aec..0aa0110e4b6cffba335116d7cd836d5f2d22e85c 100644 (file)
--- a/drivers/infiniband/hw/mthca/mthca_catas.c
+++ b/drivers/infiniband/hw/mthca/mthca_catas.c
@@ -68,11 +68,16 @@ static void catas_reset(struct work_struct *work)
        spin_unlock_irq(&catas_lock);
 
        list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) {
+               struct pci_dev *pdev = dev->pdev;
                ret = __mthca_restart_one(dev->pdev);
+               /* 'dev' now is not valid */
                if (ret)
-                       mthca_err(dev, "Reset failed (%d)\n", ret);
-               else
-                       mthca_dbg(dev, "Reset succeeded\n");
+                       printk(KERN_ERR "mthca %s: Reset failed (%d)\n",
+                              pci_name(pdev), ret);
+               else {
+                       struct mthca_dev *d = pci_get_drvdata(pdev);
+                       mthca_dbg(d, "Reset succeeded\n");
+               }
        }
 
        mutex_unlock(&mthca_device_mutex);