From: Vitaliy Gusev <vgusev@openvz.org>
Date: Wed, 16 Sep 2009 07:00:21 +0000 (-0700)
Subject: mlx4: Fix access to freed memory
X-Git-Tag: MMI-PSA29.97-13-9~25857^2~346
X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=634354d753898f9d9d146bd47628a1ef27f7dc98;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git

mlx4: Fix access to freed memory

catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid
after call mlx4_restart_one().

Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
Acked-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: David S. Miller <davem@davemloft.net>
---

diff --git a/drivers/net/mlx4/catas.c b/drivers/net/mlx4/catas.c
index aa9674b7f19c..f599294fa8ab 100644
--- a/drivers/net/mlx4/catas.c
+++ b/drivers/net/mlx4/catas.c
@@ -96,12 +96,17 @@ static void catas_reset(struct work_struct *work)
 	spin_unlock_irq(&catas_lock);
 
 	list_for_each_entry_safe(priv, tmppriv, &tlist, catas_err.list) {
+		struct pci_dev *pdev = priv->dev.pdev;
+
 		ret = mlx4_restart_one(priv->dev.pdev);
-		dev = &priv->dev;
+		/* 'priv' now is not valid */
 		if (ret)
-			mlx4_err(dev, "Reset failed (%d)\n", ret);
-		else
+			printk(KERN_ERR "mlx4 %s: Reset failed (%d)\n",
+				pci_name(pdev), ret);
+		else {
+			dev  = pci_get_drvdata(pdev);
 			mlx4_dbg(dev, "Reset succeeded\n");
+		}
 	}
 }