From: Sean Hefty Date: Sat, 1 Dec 2007 01:30:18 +0000 (-0800) Subject: IB/mad: Fix incorrect access to items on local_list X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=b61d92d8ae6aa13b17d1c31e69d123879cec2ee2;p=GitHub%2FLineageOS%2Fandroid_kernel_motorola_exynos9610.git IB/mad: Fix incorrect access to items on local_list In cancel_mads(), MADs are moved from the wait_list and local_list to a cancel_list for processing. However, the structures on these two lists are not the same. The wait_list references struct ib_mad_send_wr_private, but local_list references struct ib_mad_local_private. Cancel_mads() treats all items moved to the cancel_list as struct ib_mad_send_wr_private. This leads to a system crash when requests are moved from the local_list to the cancel_list. Fix this by leaving local_list alone. All requests on the local_list have completed are just awaiting processing by a queued worker thread. Bug (crash) reported by Dotan Barak . Problem with local_list access reported by Robert Reynolds . Signed-off-by: Sean Hefty Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/core/mad.c b/drivers/infiniband/core/mad.c index 5eace995836d..fbe16d5250a4 100644 --- a/drivers/infiniband/core/mad.c +++ b/drivers/infiniband/core/mad.c @@ -2275,8 +2275,6 @@ static void cancel_mads(struct ib_mad_agent_private *mad_agent_priv) /* Empty wait list to prevent receives from finding a request */ list_splice_init(&mad_agent_priv->wait_list, &cancel_list); - /* Empty local completion list as well */ - list_splice_init(&mad_agent_priv->local_list, &cancel_list); spin_unlock_irqrestore(&mad_agent_priv->lock, flags); /* Report all cancelled requests */