From: Jack Morgenstein Date: Thu, 24 Sep 2009 18:55:41 +0000 (-0700) Subject: IB/mthca: Fix access to freed memory in catastrophic event handling X-Git-Tag: MMI-PSA29.97-13-9~26324^2^4 X-Git-Url: https://git.stricted.de/?a=commitdiff_plain;h=d686159e50c57788001001e9537aa8b4bbc38001;p=GitHub%2FMotorolaMobilityLLC%2Fkernel-slsi.git IB/mthca: Fix access to freed memory in catastrophic event handling catas_reset() uses a pointer to mthca_dev, but mthca_dev is not valid after the call to __mthca_restart_one(). Based on a similar patch for mlx4 (634354d7, "mlx4: Fix access to freed memory") by Vitaliy Gusev Signed-off-by: Jack Morgenstein Signed-off-by: Roland Dreier --- diff --git a/drivers/infiniband/hw/mthca/mthca_catas.c b/drivers/infiniband/hw/mthca/mthca_catas.c index 056b2a4c6970..0aa0110e4b6c 100644 --- a/drivers/infiniband/hw/mthca/mthca_catas.c +++ b/drivers/infiniband/hw/mthca/mthca_catas.c @@ -68,11 +68,16 @@ static void catas_reset(struct work_struct *work) spin_unlock_irq(&catas_lock); list_for_each_entry_safe(dev, tmpdev, &tlist, catas_err.list) { + struct pci_dev *pdev = dev->pdev; ret = __mthca_restart_one(dev->pdev); + /* 'dev' now is not valid */ if (ret) - mthca_err(dev, "Reset failed (%d)\n", ret); - else - mthca_dbg(dev, "Reset succeeded\n"); + printk(KERN_ERR "mthca %s: Reset failed (%d)\n", + pci_name(pdev), ret); + else { + struct mthca_dev *d = pci_get_drvdata(pdev); + mthca_dbg(d, "Reset succeeded\n"); + } } mutex_unlock(&mthca_device_mutex);