diff mbox

mlx4: Fix access to freed memory

Message ID 200909151452.41206.vgusev@openvz.org
State Accepted, archived
Delegated to: David Miller
Headers show

Commit Message

Vitaliy Gusev Sept. 15, 2009, 10:52 a.m. UTC
catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid after
call mlx4_restart_one().

Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>

--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html

Comments

Roland Dreier Sept. 15, 2009, 6:23 p.m. UTC | #1
> catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid after
 > call mlx4_restart_one().
 > 
 > Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>

Good catch.  Dave, if you want me to take this, let me know, otherwise:

Acked-by: Roland Dreier <rolandd@cisco.com>
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
David Miller Sept. 16, 2009, 7 a.m. UTC | #2
From: Roland Dreier <rdreier@cisco.com>
Date: Tue, 15 Sep 2009 11:23:33 -0700

> 
>  > catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid after
>  > call mlx4_restart_one().
>  > 
>  > Signed-off-by: Vitaliy Gusev <vgusev@openvz.org>
> 
> Good catch.  Dave, if you want me to take this, let me know, otherwise:
> 
> Acked-by: Roland Dreier <rolandd@cisco.com>

I've got it, thanks everyone.
--
To unsubscribe from this list: send the line "unsubscribe netdev" in
the body of a message to majordomo@vger.kernel.org
More majordomo info at  http://vger.kernel.org/majordomo-info.html
diff mbox

Patch

diff --git a/drivers/net/mlx4/catas.c b/drivers/net/mlx4/catas.c
index aa9674b..f599294 100644
--- a/drivers/net/mlx4/catas.c
+++ b/drivers/net/mlx4/catas.c
@@ -96,12 +96,17 @@  static void catas_reset(struct work_struct *work)
 	spin_unlock_irq(&catas_lock);
 
 	list_for_each_entry_safe(priv, tmppriv, &tlist, catas_err.list) {
+		struct pci_dev *pdev = priv->dev.pdev;
+
 		ret = mlx4_restart_one(priv->dev.pdev);
-		dev = &priv->dev;
+		/* 'priv' now is not valid */
 		if (ret)
-			mlx4_err(dev, "Reset failed (%d)\n", ret);
-		else
+			printk(KERN_ERR "mlx4 %s: Reset failed (%d)\n",
+				pci_name(pdev), ret);
+		else {
+			dev  = pci_get_drvdata(pdev);
 			mlx4_dbg(dev, "Reset succeeded\n");
+		}
 	}
 }