diff options
| author | Michael S. Tsirkin <mst@dev.mellanox.co.il> | 2007-03-22 14:40:16 -0700 |
|---|---|---|
| committer | Roland Dreier <rolandd@cisco.com> | 2007-03-22 14:40:16 -0700 |
| commit | d04d01b113be5b88418eb30087753c3de0a39fd8 (patch) | |
| tree | 3c7dc849f1dfc7293e8337cb66f6b24e90a3fc36 /drivers/infiniband/ulp/ipoib | |
| parent | 73b9e9870f5780cb554b68bbcfa47782b27a3e04 (diff) | |
IPoIB: Fix use-after-free in path_rec_completion()
The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free. Fix this by changing to the _safe
variant of the list walking macro.
This was spotted by the Coverity checker (CID 1567).
Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband/ulp/ipoib')
| -rw-r--r-- | drivers/infiniband/ulp/ipoib/ipoib_main.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/ulp/ipoib/ipoib_main.c b/drivers/infiniband/ulp/ipoib/ipoib_main.c index f9dbc6f6814..0741c6d1337 100644 --- a/drivers/infiniband/ulp/ipoib/ipoib_main.c +++ b/drivers/infiniband/ulp/ipoib/ipoib_main.c @@ -380,7 +380,7 @@ static void path_rec_completion(int status, struct net_device *dev = path->dev; struct ipoib_dev_priv *priv = netdev_priv(dev); struct ipoib_ah *ah = NULL; - struct ipoib_neigh *neigh; + struct ipoib_neigh *neigh, *tn; struct sk_buff_head skqueue; struct sk_buff *skb; unsigned long flags; @@ -418,7 +418,7 @@ static void path_rec_completion(int status, while ((skb = __skb_dequeue(&path->queue))) __skb_queue_tail(&skqueue, skb); - list_for_each_entry(neigh, &path->neigh_list, list) { + list_for_each_entry_safe(neigh, tn, &path->neigh_list, list) { kref_get(&path->ah->ref); neigh->ah = path->ah; memcpy(&neigh->dgid.raw, &path->pathrec.dgid.raw, |