Commit 634354d7 authored by Vitaliy Gusev's avatar Vitaliy Gusev Committed by David S. Miller
Browse files

mlx4: Fix access to freed memory 



catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid
after call mlx4_restart_one().

Signed-off-by: default avatarVitaliy Gusev <vgusev@openvz.org>
Acked-by: default avatarRoland Dreier <rolandd@cisco.com>
Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
parent 657e9649

drivers/net/mlx4/catas.c

+8 −3
Original line number Diff line number Diff line
@@ -96,14 +96,19 @@ static void catas_reset(struct work_struct *work) 
	spin_unlock_irq(&catas_lock);



	list_for_each_entry_safe(priv, tmppriv, &tlist, catas_err.list) {

		struct pci_dev *pdev = priv->dev.pdev;



		ret = mlx4_restart_one(priv->dev.pdev);

		dev = &priv->dev;

		/* 'priv' now is not valid */

		if (ret)

			mlx4_err(dev, "Reset failed (%d)\n", ret);

		else

			printk(KERN_ERR "mlx4 %s: Reset failed (%d)\n",

				pci_name(pdev), ret);

		else {

			dev  = pci_get_drvdata(pdev);

			mlx4_dbg(dev, "Reset succeeded\n");

		}

	}

}



void mlx4_start_catas_poll(struct mlx4_dev *dev)

{