]> err.no Git - linux-2.6/commit
projects / linux-2.6 / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 73b9e98) | patch
IPoIB: Fix use-after-free in path_rec_completion()
authorMichael S. Tsirkin <mst@dev.mellanox.co.il>
Thu, 22 Mar 2007 21:40:16 +0000 (14:40 -0700)
committerRoland Dreier <rolandd@cisco.com>
Thu, 22 Mar 2007 21:40:16 +0000 (14:40 -0700)
commitd04d01b113be5b88418eb30087753c3de0a39fd8
tree3c7dc849f1dfc7293e8337cb66f6b24e90a3fc36tree | snapshot
parent73b9e9870f5780cb554b68bbcfa47782b27a3e04commit | diff
IPoIB: Fix use-after-free in path_rec_completion()

The connected mode code added the possibility that an neigh struct
gets freed in the list_for_each_entry() loop in path_rec_completion(),
which causes a use-after-free.  Fix this by changing to the _safe
variant of the list walking macro.

This was spotted by the Coverity checker (CID 1567).

Signed-off-by: Michael S. Tsirkin <mst@dev.mellanox.co.il>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/ulp/ipoib/ipoib_main.c diff | blob | history
Linux 2.6 source tree