Re: [PATCH rdma-rc] IB/ipoib: Fix for use-after-free in ipoib_cm_tx_start

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



On Thu, Jan 24, 2019 at 02:33:19PM +0200, Leon Romanovsky wrote:
> From: Feras Daoud <ferasda@xxxxxxxxxxxx>
> 

[snip]

> ---
>  drivers/infiniband/ulp/ipoib/ipoib_cm.c | 2 +-
>  1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/infiniband/ulp/ipoib/ipoib_cm.c b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> index 0428e01e8f69..d1f1dcea0656 100644
> --- a/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> +++ b/drivers/infiniband/ulp/ipoib/ipoib_cm.c
> @@ -1371,7 +1371,7 @@ static void ipoib_cm_tx_start(struct work_struct *work)
>  				neigh->daddr + QPN_AND_OPTIONS_OFFSET);
>  			goto free_neigh;
>  		}
> -		memcpy(&pathrec, &p->path->pathrec, sizeof(pathrec));
> +		memcpy(&pathrec, &path->pathrec, sizeof(pathrec));

A quick review makes it look like we can remove "path" as a member of
ipoib_cm_tx as this looks like the only use of it.  Is that true?

Ira

>  
>  		spin_unlock_irqrestore(&priv->lock, flags);
>  		netif_tx_unlock_bh(dev);
> -- 
> 2.19.1
> 



[Index of Archives]     [Linux USB Devel]     [Video for Linux]     [Linux Audio Users]     [Photo]     [Yosemite News]     [Yosemite Photos]     [Linux Kernel]     [Linux SCSI]     [XFree86]

  Powered by Linux