On Thu, Jul 16, 2020 at 10:03:41PM +0300, m.malygin@xxxxxxxxx wrote: > From: Mikhail Malygin <m.malygin@xxxxxxxxx> > > rxe_post_send_kernel() iterates over linked list of wr's, until the wr->next ptr is NULL. > However it we've got an interrupt after last wr is posted, control may be returned > to the code after send completion callback is executed and wr memory is freed. > As a result, wr->next pointer may contain incorrect value leading to panic. > > Signed-off-by: Mikhail Malygin <m.malygin@xxxxxxxxx> > Signed-off-by: Sergey Kojushev <s.kojushev@xxxxxxxxx> > --- > drivers/infiniband/sw/rxe/rxe_verbs.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) Applied to for-next, thanks Jason
