diff options
author | Ralph Campbell <ralph.campbell@qlogic.com> | 2009-02-27 10:34:30 -0800 |
---|---|---|
committer | Roland Dreier <rolandd@cisco.com> | 2009-02-27 10:34:30 -0800 |
commit | 1d9bc6d648ece77ffb41c5a577eab81fac5ad4de (patch) | |
tree | f4694fe940cfd4cef0c1a96fd436984c1b2c6ea5 /net | |
parent | 7020cb0fe216fdcec246cdc2412614a3190fbb2f (diff) | |
download | op-kernel-dev-1d9bc6d648ece77ffb41c5a577eab81fac5ad4de.zip op-kernel-dev-1d9bc6d648ece77ffb41c5a577eab81fac5ad4de.tar.gz |
IB/mad: Fix null pointer dereference in local_completions()
handle_outgoing_dr_smp() can queue a struct ib_mad_local_private
*local on the mad_agent_priv->local_work work queue with
local->mad_priv == NULL if device->process_mad() returns
IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY and
(!ib_response_mad(&mad_priv->mad.mad) ||
!mad_agent_priv->agent.recv_handler).
In this case, local_completions() will be called with local->mad_priv
== NULL. The code does check for this case and skips calling
recv_mad_agent->agent.recv_handler() but recv == 0 so
kmem_cache_free() is called with a NULL pointer.
Also, since recv isn't reinitialized each time through the loop, it
can cause a memory leak if recv should have been zero.
Signed-off-by: Ralph Campbell <ralph.campbell@qlogic.com>
Diffstat (limited to 'net')
0 files changed, 0 insertions, 0 deletions