Commit 634354d7 authored by Vitaliy Gusev's avatar Vitaliy Gusev Committed by David S. Miller
Browse files

mlx4: Fix access to freed memory

catas_reset() uses pointer to mlx4_priv, but mlx4_priv is not valid
after call mlx4_restart_one().
Signed-off-by: default avatarVitaliy Gusev <>
Acked-by: default avatarRoland Dreier <>
Signed-off-by: default avatarDavid S. Miller <>
parent 657e9649
...@@ -96,13 +96,18 @@ static void catas_reset(struct work_struct *work) ...@@ -96,13 +96,18 @@ static void catas_reset(struct work_struct *work)
spin_unlock_irq(&catas_lock); spin_unlock_irq(&catas_lock);
list_for_each_entry_safe(priv, tmppriv, &tlist, catas_err.list) { list_for_each_entry_safe(priv, tmppriv, &tlist, catas_err.list) {
struct pci_dev *pdev = priv->dev.pdev;
ret = mlx4_restart_one(priv->dev.pdev); ret = mlx4_restart_one(priv->dev.pdev);
dev = &priv->dev; /* 'priv' now is not valid */
if (ret) if (ret)
mlx4_err(dev, "Reset failed (%d)\n", ret); printk(KERN_ERR "mlx4 %s: Reset failed (%d)\n",
else pci_name(pdev), ret);
else {
dev = pci_get_drvdata(pdev);
mlx4_dbg(dev, "Reset succeeded\n"); mlx4_dbg(dev, "Reset succeeded\n");
} }
} }
void mlx4_start_catas_poll(struct mlx4_dev *dev) void mlx4_start_catas_poll(struct mlx4_dev *dev)
Supports Markdown
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment