diff options
| author | Mustafa Ismail <mustafa.ismail@intel.com> | 2016-08-23 17:24:56 -0500 |
|---|---|---|
| committer | Doug Ledford <dledford@redhat.com> | 2016-08-24 11:31:40 -0400 |
| commit | 433c58139f6a7d59824aadd23d6c9cac1d4e6100 (patch) | |
| tree | 26f4e9d990c4f8b8d4aee7521ee15230727f217a /drivers/infiniband | |
| parent | d41d0910d97f05be987d2d60de7e8685c108963b (diff) | |
| download | lwn-433c58139f6a7d59824aadd23d6c9cac1d4e6100.tar.gz lwn-433c58139f6a7d59824aadd23d6c9cac1d4e6100.zip | |
i40iw: Avoid writing to freed memory
iwpbl->iwmr points to the structure that contains iwpbl,
which is iwmr. Setting this to NULL would result in
writing to freed memory. So just free iwmr, and return.
Fixes: d37498417947 ("i40iw: add files for iwarp interface")
Reported-by: Stefan Assmann <sassmann@redhat.com>
Signed-off-by: Mustafa Ismail <mustafa.ismail@intel.com>
Signed-off-by: Shiraz Saleem <shiraz.saleem@intel.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
Diffstat (limited to 'drivers/infiniband')
| -rw-r--r-- | drivers/infiniband/hw/i40iw/i40iw_verbs.c | 3 |
1 files changed, 1 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/i40iw/i40iw_verbs.c b/drivers/infiniband/hw/i40iw/i40iw_verbs.c index 722e5af1e3d8..6329c971c22f 100644 --- a/drivers/infiniband/hw/i40iw/i40iw_verbs.c +++ b/drivers/infiniband/hw/i40iw/i40iw_verbs.c @@ -1925,8 +1925,7 @@ static int i40iw_dereg_mr(struct ib_mr *ib_mr) } if (iwpbl->pbl_allocated) i40iw_free_pble(iwdev->pble_rsrc, palloc); - kfree(iwpbl->iwmr); - iwpbl->iwmr = NULL; + kfree(iwmr); return 0; } |