| commit | d7c1fbd6606085dbf95e47068d6bd2db8a180e38 | |
| author | Steve Wise <swise@opengridcomputing.com> | |
| Tue, 4 Mar 2008 22:44:52 +0000 (4 16:44 -0600) | ||
| committer | Roland Dreier <rolandd@cisco.com> | |
| Tue, 11 Mar 2008 04:22:22 +0000 (10 21:22 -0700) | ||
| tree | 0852af87269facc5f07f08bd20387f183976cca2 | treesnapshot (tar.gz zip) |
| parent | d33ed425c6cc14370d8c418b504328d2c3db58b4 | commitdiff |
RDMA/iwcm: Don't access a cm_id after dropping reference
cm_work_handler() can access cm_id_priv after it drops its reference
by calling iwch_deref_id(), which might cause it to be freed. The fix
is to look at whether IWCM_F_CALLBACK_DESTROY is set _before_ dropping
the reference. Then if it was set, free the cm_id on this thread.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
cm_work_handler() can access cm_id_priv after it drops its reference
by calling iwch_deref_id(), which might cause it to be freed. The fix
is to look at whether IWCM_F_CALLBACK_DESTROY is set _before_ dropping
the reference. Then if it was set, free the cm_id on this thread.
Signed-off-by: Steve Wise <swise@opengridcomputing.com>
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| drivers/infiniband/core/iwcm.c | diffblobblamehistory |