[IB] ib_umad: fix crash when freeing send buffers
commit089a1bedd84be16a4f49a319e7ccb4a128da5ce9
authorRoland Dreier <rolandd@cisco.com>
Fri, 28 Oct 2005 03:33:43 +0000 (27 20:33 -0700)
committerRoland Dreier <rolandd@cisco.com>
Fri, 28 Oct 2005 03:33:43 +0000 (27 20:33 -0700)
treed2bad46f16a76769b1f8d87aad369d50b4966cb6
parent3d155f8cd0d077938d271225d26ee52f8eb26082
[IB] ib_umad: fix crash when freeing send buffers

The conversion of user_mad.c to the new MAD send API was slightly off:
in a few places, we used packet->msg instead of packet->msg->mad when
referring to the actual data buffer, which ended up corrupting the
underlying data structure and crashing when we free an invalid pointer.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/core/user_mad.c