linux/drivers/infiniband/ulp/ipoib
Erez Shitrit 50be28de6f IB/IPoIB: Fix kernel panic on multicast flow
ipoib_mcast_restart_task calls ipoib_mcast_remove_list with the
parameter mcast->dev. That mcast is a temporary (used as an iterator)
variable that may be uninitialized.
There is no need to send the variable dev to the function, as each mcast
has its dev as a member in the mcast struct.

This causes the next panic:
RIP: 0010: ipoib_mcast_leave+0x6d/0xf0 [ib_ipoib]
RSP: 0018: EFLAGS: 00010246
RAX: f0201 RBX: 24e00 RCX: 00000
....
....
Stack:
Call Trace:
	ipoib_mcast_remove_list+0x3a/0x70 [ib_ipoib]
	ipoib_mcast_restart_task+0x3bb/0x520 [ib_ipoib]
	process_one_work+0x164/0x470
	worker_thread+0x11d/0x420
	...

Fixes: 5a0e81f6f4 ('IB/IPoIB: factor out common multicast list removal code')
Signed-off-by: Erez Shitrit <erezsh@mellanox.com>
Reported-by: Doron Tsur <doront@mellanox.com>
Reviewed-by: Christoph Lameter <cl@linux.com>
Signed-off-by: Doug Ledford <dledford@redhat.com>
2016-01-19 12:59:54 -05:00
..
ipoib_cm.c Merge branches '4.5/Or-cleanup' and '4.5/rdma-cq' into k.o/for-4.5 2015-12-22 17:03:15 -05:00
ipoib_ethtool.c IB/ulps: Avoid calling ib_query_device 2015-12-22 14:39:00 -05:00
ipoib_fs.c IPoIB: Remove unnecessary test for NULL before debugfs_remove() 2014-08-12 21:59:54 -07:00
ipoib_ib.c IB: split struct ib_send_wr 2015-10-08 11:09:10 +01:00
ipoib_main.c IB/IPoIB: Fix kernel panic on multicast flow 2016-01-19 12:59:54 -05:00
ipoib_multicast.c IB/IPoIB: Fix kernel panic on multicast flow 2016-01-19 12:59:54 -05:00
ipoib_netlink.c infiniband: make sure the src net is infiniband when create new link 2014-01-03 20:38:56 -05:00
ipoib_verbs.c IB: split struct ib_send_wr 2015-10-08 11:09:10 +01:00
ipoib_vlan.c IB/ipoib: Fix ndo_get_iflink 2015-04-17 15:21:04 -04:00
ipoib.h IB/IPoIB: Fix kernel panic on multicast flow 2016-01-19 12:59:54 -05:00
Kconfig kconfig: rename CONFIG_EMBEDDED to CONFIG_EXPERT 2011-01-20 17:02:05 -08:00
Makefile IB/ipoib: Add rtnl_link_ops support 2012-09-20 16:49:17 -04:00