• Yossi Etigin's avatar
    IPoIB: Fix crash in path_rec_completion() · ff79ae80
    Yossi Etigin authored
    Fix a crash in path_rec_completion() during an SM up/down loop.  If
    more than one path record request is issued, the first completion
    releases path->done, allowing ipoib_flush_paths() to free the path,
    and thus corrupting it for the second completion.
    
    Commit ee1e2c82 ("IPoIB: Refresh paths instead of flushing them on SM
    change events") added the field path->valid and changed the test "if
    (!path)" to "if (!path || !path->valid)".  This change made it
    possible for a path with an outstanding query to pass the test and
    issue another query on the same path.  Having two queries on the same
    path leads to a crash.
    
    This fixes <https://bugs.openfabrics.org/show_bug.cgi?id=1325>.
    Signed-off-by: default avatarYossi Etigin <yosefe@voltaire.com>
    Signed-off-by: default avatarRoland Dreier <rolandd@cisco.com>
    ff79ae80
ipoib_main.c 35.6 KB