• R
    IB/mad: Fix null pointer dereference in local_completions() · 1d9bc6d6
    Ralph Campbell 提交于
    handle_outgoing_dr_smp() can queue a struct ib_mad_local_private
    *local on the mad_agent_priv->local_work work queue with
    local->mad_priv == NULL if device->process_mad() returns
    IB_MAD_RESULT_SUCCESS | IB_MAD_RESULT_REPLY and
    (!ib_response_mad(&mad_priv->mad.mad) ||
    !mad_agent_priv->agent.recv_handler).
    
    In this case, local_completions() will be called with local->mad_priv
    == NULL. The code does check for this case and skips calling
    recv_mad_agent->agent.recv_handler() but recv == 0 so
    kmem_cache_free() is called with a NULL pointer.
    
    Also, since recv isn't reinitialized each time through the loop, it
    can cause a memory leak if recv should have been zero.
    Signed-off-by: NRalph Campbell <ralph.campbell@qlogic.com>
    1d9bc6d6
mad.c 83.6 KB