| commit | 089a1bedd84be16a4f49a319e7ccb4a128da5ce9 | |
| author | Roland Dreier <rolandd@cisco.com> | |
| Fri, 28 Oct 2005 03:33:43 +0000 (27 20:33 -0700) | ||
| committer | Roland Dreier <rolandd@cisco.com> | |
| Fri, 28 Oct 2005 03:33:43 +0000 (27 20:33 -0700) | ||
| tree | d2bad46f16a76769b1f8d87aad369d50b4966cb6 | treesnapshot (tar.gz zip) |
| parent | 3d155f8cd0d077938d271225d26ee52f8eb26082 | commitdiff |
[IB] ib_umad: fix crash when freeing send buffers
The conversion of user_mad.c to the new MAD send API was slightly off:
in a few places, we used packet->msg instead of packet->msg->mad when
referring to the actual data buffer, which ended up corrupting the
underlying data structure and crashing when we free an invalid pointer.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
The conversion of user_mad.c to the new MAD send API was slightly off:
in a few places, we used packet->msg instead of packet->msg->mad when
referring to the actual data buffer, which ended up corrupting the
underlying data structure and crashing when we free an invalid pointer.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
| drivers/infiniband/core/user_mad.c | diffblobblamehistory |