diff options
| author | Mark Johnston <markj@FreeBSD.org> | 2015-09-15 23:56:31 +0000 |
|---|---|---|
| committer | Mark Johnston <markj@FreeBSD.org> | 2015-09-15 23:56:31 +0000 |
| commit | 4af587d062fbc85a4cc2d33ebea3a9a58fc038e4 (patch) | |
| tree | e526d9cebec1f09e09b9e34c3f3ca9cb8526235e /sys/ofed | |
| parent | 319a55f4cd6ee9926d223a6c671a558f8dc28a2c (diff) | |
| download | src-4af587d062fbc85a4cc2d33ebea3a9a58fc038e4.tar.gz src-4af587d062fbc85a4cc2d33ebea3a9a58fc038e4.zip | |
Ensure that the MAD agent's delayed taskqueue is completely stopped
before proceeding. Otherwise, nothing prevents it from running after the
MAD agent struct has been been freed, and this results in a use-after-free
when the task's ta_pending count is incremented in the callout handler.
MFC after: 2 weeks
Sponsored by: EMC / Isilon Storage Division
Notes
Notes:
svn path=/head/; revision=287837
Diffstat (limited to 'sys/ofed')
| -rw-r--r-- | sys/ofed/drivers/infiniband/core/mad.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/sys/ofed/drivers/infiniband/core/mad.c b/sys/ofed/drivers/infiniband/core/mad.c index 3eedca1d6b6a..a78dd3ac10fc 100644 --- a/sys/ofed/drivers/infiniband/core/mad.c +++ b/sys/ofed/drivers/infiniband/core/mad.c @@ -1053,7 +1053,7 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv) */ cancel_mads(mad_agent_priv); port_priv = mad_agent_priv->qp_info->port_priv; - cancel_delayed_work(&mad_agent_priv->timed_work); + cancel_delayed_work_sync(&mad_agent_priv->timed_work); spin_lock_irqsave(&port_priv->reg_lock, flags); remove_mad_reg_req(mad_agent_priv); |