Ensure that the MAD agent's delayed taskqueue is completely stopped
before proceeding. Otherwise, nothing prevents it from running after the MAD agent struct has been been freed, and this results in a use-after-free when the task's ta_pending count is incremented in the callout handler. MFC after: 2 weeks Sponsored by: EMC / Isilon Storage Division
This commit is contained in:
parent
319a55f4cd
commit
4af587d062
Notes:
svn2git
2020-12-20 02:59:44 +00:00
svn path=/head/; revision=287837
@ -1053,7 +1053,7 @@ static void unregister_mad_agent(struct ib_mad_agent_private *mad_agent_priv)
|
||||
*/
|
||||
cancel_mads(mad_agent_priv);
|
||||
port_priv = mad_agent_priv->qp_info->port_priv;
|
||||
cancel_delayed_work(&mad_agent_priv->timed_work);
|
||||
cancel_delayed_work_sync(&mad_agent_priv->timed_work);
|
||||
|
||||
spin_lock_irqsave(&port_priv->reg_lock, flags);
|
||||
remove_mad_reg_req(mad_agent_priv);
|
||||
|
Loading…
Reference in New Issue
Block a user