diff options
| author | Roland Dreier <rolandd@cisco.com> | 2008-04-18 16:25:17 +0000 |
|---|---|---|
| committer | Greg Kroah-Hartman <gregkh@suse.de> | 2008-05-01 14:44:34 -0700 |
| commit | 2bef74464c8f5b9da0cb489c9867cf88bd5a735a (patch) | |
| tree | f3454c41648c15e5c68f2fa37ff6285a50df52ef | |
| parent | bc657c218dc4f0d8fbb5fb9c746c0dd9736e128a (diff) | |
RDMA/nes: Free IRQ before killing tasklet
commit: 4cd1e5eb3cbe6e0cc934959770b4c60eac6ecf66
Move the free_irq() call in nes_remove() to before the tasklet_kill();
otherwise there is a window after tasklet_kill() where a new interrupt
can be handled and reschedule the tasklet, leading to a use-after-free
crash.
Signed-off-by: Roland Dreier <rolandd@cisco.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
| -rw-r--r-- | drivers/infiniband/hw/nes/nes.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c index b2112f5a422..a3b23749483 100644 --- a/drivers/infiniband/hw/nes/nes.c +++ b/drivers/infiniband/hw/nes/nes.c @@ -751,13 +751,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev) list_del(&nesdev->list); nes_destroy_cqp(nesdev); + + free_irq(pcidev->irq, nesdev); tasklet_kill(&nesdev->dpc_tasklet); /* Deallocate the Adapter Structure */ nes_destroy_adapter(nesdev->nesadapter); - free_irq(pcidev->irq, nesdev); - if (nesdev->msi_enabled) { pci_disable_msi(pcidev); } |