From: Roland Dreier <rolandd@cisco.com>
Date: Fri, 28 Oct 2005 03:33:43 +0000 (-0700)
Subject: [IB] ib_umad: fix crash when freeing send buffers
X-Git-Tag: v2.6.15-rc1~731^2~21^2~6
X-Git-Url: http://git.openpandora.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=089a1bedd84be16a4f49a319e7ccb4a128da5ce9;p=pandora-kernel.git

[IB] ib_umad: fix crash when freeing send buffers

The conversion of user_mad.c to the new MAD send API was slightly off:
in a few places, we used packet->msg instead of packet->msg->mad when
referring to the actual data buffer, which ended up corrupting the
underlying data structure and crashing when we free an invalid pointer.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
---

Reading git-diff-tree failed