git.openpandora.org
/
pandora-kernel.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
IB/core: Fix use after free in send_leave function
[pandora-kernel.git]
/
drivers
/
infiniband
/
core
/
multicast.c
diff --git
a/drivers/infiniband/core/multicast.c
b/drivers/infiniband/core/multicast.c
index
d2360a8
..
180d7f4
100644
(file)
--- a/
drivers/infiniband/core/multicast.c
+++ b/
drivers/infiniband/core/multicast.c
@@
-106,7
+106,6
@@
struct mcast_group {
atomic_t refcount;
enum mcast_group_state state;
struct ib_sa_query *query;
atomic_t refcount;
enum mcast_group_state state;
struct ib_sa_query *query;
- int query_id;
u16 pkey_index;
u8 leave_state;
int retries;
u16 pkey_index;
u8 leave_state;
int retries;
@@
-339,11
+338,7
@@
static int send_join(struct mcast_group *group, struct mcast_member *member)
member->multicast.comp_mask,
3000, GFP_KERNEL, join_handler, group,
&group->query);
member->multicast.comp_mask,
3000, GFP_KERNEL, join_handler, group,
&group->query);
- if (ret >= 0) {
- group->query_id = ret;
- ret = 0;
- }
- return ret;
+ return (ret > 0) ? 0 : ret;
}
static int send_leave(struct mcast_group *group, u8 leave_state)
}
static int send_leave(struct mcast_group *group, u8 leave_state)
@@
-363,11
+358,7
@@
static int send_leave(struct mcast_group *group, u8 leave_state)
IB_SA_MCMEMBER_REC_JOIN_STATE,
3000, GFP_KERNEL, leave_handler,
group, &group->query);
IB_SA_MCMEMBER_REC_JOIN_STATE,
3000, GFP_KERNEL, leave_handler,
group, &group->query);
- if (ret >= 0) {
- group->query_id = ret;
- ret = 0;
- }
- return ret;
+ return (ret > 0) ? 0 : ret;
}
static void join_group(struct mcast_group *group, struct mcast_member *member,
}
static void join_group(struct mcast_group *group, struct mcast_member *member,