summaryrefslogtreecommitdiffstats
path: root/drivers/infiniband
diff options
context:
space:
mode:
authorRoland Dreier <rolandd@cisco.com>2008-04-16 21:09:34 -0700
committerRoland Dreier <rolandd@cisco.com>2008-04-16 21:09:34 -0700
commit4cd1e5eb3cbe6e0cc934959770b4c60eac6ecf66 (patch)
treecf0a0219790a7fac9acf08727ad63de14c6c6bb4 /drivers/infiniband
parent940801b27e021b3494a44bc93be3c73fadbe4c2f (diff)
downloadlinux-4cd1e5eb3cbe6e0cc934959770b4c60eac6ecf66.tar.bz2
RDMA/nes: Free IRQ before killing tasklet
Move the free_irq() call in nes_remove() to before the tasklet_kill(); otherwise there is a window after tasklet_kill() where a new interrupt can be handled and reschedule the tasklet, leading to a use-after-free crash. Cc: <stable@kernel.org> Signed-off-by: Roland Dreier <rolandd@cisco.com>
Diffstat (limited to 'drivers/infiniband')
-rw-r--r--drivers/infiniband/hw/nes/nes.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/infiniband/hw/nes/nes.c b/drivers/infiniband/hw/nes/nes.c
index 7a89cd7327e2..b00b0e3a91dc 100644
--- a/drivers/infiniband/hw/nes/nes.c
+++ b/drivers/infiniband/hw/nes/nes.c
@@ -744,13 +744,13 @@ static void __devexit nes_remove(struct pci_dev *pcidev)
list_del(&nesdev->list);
nes_destroy_cqp(nesdev);
+
+ free_irq(pcidev->irq, nesdev);
tasklet_kill(&nesdev->dpc_tasklet);
/* Deallocate the Adapter Structure */
nes_destroy_adapter(nesdev->nesadapter);
- free_irq(pcidev->irq, nesdev);
-
if (nesdev->msi_enabled) {
pci_disable_msi(pcidev);
}