releases/2.6.14.4/infiniband-fix-a-null-pointer-deref.patch

   1 From stable-bounces@linux.kernel.org  Mon Nov 28 03:46:11 2005
   2 Date: Mon, 28 Nov 2005 12:46:00 +0100
   3 From: Adrian Bunk <bunk@stusta.de>
   4 To: stable@kernel.org
   5 Cc:
   6 Subject: drivers/infiniband/core/mad.c: fix a use-after-free
   7
   8 The Coverity checker spotted this obvious use-after-free
   9 caused by a wrong order of the cleanups.
  10
  11 Signed-off-by: Adrian Bunk <bunk@stusta.de>
  12 Acked-by: Roland Dreier <rolandd@cisco.com>
  13 Signed-off-by: Chris Wright <chrisw@osdl.org>
  14 Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de>
  15 ---
  16  drivers/infiniband/core/mad.c |    4 ++--
  17  1 file changed, 2 insertions(+), 2 deletions(-)
  18
  19 --- linux-2.6.14.3.orig/drivers/infiniband/core/mad.c
  20 +++ linux-2.6.14.3/drivers/infiniband/core/mad.c
  21 @@ -356,9 +356,9 @@ error4:
  22         spin_unlock_irqrestore(&port_priv->reg_lock, flags);
  23         kfree(reg_req);
  24  error3:
  25 -       kfree(mad_agent_priv);
  26 -error2:
  27         ib_dereg_mr(mad_agent_priv->agent.mr);
  28 +error2:
  29 +       kfree(mad_agent_priv);
  30  error1:
  31         return ret;
  32  }