ipoib_mcast_restart_task calls ipoib_mcast_remove_list with the
parameter mcast->dev. That mcast is a temporary (used as an iterator)
variable that may be uninitialized.
There is no need to send the variable dev to the function, as each mcast
has its dev as a member in the mcast struct.
This causes the next panic:
RIP: 0010: ipoib_mcast_leave+0x6d/0xf0 [ib_ipoib]
RSP: 0018: EFLAGS: 00010246
RAX: f0201 RBX: 24e00 RCX: 00000
....
....
Stack:
Call Trace:
ipoib_mcast_remove_list+0x3a/0x70 [ib_ipoib]
ipoib_mcast_restart_task+0x3bb/0x520 [ib_ipoib]
process_one_work+0x164/0x470
worker_thread+0x11d/0x420
...
Fixes:
|
||
---|---|---|
.. | ||
ipoib.h | ||
ipoib_cm.c | ||
ipoib_ethtool.c | ||
ipoib_fs.c | ||
ipoib_ib.c | ||
ipoib_main.c | ||
ipoib_multicast.c | ||
ipoib_netlink.c | ||
ipoib_verbs.c | ||
ipoib_vlan.c | ||
Kconfig | ||
Makefile |