From: Shirley Ma IPoIB small fixes: Initialize path->ah to NULL, and fix dereference after free of neigh in error path of neigh_add_path(). Signed-off-by: Shirley Ma Signed-off-by: Roland Dreier Signed-off-by: Andrew Morton --- 25-akpm/drivers/infiniband/ulp/ipoib/ipoib_main.c | 5 +++-- 1 files changed, 3 insertions(+), 2 deletions(-) diff -puN drivers/infiniband/ulp/ipoib/ipoib_main.c~ib-ipoib-small-fixes drivers/infiniband/ulp/ipoib/ipoib_main.c --- 25/drivers/infiniband/ulp/ipoib/ipoib_main.c~ib-ipoib-small-fixes 2005-03-02 21:50:41.000000000 -0800 +++ 25-akpm/drivers/infiniband/ulp/ipoib/ipoib_main.c 2005-03-02 21:50:41.000000000 -0800 @@ -346,8 +346,9 @@ static struct ipoib_path *path_rec_creat if (!path) return NULL; - path->dev = dev; + path->dev = dev; path->pathrec.dlid = 0; + path->ah = NULL; skb_queue_head_init(&path->queue); @@ -450,8 +451,8 @@ static void neigh_add_path(struct sk_buf err: *to_ipoib_neigh(skb->dst->neighbour) = NULL; list_del(&neigh->list); - kfree(neigh); neigh->neighbour->ops->destructor = NULL; + kfree(neigh); ++priv->stats.tx_dropped; dev_kfree_skb_any(skb); _