From: Shirley Ma <xma@us.ibm.com>

IPoIB small fixes: Initialize path->ah to NULL, and fix dereference after free
of neigh in error path of neigh_add_path().

Signed-off-by: Shirley Ma <xma@us.ibm.com>
Signed-off-by: Roland Dreier <roland@topspin.com>
Signed-off-by: Andrew Morton <akpm@osdl.org>
---

 25-akpm/drivers/infiniband/ulp/ipoib/ipoib_main.c |    5 +++--
 1 files changed, 3 insertions(+), 2 deletions(-)

diff -puN drivers/infiniband/ulp/ipoib/ipoib_main.c~ib-ipoib-small-fixes drivers/infiniband/ulp/ipoib/ipoib_main.c
--- 25/drivers/infiniband/ulp/ipoib/ipoib_main.c~ib-ipoib-small-fixes	2005-03-02 21:50:41.000000000 -0800
+++ 25-akpm/drivers/infiniband/ulp/ipoib/ipoib_main.c	2005-03-02 21:50:41.000000000 -0800
@@ -346,8 +346,9 @@ static struct ipoib_path *path_rec_creat
 	if (!path)
 		return NULL;
 
-	path->dev = dev;
+	path->dev          = dev;
 	path->pathrec.dlid = 0;
+	path->ah           = NULL;
 
 	skb_queue_head_init(&path->queue);
 
@@ -450,8 +451,8 @@ static void neigh_add_path(struct sk_buf
 err:
 	*to_ipoib_neigh(skb->dst->neighbour) = NULL;
 	list_del(&neigh->list);
-	kfree(neigh);
 	neigh->neighbour->ops->destructor = NULL;
+	kfree(neigh);
 
 	++priv->stats.tx_dropped;
 	dev_kfree_skb_any(skb);
_