| commit | 1b205c2d2464bfecbba80227e74b412596dc5521 | [log] [tgz] |
|---|---|---|
| author | Roland Dreier <roland@eddore.topspincom.com> | Fri Sep 09 20:52:00 2005 -0700 |
| committer | Roland Dreier <rolandd@cisco.com> | Fri Sep 09 20:52:00 2005 -0700 |
| tree | 8c22c14bd8b2c6cde19bd05b5cbbc1c88b64152a | |
| parent | 354ba39cf96e439149541acf3c6c7c0df0a3ef25 [diff] |
[PATCH] IB: fix CM use-after-free If the CM REQ handling function gets to error2, then it frees cm_id_priv->timewait_info. But the next line goes through ib_destroy_cm_id() -> ib_send_cm_rej() -> cm_reset_to_idle(), which ends up calling cm_cleanup_timewait(), which dereferences the pointer we just freed. Make sure we clear cm_id_priv->timewait_info after freeing it, so that doesn't happen. Signed-off-by: Roland Dreier <rolandd@cisco.com>