Roland Dreier
1b205c2d24
[PATCH] IB: fix CM use-after-free
...
If the CM REQ handling function gets to error2, then it frees
cm_id_priv->timewait_info. But the next line goes through
ib_destroy_cm_id() -> ib_send_cm_rej() -> cm_reset_to_idle(),
which ends up calling cm_cleanup_timewait(), which dereferences the
pointer we just freed. Make sure we clear cm_id_priv->timewait_info
after freeing it, so that doesn't happen.
Signed-off-by: Roland Dreier <rolandd@cisco.com >
2005-09-09 20:52:00 -07:00
..
2005-08-07 14:23:42 +01:00
2005-08-27 10:11:40 -07:00
2005-09-02 12:18:03 -07:00
2005-09-05 16:03:13 -07:00
2005-09-06 00:35:51 -07:00
2005-08-29 15:55:13 -07:00
2005-08-30 13:31:56 +10:00
2005-09-05 23:35:41 -07:00
2005-07-28 09:43:56 -07:00
2005-07-06 13:54:09 -07:00
2005-06-20 15:15:32 -07:00
2005-06-20 15:15:32 -07:00
2005-07-30 09:47:53 -05:00
2005-07-28 08:39:02 -07:00
2005-09-05 09:26:55 -07:00
2005-09-05 09:26:54 -07:00
2005-09-05 00:06:16 -07:00
2005-09-05 09:26:52 -07:00
2005-09-09 20:52:00 -07:00
2005-09-05 00:06:08 -07:00
2005-08-29 15:33:26 -07:00
2005-09-05 00:06:16 -07:00
2005-06-25 16:24:56 -07:00
2005-09-01 17:43:25 -07:00
2005-09-05 09:14:35 -07:00
2005-08-09 17:59:52 -07:00
2005-08-18 10:10:46 +01:00
2005-08-31 21:48:47 +01:00
2005-09-03 16:45:49 +01:00
2005-07-27 16:26:08 -07:00
2005-09-06 00:47:18 -07:00
2005-07-27 16:26:20 -07:00
2005-06-27 21:52:39 -07:00
2005-08-29 10:34:59 -07:00
2005-09-05 00:06:16 -07:00
2005-09-05 20:49:54 +01:00
2005-08-18 08:43:59 -07:00
2005-09-05 00:06:29 -07:00
2005-08-30 21:46:19 -07:00
2005-09-05 05:50:36 -07:00
2005-09-05 23:35:05 -07:00
2005-06-20 15:15:35 -07:00
2005-06-21 18:46:32 -07:00
2005-07-07 18:24:07 -07:00
2005-09-06 00:32:12 -07:00
2005-09-05 09:14:32 -07:00
2005-08-29 16:01:11 -07:00
2005-06-20 15:15:35 -07:00
2005-08-18 10:06:59 +01:00
2005-08-18 10:06:59 +01:00