projects / platform / kernel / linux-rpi.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 354ba39) | patch
[PATCH] IB: fix CM use-after-free
authorRoland Dreier <roland@eddore.topspincom.com>
Sat, 10 Sep 2005 03:52:00 +0000 (20:52 -0700)
committerRoland Dreier <rolandd@cisco.com>
Sat, 10 Sep 2005 03:52:00 +0000 (20:52 -0700)
commit1b205c2d2464bfecbba80227e74b412596dc5521
tree8c22c14bd8b2c6cde19bd05b5cbbc1c88b64152atree | snapshot
parent354ba39cf96e439149541acf3c6c7c0df0a3ef25commit | diff
[PATCH] IB: fix CM use-after-free

If the CM REQ handling function gets to error2, then it frees
cm_id_priv->timewait_info.  But the next line goes through
ib_destroy_cm_id() -> ib_send_cm_rej() -> cm_reset_to_idle(),
which ends up calling cm_cleanup_timewait(), which dereferences the
pointer we just freed.  Make sure we clear cm_id_priv->timewait_info
after freeing it, so that doesn't happen.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
drivers/infiniband/core/cm.c diff | blob | history
Domain: System / Kernel;