mirror of
https://github.com/torvalds/linux
synced 2024-09-24 21:38:33 +00:00
1b205c2d24
If the CM REQ handling function gets to error2, then it frees cm_id_priv->timewait_info. But the next line goes through ib_destroy_cm_id() -> ib_send_cm_rej() -> cm_reset_to_idle(), which ends up calling cm_cleanup_timewait(), which dereferences the pointer we just freed. Make sure we clear cm_id_priv->timewait_info after freeing it, so that doesn't happen. Signed-off-by: Roland Dreier <rolandd@cisco.com> |
||
|---|---|---|
| .. | ||
| core | ||
| hw/mthca | ||
| ulp/ipoib | ||
| Kconfig | ||
| Makefile | ||