This repository has been archived on 2026-03-14. You can view files and clone it, but cannot push or open issues or pull requests.
Files
ubports_kernel_google_msm/drivers
Roland Dreier 1b205c2d24 [PATCH] IB: fix CM use-after-free
If the CM REQ handling function gets to error2, then it frees
cm_id_priv->timewait_info.  But the next line goes through
ib_destroy_cm_id() -> ib_send_cm_rej() -> cm_reset_to_idle(),
which ends up calling cm_cleanup_timewait(), which dereferences the
pointer we just freed.  Make sure we clear cm_id_priv->timewait_info
after freeing it, so that doesn't happen.

Signed-off-by: Roland Dreier <rolandd@cisco.com>
2005-09-09 20:52:00 -07:00
..
2005-07-30 09:47:53 -05:00
2005-04-16 15:20:36 -07:00
2005-08-30 21:46:19 -07:00
2005-09-05 23:35:05 -07:00
2005-06-21 18:46:32 -07:00
2005-04-16 15:20:36 -07:00