• Jon Maloy's avatar
    tipc: fix access of released memory · e0e853ac
    Jon Maloy authored
    When the function tipc_group_filter_msg() finds that a member event
    indicates that the member is leaving the group, it first deletes the
    member instance, and then purges the message queue being handled
    by the call. But the message queue is an aggregated field in the
    just deleted item, leading the purge call to access freed memory.
    
    We fix this by swapping the order of the two actions.
    Signed-off-by: default avatarJon Maloy <jon.maloy@ericsson.com>
    Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
    e0e853ac
group.c 21.5 KB