-
Karsten Graul authored
Two buffers are allocated for each SMC connection. Each buffer is added to a buffer list after creation. When the second buffer allocation fails, the first buffer is freed but not deleted from the list. This might result in crashes when another connection picks up the freed buffer later and starts to work with it. Reviewed-by:
Ursula Braun <ubraun@linux.ibm.com> Fixes: 6511aad3 ("net/smc: change smc_buf_free function parameters") Signed-off-by:
Karsten Graul <kgraul@linux.ibm.com> Signed-off-by:
David S. Miller <davem@davemloft.net>
fd7f3a74