From: Jon Maloy <[email protected]> Date: Mon, 20 Nov 2017 21:43:03 +0100
> When the function tipc_group_filter_msg() finds that a member event > indicates that the member is leaving the group, it first deletes the > member instance, and then purges the message queue being handled > by the call. But the message queue is an aggregated field in the > just deleted item, leading the purge call to access freed memory. > > We fix this by swapping the order of the two actions. > > Signed-off-by: Jon Maloy <[email protected]> Applied, thanks Jon.
