2 files changed, 6 insertions, 4 deletions
diff --git a/cpp/src/qpid/sys/rdma/RdmaIO.cpp b/cpp/src/qpid/sys/rdma/RdmaIO.cpp
index 3b49e9759e..25301e9850 100644
--- a/cpp/src/qpid/sys/rdma/RdmaIO.cpp
+++ b/cpp/src/qpid/sys/rdma/RdmaIO.cpp
@@ -41,8 +41,6 @@ namespace Rdma {
             FullCallback fc,
             ErrorCallback ec
     ) :
-        qp(q),
-        dataHandle(*qp, boost::bind(&AsynchIO::dataEvent, this), 0, 0),
         bufferSize(size),
         recvCredit(0),
         xmitCredit(xCredit),
@@ -51,6 +49,8 @@ namespace Rdma {
         outstandingWrites(0),
         draining(false),
         state(IDLE),
+        qp(q),
+        dataHandle(*qp, boost::bind(&AsynchIO::dataEvent, this), 0, 0),
         readCallback(rc),
         idleCallback(ic),
         fullCallback(fc),
diff --git a/cpp/src/qpid/sys/rdma/RdmaIO.h b/cpp/src/qpid/sys/rdma/RdmaIO.h
index 655119b798..4cd0e08592 100644
--- a/cpp/src/qpid/sys/rdma/RdmaIO.h
+++ b/cpp/src/qpid/sys/rdma/RdmaIO.h
@@ -47,8 +47,6 @@ namespace Rdma {
         typedef boost::function2<void, AsynchIO&, Buffer*> FullCallback;
         typedef boost::function1<void, AsynchIO&> NotifyCallback;
 
-        QueuePair::intrusive_ptr qp;
-        qpid::sys::DispatchHandleRef dataHandle;
         int bufferSize;
         int recvCredit;
         int xmitCredit;
@@ -62,6 +60,10 @@ namespace Rdma {
         std::deque<Buffer*> bufferQueue;
         qpid::sys::Mutex bufferQueueLock;
         boost::ptr_deque<Buffer> buffers;
+        // The QueuePair must be after the buffers so that the connection is destroyed before the buffers
+        // are deallocated so that the hardware doesn't write into memory that's been given back.
+        QueuePair::intrusive_ptr qp;
+        qpid::sys::DispatchHandleRef dataHandle;
 
         ReadCallback readCallback;
         IdleCallback idleCallback;