Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

scan: fix invalid read when canceling an ongoing scan 

When the survey code was added it neglected to add the same
cancelation logic that existed for the GET_SCAN call, i.e. if
a scan was canceled and there was a pending GET_SURVEY to the
kernel that needs to be canceled, and the request cleaned up.

Fixes: 35808debae ("scan: use GET_SURVEY for SNR calculation in ranking")
This commit is contained in:
James Prestwood 2024-07-24 05:14:42 -07:00 committed by Denis Kenzior
parent 91f7253ae1
commit 64d68b4f08
1 changed files with 8 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
src/scan.c
View File

@ -930,7 +930,7 @@ bool scan_cancel(uint64_t wdev_id, uint32_t id)
* Takes care of the following cases:
* 1. If TRIGGER_SCAN is in flight
* 2. TRIGGER_SCAN sent but bounced with -EBUSY
* 3. Scan request is done but GET_SCAN is still pending
* 3. Scan request is done but GET_SCAN/GET_SURVEY is still pending
*
* For case 3, we can easily cancel the command and proceed with the
* other pending requests. For case 1 & 2, the subsequent pending
@ -945,6 +945,9 @@ bool scan_cancel(uint64_t wdev_id, uint32_t id)
if (sc->start_cmd_id)
l_genl_family_cancel(nl80211, sc->start_cmd_id);
if (sc->get_survey_cmd_id)
l_genl_family_cancel(nl80211, sc->get_survey_cmd_id);
if (sc->get_scan_cmd_id)
l_genl_family_cancel(nl80211, sc->get_scan_cmd_id);
@ -2053,7 +2056,10 @@ static void get_survey_done(void *user_data)
sc->get_survey_cmd_id = 0;
get_results(results);
if (!results->sr->canceled)
get_results(results);
else
get_scan_done(user_data);
}
static bool scan_survey(struct scan_results *results)