Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-11-26 02:19:26 +01:00
Code Releases Activity

frame-xchg: Fix potential use after free

Browse Source 
Check if the frame callback has cancelled the frame_xchg before
attempting to free it.
This commit is contained in:
Andrew Zaborowski 2020-07-31 03:31:24 +02:00 committed by Denis Kenzior
parent 40c091ac7f
commit 736aadc75f
1 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/frame-xchg.c
View File

@ -975,6 +975,11 @@ static bool frame_xchg_tx_retry(struct wiphy_radio_work_item *item)
return false; return false;
} }
static bool frame_xchg_match_ptr(const void *a, const void *b)
{
return a == b;
}
static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu, static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
const void *body, size_t body_len, const void *body, size_t body_len,
int rssi, void *user_data) int rssi, void *user_data)
@ -1013,6 +1018,9 @@ static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
done = watch->cb(mpdu, body, body_len, rssi, fx->user_data); done = watch->cb(mpdu, body, body_len, rssi, fx->user_data);
if (!l_queue_find(frame_xchgs, frame_xchg_match_ptr, fx))
return true;
if (done) { if (done) {
/* NULL callback here since the caller is done */ /* NULL callback here since the caller is done */
fx->cb = NULL; fx->cb = NULL;