Kernel
/
iwd
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git
3
0
Fork 0
Code Releases Activity

frame-xchg: Don't call frame_xchg_destroy directly 

frame_xchg_destroy is passed as the wiphy radio work's destroy callback
to wiphy.c.  If it's also called directly in frame_xchg_exit, there's
going to be a use-after-free when it's called again from wiphy_exit, so
instead use wiphy_radio_work_done which will call frame_xchg_destroy and
forget the frame_xchg record.
This commit is contained in:
Andrew Zaborowski 2020-07-21 02:45:37 +02:00 committed by Denis Kenzior
parent e64de776a7
commit b4d85942e6
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/frame-xchg.c
View File

@ -1337,7 +1337,7 @@ static void destroy_xchg_data(void *user_data)
{
struct frame_xchg_data *fx = user_data;
frame_xchg_destroy(&fx->work);
wiphy_radio_work_done(wiphy_find_by_wdev(fx->wdev_id), fx->work.id);
}
static void frame_xchg_exit(void)
@ -1359,3 +1359,4 @@ static void frame_xchg_exit(void)
}
IWD_MODULE(frame_xchg, frame_xchg_init, frame_xchg_exit);
IWD_MODULE_DEPENDS(frame_xchg, wiphy)