mirror of
https://git.kernel.org/pub/scm/network/wireless/iwd.git
synced 2024-12-22 21:22:37 +01:00
frame-xchg: Don't call frame_xchg_destroy directly
frame_xchg_destroy is passed as the wiphy radio work's destroy callback to wiphy.c. If it's also called directly in frame_xchg_exit, there's going to be a use-after-free when it's called again from wiphy_exit, so instead use wiphy_radio_work_done which will call frame_xchg_destroy and forget the frame_xchg record.
This commit is contained in:
parent
e64de776a7
commit
b4d85942e6
@ -1337,7 +1337,7 @@ static void destroy_xchg_data(void *user_data)
|
|||||||
{
|
{
|
||||||
struct frame_xchg_data *fx = user_data;
|
struct frame_xchg_data *fx = user_data;
|
||||||
|
|
||||||
frame_xchg_destroy(&fx->work);
|
wiphy_radio_work_done(wiphy_find_by_wdev(fx->wdev_id), fx->work.id);
|
||||||
}
|
}
|
||||||
|
|
||||||
static void frame_xchg_exit(void)
|
static void frame_xchg_exit(void)
|
||||||
@ -1359,3 +1359,4 @@ static void frame_xchg_exit(void)
|
|||||||
}
|
}
|
||||||
|
|
||||||
IWD_MODULE(frame_xchg, frame_xchg_init, frame_xchg_exit);
|
IWD_MODULE(frame_xchg, frame_xchg_init, frame_xchg_exit);
|
||||||
|
IWD_MODULE_DEPENDS(frame_xchg, wiphy)
|
||||||
|
Loading…
Reference in New Issue
Block a user