Kernel/iwd
3
0
Fork 0
mirror of https://git.kernel.org/pub/scm/network/wireless/iwd.git synced 2024-12-22 13:02:44 +01:00
Code Releases Activity

frame-xchg: Don't call frame_xchg_destroy directly

Browse Source 
frame_xchg_destroy is passed as the wiphy radio work's destroy callback
to wiphy.c.  If it's also called directly in frame_xchg_exit, there's
going to be a use-after-free when it's called again from wiphy_exit, so
instead use wiphy_radio_work_done which will call frame_xchg_destroy and
forget the frame_xchg record.
This commit is contained in:
Andrew Zaborowski 2020-07-21 02:45:37 +02:00 committed by Denis Kenzior
parent e64de776a7
commit b4d85942e6
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/frame-xchg.c
View File

@ -1337,7 +1337,7 @@ static void destroy_xchg_data(void *user_data)
{ {
struct frame_xchg_data *fx = user_data; struct frame_xchg_data *fx = user_data;
frame_xchg_destroy(&fx->work); wiphy_radio_work_done(wiphy_find_by_wdev(fx->wdev_id), fx->work.id);
} }
static void frame_xchg_exit(void) static void frame_xchg_exit(void)
@ -1359,3 +1359,4 @@ static void frame_xchg_exit(void)
} }
IWD_MODULE(frame_xchg, frame_xchg_init, frame_xchg_exit); IWD_MODULE(frame_xchg, frame_xchg_init, frame_xchg_exit);
IWD_MODULE_DEPENDS(frame_xchg, wiphy)