Date: Tue, 19 Apr 2016 20:19:22 +0000 (UTC) From: Andriy Voskoboinyk <avos@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org Subject: svn commit: r298293 - head/sys/net80211 Message-ID: <201604192019.u3JKJMKD034073@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: avos Date: Tue Apr 19 20:19:21 2016 New Revision: 298293 URL: https://svnweb.freebsd.org/changeset/base/298293 Log: net80211: do not reschedule scan_curchan_task() if the scan was canceled. This should fix possible use-after-free in the scheduled task. PR: 208605 Modified: head/sys/net80211/ieee80211_scan_sw.c Modified: head/sys/net80211/ieee80211_scan_sw.c ============================================================================== --- head/sys/net80211/ieee80211_scan_sw.c Tue Apr 19 20:12:46 2016 (r298292) +++ head/sys/net80211/ieee80211_scan_sw.c Tue Apr 19 20:19:21 2016 (r298293) @@ -736,8 +736,11 @@ end: /* clear mindwell lock and initial channel change flush */ ss_priv->ss_iflags &= ~ISCAN_REP; - if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) + if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) { + taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan, + NULL); goto end; + } IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n", __func__);
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201604192019.u3JKJMKD034073>