diff options
| author | avos <avos@FreeBSD.org> | 2016-04-19 20:19:21 +0000 |
|---|---|---|
| committer | avos <avos@FreeBSD.org> | 2016-04-19 20:19:21 +0000 |
| commit | 2cd2037927608bf92044a8f1e2c5235231f33cad (patch) | |
| tree | 40a6c2fc1bb2936a504cc0025cbe10bf884c6e2c /sys/net80211 | |
| parent | 1b24ba8d1f70c4121baa1cbdd2bd34ef13b80534 (diff) | |
| download | FreeBSD-src-2cd2037927608bf92044a8f1e2c5235231f33cad.zip FreeBSD-src-2cd2037927608bf92044a8f1e2c5235231f33cad.tar.gz | |
net80211: do not reschedule scan_curchan_task() if the scan was canceled.
This should fix possible use-after-free in the scheduled task.
PR: 208605
Diffstat (limited to 'sys/net80211')
| -rw-r--r-- | sys/net80211/ieee80211_scan_sw.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/sys/net80211/ieee80211_scan_sw.c b/sys/net80211/ieee80211_scan_sw.c index 5875980..6c9bcdb 100644 --- a/sys/net80211/ieee80211_scan_sw.c +++ b/sys/net80211/ieee80211_scan_sw.c @@ -736,8 +736,11 @@ end: /* clear mindwell lock and initial channel change flush */ ss_priv->ss_iflags &= ~ISCAN_REP; - if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) + if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) { + taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan, + NULL); goto end; + } IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n", __func__); |
