[PATCH 01/13] frame-xchg: Fix potential use after free

* [PATCH 01/13] frame-xchg: Fix potential use after free
@ 2020-07-31  1:31 Andrew Zaborowski
  2020-07-31  1:31 ` [PATCH 02/13] frame-xchg: Improve search for current frame in MLME notify Andrew Zaborowski
                   ` (12 more replies)
  0 siblings, 13 replies; 15+ messages in thread
From: Andrew Zaborowski @ 2020-07-31  1:31 UTC (permalink / raw)
  To: iwd

[-- Attachment #1: Type: text/plain, Size: 1263 bytes --]

Check if the frame callback has cancelled the frame_xchg before
attempting to free it.
---
I'm adding a frame_xchg_match_ptr here and I think I might have
used a similar function somewhere else.  I was wondering if we
want to add a pointer compare function in util.c or accept NULL
as match function in l_queue_find() to mean match by data pointer.
---
 src/frame-xchg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/frame-xchg.c b/src/frame-xchg.c
index 3c1fc279..dfe08f6a 100644
--- a/src/frame-xchg.c
+++ b/src/frame-xchg.c
@@ -975,6 +975,11 @@ static bool frame_xchg_tx_retry(struct wiphy_radio_work_item *item)
 	return false;
 }
 
+static bool frame_xchg_match_ptr(const void *a, const void *b)
+{
+	return a == b;
+}
+
 static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
 					const void *body, size_t body_len,
 					int rssi, void *user_data)
@@ -1013,6 +1018,9 @@ static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
 
 		done = watch->cb(mpdu, body, body_len, rssi, fx->user_data);
 
+		if (!l_queue_find(frame_xchgs, frame_xchg_match_ptr, fx))
+			return true;
+
 		if (done) {
 			/* NULL callback here since the caller is done */
 			fx->cb = NULL;
-- 
2.25.1

^ permalink raw reply related	[flat|nested] 15+ messages in thread