All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 01/13] frame-xchg: Fix potential use after free
@ 2020-07-31  1:31 Andrew Zaborowski
  2020-07-31  1:31 ` [PATCH 02/13] frame-xchg: Improve search for current frame in MLME notify Andrew Zaborowski
                   ` (12 more replies)
  0 siblings, 13 replies; 15+ messages in thread
From: Andrew Zaborowski @ 2020-07-31  1:31 UTC (permalink / raw)
  To: iwd

[-- Attachment #1: Type: text/plain, Size: 1263 bytes --]

Check if the frame callback has cancelled the frame_xchg before
attempting to free it.
---
I'm adding a frame_xchg_match_ptr here and I think I might have
used a similar function somewhere else.  I was wondering if we
want to add a pointer compare function in util.c or accept NULL
as match function in l_queue_find() to mean match by data pointer.
---
 src/frame-xchg.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/frame-xchg.c b/src/frame-xchg.c
index 3c1fc279..dfe08f6a 100644
--- a/src/frame-xchg.c
+++ b/src/frame-xchg.c
@@ -975,6 +975,11 @@ static bool frame_xchg_tx_retry(struct wiphy_radio_work_item *item)
 	return false;
 }
 
+static bool frame_xchg_match_ptr(const void *a, const void *b)
+{
+	return a == b;
+}
+
 static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
 					const void *body, size_t body_len,
 					int rssi, void *user_data)
@@ -1013,6 +1018,9 @@ static bool frame_xchg_resp_handle(const struct mmpdu_header *mpdu,
 
 		done = watch->cb(mpdu, body, body_len, rssi, fx->user_data);
 
+		if (!l_queue_find(frame_xchgs, frame_xchg_match_ptr, fx))
+			return true;
+
 		if (done) {
 			/* NULL callback here since the caller is done */
 			fx->cb = NULL;
-- 
2.25.1

^ permalink raw reply related	[flat|nested] 15+ messages in thread

end of thread, other threads:[~2020-07-31 18:56 UTC | newest]

Thread overview: 15+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2020-07-31  1:31 [PATCH 01/13] frame-xchg: Fix potential use after free Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 02/13] frame-xchg: Improve search for current frame in MLME notify Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 03/13] frame-xchg: Re-add frame_xchg_stop Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 04/13] station: Comment/whitespace fix Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 05/13] p2p: Retry connect on "Previous authentication not valid" Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 06/13] p2p: Add a null-check before use Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 07/13] p2p: Set p2p_own_wfd->available by default Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 08/13] p2p: Use a longer DHCP timeout Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 09/13] wfd-source: Print call trace on error Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 10/13] wfd-source: Support wfd-idr-request Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 11/13] wfd-source: Display some stream properties Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 12/13] wfd-source: Add stream utility buttons Andrew Zaborowski
2020-07-31  1:31 ` [PATCH 13/13] wfd-source: Allow alternative URLs in SETUP request Andrew Zaborowski
2020-07-31 15:40 ` [PATCH 01/13] frame-xchg: Fix potential use after free Denis Kenzior
2020-07-31 18:56   ` Andrew Zaborowski

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.