runqueue: fix use-after-free bug

Calling t->complete in runqueue_task_complete can free the memory
associated with t. Change the runqueue_start_next accordingly.

Fixes https://github.com/openwrt/openwrt/issues/493

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2017-06-14 12:08:42 +02:00
parent 368fd26458
commit 6a7fb7d8df

View file

@ -232,7 +232,7 @@ void runqueue_task_complete(struct runqueue_task *t)
t->cancelled = false;
if (t->complete)
t->complete(q, t);
runqueue_start_next(t->q);
runqueue_start_next(q);
}
static void