DGNum/libubox
6
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

runqueue: fix use-after-free bug

Browse source 
Calling t->complete in runqueue_task_complete can free the memory
associated with t. Change the runqueue_start_next accordingly.

Fixes https://github.com/openwrt/openwrt/issues/493

Signed-off-by: Felix Fietkau <nbd@nbd.name>
This commit is contained in:
Felix Fietkau 2017-06-14 12:08:42 +02:00
parent 368fd26458
commit 6a7fb7d8df
1 changed files with 1 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
runqueue.c
View file

@ -232,7 +232,7 @@ void runqueue_task_complete(struct runqueue_task *t)
t->cancelled = false; t->cancelled = false;
if (t->complete) if (t->complete)
t->complete(q, t); t->complete(q, t);
runqueue_start_next(t->q); runqueue_start_next(q);
} }
static void static void