runqueue: fix use-after-free bug
authorFelix Fietkau <nbd@nbd.name>
Wed, 14 Jun 2017 10:08:42 +0000 (12:08 +0200)
committerFelix Fietkau <nbd@nbd.name>
Wed, 14 Jun 2017 10:08:53 +0000 (12:08 +0200)
Calling t->complete in runqueue_task_complete can free the memory
associated with t. Change the runqueue_start_next accordingly.

Fixes https://github.com/openwrt/openwrt/issues/493

Signed-off-by: Felix Fietkau <nbd@nbd.name>
runqueue.c

index 1d9fa4b3a120d1231e9830868b92de686ad653cd..a1d013361aabe4cfb1b067430ce592e396b94d54 100644 (file)
@@ -232,7 +232,7 @@ void runqueue_task_complete(struct runqueue_task *t)
        t->cancelled = false;
        if (t->complete)
                t->complete(q, t);
-       runqueue_start_next(t->q);
+       runqueue_start_next(q);
 }
 
 static void