tree 85785b13fba78ca4e70bd7a8f3c567db29ace2cf
parent 694b38b47c1105698d9933c36899468a3d7e54ba
author Johannes Berg <johannes.berg@intel.com> 1614263828 +0100
committer Bob Copeland <me@bobcopeland.com> 1614654141 -0500

wmediumd: fix use-after-free in client removal

If a client dies while we're waiting for an ACK from it, then
wmediumd_api_handler() will call wmediumd_remove_client() and
free the client, even while we're still waiting for it to
respond in wmediumd_wait_for_client_ack(). This leads then to
wmediumd_wait_for_client_ack() using the data after it was
already freed, and we also get stuck.

Fix this by deferring the free to the outermost loop, instead
just setting wait_for_ack=false whenever we find that we have
to free a client.

All client iterations (that can call back into the loop) then
must use _safe() in order to not use the 'next' pointer after
the client was removed (and the pointer poisoned).