svn commit: r298293 - head/sys/net80211

[Andriy Voskoboinyk]

Author: avos
Date: Tue Apr 19 20:19:21 2016
New Revision: 298293
URL: https://svnweb.freebsd.org/changeset/base/298293

Log:
  net80211: do not reschedule scan_curchan_task() if the scan was canceled.
  
  This should fix possible use-after-free in the scheduled task.
  
  PR:		208605

Modified:
  head/sys/net80211/ieee80211_scan_sw.c

Modified: head/sys/net80211/ieee80211_scan_sw.c
==============================================================================
--- head/sys/net80211/ieee80211_scan_sw.c	Tue Apr 19 20:12:46 2016	(r298292)
+++ head/sys/net80211/ieee80211_scan_sw.c	Tue Apr 19 20:19:21 2016	(r298293)
@@ -736,8 +736,11 @@ end:
 	/* clear mindwell lock and initial channel change flush */
 	ss_priv->ss_iflags &= ~ISCAN_REP;
 
-	if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT))
+	if (ss_priv->ss_iflags & (ISCAN_CANCEL|ISCAN_ABORT)) {
+		taskqueue_cancel_timeout(ic->ic_tq, &ss_priv->ss_scan_curchan,
+		    NULL);
 		goto end;
+	}
 
 	IEEE80211_DPRINTF(ss->ss_vap, IEEE80211_MSG_SCAN, "%s: waiting\n",
 	    __func__);