On 7/20/20 7:45 PM, Andrew Zaborowski wrote:
frame_xchg_destroy is passed as the wiphy radio work's destroy
to wiphy.c. If it's also called directly in frame_xchg_exit, there's
going to be a use-after-free when it's called again from wiphy_exit, so
instead use wiphy_radio_work_done which will call frame_xchg_destroy and
forget the frame_xchg record.
src/frame-xchg.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
All applied, thanks.