hostap: Do not free priv until timer handler has actually stopped using it
authorKirill Tkhai <ktkhai@parallels.com>
Fri, 14 Feb 2014 12:17:49 +0000 (16:17 +0400)
committerJohn W. Linville <linville@tuxdriver.com>
Thu, 20 Feb 2014 20:49:07 +0000 (15:49 -0500)
commit72471c0d3197d02da53897868692f0b91042f8a5
tree83d3447d12c5b474ac26b302be4cc4273737bd1c
parentd421c62e37c9c83496fa721d4f4cd4a6cae82151
hostap: Do not free priv until timer handler has actually stopped using it

Function del_timer() does not guarantee that timer was really deleted.
If the timer handler is beeing executed at the moment, the function
does nothing. So, it's possible to use already freed memory in the handler:

[ref: Documentation/DocBook/kernel-locking.tmpl]

This was found using grep and compile-tested only. Please, consider
applying or something similar to it.

Signed-off-by: Kirill Tkhai <ktkhai@parallels.com>
CC: Jouni Malinen <j@w1.fi>
CC: John W. Linville <linville@tuxdriver.com>
Signed-off-by: John W. Linville <linville@tuxdriver.com>
drivers/net/wireless/hostap/hostap_ap.c