runqueue: fix use-after-free bug

Calling t->complete in runqueue_task_complete can free the memory
associated with t. Change the runqueue_start_next accordingly.

Fixes https://github.com/openwrt/openwrt/issues/493

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/runqueue.c b/runqueue.c
index 1d9fa4b3a120d1231e9830868b92de686ad653cd..a1d013361aabe4cfb1b067430ce592e396b94d54 100644 (file)
--- a/runqueue.c
+++ b/runqueue.c
@@ -232,7 +232,7 @@ void runqueue_task_complete(struct runqueue_task *t)
        t->cancelled = false;
        if (t->complete)
                t->complete(q, t);
-       runqueue_start_next(t->q);
+       runqueue_start_next(q);
 }
 
 static void