From f96536b6e6a453545b92cb1dda8c6bb420a371a7 Mon Sep 17 00:00:00 2001 From: Felix Fietkau Date: Tue, 29 Apr 2014 15:16:21 +0200 Subject: [PATCH] netifd: fix a use-after-free issue on wireless config update After vlist_add() the device could have been freed Signed-off-by: Felix Fietkau --- wireless.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wireless.c b/wireless.c index ffb9e38..f3c9549 100644 --- a/wireless.c +++ b/wireless.c @@ -629,7 +629,6 @@ wireless_device_create(struct wireless_driver *drv, const char *name, struct blo INIT_LIST_HEAD(&wdev->script_proc); vlist_init(&wdev->interfaces, avl_strcmp, vif_update); wdev->interfaces.keep_old = true; - vlist_add(&wireless_devices, &wdev->node, wdev->name); wdev->timeout.cb = wireless_device_setup_timeout; wdev->script_task.cb = wireless_device_script_task_cb; @@ -640,6 +639,8 @@ wireless_device_create(struct wireless_driver *drv, const char *name, struct blo wdev->script_proc_fd.cb = wireless_proc_poll_fd; wdev->script_check.cb = wireless_device_check_script_tasks; + + vlist_add(&wireless_devices, &wdev->node, wdev->name); } void wireless_interface_create(struct wireless_device *wdev, struct blob_attr *data, const char *section) -- 2.25.1