eloop: Remove references before destroying socket table

If the table is not yet empty, there are still references stored inside
the table and inserted into the global reference list. Clean these up
before freeing the table to avoid an use-after-free if a socket was not
removed and tracing is enabled.

Fixes: a6ff0e0810b4 ("trace: Add active reference tracking")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>

diff --git a/src/utils/eloop.c b/src/utils/eloop.c
index b4ad8b8241f87f11bb97c46ebd15a210cd891d3d..250f1543ce8cba06dddd299240166e59b8238258 100644 (file)
--- a/src/utils/eloop.c
+++ b/src/utils/eloop.c
@@ -713,6 +713,7 @@ static void eloop_sock_table_destroy(struct eloop_sock_table *table)
                                                table->table[i].handler);
                        wpa_trace_dump("eloop sock", &table->table[i]);
                }
+               eloop_trace_sock_remove_ref(table);
                os_free(table->table);
        }
 }