mka: Fix use after free

We must cancel the timer when we delete an MKA instance.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index e6c41db243d51d30920b08f22f370d8a8d90e3b6..dfc58707eae75cd4f44b9a0d08c3b2d71fe42876 100644 (file)
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -3438,6 +3438,7 @@ ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn)
                return;
        }
 
+       eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL);
        dl_list_del(&participant->list);
 
        /* remove live peer */