From: Benjamin Berg <benjamin.berg@intel.com>
Date: Thu, 30 Oct 2025 08:24:34 +0000 (+0100)
Subject: eloop: Remove references before destroying socket table
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=c549d099a56b2bd7858eef55a64462d7480882c2;p=thirdparty%2Fhostap.git

eloop: Remove references before destroying socket table

If the table is not yet empty, there are still references stored inside
the table and inserted into the global reference list. Clean these up
before freeing the table to avoid an use-after-free if a socket was not
removed and tracing is enabled.

Fixes: a6ff0e0810b4 ("trace: Add active reference tracking")
Signed-off-by: Benjamin Berg <benjamin.berg@intel.com>
---

diff --git a/src/utils/eloop.c b/src/utils/eloop.c
index b4ad8b824..250f1543c 100644
--- a/src/utils/eloop.c
+++ b/src/utils/eloop.c
@@ -713,6 +713,7 @@ static void eloop_sock_table_destroy(struct eloop_sock_table *table)
 						table->table[i].handler);
 			wpa_trace_dump("eloop sock", &table->table[i]);
 		}
+		eloop_trace_sock_remove_ref(table);
 		os_free(table->table);
 	}
 }