From: Sabrina Dubroca <sd@queasysnail.net>
Date: Tue, 19 Jul 2016 09:56:58 +0000 (+0200)
Subject: mka: Fix use after free
X-Git-Tag: hostap_2_6~142
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=cfe0a0194b9d666593a1495980a1591c9c948da8;p=thirdparty%2Fhostap.git

mka: Fix use after free

We must cancel the timer when we delete an MKA instance.

Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
---

diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
index e6c41db24..dfc58707e 100644
--- a/src/pae/ieee802_1x_kay.c
+++ b/src/pae/ieee802_1x_kay.c
@@ -3438,6 +3438,7 @@ ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn)
 		return;
 	}
 
+	eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL);
 	dl_list_del(&participant->list);
 
 	/* remove live peer */