From cfe0a0194b9d666593a1495980a1591c9c948da8 Mon Sep 17 00:00:00 2001 From: Sabrina Dubroca Date: Tue, 19 Jul 2016 11:56:58 +0200 Subject: [PATCH] mka: Fix use after free We must cancel the timer when we delete an MKA instance. Signed-off-by: Sabrina Dubroca --- src/pae/ieee802_1x_kay.c | 1 + 1 file changed, 1 insertion(+) diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c index e6c41db24..dfc58707e 100644 --- a/src/pae/ieee802_1x_kay.c +++ b/src/pae/ieee802_1x_kay.c @@ -3438,6 +3438,7 @@ ieee802_1x_kay_delete_mka(struct ieee802_1x_kay *kay, struct mka_key_name *ckn) return; } + eloop_cancel_timeout(ieee802_1x_participant_timer, participant, NULL); dl_list_del(&participant->list); /* remove live peer */