mac80211: fix remain-on-channel cancel crash

If a ROC item is canceled just as it expires, the work
struct may be scheduled while it is running (and waiting
for the mutex). This results in it being run after being
freed, which obviously crashes.

To fix this don't free it when aborting is requested but
instead mark it as "to be freed", which makes the work a
no-op and allows freeing it outside.

Cc: [email protected] [3.6+]
Reported-by: Jouni Malinen <[email protected]>
Tested-by: Jouni Malinen <[email protected]>
Signed-off-by: Johannes Berg <[email protected]>

0 files changed, 0 insertions, 0 deletions