runqueue: fix use-after-free bug

Calling t->complete in runqueue_task_complete can free the memory
associated with t. Change the runqueue_start_next accordingly.

Fixes https://github.com/openwrt/openwrt/issues/493

Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/runqueue.c b/runqueue.c
index 1d9fa4b..a1d0133 100644 (file)
--- a/runqueue.c
+++ b/runqueue.c
@@ -232,7 +232,7 @@ void runqueue_task_complete(struct runqueue_task *t)
        t->cancelled = false;
        if (t->complete)
                t->complete(q, t);
        t->cancelled = false;
        if (t->complete)
                t->complete(q, t);

-       runqueue_start_next(t->q);
+       runqueue_start_next(q);

 }
 
 static void
 }
 
 static void