[1/2] scan: fix invalid read when canceling an ongoing scan

Commit Message

James Prestwood July 24, 2024, 12:14 p.m. UTC

When the survey code was added it neglected to add the same
cancelation logic that existed for the GET_SCAN call, i.e. if
a scan was canceled and there was a pending GET_SURVEY to the
kernel that needs to be canceled, and the request cleaned up.

Fixes: 35808debae ("scan: use GET_SURVEY for SNR calculation in ranking")
---
 src/scan.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

Comments

Denis Kenzior July 24, 2024, 2:14 p.m. UTC | #1

Hi James,

On 7/24/24 7:14 AM, James Prestwood wrote:
> When the survey code was added it neglected to add the same
> cancelation logic that existed for the GET_SCAN call, i.e. if
> a scan was canceled and there was a pending GET_SURVEY to the
> kernel that needs to be canceled, and the request cleaned up.
> 
> Fixes: 35808debae ("scan: use GET_SURVEY for SNR calculation in ranking")
> ---
>   src/scan.c | 10 ++++++++--
>   1 file changed, 8 insertions(+), 2 deletions(-)
> 

Both applied, thanks.

Regards,
-Denis

Patch

diff --git a/src/scan.c b/src/scan.c
index 1982cf74..30b3361e 100644
--- a/src/scan.c
+++ b/src/scan.c
@@ -948,7 +948,7 @@  bool scan_cancel(uint64_t wdev_id, uint32_t id)
 	 * Takes care of the following cases:
 	 * 1. If TRIGGER_SCAN is in flight
 	 * 2. TRIGGER_SCAN sent but bounced with -EBUSY
-	 * 3. Scan request is done but GET_SCAN is still pending
+	 * 3. Scan request is done but GET_SCAN/GET_SURVEY is still pending
 	 *
 	 * For case 3, we can easily cancel the command and proceed with the
 	 * other pending requests.  For case 1 & 2, the subsequent pending
@@ -963,6 +963,9 @@  bool scan_cancel(uint64_t wdev_id, uint32_t id)
 		if (sc->start_cmd_id)
 			l_genl_family_cancel(nl80211, sc->start_cmd_id);
 
+		if (sc->get_survey_cmd_id)
+			l_genl_family_cancel(nl80211, sc->get_survey_cmd_id);
+
 		if (sc->get_scan_cmd_id)
 			l_genl_family_cancel(nl80211, sc->get_scan_cmd_id);
 
@@ -2105,7 +2108,10 @@  static void get_survey_done(void *user_data)
 
 	sc->get_survey_cmd_id = 0;
 
-	get_results(results);
+	if (!results->sr->canceled)
+		get_results(results);
+	else
+		get_scan_done(user_data);
 }
 
 static bool scan_survey(struct scan_results *results)