DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

Fix Linux packat socket regression work around

Browse source 
Commit e6dd8196e5 ('Work around Linux
packet socket regression') added a mechanism to close the workaround
bridge socket in l2_packet_receive(). However, it did not take into
account the possibility of the l2->rx_callback() closing the l2_packet
socket altogether. This could result in use of freed memory when usin
RSN pre-authentication. Fix this by reordering the calls to clear the
workaround socket before calling the rx_callback.

Signed-off-by: Jouni Malinen <j@w1.fi>
This commit is contained in:
Jouni Malinen 2015-02-07 01:13:34 +02:00
parent d821e2f294
commit 23ed011bea
1 changed files with 2 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

4
src/l2_packet/l2_packet_linux.c
View file

@ -132,8 +132,6 @@ static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
return;
}
l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
if (l2->fd_br_rx >= 0) {
wpa_printf(MSG_DEBUG, "l2_packet_receive: Main packet socket for %s seems to have working RX - close workaround bridge socket",
l2->ifname);
@ -141,6 +139,8 @@ static void l2_packet_receive(int sock, void *eloop_ctx, void *sock_ctx)
close(l2->fd_br_rx);
l2->fd_br_rx = -1;
}
l2->rx_callback(l2->rx_callback_ctx, ll.sll_addr, buf, res);
}