DGNum/hostapd
6
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions

nl80211: Fix wiphy event handling when the driver is deinitialized

Browse source 
Radar detection event could have resulted in the driver interface
instance getting deinitialized and the related memory freed in the
middle of the loop. This was not an issue when the event was passed only
into a single interface, but it became an issue when the loop tried to
send it to all interfaces. If the driver were removed, that loop check
would have used freed memory. Avoid this by explicitly checking that the
driver interface instance is still valid.

Fixes: f136837202 ("nl80211: Pass wiphy events to all affected interfaces")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>
This commit is contained in:
Jouni Malinen 2024-01-22 14:39:54 +02:00 committed by Jouni Malinen
parent 1c90c8d24e
commit 4037c0ac1e
1 changed files with 21 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

21
src/drivers/driver_nl80211_event.c
View file

@ -4095,6 +4095,21 @@ static void do_process_drv_event(struct i802_bss *bss, int cmd,
}
static bool nl80211_drv_in_list(struct nl80211_global *global,
struct wpa_driver_nl80211_data *drv)
{
struct wpa_driver_nl80211_data *tmp;
dl_list_for_each(tmp, &global->interfaces,
struct wpa_driver_nl80211_data, list) {
if (drv == tmp)
return true;
}
return false;
}
int process_global_event(struct nl_msg *msg, void *arg)
{
struct nl80211_global *global = arg;
@ -4159,6 +4174,12 @@ int process_global_event(struct nl_msg *msg, void *arg)
do_process_drv_event(bss, gnlh->cmd, tb);
if (!wiphy_idx_set)
return NL_SKIP;
/* The driver instance could have been removed,
* e.g., due to NL80211_CMD_RADAR_DETECT event,
* so need to stop the loop if that has
* happened. */
if (!nl80211_drv_in_list(global, drv))
break;
}
}
}