From 1b822f52e6356e78938f285d511d458e202fbc76 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 13 Oct 2015 23:35:00 +0300 Subject: [PATCH] hostapd: Fix WPA, IEEE 802.1X, and WPS deinit in cases where init fails With driver wrappers that implement set_privacy(), set_generic_elem(), set_ieee8021x(), or set_ap_wps_ie(), it was possible to hit a NULL pointer dereference in error cases where interface setup failed and the network configuration used WPA/WPA2, IEEE 802.1X, or WPS. Fix this by skipping the driver operations in case the driver interface is not initialized. Signed-off-by: Jouni Malinen --- src/ap/ieee802_1x.c | 2 +- src/ap/wpa_auth_glue.c | 5 +++-- src/ap/wps_hostapd.c | 3 ++- 3 files changed, 6 insertions(+), 4 deletions(-) diff --git a/src/ap/ieee802_1x.c b/src/ap/ieee802_1x.c index 0f2d428cf..c18449322 100644 --- a/src/ap/ieee802_1x.c +++ b/src/ap/ieee802_1x.c @@ -2190,7 +2190,7 @@ void ieee802_1x_deinit(struct hostapd_data *hapd) { eloop_cancel_timeout(ieee802_1x_rekey, hapd, NULL); - if (hapd->driver != NULL && + if (hapd->driver && hapd->drv_priv && (hapd->conf->ieee802_1x || hapd->conf->wpa)) hostapd_set_drv_ieee8021x(hapd, hapd->conf->iface, 0); diff --git a/src/ap/wpa_auth_glue.c b/src/ap/wpa_auth_glue.c index f98cc5059..ffd0790fe 100644 --- a/src/ap/wpa_auth_glue.c +++ b/src/ap/wpa_auth_glue.c @@ -674,13 +674,14 @@ void hostapd_deinit_wpa(struct hostapd_data *hapd) wpa_deinit(hapd->wpa_auth); hapd->wpa_auth = NULL; - if (hostapd_set_privacy(hapd, 0)) { + if (hapd->drv_priv && hostapd_set_privacy(hapd, 0)) { wpa_printf(MSG_DEBUG, "Could not disable " "PrivacyInvoked for interface %s", hapd->conf->iface); } - if (hostapd_set_generic_elem(hapd, (u8 *) "", 0)) { + if (hapd->drv_priv && + hostapd_set_generic_elem(hapd, (u8 *) "", 0)) { wpa_printf(MSG_DEBUG, "Could not remove generic " "information element from interface %s", hapd->conf->iface); diff --git a/src/ap/wps_hostapd.c b/src/ap/wps_hostapd.c index cde31e60e..66a43eb81 100644 --- a/src/ap/wps_hostapd.c +++ b/src/ap/wps_hostapd.c @@ -872,7 +872,8 @@ static void hostapd_wps_clear_ies(struct hostapd_data *hapd, int deinit_only) hapd->wps_probe_resp_ie = NULL; if (deinit_only) { - hostapd_reset_ap_wps_ie(hapd); + if (hapd->drv_priv) + hostapd_reset_ap_wps_ie(hapd); return; }