jeltz/hostap
1
0
Fork 0
Code Issues Pull requests Projects Releases Wiki Activity

P2P: Fix P2P_CANCEL for p2p_in_invitation case

Browse source 
Commit f05cee9714 ('P2P: Clear
p2p_in_invitation on cancel') added a wpas_p2p_cancel() case to call
wpas_p2p_group_formation_failed() if wpa_s->p2p_in_invitation is set.
This is done in a loop going through wpa_s->next pointers. However, the
call here can result in removing the interface and freeing wpa_s. The
following attempt to read wpa_s->next is from freed memory and that can
result in process termination when using a separate P2P group interface
and issuing P2P_CANCEL on a group that was started through re-invocation
of a persistent group.

The recent commit 328f49acfe ('P2P:
Complete group formation on client data connection') "fixed" this by
accident since wpa_s->p2p_in_invitation gets cleared in the sequence
that could hit this issue and this results in P2P_CANCEL getting
rejected. However, the real bug here is in the loop that continues after
possible wpa_s instance deletion. Fix that by breaking out of the loop.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2015-12-04 22:49:59 +02:00 committed by Jouni Malinen
parent f98b0e5806
commit 63502c64e1
1 changed files with 1 additions and 0 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

1
wpa_supplicant/p2p_supplicant.c
View file

@ -7523,6 +7523,7 @@ int wpas_p2p_cancel(struct wpa_supplicant *wpa_s)
wpa_s->ifname); wpa_s->ifname);
found = 1; found = 1;
wpas_p2p_group_formation_failed(wpa_s, 0); wpas_p2p_group_formation_failed(wpa_s, 0);
break;
} }
} }