From 9b170991ac15032624ab330fc10534e237579999 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Sat, 4 Feb 2017 21:24:37 +0200 Subject: [PATCH] mesh: Fix mesh interface removal fix This wpa_drv_if_remove() call was previously modified to fix a different issue, but that fix resulted in unconditional use of treed memory here (wpa_supplicant_deinit_iface() frees wpa_s). Make a local copy of wpa_s->parent to be able to use it after wpa_s is freed. The mesh_if_created case has wpa_s->parent != wpa_s, so this should be sufficient way of handling the wpa_drv_if_remove() call here. Signed-off-by: Jouni Malinen --- wpa_supplicant/wpa_supplicant.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c index 742aa1f0b..448a59271 100644 --- a/wpa_supplicant/wpa_supplicant.c +++ b/wpa_supplicant/wpa_supplicant.c @@ -5322,6 +5322,7 @@ int wpa_supplicant_remove_iface(struct wpa_global *global, #ifdef CONFIG_MESH unsigned int mesh_if_created = wpa_s->mesh_if_created; char *ifname = NULL; + struct wpa_supplicant *parent = wpa_s->parent; #endif /* CONFIG_MESH */ /* Remove interface from the global list of interfaces */ @@ -5357,7 +5358,7 @@ int wpa_supplicant_remove_iface(struct wpa_global *global, #ifdef CONFIG_MESH if (mesh_if_created) { - wpa_drv_if_remove(wpa_s->parent, WPA_IF_MESH, ifname); + wpa_drv_if_remove(parent, WPA_IF_MESH, ifname); os_free(ifname); } #endif /* CONFIG_MESH */