From b4c738ec86a933c7fb967fbea9a6c87b10620a28 Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Mon, 30 May 2016 20:15:16 +0300 Subject: [PATCH] mesh: Fix error path handling for RSN (MGTK init) wpa_deinit() got called twice if the random_get_bytes() fails to generate the MGTK. This resulted in double-freeing the rsn->auth pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for all error cases. Signed-off-by: Jouni Malinen --- wpa_supplicant/mesh_rsn.c | 4 +--- 1 file changed, 1 insertion(+), 3 deletions(-) diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c index 1994f3f5a..ff5fefae6 100644 --- a/wpa_supplicant/mesh_rsn.c +++ b/wpa_supplicant/mesh_rsn.c @@ -167,10 +167,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr) } /* TODO: support rekeying */ - if (random_get_bytes(rsn->mgtk, 16) < 0) { - wpa_deinit(rsn->auth); + if (random_get_bytes(rsn->mgtk, 16) < 0) return -1; - } /* group mgmt */ wpa_drv_set_key(rsn->wpa_s, WPA_ALG_IGTK, NULL, 4, 1,