aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJohannes Berg <johannes.berg@intel.com>2012-06-04 17:25:11 (GMT)
committerJouni Malinen <j@w1.fi>2012-06-04 17:25:11 (GMT)
commit24b5bd8b42c05ca5c041c88abf3944a07f3f839f (patch)
tree70d9250b28a10a2fffae522d5eaf077ba08f2fe6
parentfdfb1c8bcf491ca91f6575e31a02e5d5d2de911d (diff)
downloadhostap-24b5bd8b42c05ca5c041c88abf3944a07f3f839f.zip
hostap-24b5bd8b42c05ca5c041c88abf3944a07f3f839f.tar.gz
hostap-24b5bd8b42c05ca5c041c88abf3944a07f3f839f.tar.bz2
nl80211: Use safe list iteration
In certain cases like PBC session overlap it appears to be possible that an interface is removed due to an event handled on it, this leads to list corruption. Use safe iteration to prevent this issue. Reported-by: Nirav Shah <nirav.j2.shah@intel.com> Reported-by: Neeraj Kumar Garg <neerajkg@broadcom.com> Signed-hostap: Johannes Berg <johannes.berg@intel.com> intended-for: hostap-1
-rw-r--r--src/drivers/driver_nl80211.c6
1 files changed, 3 insertions, 3 deletions
diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 693a885..92a7de0 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -2198,7 +2198,7 @@ static int process_global_event(struct nl_msg *msg, void *arg)
struct nl80211_global *global = arg;
struct genlmsghdr *gnlh = nlmsg_data(nlmsg_hdr(msg));
struct nlattr *tb[NL80211_ATTR_MAX + 1];
- struct wpa_driver_nl80211_data *drv;
+ struct wpa_driver_nl80211_data *drv, *tmp;
int ifidx = -1;
nla_parse(tb, NL80211_ATTR_MAX, genlmsg_attrdata(gnlh, 0),
@@ -2207,8 +2207,8 @@ static int process_global_event(struct nl_msg *msg, void *arg)
if (tb[NL80211_ATTR_IFINDEX])
ifidx = nla_get_u32(tb[NL80211_ATTR_IFINDEX]);
- dl_list_for_each(drv, &global->interfaces,
- struct wpa_driver_nl80211_data, list) {
+ dl_list_for_each_safe(drv, tmp, &global->interfaces,
+ struct wpa_driver_nl80211_data, list) {
if (ifidx == -1 || ifidx == drv->ifindex ||
have_ifidx(drv, ifidx))
do_process_drv_event(drv, gnlh->cmd, tb);