diff options
| author | Max Stepanov <Max.Stepanov@intel.com> | 2014-01-22 14:05:45 (GMT) |
|---|---|---|
| committer | Jouni Malinen <j@w1.fi> | 2014-01-22 17:25:22 (GMT) |
| commit | a6cff8bfa87dab458eeef43e158ba92b7a10aed5 (patch) | |
| tree | 238c86e6e338215ee37dd7286fb6ca446ce26d53 /wpa_supplicant | |
| parent | f62a3c2fce6d54d609b33374aa519aa815254713 (diff) | |
| download | hostap-a6cff8bfa87dab458eeef43e158ba92b7a10aed5.zip hostap-a6cff8bfa87dab458eeef43e158ba92b7a10aed5.tar.gz hostap-a6cff8bfa87dab458eeef43e158ba92b7a10aed5.tar.bz2 | |
wpa_supplicant: Fix seg fault in wpas_ctrl_radio_work_flush() in error case
Verify wpa_s->radio pointer before accessing it. If interface addition
fails, this could get called before wpa_s->radio has been set.
The segmentation fault details:
Program received signal SIGSEGV, Segmentation fault.
0x00000000004b9591 in wpas_ctrl_radio_work_flush (wpa_s=0x77fff0) at ctrl_iface.c:5754
5754 dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
Call stack:
0 wpas_ctrl_radio_work_flush (wpa_s=0x77fff0) at ctrl_iface.c:5754
1 wpa_supplicant_deinit_iface (wpa_s=0x77fff0, notify=0, terminate=0) at wpa_supplicant.c:3619
2 wpa_supplicant_add_iface (global=0x75db10, iface=0x7fffffffe270) at wpa_supplicant.c:3691
3 wpas_p2p_add_p2pdev_interface (wpa_s=0x75dd20) at p2p_supplicant.c:3700
4 main (argc=<optimized out>, argv=<optimized out>) at main.c:317
Function:
5750 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
5751 {
5752 struct wpa_radio_work *work, *tmp;
5753
5754 dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
5755 struct wpa_radio_work, list) {
5756 struct wpa_external_work *ework;
5757
5758 if (os_strncmp(work->type, "ext:", 4) != 0)
Root cause:
(gdb) p wpa_s->radio
$1 = (struct wpa_radio *) 0x0
Signed-hostap: Max Stepanov <Max.Stepanov@intel.com>
Diffstat (limited to 'wpa_supplicant')
| -rw-r--r-- | wpa_supplicant/ctrl_iface.c | 3 |
1 files changed, 3 insertions, 0 deletions
diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c index f7ee6e3..ec79de3 100644 --- a/wpa_supplicant/ctrl_iface.c +++ b/wpa_supplicant/ctrl_iface.c @@ -5477,6 +5477,9 @@ void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s) { struct wpa_radio_work *work, *tmp; + if (!wpa_s || !wpa_s->radio) + return; + dl_list_for_each_safe(work, tmp, &wpa_s->radio->work, struct wpa_radio_work, list) { struct wpa_external_work *ework; |