aboutsummaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorJouni Malinen <j@w1.fi>2011-01-09 17:18:50 (GMT)
committerJouni Malinen <j@w1.fi>2012-06-30 17:48:32 (GMT)
commit6e4d241df33b3bd6935f74f45f2f1161df889268 (patch)
tree78c9337b1efe969ed9eeeb5142de79f1f43ad2e1
parentb80b5639935d37b95d00f86b57f2844a9c775f57 (diff)
downloadhostap-07-6e4d241df33b3bd6935f74f45f2f1161df889268.zip
hostap-07-6e4d241df33b3bd6935f74f45f2f1161df889268.tar.gz
hostap-07-6e4d241df33b3bd6935f74f45f2f1161df889268.tar.bz2
nl80211: Avoid infinite loop when searching a BSS
When hostapd is removing a virtual BSS interface, the loop here was incorrectly not updating the iterator during list traversal and ended up in an infinite loop in some cases. (cherry picked from commit 8546ea19301f31e5faf58a0f154773c3123e6474)
-rw-r--r--src/drivers/driver_nl80211.c19
1 files changed, 11 insertions, 8 deletions
diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index fb75c2e..0a8c5bc 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -4968,16 +4968,19 @@ static int wpa_driver_nl80211_if_remove(void *priv,
return 0;
if (bss != &drv->first_bss) {
- struct i802_bss *tbss = &drv->first_bss;
+ struct i802_bss *tbss;
- while (tbss) {
- if (tbss->next != bss)
- continue;
-
- tbss->next = bss->next;
- os_free(bss);
- break;
+ for (tbss = &drv->first_bss; tbss; tbss = tbss->next) {
+ if (tbss->next == bss) {
+ tbss->next = bss->next;
+ os_free(bss);
+ bss = NULL;
+ break;
+ }
}
+ if (bss)
+ wpa_printf(MSG_INFO, "nl80211: %s - could not find "
+ "BSS %p in the list", __func__, bss);
}
#endif /* HOSTAPD */