aboutsummaryrefslogtreecommitdiffstats
path: root/wpa_supplicant
diff options
context:
space:
mode:
authorJouni Malinen <jouni@qca.qualcomm.com>2016-05-30 17:15:16 (GMT)
committerJouni Malinen <j@w1.fi>2016-05-30 17:15:16 (GMT)
commitb4c738ec86a933c7fb967fbea9a6c87b10620a28 (patch)
tree340b15faa6766626a70daf4d6afea64d672d03b3 /wpa_supplicant
parent4d4cdc3bb2f97238519a5737bb7e313115f3c8a7 (diff)
downloadhostap-b4c738ec86a933c7fb967fbea9a6c87b10620a28.zip
hostap-b4c738ec86a933c7fb967fbea9a6c87b10620a28.tar.gz
hostap-b4c738ec86a933c7fb967fbea9a6c87b10620a28.tar.bz2
mesh: Fix error path handling for RSN (MGTK init)
wpa_deinit() got called twice if the random_get_bytes() fails to generate the MGTK. This resulted in double-freeing the rsn->auth pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for all error cases. Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
Diffstat (limited to 'wpa_supplicant')
-rw-r--r--wpa_supplicant/mesh_rsn.c4
1 files changed, 1 insertions, 3 deletions
diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c
index 1994f3f..ff5fefa 100644
--- a/wpa_supplicant/mesh_rsn.c
+++ b/wpa_supplicant/mesh_rsn.c
@@ -167,10 +167,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr)
}
/* TODO: support rekeying */
- if (random_get_bytes(rsn->mgtk, 16) < 0) {
- wpa_deinit(rsn->auth);
+ if (random_get_bytes(rsn->mgtk, 16) < 0)
return -1;
- }
/* group mgmt */
wpa_drv_set_key(rsn->wpa_s, WPA_ALG_IGTK, NULL, 4, 1,