nl80211: Ensure nl_preq unregistration on driver deinit

When driver interface is destroyed (via wpa_driver_nl80211_deinit) the
"preq" nl socket isn't always deleted but the callback struct associated
is. After the interface is destroyed we may still get event on the
socket but as the callback has been freed this will cause wpa_supplicant
to crash.

This patch ensures that the "preq" socket is destroyed when destroying
the interface.

Signed-off-by: Cedric IZOARD <cedricx.izoard@intel.com>

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 4d5da94..683123b 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -10566,7 +10566,7 @@ static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
 
        if (!report) {
                if (bss->nl_preq && drv->device_ap_sme &&
-                   is_ap_interface(drv->nlmode)) {
+                   is_ap_interface(drv->nlmode) && !bss->in_deinit) {
                        /*
                         * Do not disable Probe Request reporting that was
                         * enabled in nl80211_setup_ap().