wpa_supplicant: Fix seg fault in wpas_ctrl_radio_work_flush() in error case
authorMax Stepanov <Max.Stepanov@intel.com>
Wed, 22 Jan 2014 14:05:45 +0000 (16:05 +0200)
committerJouni Malinen <j@w1.fi>
Wed, 22 Jan 2014 17:25:22 +0000 (19:25 +0200)
commita6cff8bfa87dab458eeef43e158ba92b7a10aed5
tree238c86e6e338215ee37dd7286fb6ca446ce26d53
parentf62a3c2fce6d54d609b33374aa519aa815254713
wpa_supplicant: Fix seg fault in wpas_ctrl_radio_work_flush() in error case

Verify wpa_s->radio pointer before accessing it. If interface addition
fails, this could get called before wpa_s->radio has been set.

The segmentation fault details:

Program received signal SIGSEGV, Segmentation fault.
0x00000000004b9591 in wpas_ctrl_radio_work_flush (wpa_s=0x77fff0) at ctrl_iface.c:5754
5754 dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,

Call stack:
0  wpas_ctrl_radio_work_flush (wpa_s=0x77fff0) at ctrl_iface.c:5754
1  wpa_supplicant_deinit_iface (wpa_s=0x77fff0, notify=0, terminate=0) at wpa_supplicant.c:3619
2  wpa_supplicant_add_iface (global=0x75db10, iface=0x7fffffffe270) at wpa_supplicant.c:3691
3  wpas_p2p_add_p2pdev_interface (wpa_s=0x75dd20) at p2p_supplicant.c:3700
4  main (argc=<optimized out>, argv=<optimized out>) at main.c:317

Function:
5750 void wpas_ctrl_radio_work_flush(struct wpa_supplicant *wpa_s)
5751 {
5752 struct wpa_radio_work *work, *tmp;
5753
5754 dl_list_for_each_safe(work, tmp, &wpa_s->radio->work,
5755       struct wpa_radio_work, list) {
5756 struct wpa_external_work *ework;
5757
5758 if (os_strncmp(work->type, "ext:", 4) != 0)

Root cause:
(gdb) p wpa_s->radio
$1 = (struct wpa_radio *) 0x0

Signed-hostap: Max Stepanov <Max.Stepanov@intel.com>
wpa_supplicant/ctrl_iface.c