Check for driver initialization before doing driver operations

Number of hostapd control interface commands (e.g., STATUS-DRIVER) could
result in NULL pointer dereference when issued on not yet enabled BSS.
Fix this by checking that the driver interface has been initialized
before calling the driver_ops function.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/src/ap/ap_drv_ops.c b/src/ap/ap_drv_ops.c
index 532b72f..f139465 100644 (file)
--- a/src/ap/ap_drv_ops.c
+++ b/src/ap/ap_drv_ops.c
@@ -623,7 +623,7 @@ int hostapd_drv_set_key(const char *ifname, struct hostapd_data *hapd,
 int hostapd_drv_send_mlme(struct hostapd_data *hapd,
                          const void *msg, size_t len, int noack)
 {
-       if (hapd->driver == NULL || hapd->driver->send_mlme == NULL)
+       if (!hapd->driver || !hapd->driver->send_mlme || !hapd->drv_priv)
                return 0;
        return hapd->driver->send_mlme(hapd->drv_priv, msg, len, noack, 0,
                                       NULL, 0);
@@ -644,7 +644,7 @@ int hostapd_drv_send_mlme_csa(struct hostapd_data *hapd,
 int hostapd_drv_sta_deauth(struct hostapd_data *hapd,
                           const u8 *addr, int reason)
 {
-       if (hapd->driver == NULL || hapd->driver->sta_deauth == NULL)
+       if (!hapd->driver || !hapd->driver->sta_deauth || !hapd->drv_priv)
                return 0;
        return hapd->driver->sta_deauth(hapd->drv_priv, hapd->own_addr, addr,
                                        reason);
@@ -654,7 +654,7 @@ int hostapd_drv_sta_deauth(struct hostapd_data *hapd,
 int hostapd_drv_sta_disassoc(struct hostapd_data *hapd,
                             const u8 *addr, int reason)
 {
-       if (hapd->driver == NULL || hapd->driver->sta_disassoc == NULL)
+       if (!hapd->driver || !hapd->driver->sta_disassoc || !hapd->drv_priv)
                return 0;
        return hapd->driver->sta_disassoc(hapd->drv_priv, hapd->own_addr, addr,
                                          reason);
@@ -680,7 +680,7 @@ int hostapd_drv_send_action(struct hostapd_data *hapd, unsigned int freq,
                0xff, 0xff, 0xff, 0xff, 0xff, 0xff
        };
 
-       if (hapd->driver == NULL || hapd->driver->send_action == NULL)
+       if (!hapd->driver || !hapd->driver->send_action || !hapd->drv_priv)
                return 0;
        bssid = hapd->own_addr;
        if (!is_multicast_ether_addr(dst) &&
@@ -754,7 +754,7 @@ int hostapd_start_dfs_cac(struct hostapd_iface *iface,
 int hostapd_drv_set_qos_map(struct hostapd_data *hapd,
                            const u8 *qos_map_set, u8 qos_map_set_len)
 {
-       if (hapd->driver == NULL || hapd->driver->set_qos_map == NULL)
+       if (!hapd->driver || !hapd->driver->set_qos_map || !hapd->drv_priv)
                return 0;
        return hapd->driver->set_qos_map(hapd->drv_priv, qos_map_set,
                                         qos_map_set_len);

diff --git a/src/ap/ap_drv_ops.h b/src/ap/ap_drv_ops.h
index 6406d13..0bb7954 100644 (file)
--- a/src/ap/ap_drv_ops.h
+++ b/src/ap/ap_drv_ops.h
@@ -160,7 +160,7 @@ static inline int hostapd_drv_get_inact_sec(struct hostapd_data *hapd,
 static inline int hostapd_drv_sta_remove(struct hostapd_data *hapd,
                                         const u8 *addr)
 {
-       if (hapd->driver == NULL || hapd->driver->sta_remove == NULL)
+       if (!hapd->driver || !hapd->driver->sta_remove || !hapd->drv_priv)
                return 0;
        return hapd->driver->sta_remove(hapd->drv_priv, addr);
 }
@@ -283,7 +283,7 @@ static inline int hostapd_drv_switch_channel(struct hostapd_data *hapd,
 static inline int hostapd_drv_status(struct hostapd_data *hapd, char *buf,
                                     size_t buflen)
 {
-       if (hapd->driver == NULL || hapd->driver->status == NULL)
+       if (!hapd->driver || !hapd->driver->status || !hapd->drv_priv)
                return -1;
        return hapd->driver->status(hapd->drv_priv, buf, buflen);
 }
@@ -342,7 +342,7 @@ static inline int hostapd_drv_vendor_cmd(struct hostapd_data *hapd,
 
 static inline int hostapd_drv_stop_ap(struct hostapd_data *hapd)
 {
-       if (hapd->driver == NULL || hapd->driver->stop_ap == NULL)
+       if (!hapd->driver || !hapd->driver->stop_ap || !hapd->drv_priv)
                return 0;
        return hapd->driver->stop_ap(hapd->drv_priv);
 }

diff --git a/src/ap/ctrl_iface_ap.c b/src/ap/ctrl_iface_ap.c
index 17a3ea4..23c8c60 100644 (file)
--- a/src/ap/ctrl_iface_ap.c
+++ b/src/ap/ctrl_iface_ap.c
@@ -258,7 +258,7 @@ static int p2p_manager_disconnect(struct hostapd_data *hapd, u16 stype,
        int ret;
        u8 *pos;
 
-       if (hapd->driver->send_frame == NULL)
+       if (!hapd->drv_priv || !hapd->driver->send_frame)
                return -1;
 
        mgmt = os_zalloc(sizeof(*mgmt) + 100);
@@ -325,7 +325,7 @@ int hostapd_ctrl_iface_deauthenticate(struct hostapd_data *hapd,
        if (pos) {
                struct ieee80211_mgmt mgmt;
                int encrypt;
-               if (hapd->driver->send_frame == NULL)
+               if (!hapd->drv_priv || !hapd->driver->send_frame)
                        return -1;
                pos += 6;
                encrypt = atoi(pos);
@@ -388,7 +388,7 @@ int hostapd_ctrl_iface_disassociate(struct hostapd_data *hapd,
        if (pos) {
                struct ieee80211_mgmt mgmt;
                int encrypt;
-               if (hapd->driver->send_frame == NULL)
+               if (!hapd->drv_priv || !hapd->driver->send_frame)
                        return -1;
                pos += 6;
                encrypt = atoi(pos);