hostapd: Fix memory leak on dynamic add-BSS error path

If "ADD bss_config=" command failed in driver_init() or
hostapd_setup_interface(), some of the allocated resources were not
freed properly.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/hostapd.c b/src/ap/hostapd.c
index 73e939c..71a9a2e 100644 (file)
--- a/src/ap/hostapd.c
+++ b/src/ap/hostapd.c
@@ -1940,11 +1940,19 @@ int hostapd_add_iface(struct hapd_interfaces *interfaces, char *buf)
                }
 
                if (new_iface) {
-                       if (interfaces->driver_init(hapd_iface) ||
-                           hostapd_setup_interface(hapd_iface)) {
+                       if (interfaces->driver_init(hapd_iface)) {
                                interfaces->count--;
                                goto fail;
                        }
+
+                       if (hostapd_setup_interface(hapd_iface)) {
+                               interfaces->count--;
+                               hostapd_deinit_driver(
+                                       hapd_iface->bss[0]->driver,
+                                       hapd_iface->bss[0]->drv_priv,
+                                       hapd_iface);
+                               goto fail;
+                       }
                } else {
                        /* Assign new BSS with bss[0]'s driver info */
                        hapd = hapd_iface->bss[hapd_iface->num_bss - 1];
@@ -2036,14 +2044,14 @@ fail:
                                wpa_printf(MSG_DEBUG, "%s: free hapd %p (%s)",
                                           __func__, hapd_iface->bss[i],
                                           hapd->conf->iface);
+                               hostapd_cleanup(hapd);
                                os_free(hapd);
                                hapd_iface->bss[i] = NULL;
                        }
                        os_free(hapd_iface->bss);
+                       hapd_iface->bss = NULL;
                }
-               wpa_printf(MSG_DEBUG, "%s: free iface %p",
-                          __func__, hapd_iface);
-               os_free(hapd_iface);
+               hostapd_cleanup_iface(hapd_iface);
        }
        return -1;
 }