mesh: Fix error path handling for RSN (MGTK init)

wpa_deinit() got called twice if the random_get_bytes() fails to
generate the MGTK. This resulted in double-freeing the rsn->auth
pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for
all error cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c
index 1994f3f..ff5fefa 100644 (file)
--- a/wpa_supplicant/mesh_rsn.c
+++ b/wpa_supplicant/mesh_rsn.c
@@ -167,10 +167,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr)
        }
 
        /* TODO: support rekeying */
-       if (random_get_bytes(rsn->mgtk, 16) < 0) {
-               wpa_deinit(rsn->auth);
+       if (random_get_bytes(rsn->mgtk, 16) < 0)
                return -1;
-       }
 
        /* group mgmt */
        wpa_drv_set_key(rsn->wpa_s, WPA_ALG_IGTK, NULL, 4, 1,