scottk/wlan-ap
1
0
Fork 0
mirror of https://github.com/Telecominfraproject/wlan-ap.git synced 2025-10-30 18:07:52 +00:00
Code Issues Packages Projects Releases 10 Wiki Activity

hostapd: fix a use-after-free bug

Browse Source 
Signed-off-by: John Crispin <john@phrozen.org>
This commit is contained in:
John Crispin
2023-07-21 14:55:07 +02:00
parent e02d9261df
commit 835909f3cc
2 changed files with 7 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
feeds/wifi-ax/hostapd/files/hostapd.uc
View File

@@ -149,6 +149,7 @@ function iface_reload_config(phy, config, old_config)
if (!new_cfg[name]) { if (!new_cfg[name]) {
hostapd.printf(`Remove bss '${name}' on phy '${phy}'`); hostapd.printf(`Remove bss '${name}' on phy '${phy}'`);
bss.delete(); bss.delete();
wdev_remove(name);
continue; continue;
} }

7
feeds/wifi-ax/hostapd/src/src/ap/ucode.c
View File

@@ -4,6 +4,7 @@
#include "utils/common.h" #include "utils/common.h"
#include "utils/ucode.h" #include "utils/ucode.h"
#include "hostapd.h" #include "hostapd.h"
#include "ap_drv_ops.h"
#include <libubox/uloop.h> #include <libubox/uloop.h>
static uc_resource_type_t *global_type, *bss_type, *iface_type; static uc_resource_type_t *global_type, *bss_type, *iface_type;
@@ -110,6 +111,7 @@ static uc_value_t *
uc_hostapd_bss_set_config(uc_vm_t *vm, size_t nargs) uc_hostapd_bss_set_config(uc_vm_t *vm, size_t nargs)
{ {
struct hostapd_data *hapd = uc_fn_thisval("hostapd.bss"); struct hostapd_data *hapd = uc_fn_thisval("hostapd.bss");
struct hostapd_bss_config *old_bss;
struct hostapd_iface *iface; struct hostapd_iface *iface;
struct hostapd_config *conf; struct hostapd_config *conf;
uc_value_t *file = uc_fn_arg(0); uc_value_t *file = uc_fn_arg(0);
@@ -128,7 +130,7 @@ uc_hostapd_bss_set_config(uc_vm_t *vm, size_t nargs)
if (!conf || idx > conf->num_bss || !conf->bss[idx]) if (!conf || idx > conf->num_bss || !conf->bss[idx])
goto out; goto out;
hostapd_config_free_bss(hapd->conf); old_bss = hapd->conf;
for (i = 0; i < iface->conf->num_bss; i++) for (i = 0; i < iface->conf->num_bss; i++)
if (iface->conf->bss[i] == hapd->conf) if (iface->conf->bss[i] == hapd->conf)
iface->conf->bss[i] = conf->bss[idx]; iface->conf->bss[i] = conf->bss[idx];
@@ -137,7 +139,9 @@ uc_hostapd_bss_set_config(uc_vm_t *vm, size_t nargs)
hostapd_config_free(conf); hostapd_config_free(conf);
hostapd_bss_deinit_no_free(hapd); hostapd_bss_deinit_no_free(hapd);
hostapd_drv_stop_ap(hapd);
hostapd_free_hapd_data(hapd); hostapd_free_hapd_data(hapd);
hostapd_config_free_bss(old_bss);
hostapd_setup_bss(hapd, hapd == iface->bss[0], !iface->conf->multiple_bssid); hostapd_setup_bss(hapd, hapd == iface->bss[0], !iface->conf->multiple_bssid);
ret = 0; ret = 0;
@@ -187,6 +191,7 @@ uc_hostapd_bss_delete(uc_vm_t *vm, size_t nargs)
iface->bss[i - 1] = iface->bss[i]; iface->bss[i - 1] = iface->bss[i];
iface->num_bss--; iface->num_bss--;
hostapd_drv_stop_ap(hapd);
hostapd_bss_deinit(hapd); hostapd_bss_deinit(hapd);
hostapd_remove_iface_bss_conf(iface->conf, hapd->conf); hostapd_remove_iface_bss_conf(iface->conf, hapd->conf);
hostapd_config_free_bss(hapd->conf); hostapd_config_free_bss(hapd->conf);