Fix possible freed-memory use in BSS table updates

If there are large number of BSSes in the scan results, BSS table update
could have added a BSS entry to the last_scan_res in a case where that
BSS entry got just deleted. This would happen only if there are more
than bss_max_count (by default 200) BSSes and if at least bss_max_count
of those BSSes are known (match a configured network). In such a case,
wpa_bss_add() could end up allocating a new BSS entry and return a
pointer to that entry even if it was the one that ended up getting freed
to keep the BSS table length within the limit. This could result in
freed memory being used and the process crashing (likely with segfault)
when trying to access information from that BSS entry.

Fix the issue by removing the oldest BSS entry before linking the new
entry to the table. This makes sure the newly added entry will never get
picked up as the one to be deleted immediately.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>

diff --git a/wpa_supplicant/bss.c b/wpa_supplicant/bss.c
index 0e1576b0fde1a71f2478665594631bac4fed28bf..67a9f97de776e7951bfd404f4d576b8148c35087 100644 (file)
--- a/wpa_supplicant/bss.c
+++ b/wpa_supplicant/bss.c
@@ -343,6 +343,14 @@ static struct wpa_bss * wpa_bss_add(struct wpa_supplicant *wpa_s,
        os_memcpy(bss + 1, res + 1, res->ie_len + res->beacon_ie_len);
        wpa_bss_set_hessid(bss);
 
+       if (wpa_s->num_bss + 1 > wpa_s->conf->bss_max_count &&
+           wpa_bss_remove_oldest(wpa_s) != 0) {
+               wpa_printf(MSG_ERROR, "Increasing the MAX BSS count to %d "
+                          "because all BSSes are in use. We should normally "
+                          "not get here!", (int) wpa_s->num_bss + 1);
+               wpa_s->conf->bss_max_count = wpa_s->num_bss + 1;
+       }
+
        dl_list_add_tail(&wpa_s->bss, &bss->list);
        dl_list_add_tail(&wpa_s->bss_id, &bss->list_id);
        wpa_s->num_bss++;
@@ -350,13 +358,6 @@ static struct wpa_bss * wpa_bss_add(struct wpa_supplicant *wpa_s,
                " SSID '%s'",
                bss->id, MAC2STR(bss->bssid), wpa_ssid_txt(ssid, ssid_len));
        wpas_notify_bss_added(wpa_s, bss->bssid, bss->id);
-       if (wpa_s->num_bss > wpa_s->conf->bss_max_count &&
-           wpa_bss_remove_oldest(wpa_s) != 0) {
-               wpa_printf(MSG_ERROR, "Increasing the MAX BSS count to %d "
-                          "because all BSSes are in use. We should normally "
-                          "not get here!", (int) wpa_s->num_bss);
-               wpa_s->conf->bss_max_count = wpa_s->num_bss;
-       }
        return bss;
 }