Fix DHCP/NDISC snoop deinit followed by failing re-init

It was possible to hit a double-free on the l2_packet socket if
initialization of DHCP/NDISC snoop failed on a hostapd interface that
had previously had those enabled successfully. Fix this by clearing the
l2_packet pointers during deinit.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/ap/dhcp_snoop.c b/src/ap/dhcp_snoop.c
index b9a36d760fd013340800f9c49ee0c3a029d8bb92..6d8c2f4be0da9263acf256f8631119774af538ef 100644 (file)
--- a/src/ap/dhcp_snoop.c
+++ b/src/ap/dhcp_snoop.c
@@ -154,4 +154,5 @@ int dhcp_snoop_init(struct hostapd_data *hapd)
 void dhcp_snoop_deinit(struct hostapd_data *hapd)
 {
        l2_packet_deinit(hapd->sock_dhcp);
+       hapd->sock_dhcp = NULL;
 }

diff --git a/src/ap/ndisc_snoop.c b/src/ap/ndisc_snoop.c
index 3c086bfc7131bc76d996679fa6598b87d45fbaf6..4d6a92e086bd593858d44ef4a37075cedb99220f 100644 (file)
--- a/src/ap/ndisc_snoop.c
+++ b/src/ap/ndisc_snoop.c
@@ -182,4 +182,5 @@ int ndisc_snoop_init(struct hostapd_data *hapd)
 void ndisc_snoop_deinit(struct hostapd_data *hapd)
 {
        l2_packet_deinit(hapd->sock_ndisc);
+       hapd->sock_ndisc = NULL;
 }