]> git.ipfire.org Git - thirdparty/hostap.git/commit
mesh: Add for_each_sta implementation in wpa_auth_callbacks
authorRemi Pommarel <repk@triplefau.lt>
Fri, 1 Dec 2023 15:14:11 +0000 (16:14 +0100)
committerJouni Malinen <j@w1.fi>
Sat, 2 Dec 2023 18:34:34 +0000 (20:34 +0200)
commitbbb0d3a40e96ca2989d97829a286282aad9c19b4
tree2f70ba734825db3247f40bc07b8c37c032f273fd
parentb07f19e082862b5e9d1901bdd95b5a2c9ab1146d
mesh: Add for_each_sta implementation in wpa_auth_callbacks

The wpa_auth_callbacks for mesh was missing a for_each_sta
implementation. This is an issue with pmksa cache, as when a cache entry
expires the for_each_sta callback is called in order to clear the pmksa
reference for all sta that was using this entry. Not having a
for_each_sta callback will prevent this cleanup to happen then a sta
could still use this pmksa entry even after it has been freed.

This used after free was not a problem up until recently where
dpp_pkhash is now stored in pmksa entry and retreived later on causing
crash with below backtrace:

  _wpa_snprintf_hex                        src/utils/common.c:326
  wpa_snprintf_hex                         src/utils/common.c:348
  hostapd_ctrl_iface_sta_mib               src/ap/ctrl_iface_ap.c:542
  hostapd_ctrl_iface_sta_mib               src/ap/ctrl_iface_ap.c:542
  hostapd_ctrl_iface_sta_mib               src/ap/ctrl_iface_ap.c:600
  hostapd_ctrl_iface_sta                   src/ap/ctrl_iface_ap.c:615
  wpa_supplicant_ctrl_iface_process        src/wpa_supplicant/ctrl_iface.c:12741
  wpa_supplicant_global_ctrl_iface_receive src/wpa_supplicant/ctrl_iface_unix.c:1141
  eloop_sock_table_dispatch                src/utils/eloop.c:625
  eloop_run                                src/utils/eloop.c:1238
  wpa_supplicant_run                       src/wpa_supplicant/wpa_supplicant.c:8021
  main                                     src/wpa_supplicant/main.c:393

Adding a for_each_sta callbacks fixes that.

Fixes: 043dedee83a7 ("DPP: Expose enrollee pubkey hash for identification")
Signed-off-by: Remi Pommarel <repk@triplefau.lt>
wpa_supplicant/mesh_rsn.c