TDLS: Fix error path for TPK M1 send failure in testing functionality

The previous fix did not actually address this testing functionality
case correctly. Clear the peer pointer to avoid double freeing.

Fixes: a86078c87613 ("TDLS: Fix error path handling for TPK M1 send failures")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
index 1fb28c5c596f5d1bb1bdf640f7f734e15459e5c6..7c4ef191c4f47ab3cc088a7f002fa5d90b69ef97 100644 (file)
--- a/src/rsn_supp/tdls.c
+++ b/src/rsn_supp/tdls.c
@@ -1926,8 +1926,10 @@ static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
                peer->initiator = 1;
                wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
                                        NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0);
-               if (wpa_tdls_send_tpk_m1(sm, peer) == -2)
+               if (wpa_tdls_send_tpk_m1(sm, peer) == -2) {
+                       peer = NULL;
                        goto error;
+               }
        }
 
        if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&