Decrement GKeyDoneStations in WPA authenticator when STA is freed

If the STA to be freed is still included in GKeyDoneStations count,
decrement the count when the STA is freed. This does not happen in
AP mode since there is enough time to go through the authenticator
state machine to clear the STA. However, in the current RSN IBSS
implementation, the authenticator state for the STA is freed in a
way that does not allow the state machine to go through the clearing.
To address this, make sure that wpa_free_sta_sm() decrements the
GKeyDoneStations count if the STA happened to be in the process of
GTK rekeying.

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 7ad60a23d999082a00e9be672d4b55a19c46a4bb..157308d1abbb0ec24ab0a9bf02094c7ed75b2e01 100644 (file)
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -574,6 +574,10 @@ void wpa_auth_sta_no_wpa(struct wpa_state_machine *sm)
 
 static void wpa_free_sta_sm(struct wpa_state_machine *sm)
 {
+       if (sm->GUpdateStationKeys) {
+               sm->group->GKeyDoneStations--;
+               sm->GUpdateStationKeys = FALSE;
+       }
 #ifdef CONFIG_IEEE80211R
        os_free(sm->assoc_resp_ftie);
 #endif /* CONFIG_IEEE80211R */