wpa_supplicant: Fix access to the freed memory when removing all networks

Commit 59ff6653aad1c228cb2e9ccfe02b9dd4e6fc7901 fixed this issue for
'removing a network', and we also need to take care of 'removing all
networks'.

Signed-hostap: Jaewan Kim <jaewan at google.com>

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index f10817927fd8c6e0bbe99420fee322b39d459f37..a5db768588ff931f388839f3eefce5679a73a83f 100644 (file)
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -2111,14 +2111,6 @@ static int wpa_supplicant_ctrl_iface_remove_network(
        /* cmd: "<network id>" or "all" */
        if (os_strcmp(cmd, "all") == 0) {
                wpa_printf(MSG_DEBUG, "CTRL_IFACE: REMOVE_NETWORK all");
-               ssid = wpa_s->conf->ssid;
-               while (ssid) {
-                       struct wpa_ssid *remove_ssid = ssid;
-                       id = ssid->id;
-                       ssid = ssid->next;
-                       wpas_notify_network_removed(wpa_s, remove_ssid);
-                       wpa_config_remove_network(wpa_s->conf, id);
-               }
                eapol_sm_invalidate_cached_session(wpa_s->eapol);
                if (wpa_s->current_ssid) {
 #ifdef CONFIG_SME
@@ -2129,6 +2121,14 @@ static int wpa_supplicant_ctrl_iface_remove_network(
                        wpa_supplicant_deauthenticate(
                                wpa_s, WLAN_REASON_DEAUTH_LEAVING);
                }
+               ssid = wpa_s->conf->ssid;
+               while (ssid) {
+                       struct wpa_ssid *remove_ssid = ssid;
+                       id = ssid->id;
+                       ssid = ssid->next;
+                       wpas_notify_network_removed(wpa_s, remove_ssid);
+                       wpa_config_remove_network(wpa_s->conf, id);
+               }
                return 0;
        }