ndisc_snoop: Call dl_list_del() before freeing IPv6 addresses

This fixes a segmentation fault on STA disconnect in case IPv6 addresses
where learned for the STA based on snooped neighbor solicication.

Fixes: bd00c4311c0e ("AP: Add Neighbor Discovery snooping mechanism for Proxy ARP")
Signed-off-by: Felix Fietkau <nbd@nbd.name>

diff --git a/src/ap/ndisc_snoop.c b/src/ap/ndisc_snoop.c
index 788c12fdc1cfa083ac9be3ac4c8ce3f49c84b81f..bc1eb6251ac013591bc0422a57b39a8f24c99429 100644 (file)
--- a/src/ap/ndisc_snoop.c
+++ b/src/ap/ndisc_snoop.c
@@ -61,6 +61,7 @@ void sta_ip6addr_del(struct hostapd_data *hapd, struct sta_info *sta)
        dl_list_for_each_safe(ip6addr, prev, &sta->ip6addr, struct ip6addr,
                              list) {
                hostapd_drv_br_delete_ip_neigh(hapd, 6, (u8 *) &ip6addr->addr);
+               dl_list_del(&ip6addr->list);
                os_free(ip6addr);
        }
 }