nl80211: Fix wiphy event handling when the driver is deinitialized

Radar detection event could have resulted in the driver interface
instance getting deinitialized and the related memory freed in the
middle of the loop. This was not an issue when the event was passed only
into a single interface, but it became an issue when the loop tried to
send it to all interfaces. If the driver were removed, that loop check
would have used freed memory. Avoid this by explicitly checking that the
driver interface instance is still valid.

Fixes: f13683720239 ("nl80211: Pass wiphy events to all affected interfaces")
Signed-off-by: Jouni Malinen <quic_jouni@quicinc.com>

diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
index 993fb8fc9e66c44f94cb80fd730bf672bdbe5f29..9b58310ff9842bfe712bc8d636425a3d02573a65 100644 (file)
--- a/src/drivers/driver_nl80211_event.c
+++ b/src/drivers/driver_nl80211_event.c
@@ -4095,6 +4095,21 @@ static void do_process_drv_event(struct i802_bss *bss, int cmd,
 }
 
 
+static bool nl80211_drv_in_list(struct nl80211_global *global,
+                               struct wpa_driver_nl80211_data *drv)
+{
+       struct wpa_driver_nl80211_data *tmp;
+
+       dl_list_for_each(tmp, &global->interfaces,
+                        struct wpa_driver_nl80211_data, list) {
+               if (drv == tmp)
+                       return true;
+       }
+
+       return false;
+}
+
+
 int process_global_event(struct nl_msg *msg, void *arg)
 {
        struct nl80211_global *global = arg;
@@ -4159,6 +4174,12 @@ int process_global_event(struct nl_msg *msg, void *arg)
                                do_process_drv_event(bss, gnlh->cmd, tb);
                                if (!wiphy_idx_set)
                                        return NL_SKIP;
+                               /* The driver instance could have been removed,
+                                * e.g., due to NL80211_CMD_RADAR_DETECT event,
+                                * so need to stop the loop if that has
+                                * happened. */
+                               if (!nl80211_drv_in_list(global, drv))
+                                       break;
                        }
                }
        }