DPP: Clear bootstrap entries only after clearing authentication state

This fixes an issue where the pending authentication might have held a
reference to auth->tmp_peer_bi and dpp_auth_deinit() would try to free
that bootstrapping entry. This needs to happen before the call to
dpp_global_clear() to avoid double-removal of the bootstrapping entry
from the list.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/wpa_supplicant/dpp_supplicant.c b/wpa_supplicant/dpp_supplicant.c
index 2d56b2f9d841f03cae2c1715bce105ee1f4d664b..0cda385424240af5467f065402ae0e8b651bba3b 100644 (file)
--- a/wpa_supplicant/dpp_supplicant.c
+++ b/wpa_supplicant/dpp_supplicant.c
@@ -3260,7 +3260,6 @@ void wpas_dpp_deinit(struct wpa_supplicant *wpa_s)
 #endif /* CONFIG_TESTING_OPTIONS */
        if (!wpa_s->dpp)
                return;
-       dpp_global_clear(wpa_s->dpp);
        eloop_cancel_timeout(wpas_dpp_pkex_retry_timeout, wpa_s, NULL);
        eloop_cancel_timeout(wpas_dpp_reply_wait_timeout, wpa_s, NULL);
        eloop_cancel_timeout(wpas_dpp_init_timeout, wpa_s, NULL);
@@ -3284,6 +3283,7 @@ void wpas_dpp_deinit(struct wpa_supplicant *wpa_s)
        os_memset(wpa_s->dpp_intro_bssid, 0, ETH_ALEN);
        os_free(wpa_s->dpp_configurator_params);
        wpa_s->dpp_configurator_params = NULL;
+       dpp_global_clear(wpa_s->dpp);
 }