DPP2: Clean up Controller on hostapd interface removal

Stop the DPP Controller instance, if one is started, when the hostapd
interface that was used to start that Controller is removed. This is
needed to remove the control pointers that point to the soon-to-be-freed
hostapd structures. This fixes an issue where a Controller operation
with multiple interfaces could have resulted in references to freed
memory if an interface is removed without explicitly stopping the DPP
Controller.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/src/ap/dpp_hostapd.c b/src/ap/dpp_hostapd.c
index 013022a87802354f2e13dd4274a72687911d462b..41769f475544b7adbd94cd335bcc6570bc9cf73b 100644 (file)
--- a/src/ap/dpp_hostapd.c
+++ b/src/ap/dpp_hostapd.c
@@ -2276,6 +2276,8 @@ void hostapd_dpp_deinit(struct hostapd_data *hapd)
        eloop_cancel_timeout(hostapd_dpp_conn_status_result_wait_timeout, hapd,
                             NULL);
        hostapd_dpp_chirp_stop(hapd);
+       if (hapd->iface->interfaces)
+               dpp_controller_stop_for_ctx(hapd->iface->interfaces->dpp, hapd);
 #endif /* CONFIG_DPP2 */
        dpp_auth_deinit(hapd->dpp_auth);
        hapd->dpp_auth = NULL;

diff --git a/src/common/dpp.h b/src/common/dpp.h
index 75de3cae93e9239b32b7ec5521eff37478385912..bc1cd46118d075ee8275718a788ef1561d771b1a 100644 (file)
--- a/src/common/dpp.h
+++ b/src/common/dpp.h
@@ -676,6 +676,7 @@ int dpp_relay_rx_gas_req(struct dpp_global *dpp, const u8 *src, const u8 *data,
 int dpp_controller_start(struct dpp_global *dpp,
                         struct dpp_controller_config *config);
 void dpp_controller_stop(struct dpp_global *dpp);
+void dpp_controller_stop_for_ctx(struct dpp_global *dpp, void *cb_ctx);
 struct dpp_authentication * dpp_controller_get_auth(struct dpp_global *dpp,
                                                    unsigned int id);
 void dpp_controller_new_qr_code(struct dpp_global *dpp,

diff --git a/src/common/dpp_tcp.c b/src/common/dpp_tcp.c
index c373f107791cb6965d83fd58f9d908a5183568e2..103eda272649b015bb9340c6e3d9280728427fd4 100644 (file)
--- a/src/common/dpp_tcp.c
+++ b/src/common/dpp_tcp.c
@@ -1723,6 +1723,13 @@ void dpp_controller_stop(struct dpp_global *dpp)
 }
 
 
+void dpp_controller_stop_for_ctx(struct dpp_global *dpp, void *cb_ctx)
+{
+       if (dpp && dpp->controller && dpp->controller->cb_ctx == cb_ctx)
+               dpp_controller_stop(dpp);
+}
+
+
 static bool dpp_tcp_peer_id_match(struct dpp_authentication *auth,
                                  unsigned int id)
 {