nl80211: Ensure nl_preq unregistration on driver deinit

When driver interface is destroyed (via wpa_driver_nl80211_deinit) the
"preq" nl socket isn't always deleted but the callback struct associated
is. After the interface is destroyed we may still get event on the
socket but as the callback has been freed this will cause wpa_supplicant
to crash.

This patch ensures that the "preq" socket is destroyed when destroying
the interface.

Signed-off-by: Cedric IZOARD <cedricx.izoard@intel.com>

diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 4d5da949505a2aa1dd28316ec050abf3d607bb04..683123b1029a626895ca0bd5025b4176050ac453 100644 (file)
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -10566,7 +10566,7 @@ static int wpa_driver_nl80211_probe_req_report(struct i802_bss *bss, int report)
 
        if (!report) {
                if (bss->nl_preq && drv->device_ap_sme &&
-                   is_ap_interface(drv->nlmode)) {
+                   is_ap_interface(drv->nlmode) && !bss->in_deinit) {
                        /*
                         * Do not disable Probe Request reporting that was
                         * enabled in nl80211_setup_ap().