EAP peer: Make EAP-Success handling more robust against race conditions

When ERP initialization was moved from the METHOD state to the SUCCESS
state, the conditions for checking against EAP state being cleared was
missed. The METHOD state verified that sm->m is not NULL while the
SUCCESS state did not have such a check. This opened a window for a race
condition where processing of deauthentication event and EAPOL RX events
could end up delivering an EAP-Success to the EAP peer state machine
after the state had been cleared. This issue has now been worked around
in another manner, but the root cause for this regression should be
fixed as well.

Check that the EAP state machine is properly configured before trying to
initialize ERP in the SUCCESS state.

Fixes: 2a71673e27e9 ("ERP: Derive ERP key only after successful EAP authentication")
Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/src/eap_peer/eap.c b/src/eap_peer/eap.c
index 74c2ad36171c4bf14da1329f874cea96ad4dc4bf..7dcfe4fff45ea5b89a7c0d0d7a02e16f958949e1 100644 (file)
--- a/src/eap_peer/eap.c
+++ b/src/eap_peer/eap.c
@@ -1069,6 +1069,20 @@ SM_STATE(EAP, SUCCESS)
        wpa_msg(sm->msg_ctx, MSG_INFO, WPA_EVENT_EAP_SUCCESS
                "EAP authentication completed successfully");
 
+       if (!config || !sm->m) {
+               /*
+                * This should not happen under normal conditions, but be more
+                * careful here since there was an earlier case where
+                * EAP-Success could end up getting delivered to the state
+                * machine for processing after the state had been cleaned with
+                * a call to eap_invalidate_cached_session() (and also
+                * eapol_sm_notify_config() having been used to clear EAP
+                * configuration in the EAPOL state machine).
+                */
+               wpa_printf(MSG_DEBUG,
+                          "EAP: State machine not configured - cannot initialize ERP");
+               return;
+       }
        if (config->erp && sm->m->get_emsk && sm->eapSessionId &&
            sm->m->isKeyAvailable &&
            sm->m->isKeyAvailable(sm, sm->eap_method_priv))