From: Jouni Malinen <jouni@codeaurora.org>
Date: Tue, 3 Nov 2020 17:45:36 +0000 (+0200)
Subject: TDLS: Fix error path for TPK M1 send failure in testing functionality
X-Git-Tag: hostap_2_10~783
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=05962099c3b88831a1815df8e542b38474b109be;p=thirdparty%2Fhostap.git

TDLS: Fix error path for TPK M1 send failure in testing functionality

The previous fix did not actually address this testing functionality
case correctly. Clear the peer pointer to avoid double freeing.

Fixes: a86078c87613 ("TDLS: Fix error path handling for TPK M1 send failures")
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
---

diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c
index 1fb28c5c5..7c4ef191c 100644
--- a/src/rsn_supp/tdls.c
+++ b/src/rsn_supp/tdls.c
@@ -1926,8 +1926,10 @@ static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr,
 		peer->initiator = 1;
 		wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL,
 					NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0);
-		if (wpa_tdls_send_tpk_m1(sm, peer) == -2)
+		if (wpa_tdls_send_tpk_m1(sm, peer) == -2) {
+			peer = NULL;
 			goto error;
+		}
 	}
 
 	if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&