From: Jouni Malinen <jouni@qca.qualcomm.com>
Date: Mon, 30 May 2016 17:15:16 +0000 (+0300)
Subject: mesh: Fix error path handling for RSN (MGTK init)
X-Git-Tag: hostap_2_6~434
X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=b4c738ec86a933c7fb967fbea9a6c87b10620a28;p=thirdparty%2Fhostap.git

mesh: Fix error path handling for RSN (MGTK init)

wpa_deinit() got called twice if the random_get_bytes() fails to
generate the MGTK. This resulted in double-freeing the rsn->auth
pointer. Fix this by allowing mesh_rsn_auth_init() handle freeing for
all error cases.

Signed-off-by: Jouni Malinen <jouni@qca.qualcomm.com>
---

diff --git a/wpa_supplicant/mesh_rsn.c b/wpa_supplicant/mesh_rsn.c
index 1994f3f5a..ff5fefae6 100644
--- a/wpa_supplicant/mesh_rsn.c
+++ b/wpa_supplicant/mesh_rsn.c
@@ -167,10 +167,8 @@ static int __mesh_rsn_auth_init(struct mesh_rsn *rsn, const u8 *addr)
 	}
 
 	/* TODO: support rekeying */
-	if (random_get_bytes(rsn->mgtk, 16) < 0) {
-		wpa_deinit(rsn->auth);
+	if (random_get_bytes(rsn->mgtk, 16) < 0)
 		return -1;
-	}
 
 	/* group mgmt */
 	wpa_drv_set_key(rsn->wpa_s, WPA_ALG_IGTK, NULL, 4, 1,