Skip to contentSkip to conversation

Double 'put' of bss in mac80211/mlme.c?

DISCUSSION Ben Greear 1 participant 2 messages Jun 14, 2013

lore
Share & tools
lore

Ben Greear

author
#0 lore raw

Looks like an easy way to leak ies would be to mess up the ref counting on bss objects.

While looking at such code, I found this in mac80211/mlme.c

The destroy_assoc_data does a put_bss, and then it is put again directly. Is this on purpose, or would this effectively cause a double-free?

		if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
			/* oops -- internal error -- send timeout for now */
			ieee80211_destroy_assoc_data(sdata, false);
			cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
			return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
		}

Thanks,
Ben

Signature · 2 lines
Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com
author
#1 lore raw
Quoted 16 lines · Ben Greear

Looks like an easy way to leak ies would be to mess up the ref counting on bss objects.

While looking at such code, I found this in mac80211/mlme.c

The destroy_assoc_data does a put_bss, and then it is put again directly. Is this on purpose, or would this effectively cause a double-free?

         if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
             /* oops -- internal error -- send timeout for now */
             ieee80211_destroy_assoc_data(sdata, false);
             cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
             return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
         }
Quoted 3 lines

Thanks,
Ben

Gah, nevermind...one is assoc_data->bss, the other is auth_data->bss.

Thanks,
Ben

Signature · 2 lines
Ben Greear <[email protected]>
Candela Technologies Inc  http://www.candelatech.com