From 05962099c3b88831a1815df8e542b38474b109be Mon Sep 17 00:00:00 2001 From: Jouni Malinen Date: Tue, 3 Nov 2020 19:45:36 +0200 Subject: [PATCH] TDLS: Fix error path for TPK M1 send failure in testing functionality The previous fix did not actually address this testing functionality case correctly. Clear the peer pointer to avoid double freeing. Fixes: a86078c87613 ("TDLS: Fix error path handling for TPK M1 send failures") Signed-off-by: Jouni Malinen --- src/rsn_supp/tdls.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/rsn_supp/tdls.c b/src/rsn_supp/tdls.c index 1fb28c5c5..7c4ef191c 100644 --- a/src/rsn_supp/tdls.c +++ b/src/rsn_supp/tdls.c @@ -1926,8 +1926,10 @@ static int wpa_tdls_process_tpk_m1(struct wpa_sm *sm, const u8 *src_addr, peer->initiator = 1; wpa_sm_tdls_peer_addset(sm, peer->addr, 1, 0, 0, NULL, 0, NULL, NULL, 0, 0, NULL, 0, NULL, 0, NULL, 0); - if (wpa_tdls_send_tpk_m1(sm, peer) == -2) + if (wpa_tdls_send_tpk_m1(sm, peer) == -2) { + peer = NULL; goto error; + } } if ((tdls_testing & TDLS_TESTING_IGNORE_AP_PROHIBIT) &&