Amazing-Mirror/fragattacks
1
0
Fork 0
mirror of https://github.com/vanhoefm/fragattacks.git synced 2025-01-18 02:44:03 -05:00
Code Issues Projects Releases Wiki Activity

Fix removal of a BSS that has not yet been fully initialized

Browse Source 
If a secondary BSS is removed while it is waiting for the primary BSS to
complete channel setup (e.g., due to HT co-ex scan, ACS, or DFS), the
hostapd_data instance has not yet been initialized. Fix the BSS removal
code to take this special case into account and not try to deinitialize
the hostapd_data instance that has not yet been started.

Signed-hostap: Jouni Malinen <jouni@qca.qualcomm.com>
This commit is contained in:
Jouni Malinen 2013-11-06 00:57:38 +02:00 committed by Jouni Malinen
parent 2f99d90726
commit cdf3fb1f1c
1 changed files with 20 additions and 15 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

17
src/ap/hostapd.c
View File

@ -1818,13 +1818,13 @@ fail:
static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx) static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
{ {
struct hostapd_data *hapd;
size_t i; size_t i;
if (idx > iface->num_bss || idx > iface->conf->num_bss) wpa_printf(MSG_INFO, "Remove BSS '%s'", iface->conf->bss[idx]->iface);
return -1;
hapd = iface->bss[idx]; /* Remove hostapd_data only if it has already been initialized */
wpa_printf(MSG_INFO, "Remove BSS '%s'", hapd->conf->iface); if (idx < iface->num_bss) {
struct hostapd_data *hapd = iface->bss[idx];
hostapd_free_stas(hapd); hostapd_free_stas(hapd);
hostapd_flush_old_stations(hapd, WLAN_REASON_DEAUTH_LEAVING); hostapd_flush_old_stations(hapd, WLAN_REASON_DEAUTH_LEAVING);
@ -1834,11 +1834,16 @@ static int hostapd_remove_bss(struct hostapd_iface *iface, unsigned int idx)
os_free(hapd); os_free(hapd);
iface->num_bss--; iface->num_bss--;
for (i = idx; i < iface->num_bss; i++) for (i = idx; i < iface->num_bss; i++)
iface->bss[i] = iface->bss[i + 1]; iface->bss[i] = iface->bss[i + 1];
} else {
hostapd_config_free_bss(iface->conf->bss[idx]);
iface->conf->bss[idx] = NULL;
}
iface->conf->num_bss--; iface->conf->num_bss--;
for (i = idx; i < iface->num_bss; i++) for (i = idx; i < iface->conf->num_bss; i++)
iface->conf->bss[i] = iface->conf->bss[i + 1]; iface->conf->bss[i] = iface->conf->bss[i + 1];
return 0; return 0;