Skip to content

Commit f2b6d64

Browse files
krish2718bjarki-andreasen
authored andcommitted
[nrf fromlist] modules: hostap: Fix double free in case of error conditions
In case of error conditions post successfully sending the message, the event is already freed but we attempt to free it again. Rejig the labels to easily reflect thier purpose. Upstream PR: zephyrproject-rtos/zephyr#79231 Signed-off-by: Chaitanya Tata <[email protected]>
1 parent 162b314 commit f2b6d64

File tree

1 file changed

+5
-5
lines changed

1 file changed

+5
-5
lines changed

modules/hostap/src/supp_main.c

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -374,15 +374,15 @@ static int del_interface(struct supplicant_context *ctx, struct net_if *iface)
374374
if (!wpa_s) {
375375
ret = -ENOENT;
376376
LOG_ERR("Failed to get wpa_s handle for %s", ifname);
377-
goto out;
377+
goto free;
378378
}
379379

380380
supplicant_generate_state_event(ifname, NET_EVENT_SUPPLICANT_CMD_IFACE_REMOVING, 0);
381381

382382
if (sizeof(event->interface_status.ifname) < strlen(ifname)) {
383383
wpa_printf(MSG_ERROR, "Interface name too long: %s (max: %d)",
384384
ifname, sizeof(event->interface_status.ifname));
385-
goto out;
385+
goto free;
386386
}
387387

388388
os_memcpy(event->interface_status.ifname, ifname, strlen(ifname));
@@ -400,7 +400,7 @@ static int del_interface(struct supplicant_context *ctx, struct net_if *iface)
400400
* with WPA supplicant so we cannot unregister NM etc.
401401
*/
402402
wpa_printf(MSG_ERROR, "Failed to send event: %d", ret);
403-
goto out;
403+
goto free;
404404
}
405405

406406
while (retry++ < count && wpa_s->wpa_state != WPA_INTERFACE_DISABLED) {
@@ -438,11 +438,11 @@ static int del_interface(struct supplicant_context *ctx, struct net_if *iface)
438438

439439
return 0;
440440

441-
out:
441+
free:
442442
if (event) {
443443
os_free(event);
444444
}
445-
445+
out:
446446
return ret;
447447
}
448448
#endif

0 commit comments

Comments
 (0)