diff mbox

[09/12] mesh: Fix segmentation fault by repeating MESH_GROUP_ADD/REMOVE

Message ID 1415079413-3048-9-git-send-email-masashi.honma@gmail.com
State Superseded
Headers show

Commit Message

Masashi Honma Nov. 4, 2014, 5:36 a.m. UTC 
Signed-off-by: Natsuki Itaya <Natsuki.Itaya@jp.sony.com>
Signed-off-by: Masashi Honma <masashi.honma@gmail.com>
---
 wpa_supplicant/events.c | 4 ++++
 1 file changed, 4 insertions(+)

Comments

Bob Copeland Nov. 4, 2014, 1:57 p.m. UTC | #1 
On Tue, Nov 04, 2014 at 02:36:50PM +0900, Masashi Honma wrote:
> Signed-off-by: Natsuki Itaya <Natsuki.Itaya@jp.sony.com>
> Signed-off-by: Masashi Honma <masashi.honma@gmail.com>

I can reproduce this crash by doing two MESH_GROUP_ADD/REMOVE in
short succession?

> --- a/wpa_supplicant/events.c
> +++ b/wpa_supplicant/events.c
> @@ -3475,9 +3475,13 @@ void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
>  #endif /* CONFIG_AP */
>  		break;
>  	case EVENT_NEW_PEER_CANDIDATE:
> +#ifdef CONFIG_MESH
> +		if (!wpa_s->ifmsh || !data)
> +			break;
>  		wpa_mesh_notify_peer(wpa_s, data->mesh_peer.peer,
>  				     data->mesh_peer.ies,
>  				     data->mesh_peer.ie_len);
> +#endif /* CONFIG_MESH */
>  		break;
>  	default:
>  		wpa_msg(wpa_s, MSG_INFO, "Unknown event %d", event);
Masashi Honma Nov. 5, 2014, 2:52 a.m. UTC | #2 
2014-11-04 22:57 GMT+09:00 Bob Copeland <me@bobcopeland.com>:

> I can reproduce this crash by doing two MESH_GROUP_ADD/REMOVE in
> short succession?

To reproduce this is difficult.

In spite of trying 200 times MESH_GROUP_ADD/REMOVE with 4 mesh STAs,
I could not reproduce this.
diff mbox

Patch

diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 6761c1a..c1684bf 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -3475,9 +3475,13 @@  void wpa_supplicant_event(void *ctx, enum wpa_event_type event,
 #endif /* CONFIG_AP */
 		break;
 	case EVENT_NEW_PEER_CANDIDATE:
+#ifdef CONFIG_MESH
+		if (!wpa_s->ifmsh || !data)
+			break;
 		wpa_mesh_notify_peer(wpa_s, data->mesh_peer.peer,
 				     data->mesh_peer.ies,
 				     data->mesh_peer.ie_len);
+#endif /* CONFIG_MESH */
 		break;
 	default:
 		wpa_msg(wpa_s, MSG_INFO, "Unknown event %d", event);