Re: Double 'put' of bss in mac80211/mlme.c?

[Ben Greear <greearb@candelatech.com>]

On 06/14/2013 04:34 PM, Ben Greear wrote:
> Looks like an easy way to leak ies would be to mess up the
> ref counting on bss objects.
>
> While looking at such code, I found this in mac80211/mlme.c
>
> The destroy_assoc_data does a put_bss, and then it is put again
> directly.  Is this on purpose, or would this effectively cause
> a double-free?
>
>          if (!ieee80211_assoc_success(sdata, *bss, mgmt, len)) {
>              /* oops -- internal error -- send timeout for now */
>              ieee80211_destroy_assoc_data(sdata, false);
>              cfg80211_put_bss(sdata->local->hw.wiphy, *bss);
>              return RX_MGMT_CFG80211_ASSOC_TIMEOUT;
>          }
>
> Thanks,
> Ben
>

Gah, nevermind...one is assoc_data->bss, the other is auth_data->bss.

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com