|
 |
bcfe38 |
From 8460e3230988ef2ec13ce6b69b687e941f6cdb32 Mon Sep 17 00:00:00 2001
|
|
|
bcfe38 |
From: Jouni Malinen <jouni@codeaurora.org>
|
|
|
bcfe38 |
Date: Tue, 8 Dec 2020 23:52:50 +0200
|
|
|
bcfe38 |
Subject: [PATCH] P2P: Fix a corner case in peer addition based on PD Request
|
|
|
bcfe38 |
|
|
|
bcfe38 |
p2p_add_device() may remove the oldest entry if there is no room in the
|
|
|
bcfe38 |
peer table for a new peer. This would result in any pointer to that
|
|
|
bcfe38 |
removed entry becoming stale. A corner case with an invalid PD Request
|
|
|
bcfe38 |
frame could result in such a case ending up using (read+write) freed
|
|
|
bcfe38 |
memory. This could only by triggered when the peer table has reached its
|
|
|
bcfe38 |
maximum size and the PD Request frame is received from the P2P Device
|
|
|
bcfe38 |
Address of the oldest remaining entry and the frame has incorrect P2P
|
|
|
bcfe38 |
Device Address in the payload.
|
|
|
bcfe38 |
|
|
|
bcfe38 |
Fix this by fetching the dev pointer again after having called
|
|
|
bcfe38 |
p2p_add_device() so that the stale pointer cannot be used.
|
|
|
bcfe38 |
|
|
|
bcfe38 |
Fixes: 17bef1e97a50 ("P2P: Add peer entry based on Provision Discovery Request")
|
|
|
bcfe38 |
Signed-off-by: Jouni Malinen <jouni@codeaurora.org>
|
|
|
bcfe38 |
---
|
|
|
bcfe38 |
src/p2p/p2p_pd.c | 12 +++++-------
|
|
|
bcfe38 |
1 file changed, 5 insertions(+), 7 deletions(-)
|
|
|
bcfe38 |
|
|
|
bcfe38 |
diff --git a/src/p2p/p2p_pd.c b/src/p2p/p2p_pd.c
|
|
|
bcfe38 |
index 3994ec03f86b..05fd593494ef 100644
|
|
|
bcfe38 |
--- a/src/p2p/p2p_pd.c
|
|
|
bcfe38 |
+++ b/src/p2p/p2p_pd.c
|
|
|
bcfe38 |
@@ -595,14 +595,12 @@ void p2p_process_prov_disc_req(struct p2p_data *p2p, const u8 *sa,
|
|
|
bcfe38 |
goto out;
|
|
|
bcfe38 |
}
|
|
|
bcfe38 |
|
|
|
bcfe38 |
+ dev = p2p_get_device(p2p, sa);
|
|
|
bcfe38 |
if (!dev) {
|
|
|
bcfe38 |
- dev = p2p_get_device(p2p, sa);
|
|
|
bcfe38 |
- if (!dev) {
|
|
|
bcfe38 |
- p2p_dbg(p2p,
|
|
|
bcfe38 |
- "Provision Discovery device not found "
|
|
|
bcfe38 |
- MACSTR, MAC2STR(sa));
|
|
|
bcfe38 |
- goto out;
|
|
|
bcfe38 |
- }
|
|
|
bcfe38 |
+ p2p_dbg(p2p,
|
|
|
bcfe38 |
+ "Provision Discovery device not found "
|
|
|
bcfe38 |
+ MACSTR, MAC2STR(sa));
|
|
|
bcfe38 |
+ goto out;
|
|
|
bcfe38 |
}
|
|
|
bcfe38 |
} else if (msg.wfd_subelems) {
|
|
|
bcfe38 |
wpabuf_free(dev->info.wfd_subelems);
|
|
|
bcfe38 |
--
|
|
|
bcfe38 |
2.25.1
|
|
|
bcfe38 |
|