wlan-ap-Telecominfraproject/feeds/qca/hostapd/patches/q23-hostapd-Avoid-NULL-pointer-dereference.patch

From c745f72e166050a07f491726c3adf98849395d2a Mon Sep 17 00:00:00 2001
From: Rathees Kumar R Chinannan <quic_rrchinan@quicinc.com>
Date: Tue, 3 Oct 2023 11:27:20 +0530
Subject: [PATCH] hostapd: Avoid NULL pointer dereference.

Added NULL check before accessing cb ptr on wpa_authenticator and wiphy list on
wpa_driver_nl80211_data.

These NULL checks are added to avoid unusual hostapd crashes observed during
wifi restart and  module reload test cases.

Change-Id: I9dbabd9cf268b530553010b1c061fee730764528
Signed-off-by: Rathees Kumar R Chinannan <quic_rrchinan@quicinc.com>
---
 src/ap/wpa_auth.c            | 2 +-
 src/drivers/driver_nl80211.c | 9 ++++++---
 2 files changed, 7 insertions(+), 4 deletions(-)

diff --git a/src/ap/wpa_auth.c b/src/ap/wpa_auth.c
index 7d0f578..a5d48a0 100644
--- a/src/ap/wpa_auth.c
+++ b/src/ap/wpa_auth.c
@@ -228,7 +228,7 @@ int wpa_auth_for_each_sta(struct wpa_authenticator *wpa_auth,
 			  int (*cb)(struct wpa_state_machine *sm, void *ctx),
 			  void *cb_ctx)
 {
-	if (!wpa_auth->cb->for_each_sta)
+	if (!wpa_auth->cb || !wpa_auth->cb->for_each_sta)
 		return 0;
 	return wpa_auth->cb->for_each_sta(wpa_auth->cb_ctx, cb, cb_ctx);
 }
diff --git a/src/drivers/driver_nl80211.c b/src/drivers/driver_nl80211.c
index 330e983..be7fc7b 100644
--- a/src/drivers/driver_nl80211.c
+++ b/src/drivers/driver_nl80211.c
@@ -995,6 +995,7 @@ static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 	struct nl80211_wiphy_data *w = bss->wiphy_data;
 	struct i802_bss *tmp_bss;
 	int found = 0;
+	struct dl_list *list;
 
 	if (w == NULL)
 		return;
@@ -1009,9 +1010,11 @@ static void nl80211_put_wiphy_data_ap(struct i802_bss *bss)
 		}
 	}
 	/* if not remove it */
-	if (!found)
-		dl_list_del(&bss->drv->wiphy_list);
-
+	if (!found) {
+		list = &bss->drv->wiphy_list;
+		if (list->next && list->prev)
+			dl_list_del(list);
+	}
 	if (!dl_list_empty(&w->bsss))
 		return;
 
-- 
2.17.1