[PATCH 3/5] station: fix use-after-free on neighbor reports

[PATCH 3/5] station: fix use-after-free on neighbor reports

[James Prestwood]

[-- Attachment #1: Type: text/plain, Size: 1116 bytes --]

When netdev goes down so does station, but prior to netdev calling
the neighbor report callback. The way the logic was written station
is dereferenced prior to checking for any errors, causing a use
after free.

Since -ENODEV is used in this case check for that early before
accessing station.
---
 src/station.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/src/station.c b/src/station.c
index 4a41fe05..98fc3cf2 100644
--- a/src/station.c
+++ b/src/station.c
@@ -1709,6 +1709,9 @@ static void station_early_neighbor_report_cb(struct netdev *netdev, int err,
 {
 	struct station *station = user_data;
 
+	if (err == -ENODEV)
+		return;
+
 	l_debug("ifindex: %u, error: %d(%s)",
 			netdev_get_ifindex(station->netdev),
 			err, err < 0 ? strerror(-err) : "");
@@ -2281,6 +2284,9 @@ static void station_neighbor_report_cb(struct netdev *netdev, int err,
 	struct scan_freq_set *freq_set;
 	int r;
 
+	if (err == -ENODEV)
+		return;
+
 	l_debug("ifindex: %u, error: %d(%s)",
 			netdev_get_ifindex(station->netdev),
 			err, err < 0 ? strerror(-err) : "");
-- 
2.31.1