From: Benjamin Berg <benjamin.berg@xxxxxxxxx>
The __checK_assoc_ies function needs to create a per-link wpa_sm
temporarily. However, later on sta->wpa_sm should just be a reference to
the main wpa_sm.
Change the code so that the temporary state is self-contained to
__check_assoc_ies. This fixes a memory leak should __check_assoc_ies
return an error.
Also change the function to pass the wpa_sm for the assoc_link instead
of just a link boolean. The internal lookup appears to not have worked
and this also simplifies the code.
Fixes: 5f5db9366cde ("AP: MLO: Process Multi-Link element from (Re)Association Request frame")
Fixes: 84d2a36da02a ("AP MLD: Require same AKM and pairwise cipher for all links")
Signed-off-by: Benjamin Berg <benjamin.berg@xxxxxxxxx>
---
src/ap/ieee802_11.c | 134 ++++++++++++++++++++++++++------------------
1 file changed, 80 insertions(+), 54 deletions(-)
diff --git a/src/ap/ieee802_11.c b/src/ap/ieee802_11.c
index bf36d7f9e3..7551310e4e 100644
--- a/src/ap/ieee802_11.c
+++ b/src/ap/ieee802_11.c
@@ -4220,53 +4220,52 @@ static bool check_sa_query(struct hostapd_data *hapd, struct sta_info *sta,
static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
const u8 *ies, size_t ies_len,
struct ieee802_11_elems *elems, int reassoc,
- bool link)
+ struct wpa_state_machine *assoc_wpa_sm)
{
int resp;
const u8 *wpa_ie;
size_t wpa_ie_len;
const u8 *p2p_dev_addr = NULL;
- struct hostapd_data *assoc_hapd;
- struct sta_info *assoc_sta = NULL;
resp = check_ssid(hapd, sta, elems->ssid, elems->ssid_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = check_wmm(hapd, sta, elems->wmm, elems->wmm_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = check_ext_capab(hapd, sta, elems->ext_capab,
elems->ext_capab_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = copy_supp_rates(hapd, sta, elems);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = check_multi_ap(hapd, sta, elems->multi_ap, elems->multi_ap_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = copy_sta_ht_capab(hapd, sta, elems->ht_capabilities);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
if (hapd->iconf->ieee80211n && hapd->iconf->require_ht &&
!(sta->flags & WLAN_STA_HT)) {
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "Station does not support "
"mandatory HT PHY - reject association");
- return WLAN_STATUS_ASSOC_DENIED_NO_HT;
+ resp = WLAN_STATUS_ASSOC_DENIED_NO_HT;
+ goto out;
}
#ifdef CONFIG_IEEE80211AC
if (hapd->iconf->ieee80211ac) {
resp = copy_sta_vht_capab(hapd, sta, elems->vht_capabilities);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
resp = set_sta_vht_opmode(hapd, sta, elems->opmode_notif);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
if (hapd->iconf->ieee80211ac && hapd->iconf->require_vht &&
@@ -4274,14 +4273,15 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO, "Station does not support "
"mandatory VHT PHY - reject association");
- return WLAN_STATUS_ASSOC_DENIED_NO_VHT;
+ resp = WLAN_STATUS_ASSOC_DENIED_NO_VHT;
+ goto out;
}
if (hapd->conf->vendor_vht && !elems->vht_capabilities) {
resp = copy_sta_vendor_vht(hapd, sta, elems->vendor_vht,
elems->vendor_vht_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
#endif /* CONFIG_IEEE80211AC */
#ifdef CONFIG_IEEE80211AX
@@ -4290,14 +4290,15 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
elems->he_capabilities,
elems->he_capabilities_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
if (hapd->iconf->require_he && !(sta->flags & WLAN_STA_HE)) {
hostapd_logger(hapd, sta->addr,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station does not support mandatory HE PHY - reject association");
- return WLAN_STATUS_DENIED_HE_NOT_SUPPORTED;
+ resp = WLAN_STATUS_DENIED_HE_NOT_SUPPORTED;
+ goto out;
}
if (is_6ghz_op_class(hapd->iconf->op_class)) {
@@ -4306,12 +4307,13 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"Station does not support mandatory HE PHY - reject association");
- return WLAN_STATUS_DENIED_HE_NOT_SUPPORTED;
+ resp = WLAN_STATUS_DENIED_HE_NOT_SUPPORTED;
+ goto out;
}
resp = copy_sta_he_6ghz_capab(hapd, sta,
elems->he_6ghz_band_cap);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
}
#endif /* CONFIG_IEEE80211AX */
@@ -4323,12 +4325,12 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
elems->eht_capabilities,
elems->eht_capabilities_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
- if (!link) {
+ if (!assoc_wpa_sm) {
resp = hostapd_process_ml_assoc_req(hapd, elems, sta);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
}
#endif /* CONFIG_IEEE80211BE */
@@ -4376,7 +4378,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
if (sta->wps_ie && wps_validate_assoc_req(sta->wps_ie) < 0) {
wpa_printf(MSG_DEBUG, "WPS: Invalid WPS IE in "
"(Re)Association Request - reject");
- return WLAN_STATUS_INVALID_IE;
+ resp = WLAN_STATUS_INVALID_IE;
+ goto out;
}
} else if (hapd->conf->wps_state && wpa_ie == NULL) {
wpa_printf(MSG_DEBUG, "STA did not include WPA/RSN IE in "
@@ -4388,7 +4391,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
hostapd_logger(hapd, sta->addr, HOSTAPD_MODULE_IEEE80211,
HOSTAPD_LEVEL_INFO,
"No WPA/RSN IE in association request");
- return WLAN_STATUS_INVALID_IE;
+ resp = WLAN_STATUS_INVALID_IE;
+ goto out;
}
if (hapd->conf->wpa && wpa_ie) {
@@ -4402,10 +4406,10 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_ie_len += 2;
if (!sta->wpa_sm) {
- if (!link)
- assoc_sta = hostapd_ml_get_assoc_sta(
- hapd, sta, &assoc_hapd);
-
+ /* NOTE: For links other than the assoc-link the
+ * separate wpa_sm is only allocated internally to this
+ * function.
+ */
sta->wpa_sm = wpa_auth_sta_init(hapd->wpa_auth,
sta->addr,
p2p_dev_addr);
@@ -4413,7 +4417,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
if (!sta->wpa_sm) {
wpa_printf(MSG_WARNING,
"Failed to initialize RSN state machine");
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
}
@@ -4440,11 +4445,11 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
0,
elems->mdie, elems->mdie_len,
elems->owe_dh, elems->owe_dh_len,
- assoc_sta ? assoc_sta->wpa_sm : NULL,
+ assoc_wpa_sm,
ap_sta_is_mld(hapd, sta));
resp = wpa_res_to_status_code(res);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
if (wpa_auth_uses_mfp(sta->wpa_sm))
sta->flags |= WLAN_STA_MFP;
@@ -4463,17 +4468,18 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
"to use association (not "
"re-association) with FT auth_alg",
MAC2STR(sta->addr));
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
resp = wpa_ft_validate_reassoc(sta->wpa_sm, ies,
ies_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
#endif /* CONFIG_IEEE80211R_AP */
- if (link)
+ if (assoc_wpa_sm)
goto skip_sae_owe;
#ifdef CONFIG_SAE
if (wpa_auth_uses_sae(sta->wpa_sm) && sta->sae &&
@@ -4488,7 +4494,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_printf(MSG_DEBUG,
"SAE: No PMKSA cache entry found for "
MACSTR, MAC2STR(sta->addr));
- return WLAN_STATUS_INVALID_PMKID;
+ resp = WLAN_STATUS_INVALID_PMKID;
+ goto out;
}
wpa_printf(MSG_DEBUG, "SAE: " MACSTR
" using PMKSA caching", MAC2STR(sta->addr));
@@ -4499,7 +4506,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_printf(MSG_DEBUG, "SAE: " MACSTR " tried to use "
"SAE AKM after non-SAE auth_alg %u",
MAC2STR(sta->addr), sta->auth_alg);
- return WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
+ resp = WLAN_STATUS_NOT_SUPPORTED_AUTH_ALG;
+ goto out;
}
if (hapd->conf->sae_pwe == SAE_PWE_BOTH &&
@@ -4510,7 +4518,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_printf(MSG_INFO, "SAE: " MACSTR
" indicates support for SAE H2E, but did not use it",
MAC2STR(sta->addr));
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
#endif /* CONFIG_SAE */
@@ -4521,7 +4530,7 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
resp = owe_process_assoc_req(hapd, sta, elems->owe_dh,
elems->owe_dh_len);
if (resp != WLAN_STATUS_SUCCESS)
- return resp;
+ goto out;
}
#endif /* CONFIG_OWE */
skip_sae_owe:
@@ -4549,7 +4558,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
elems->owe_dh_len) < 0) {
dpp_pfs_free(sta->dpp_pfs);
sta->dpp_pfs = NULL;
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
}
@@ -4565,7 +4575,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
HOSTAPD_LEVEL_INFO,
"Station tried to use TKIP with HT "
"association");
- return WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
+ resp = WLAN_STATUS_CIPHER_REJECTED_PER_POLICY;
+ goto out;
}
wpa_auth_set_ssid_protection(
@@ -4595,7 +4606,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_printf(MSG_DEBUG,
"HS 2.0: PMF not negotiated by release %d station "
MACSTR, release, MAC2STR(sta->addr));
- return WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
+ resp = WLAN_STATUS_ROBUST_MGMT_FRAME_POLICY_VIOLATION;
+ goto out;
}
} else {
sta->hs20_ie = NULL;
@@ -4626,7 +4638,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
hapd->conf->ieee80211w != NO_MGMT_FRAME_PROTECTION) {
wpa_printf(MSG_INFO,
"MBO: Reject WPA2 association without PMF");
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
#endif /* CONFIG_MBO */
@@ -4643,14 +4656,17 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
if (hostapd_drv_channel_info(hapd, &ci) != 0) {
wpa_printf(MSG_WARNING,
"Failed to get channel info to validate received OCI in FILS (Re)Association Request frame");
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
if (get_sta_tx_parameters(sta->wpa_sm,
channel_width_to_int(ci.chanwidth),
ci.seg1_idx, &tx_chanwidth,
- &tx_seg1_idx) < 0)
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ &tx_seg1_idx) < 0) {
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
+ }
res = ocv_verify_tx_params(elems->oci, elems->oci_len, &ci,
tx_chanwidth, tx_seg1_idx);
@@ -4666,7 +4682,8 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
wpa_msg(hapd->msg_ctx, MSG_INFO, OCV_FAILURE "addr="
MACSTR " frame=fils-reassoc-req error=%s",
MAC2STR(sta->addr), ocv_errorstr);
- return WLAN_STATUS_UNSPECIFIED_FAILURE;
+ resp = WLAN_STATUS_UNSPECIFIED_FAILURE;
+ goto out;
}
}
#endif /* CONFIG_FILS && CONFIG_OCV */
@@ -4705,7 +4722,21 @@ static int __check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
hostapd_wfa_capab(hapd, sta, elems->wfa_capab,
elems->wfa_capab + elems->wfa_capab_len);
- return WLAN_STATUS_SUCCESS;
+out:
+ if (resp != WLAN_STATUS_SUCCESS || assoc_wpa_sm) {
+ wpa_auth_sta_deinit(sta->wpa_sm);
+
+ /* Only keep a reference to the main wpa_sm and drop the
+ * per-link instance.
+ * This reference is needed during group rekey handling.
+ */
+ if (resp == WLAN_STATUS_SUCCESS)
+ sta->wpa_sm = assoc_wpa_sm;
+ else
+ sta->wpa_sm = NULL;
+ }
+
+ return resp;
}
@@ -4722,7 +4753,7 @@ static int check_assoc_ies(struct hostapd_data *hapd, struct sta_info *sta,
}
return __check_assoc_ies(hapd, sta, ies, ies_len, &elems, reassoc,
- false);
+ NULL);
}
@@ -4841,7 +4872,8 @@ static int ieee80211_ml_process_link(struct hostapd_data *hapd,
sta->mld_assoc_link_id = origin_sta->mld_assoc_link_id;
ap_sta_set_mld(sta, true);
- status = __check_assoc_ies(hapd, sta, NULL, 0, &elems, reassoc, true);
+ status = __check_assoc_ies(hapd, sta, NULL, 0, &elems, reassoc,
+ origin_sta->wpa_sm);
if (status != WLAN_STATUS_SUCCESS) {
wpa_printf(MSG_DEBUG, "MLD: link: Element check failed");
goto out;
@@ -4872,12 +4904,6 @@ static int ieee80211_ml_process_link(struct hostapd_data *hapd,
ieee802_11_update_beacons(hapd->iface);
}
- /* Maintain state machine reference on all link STAs, this is needed
- * during group rekey handling.
- */
- wpa_auth_sta_deinit(sta->wpa_sm);
- sta->wpa_sm = origin_sta->wpa_sm;
-
/*
* Do not initialize the EAPOL state machine.
* TODO: Maybe it is needed?
--
2.49.0
_______________________________________________
Hostap mailing list
Hostap@xxxxxxxxxxxxxxxxxxx
http://lists.infradead.org/mailman/listinfo/hostap
