Skip to content

hostapd: separate ubus context for config callbacks to avoid crash

Janusz Dziedzic requested to merge acsend into devel

ubus calls with the same context as config_remove might trigger its callback which cleanups interface data. Free of interface data in the middle of functions is not expected, which might cause different kind of crashes in different places which access hostapd interface structure data.

For example, hostapd_setup_interface_complete_sync() function has hostapd_ubus_add_bss() call with adding of ubus object, and if config_remove was sent, its callback will be called at this moment, will trigger cleanup and crash in the rest part of the function, like:

  • next call of hostapd_ubus_add_bss() in the loop
  • airtime_policy_update_init which accesses iface->conf->airtime_mode
  • is_zero_ether_addr(hapd->conf->bssid) and other similar places.

Merge request reports