diff options
| author | Matthew Cather | 2025-03-03 21:46:03 +0000 |
|---|---|---|
| committer | Felix Fietkau | 2025-03-05 07:04:52 +0000 |
| commit | 634ac2bab7c4bd70f8497b4847d30f12b520ec3f (patch) | |
| tree | 3402ed03b15cddf2f8c0ab066512fc741564908f | |
| parent | 1af7bf38f7e78becefc0b5af503bde735c58f767 (diff) | |
| download | openwrt-634ac2bab7c4bd70f8497b4847d30f12b520ec3f.tar.gz | |
hostapd: get reference to object before removal
`ucv_array_set` releases the array's reference to the object being cleared.
If this is the last reference to the object, it will be freed, making our
pointer `val` invalid.
To avoid this, we need to obtain our own reference to the object so we
can safely return `val`.
Signed-off-by: Matthew Cather <mattbob4@gmail.com>
(cherry picked from commit 6a10da2934441a59283394a84917edf4983e3043)
| -rw-r--r-- | package/network/services/hostapd/src/src/ap/ucode.c | 4 | ||||
| -rw-r--r-- | package/network/services/hostapd/src/src/utils/ucode.c | 1 | ||||
| -rw-r--r-- | package/network/services/hostapd/src/wpa_supplicant/ucode.c | 1 |
3 files changed, 5 insertions, 1 deletions
diff --git a/package/network/services/hostapd/src/src/ap/ucode.c b/package/network/services/hostapd/src/src/ap/ucode.c index 0e9a4fef11..26ecc6ad30 100644 --- a/package/network/services/hostapd/src/src/ap/ucode.c +++ b/package/network/services/hostapd/src/src/ap/ucode.c @@ -876,7 +876,7 @@ void hostapd_ucode_free(void) void hostapd_ucode_free_iface(struct hostapd_iface *iface) { - wpa_ucode_registry_remove(iface_registry, iface->ucode.idx); + ucv_put(wpa_ucode_registry_remove(iface_registry, iface->ucode.idx)); } void hostapd_ucode_bss_cb(struct hostapd_data *hapd, const char *type) @@ -910,6 +910,8 @@ void hostapd_ucode_free_bss(struct hostapd_data *hapd) uc_value_push(ucv_string_new(hapd->conf->iface)); uc_value_push(ucv_get(val)); ucv_put(wpa_ucode_call(2)); + + ucv_put(val); ucv_gc(vm); } diff --git a/package/network/services/hostapd/src/src/utils/ucode.c b/package/network/services/hostapd/src/src/utils/ucode.c index e61cb18db0..7636e46aaf 100644 --- a/package/network/services/hostapd/src/src/utils/ucode.c +++ b/package/network/services/hostapd/src/src/utils/ucode.c @@ -470,6 +470,7 @@ uc_value_t *wpa_ucode_registry_remove(uc_value_t *reg, int idx) if (!val) return NULL; + ucv_get(val); ucv_array_set(reg, idx - 1, NULL); dataptr = ucv_resource_dataptr(val, NULL); if (dataptr) diff --git a/package/network/services/hostapd/src/wpa_supplicant/ucode.c b/package/network/services/hostapd/src/wpa_supplicant/ucode.c index 506bde45c9..8335a27e89 100644 --- a/package/network/services/hostapd/src/wpa_supplicant/ucode.c +++ b/package/network/services/hostapd/src/wpa_supplicant/ucode.c @@ -70,6 +70,7 @@ void wpas_ucode_free_bss(struct wpa_supplicant *wpa_s) uc_value_push(ucv_string_new(wpa_s->ifname)); uc_value_push(ucv_get(val)); ucv_put(wpa_ucode_call(2)); + ucv_put(val); ucv_gc(vm); } |