|
 |
b645d2 |
From 7612e65b9bdfe03e5a018e3c897f4a3292c42ee4 Mon Sep 17 00:00:00 2001
|
|
|
b645d2 |
Message-Id: <7612e65b9bdfe03e5a018e3c897f4a3292c42ee4.1506941240.git.davide.caratti@gmail.com>
|
|
|
b645d2 |
From: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
b645d2 |
Date: Tue, 22 Aug 2017 10:34:19 +0200
|
|
|
b645d2 |
Subject: [PATCH] mka: Add error handling for secy_init_macsec() calls
|
|
|
b645d2 |
|
|
|
b645d2 |
secy_init_macsec() can fail (if ->macsec_init fails), and
|
|
|
b645d2 |
ieee802_1x_kay_init() should handle this and not let MKA run any
|
|
|
b645d2 |
further, because nothing is going to work anyway.
|
|
|
b645d2 |
|
|
|
b645d2 |
On failure, ieee802_1x_kay_init() must deinit its kay, which will free
|
|
|
b645d2 |
kay->ctx, so ieee802_1x_kay_init callers (only ieee802_1x_alloc_kay_sm)
|
|
|
b645d2 |
must not do it. Before this patch there is a double-free of the ctx
|
|
|
b645d2 |
argument when ieee802_1x_kay_deinit() was called.
|
|
|
b645d2 |
|
|
|
b645d2 |
Signed-off-by: Sabrina Dubroca <sd@queasysnail.net>
|
|
|
b645d2 |
---
|
|
|
b645d2 |
src/pae/ieee802_1x_kay.c | 25 ++++++++++++++-----------
|
|
|
b645d2 |
wpa_supplicant/wpas_kay.c | 5 ++---
|
|
|
b645d2 |
2 files changed, 16 insertions(+), 14 deletions(-)
|
|
|
b645d2 |
|
|
|
b645d2 |
diff --git a/src/pae/ieee802_1x_kay.c b/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
index ff55f88b8..c4bfcbc63 100644
|
|
|
b645d2 |
--- a/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
+++ b/src/pae/ieee802_1x_kay.c
|
|
|
b645d2 |
@@ -3100,6 +3100,7 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
kay = os_zalloc(sizeof(*kay));
|
|
|
b645d2 |
if (!kay) {
|
|
|
b645d2 |
wpa_printf(MSG_ERROR, "KaY-%s: out of memory", __func__);
|
|
|
b645d2 |
+ os_free(ctx);
|
|
|
b645d2 |
return NULL;
|
|
|
b645d2 |
}
|
|
|
b645d2 |
|
|
|
b645d2 |
@@ -3134,10 +3135,8 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
dl_list_init(&kay->participant_list);
|
|
|
b645d2 |
|
|
|
b645d2 |
if (policy != DO_NOT_SECURE &&
|
|
|
b645d2 |
- secy_get_capability(kay, &kay->macsec_capable) < 0) {
|
|
|
b645d2 |
- os_free(kay);
|
|
|
b645d2 |
- return NULL;
|
|
|
b645d2 |
- }
|
|
|
b645d2 |
+ secy_get_capability(kay, &kay->macsec_capable) < 0)
|
|
|
b645d2 |
+ goto error;
|
|
|
b645d2 |
|
|
|
b645d2 |
if (policy == DO_NOT_SECURE ||
|
|
|
b645d2 |
kay->macsec_capable == MACSEC_CAP_NOT_IMPLEMENTED) {
|
|
|
b645d2 |
@@ -3164,16 +3163,17 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
wpa_printf(MSG_DEBUG, "KaY: state machine created");
|
|
|
b645d2 |
|
|
|
b645d2 |
/* Initialize the SecY must be prio to CP, as CP will control SecY */
|
|
|
b645d2 |
- secy_init_macsec(kay);
|
|
|
b645d2 |
+ if (secy_init_macsec(kay) < 0) {
|
|
|
b645d2 |
+ wpa_printf(MSG_DEBUG, "KaY: Could not initialize MACsec");
|
|
|
b645d2 |
+ goto error;
|
|
|
b645d2 |
+ }
|
|
|
b645d2 |
|
|
|
b645d2 |
wpa_printf(MSG_DEBUG, "KaY: secy init macsec done");
|
|
|
b645d2 |
|
|
|
b645d2 |
/* init CP */
|
|
|
b645d2 |
kay->cp = ieee802_1x_cp_sm_init(kay);
|
|
|
b645d2 |
- if (kay->cp == NULL) {
|
|
|
b645d2 |
- ieee802_1x_kay_deinit(kay);
|
|
|
b645d2 |
- return NULL;
|
|
|
b645d2 |
- }
|
|
|
b645d2 |
+ if (kay->cp == NULL)
|
|
|
b645d2 |
+ goto error;
|
|
|
b645d2 |
|
|
|
b645d2 |
if (policy == DO_NOT_SECURE) {
|
|
|
b645d2 |
ieee802_1x_cp_connect_authenticated(kay->cp);
|
|
|
b645d2 |
@@ -3184,12 +3184,15 @@ ieee802_1x_kay_init(struct ieee802_1x_kay_ctx *ctx, enum macsec_policy policy,
|
|
|
b645d2 |
if (kay->l2_mka == NULL) {
|
|
|
b645d2 |
wpa_printf(MSG_WARNING,
|
|
|
b645d2 |
"KaY: Failed to initialize L2 packet processing for MKA packet");
|
|
|
b645d2 |
- ieee802_1x_kay_deinit(kay);
|
|
|
b645d2 |
- return NULL;
|
|
|
b645d2 |
+ goto error;
|
|
|
b645d2 |
}
|
|
|
b645d2 |
}
|
|
|
b645d2 |
|
|
|
b645d2 |
return kay;
|
|
|
b645d2 |
+
|
|
|
b645d2 |
+error:
|
|
|
b645d2 |
+ ieee802_1x_kay_deinit(kay);
|
|
|
b645d2 |
+ return NULL;
|
|
|
b645d2 |
}
|
|
|
b645d2 |
|
|
|
b645d2 |
|
|
|
b645d2 |
diff --git a/wpa_supplicant/wpas_kay.c b/wpa_supplicant/wpas_kay.c
|
|
|
b645d2 |
index d087e00ad..587e5c3dd 100644
|
|
|
b645d2 |
--- a/wpa_supplicant/wpas_kay.c
|
|
|
b645d2 |
+++ b/wpa_supplicant/wpas_kay.c
|
|
|
b645d2 |
@@ -235,10 +235,9 @@ int ieee802_1x_alloc_kay_sm(struct wpa_supplicant *wpa_s, struct wpa_ssid *ssid)
|
|
|
b645d2 |
res = ieee802_1x_kay_init(kay_ctx, policy, ssid->macsec_port,
|
|
|
b645d2 |
ssid->mka_priority, wpa_s->ifname,
|
|
|
b645d2 |
wpa_s->own_addr);
|
|
|
b645d2 |
- if (res == NULL) {
|
|
|
b645d2 |
- os_free(kay_ctx);
|
|
|
b645d2 |
+ /* ieee802_1x_kay_init() frees kay_ctx on failure */
|
|
|
b645d2 |
+ if (res == NULL)
|
|
|
b645d2 |
return -1;
|
|
|
b645d2 |
- }
|
|
|
b645d2 |
|
|
|
b645d2 |
wpa_s->kay = res;
|
|
|
b645d2 |
|
|
|
b645d2 |
--
|
|
|
b645d2 |
2.13.5
|
|
|
b645d2 |
|