endless loop while PTKCALCNEGOTIATING

[Gunter Burchardt]

Hi

Im using hostapd with driver madwifi and wpa-enterprice (eap-tls)
(TKIP).

I had some cases hostapd got into an endless loop! I used strace to
find the place in source:

    for (;;) {
        if (sm->sta->wpa_key_mgmt == WPA_KEY_MGMT_PSK) {
            pmk = hostapd_get_psk(sm->hapd->conf, sm->sta->addr,
                          pmk);
            if (pmk == NULL)
                break;
        } else
            pmk = sm->PMK;

        wpa_pmk_to_ptk(sm->hapd, pmk, sm->hapd->own_addr,
                   sm->sta->addr, sm->ANonce, sm->SNonce,
                   (u8 *) &PTK, sizeof(PTK));

        if (wpa_verify_key_mic(&PTK, sm->last_rx_eapol_key,
                       sm->last_rx_eapol_key_len) == 0) {
            ok = 1;
            break;
        }

        if (sm->sta->wpa_key_mgmt != WPA_KEY_MGMT_PSK)
            break;
    }

There seems to be a state where no break matches in this endless loop.
I will report this bug in bugzilla.

regards
gunter