wpabuf overflow with WPS

[Xue Liu]

Hello,

I use  trunk for  board. I would like to add WPS to it. The Clearfog 
board is working as Access Point enabling WPA2-PSK and WPS Push Button. 
The hostapd is started from shell with -dd and the configuration file 
from 
https://wireless.wiki.kernel.org/en/users/drivers/ath10k/configuration . 
After the AP started, I enable the WPS by|
|

hostapd_cli wps_pbc

and also in my Nexus 9 tablet.

And the output show as

root at OpenWrt:~# hostapd -dd hostapd.cfg
Configuration file: hostapd.cfg
[ 2795.008571] IPv6: ADDRCONF(NETDEV_UP): wlan0: link is not ready
[ 2795.016774] device wlan0 entered promiscuous mode
wlan0: interface state UNINITIALIZED->COUNTRY_UPDATE
ACS: Automatic channel selection started, this may take a bit
wlan0: interface state COUNTRY_UPDATE->ACS
wlan0: ACS-STARTED
wlan0: ACS-COMPLETED freq=5580 channel=116
wlan0: interface state ACS->HT_SCAN
wlan0: interface state HT_SCAN->DFS
wlan0: DFS-CAC-START freq=5580 chan=116 sec_chan=1, width=1, seg0=122, 
seg1=0, cac_time=60s
wlan0: DFS-CAC-COMPLETED success=1 freq=5580 ht_enabled=0 chan_offset=0 
chan_width=3 cf1=5610 cf2=0
Using interface wlan0 with hwaddr 04:f0:21:1c:99:d9 and ssid "ath10k"
[ 2869.647294] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready
[ 2869.653769] br-lan: port 3(wlan0) entered forwarding state
[ 2869.659286] br-lan: port 3(wlan0) entered forwarding state
wlan0: interface state DFS->ENABLED
wlan0: AP-ENABLED
[ 2871.651557] br-lan: port 3(wlan0) entered forwarding state
wlan0: WPS-PBC-ACTIVE
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.11: authentication OK (open system)
wlan0: STA b4:ce:f6:09:a7:b6 MLME: 
MLME-AUTHENTICATE.indication(b4:ce:f6:09:a7:b6, OPEN_SYSTEM)
wlan0: STA b4:ce:f6:09:a7:b6 MLME: 
MLME-DELETEKEYS.request(b4:ce:f6:09:a7:b6)
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.11: authenticated
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.11: association OK (aid 1)
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.11: associated (aid 1)
wlan0: STA b4:ce:f6:09:a7:b6 MLME: 
MLME-ASSOCIATE.indication(b4:ce:f6:09:a7:b6)
wlan0: STA b4:ce:f6:09:a7:b6 MLME: 
MLME-DELETEKEYS.request(b4:ce:f6:09:a7:b6)
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.11: binding station to interface 
'wlan0'
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: start authentication
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: unauthorizing port
wlan0: CTRL-EVENT-EAP-STARTED b4:ce:f6:09:a7:b6
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=0 method=1
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: Sending EAP Packet (identifier 1)
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: received EAP packet (code=2 
id=1 len=34) from STA: EAP Response-Identity (1)
wlan0: CTRL-EVENT-EAP-PROPOSED-METHOD vendor=14122 method=254
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: Sending EAP Packet (identifier 2)
wlan0: STA b4:ce:f6:09:a7:b6 IEEE 802.1X: received EAP packet (code=2 
id=2 len=408) from STA: EAP Response-expanded (254)
wpabuf 0x71e1c0 (size=192 used=194) overflow len=2
Aborted

Any ideas about it ?