[PATCH] macsec_linux: Don't send NULL pointer to rtnl_link_delete

Andreas Westin andrwe at axis.com
Thu May 7 01:57:24 PDT 2026


If rtnl_link_add fails hostapd will still set created_link to true
and also if rtnl_link_macsec_alloc fails the link pointer will be NULL
and this is passed to rtnl_link_delete which crashes.

Signed-off-by: Andreas Westin <andrwe at axis.com>
---
  src/drivers/driver_macsec_linux.c | 7 +++++++
  1 file changed, 7 insertions(+)

diff --git a/src/drivers/driver_macsec_linux.c 
b/src/drivers/driver_macsec_linux.c
index fad47a292..57bea3b42 100644
--- a/src/drivers/driver_macsec_linux.c
+++ b/src/drivers/driver_macsec_linux.c
@@ -1200,6 +1200,7 @@ static int macsec_drv_create_transmit_sc(
                 rtnl_link_put(link);
                 wpa_printf(MSG_ERROR, DRV_PREFIX "couldn't create link: 
err %d",
                            err);
+               drv->created_link = false;
                 return err;
         }

@@ -1223,6 +1224,7 @@ static int macsec_drv_create_transmit_sc(
         drv->link = rtnl_link_macsec_alloc();
         if (!drv->link) {
                 wpa_printf(MSG_ERROR, DRV_PREFIX "couldn't allocate link");
+               drv->created_link = false;
                 return -1;
         }

@@ -1259,6 +1261,11 @@ static int macsec_drv_delete_transmit_sc(void 
*priv, struct transmit_sc *sc)
                 return 0;
         }

+       if (!drv->link) {
+               wpa_printf(MSG_ERROR, DRV_PREFIX "no link to delete");
+               return -1;
+       }
+
         err = rtnl_link_delete(drv->sk, drv->link);
         if (err < 0)
                 wpa_printf(MSG_ERROR, DRV_PREFIX "couldn't delete link");

---

Best regards,
-- 
Andreas Westin <andrwe at axis.com>



More information about the Hostap mailing list