From d6c5598e2ff78e2ae18656ace00a7c84f6ee74f6 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Fri, 18 Sep 2026 00:27:24 +0200 Subject: [PATCH] hostapd: fix NULL pointer dereference in APuP beacon handling apup_process_beacon() dereferenced the return value of ap_sta_add() without checking it. ap_sta_add() returns NULL when the station table is full, when the allocation fails or when accounting_sta_get_id() fails, so the following read of sta_ret->aid dereferences NULL. The station table filling up is remotely triggerable. Beacons reach handle_beacon() on every softmac driver, because hostapd subscribes to them per wiphy with NL80211_CMD_REGISTER_BEACONS when it starts the AP. An adjacent station can therefore beacon the target's SSID from successive spoofed BSSIDs, each of which is added as an APuP peer, until max_num_sta is reached and hostapd crashes. CONFIG_APUP=y is set unconditionally in DRIVER_MAKEOPTS, so the code is compiled into every wpad variant, but the call is gated on hapd->conf->apup at runtime and wifi-scripts defaults apup to 0. Only configurations that opt into APuP are affected. Reported-by: JuliusBairaktaris Fixes: e80520197c9c ("hostapd: Add support for APuP") Assisted-by: Claude:claude-opus-5 Link: https://github.com/openwrt/openwrt/pull/25242 Signed-off-by: Hauke Mehrtens --- .../780-Implement-APuP-Access-Point-Micro-Peering.patch | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch b/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch index 362d7f4e428..fbed196c475 100644 --- a/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch +++ b/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch @@ -164,7 +164,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6 int hostapd_sta_add(struct hostapd_data *hapd, --- /dev/null +++ b/src/ap/apup.c -@@ -0,0 +1,169 @@ +@@ -0,0 +1,175 @@ +/* + * hostapd / APuP Access Point Micro Peering + * @@ -219,6 +219,12 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6 + return; + + sta_ret = ap_sta_add(hapd, mgmt->bssid); ++ if (!sta_ret) ++ { ++ wpa_printf(MSG_INFO, ++ "apup_process_beacon(...) Failed to add APuP peer"); ++ return; ++ } + + /* TODO: this has been added just to making compiler happy after breaking + * changes introduced in 11a607d12 and 7855b6d60 to support