From 959c4c2055a5d5e89c1ed93961dcbd97a358769c Mon Sep 17 00:00:00 2001 From: Sarvesh Bodakhe Date: Wed, 4 Mar 2026 22:46:04 +0530 Subject: [PATCH] fix(wpa_supplicant): fix memory leak on SAE commit queue post failure In auth_sae_queue(), when wpa3_hostap_post_evt() fails, the queued entry was left on the list and never freed. This leaks memory under SAE commit floods or when the event queue is full. Free the entry and remove it from the list on post failure. --- components/wpa_supplicant/src/ap/ieee802_11.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/wpa_supplicant/src/ap/ieee802_11.c b/components/wpa_supplicant/src/ap/ieee802_11.c index aa9307c0ccb..786987eb80f 100644 --- a/components/wpa_supplicant/src/ap/ieee802_11.c +++ b/components/wpa_supplicant/src/ap/ieee802_11.c @@ -730,6 +730,8 @@ queued: /* posting event to the task to handle commit */ if (wpa3_hostap_post_evt(SIG_WPA3_RX_COMMIT, 0) != 0) { wpa_printf(MSG_ERROR, "failed to queue commit build event"); + dl_list_del(&q->list); + os_free(q); return -1; } return 0;