Merge branch 'bugfix/roc_cancel_error_v6.0' into 'release/v6.0'

fix(esp_wifi): backport some fixes (v6.0)

See merge request espressif/esp-idf!45874

components/wpa_supplicant/esp_supplicant/src/esp_dpp.c

@@ -740,7 +740,10 @@ static int esp_supp_rx_action(uint8_t *hdr, uint8_t *payload, size_t len, uint8_
         rx_param->frm_len = len;
         os_memcpy(rx_param->action_frm, payload, len);
 
-        eloop_register_timeout(0, 0, esp_dpp_rx_action, rx_param, NULL);
+        if (eloop_register_timeout(0, 0, esp_dpp_rx_action, rx_param, NULL) != 0) {
+            os_free(rx_param);
+            return ESP_ERR_NO_MEM;
+        }
     }
 
     return ret;
@@ -768,26 +771,24 @@ static void esp_dpp_auth_resp_retry(void *eloop_ctx, void *timeout_ctx)
     esp_dpp_auth_resp_retry_timeout(NULL, NULL);
 }
 
-static void tx_status_handler(void *arg, esp_event_base_t event_base,
-                              int32_t event_id, void *event_data)
+static void tx_status_eloop_handler(void *eloop_ctx, void *event_data)
 {
     struct dpp_authentication *auth = s_dpp_ctx.dpp_auth;
-
     wifi_event_action_tx_status_t *evt = event_data;
 
+    if (!evt) {
+        return;
+    }
+
     wpa_printf(MSG_DEBUG, "Mgmt Tx Status - %d, Cookie - 0x%x",
                evt->status, (uint32_t)evt->context);
 
     if (evt->op_id != s_current_tx_op_id) {
         wpa_printf(MSG_DEBUG, "DPP: status not for recent frame op_id=%u, s_current_tx_op_id=%u",
                    evt->op_id, s_current_tx_op_id);
-        return;
-    }
-    if (!auth) {
+    } else if (!auth) {
         wpa_printf(MSG_DEBUG, "Auth already deinitialized, return");
-        return;
-    }
-    if (auth->waiting_auth_conf) {
+    } else if (auth->waiting_auth_conf) {
         eloop_cancel_timeout(esp_dpp_auth_resp_retry_timeout, NULL, NULL);
         if (evt->status == WIFI_ACTION_TX_FAILED) {
             /* failed to send auth response frame */
@@ -807,20 +808,51 @@ static void tx_status_handler(void *arg, esp_event_base_t event_base,
             eloop_register_timeout(ESP_GAS_TIMEOUT_SECS, 0, gas_query_timeout, NULL, auth);
         }
     }
+    os_free(evt);
+}
+
+static void tx_status_handler(void *arg, esp_event_base_t event_base,
+                              int32_t event_id, void *event_data)
+{
+    wifi_event_action_tx_status_t *evt_c = os_malloc(sizeof(*evt_c));
+    if (evt_c) {
+        os_memcpy(evt_c, event_data, sizeof(*evt_c));
+        if (eloop_register_timeout(0, 0, tx_status_eloop_handler, NULL, evt_c) < 0) {
+            os_free(evt_c);
+        }
+    } else {
+        wpa_printf(MSG_ERROR, "DPP: Failed to allocate memory for TX status");
+    }
+}
+
+static void roc_status_eloop_handler(void *eloop_ctx, void *event_data)
+{
+    wifi_event_roc_done_t *evt = (wifi_event_roc_done_t *)event_data;
+
+    if (evt) {
+        if (evt->context == (uint32_t)s_action_rx_cb) {
+            eloop_cancel_timeout(dpp_listen_next_channel, NULL, NULL);
+            eloop_register_timeout(0, 0, dpp_listen_next_channel, NULL, NULL);
+        }
+        os_free(evt);
+    }
+
+    atomic_store(&roc_in_progress, false);
+    os_event_group_set_bits(s_dpp_event_group, DPP_ROC_EVENT_HANDLED);
 }
 
 static void roc_status_handler(void *arg, esp_event_base_t event_base,
                                int32_t event_id, void *event_data)
 {
-    wifi_event_roc_done_t *evt = (wifi_event_roc_done_t *)event_data;
-
-    if (evt->context == (uint32_t)s_action_rx_cb) {
-        eloop_cancel_timeout(dpp_listen_next_channel, NULL, NULL);
-        eloop_register_timeout(0, 0, dpp_listen_next_channel, NULL, NULL);
+    wifi_event_roc_done_t *evt_c = os_malloc(sizeof(*evt_c));
+    if (evt_c) {
+        os_memcpy(evt_c, event_data, sizeof(*evt_c));
+        if (eloop_register_timeout(0, 0, roc_status_eloop_handler, NULL, evt_c) < 0) {
+            os_free(evt_c);
+        }
+    } else {
+        wpa_printf(MSG_ERROR, "DPP: Failed to allocate memory for ROC status");
     }
-
-    atomic_store(&roc_in_progress, false);
-    os_event_group_set_bits(s_dpp_event_group, DPP_ROC_EVENT_HANDLED);
 }
 
 static char *esp_dpp_parse_chan_list(const char *chan_list)

components/wpa_supplicant/esp_supplicant/src/esp_hostap.c

@@ -546,7 +546,10 @@ bool wpa_ap_remove(u8* bssid)
             return false;
         }
         os_memcpy(addr, sta->addr, ETH_ALEN);
-        eloop_register_timeout(0, 10000, ap_free_sta_timeout, hapd, addr);
+        if (eloop_register_timeout(0, 10000, ap_free_sta_timeout, hapd, addr) != 0) {
+            os_free(addr);
+            return false;
+        }
     } else
 #endif
         ap_free_sta(hapd, sta);

components/wpa_supplicant/port/eloop.c

@@ -169,7 +169,7 @@ overflow:
                "ELOOP: Too long timeout (secs=%u usecs=%u) to ever happen - ignore it",
                secs, usecs);
     os_free(timeout);
-    return 0;
+    return -1;
 }
 
 #ifdef ELOOP_DEBUG
@@ -526,6 +526,9 @@ void eloop_destroy(void)
                    sec, usec, timeout->eloop_data, timeout->user_data,
                    timeout->handler);
 #endif
+        if (timeout->handler) {
+            timeout->handler(timeout->eloop_data, timeout->user_data);
+        }
         eloop_remove_timeout(timeout);
     }
     if (eloop_data_lock) {