diff --git a/components/wpa_supplicant/port/eloop.c b/components/wpa_supplicant/port/eloop.c index 37ce1a5c4a..9e149d599a 100644 --- a/components/wpa_supplicant/port/eloop.c +++ b/components/wpa_supplicant/port/eloop.c @@ -140,16 +140,31 @@ overflow: return 0; } +static bool timeout_exists(struct eloop_timeout *old) +{ + struct eloop_timeout *timeout, *prev; + dl_list_for_each_safe(timeout, prev, &eloop.timeout, + struct eloop_timeout, list) { + if (old == timeout) + return true; + } + + return false; +} static void eloop_remove_timeout(struct eloop_timeout *timeout) { + bool timeout_present = false; ELOOP_LOCK(); - dl_list_del(&timeout->list); + /* Make sure timeout still exists(Another context may have deleted this) */ + timeout_present = timeout_exists(timeout); + if (timeout_present) + dl_list_del(&timeout->list); ELOOP_UNLOCK(); - os_free(timeout); + if (timeout_present) + os_free(timeout); } - #ifdef ELOOP_DEBUG int eloop_cancel_timeout_debug(eloop_timeout_handler handler, void *eloop_data, void *user_data, const char *func, int line)