Merge branch 'bugfix/wpa3_sta_lock_crash_v5.2' into 'release/v5.2'

fix(wifi): Fix wpa3 crash for station added without sta lock (v5.2)

See merge request espressif/esp-idf!29211

components/esp_wifi/lib

@@ -1 +1 @@
-Subproject commit 1334b6d87456cd999e713e645e5dcdc10c527efb
+Subproject commit ca06494db941947214367a95c062805383d6bf74

components/wpa_supplicant/esp_supplicant/src/esp_hostap.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2022 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -59,10 +59,7 @@ void *hostap_init(void)
     auth_conf = (struct wpa_auth_config *)os_zalloc(sizeof(struct  wpa_auth_config));
 
     if (auth_conf == NULL) {
-        os_free(hapd->conf);
+        goto fail;
-        os_free(hapd);
-        hapd = NULL;
-        return NULL;
     }
 
     hapd->conf->sae_pwe = esp_wifi_get_config_sae_pwe_h2e_internal(WIFI_IF_AP);
@@ -145,23 +142,14 @@ void *hostap_init(void)
     hapd->conf->wpa_key_mgmt = auth_conf->wpa_key_mgmt;
     hapd->conf->ssid.wpa_passphrase = (char *)os_zalloc(WIFI_PASSWORD_LEN_MAX);
     if (hapd->conf->ssid.wpa_passphrase == NULL) {
-        os_free(auth_conf);
+        goto fail;
-        os_free(hapd->conf);
-        os_free(hapd);
-        hapd = NULL;
-        return NULL;
     }
 
 #ifdef CONFIG_SAE
     if (authmode == WIFI_AUTH_WPA3_PSK ||
         authmode == WIFI_AUTH_WPA2_WPA3_PSK) {
         if (wpa3_hostap_auth_init(hapd) != 0) {
-            os_free(hapd->conf->ssid.wpa_passphrase);
+            goto fail;
-            os_free(auth_conf);
-            os_free(hapd->conf);
-            os_free(hapd);
-            hapd = NULL;
-            return NULL;
         }
     }
 #endif /* CONFIG_SAE */
@@ -176,11 +164,26 @@ void *hostap_init(void)
     esp_wifi_get_macaddr_internal(WIFI_IF_AP, hapd->own_addr);
 
     hapd->wpa_auth = wpa_init(hapd->own_addr, auth_conf, NULL);
+    if (hapd->wpa_auth == NULL) {
+        goto fail;
+    }
+
     esp_wifi_set_appie_internal(WIFI_APPIE_WPA, hapd->wpa_auth->wpa_ie, (uint16_t)hapd->wpa_auth->wpa_ie_len, 0);
     os_free(auth_conf);
     global_hapd = hapd;
 
     return (void *)hapd;
+fail:
+    if (hapd->conf->ssid.wpa_passphrase != NULL) {
+        os_free(hapd->conf->ssid.wpa_passphrase);
+    }
+    if (auth_conf != NULL) {
+        os_free(auth_conf);
+    }
+    os_free(hapd->conf);
+    os_free(hapd);
+    hapd = NULL;
+    return NULL;
 }
 
 void hostapd_cleanup(struct hostapd_data *hapd)

components/wpa_supplicant/esp_supplicant/src/esp_wpa3.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -421,10 +421,6 @@ static void wpa3_process_rx_commit(wpa3_hostap_auth_event_t *evt)
         }
     }
 
-    if (!sta->lock) {
-        sta->lock = os_semphr_create(1, 1);
-    }
-
     if (sta->lock && os_semphr_take(sta->lock, 0)) {
         sta->sae_commit_processing = true;
         ret = handle_auth_sae(hapd, sta, frm->msg, frm->len, frm->bssid, frm->auth_transaction, frm->status);

components/wpa_supplicant/esp_supplicant/src/esp_wpa_main.c

@@ -1,5 +1,5 @@
 /*
- * SPDX-FileCopyrightText: 2019-2023 Espressif Systems (Shanghai) CO LTD
+ * SPDX-FileCopyrightText: 2019-2024 Espressif Systems (Shanghai) CO LTD
  *
  * SPDX-License-Identifier: Apache-2.0
  */
@@ -314,52 +314,66 @@ static bool hostap_sta_join(void **sta, u8 *bssid, u8 *wpa_ie, u8 wpa_ie_len,u8
         goto fail;
     }
 
-    if (*sta && !esp_wifi_ap_is_sta_sae_reauth_node(bssid)) {
+    if (*sta) {
-        ap_free_sta(hapd, *sta);
+        struct sta_info *old_sta = *sta;
-    }
-
-    sta_info = ap_sta_add(hapd, bssid);
-    if (!sta_info) {
-        wpa_printf(MSG_ERROR, "failed to add station " MACSTR, MAC2STR(bssid));
-        goto fail;
-    }
-
 #ifdef CONFIG_SAE
-    if (sta_info->lock && os_semphr_take(sta_info->lock, 0) != TRUE) {
+        if (old_sta->lock && os_semphr_take(old_sta->lock, 0) != TRUE) {
-        wpa_printf(MSG_INFO, "Ignore assoc request as softap is busy with sae calculation for station "MACSTR, MAC2STR(bssid));
+            wpa_printf(MSG_INFO, "Ignore assoc request as softap is busy with sae calculation for station "MACSTR, MAC2STR(bssid));
-        if (esp_send_assoc_resp(hapd, sta_info, bssid, WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY, rsnxe ? false : true, subtype) != WLAN_STATUS_SUCCESS) {
+            if (esp_send_assoc_resp(hapd, old_sta, bssid, WLAN_STATUS_ASSOC_REJECTED_TEMPORARILY, rsnxe ? false : true, subtype) != WLAN_STATUS_SUCCESS) {
+                goto fail;
+            }
+            return false;
+        }
+#endif /* CONFIG_SAE */
+        if (!esp_wifi_ap_is_sta_sae_reauth_node(bssid)) {
+            ap_free_sta(hapd, old_sta);
+        }
+    }
+
+    sta_info = ap_get_sta(hapd, bssid);
+    if (!sta_info) {
+        sta_info = ap_sta_add(hapd,bssid);
+        if (!sta_info) {
+            wpa_printf(MSG_ERROR, "failed to add station " MACSTR, MAC2STR(bssid));
             goto fail;
         }
-        return false;
+#ifdef CONFIG_SAE
-    }
+        if (sta_info->lock) {
+            os_semphr_take(sta_info->lock, 0);
+        }
 #endif /* CONFIG_SAE */
+    }
 
 #ifdef CONFIG_WPS_REGISTRAR
     if (check_n_add_wps_sta(hapd, sta_info, wpa_ie, wpa_ie_len, pmf_enable, subtype) == 0) {
         if (sta_info->eapol_sm) {
-            *sta = sta_info;
+            goto done;
-#ifdef CONFIG_SAE
-            if (sta_info->lock) {
-                os_semphr_give(sta_info->lock);
-            }
-#endif /* CONFIG_SAE */
-            return true;
         }
     } else {
         goto fail;
     }
 #endif
     if (wpa_ap_join(sta_info, bssid, wpa_ie, wpa_ie_len, rsnxe, rsnxe_len, pmf_enable, subtype)) {
-        *sta = sta_info;
+        goto done;
-#ifdef CONFIG_SAE
+    } else {
-        if (sta_info->lock) {
+        goto fail;
-            os_semphr_give(sta_info->lock);
-        }
-#endif /* CONFIG_SAE */
-        return true;
     }
+done:
+    *sta = sta_info;
+#ifdef CONFIG_SAE
+    if (sta_info->lock) {
+        os_semphr_give(sta_info->lock);
+    }
+#endif /* CONFIG_SAE */
+    return true;
 
 fail:
+
+#ifdef CONFIG_SAE
+    if (sta_info && sta_info->lock) {
+        os_semphr_give(sta_info->lock);
+    }
+#endif /* CONFIG_SAE */
     esp_wifi_ap_deauth_internal(bssid, WLAN_REASON_PREV_AUTH_NOT_VALID);
     return false;
 }

components/wpa_supplicant/src/ap/sta_info.c

@@ -175,6 +175,7 @@ struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr)
 #ifdef CONFIG_SAE
 	sta->sae_commit_processing = false;
 	sta->remove_pending = false;
+	sta->lock = os_semphr_create(1, 1);
 #endif /* CONFIG_SAE */
 
 	return sta;