From 1a040ee3575e8146cffb0b7b3cf46aa16e63166f Mon Sep 17 00:00:00 2001
From: Shreyas Sheth <shreyas.sheth@espressif.com>
Date: Mon, 27 Oct 2025 17:08:18 +0530
Subject: [PATCH] fix(esp_wifi): Fix memory leak caused due to eloop

- Fix memory leak when eloop timer is in eloop queue and esp_wifi_deinit is
called
- Return error on long timeout
- Fix memory leak when register timeout returns error
---
 components/wpa_supplicant/esp_supplicant/src/esp_hostap.c | 5 ++++-
 components/wpa_supplicant/port/eloop.c                    | 5 ++++-
 2 files changed, 8 insertions(+), 2 deletions(-)

diff --git a/components/wpa_supplicant/esp_supplicant/src/esp_hostap.c b/components/wpa_supplicant/esp_supplicant/src/esp_hostap.c
index 39c4c080d6..fd199f44f7 100644
--- a/components/wpa_supplicant/esp_supplicant/src/esp_hostap.c
+++ b/components/wpa_supplicant/esp_supplicant/src/esp_hostap.c
@@ -498,7 +498,10 @@ bool wpa_ap_remove(u8* bssid)
             return false;
         }
         os_memcpy(addr, sta->addr, ETH_ALEN);
-        eloop_register_timeout(0, 10000, ap_free_sta_timeout, hapd, addr);
+        if (eloop_register_timeout(0, 10000, ap_free_sta_timeout, hapd, addr) != 0) {
+            os_free(addr);
+            return false;
+        }
     } else
 #endif
         ap_free_sta(hapd, sta);
diff --git a/components/wpa_supplicant/port/eloop.c b/components/wpa_supplicant/port/eloop.c
index 0369dbe586..a745d9332e 100644
--- a/components/wpa_supplicant/port/eloop.c
+++ b/components/wpa_supplicant/port/eloop.c
@@ -156,7 +156,7 @@ overflow:
                "ELOOP: Too long timeout (secs=%u usecs=%u) to ever happen - ignore it",
                secs, usecs);
     os_free(timeout);
-    return 0;
+    return -1;
 }
 
 static bool timeout_exists(struct eloop_timeout *old)
@@ -398,6 +398,9 @@ void eloop_destroy(void)
                    "eloop_data=%p user_data=%p handler=%p",
                    sec, usec, timeout->eloop_data, timeout->user_data,
                    timeout->handler);
+        if (timeout->handler) {
+            timeout->handler(timeout->eloop_data, timeout->user_data);
+        }
         eloop_remove_timeout(timeout);
     }
     if (eloop_data_lock) {