From 9f1ff8afa368577763084890fb8d58dd2e732ccc Mon Sep 17 00:00:00 2001 From: Sarvesh Bodakhe Date: Wed, 4 Mar 2026 22:46:04 +0530 Subject: [PATCH] fix(wpa_supplicant): fix memory leak on SAE commit queue post failure In auth_sae_queue(), when wpa3_hostap_post_evt() fails, the queued entry was left on the list and never freed. This leaks memory under SAE commit floods or when the event queue is full. Free the entry and remove it from the list on post failure. --- components/wpa_supplicant/src/ap/ieee802_11.c | 2 ++ 1 file changed, 2 insertions(+) diff --git a/components/wpa_supplicant/src/ap/ieee802_11.c b/components/wpa_supplicant/src/ap/ieee802_11.c index aa9307c0cc..786987eb80 100644 --- a/components/wpa_supplicant/src/ap/ieee802_11.c +++ b/components/wpa_supplicant/src/ap/ieee802_11.c @@ -730,6 +730,8 @@ queued: /* posting event to the task to handle commit */ if (wpa3_hostap_post_evt(SIG_WPA3_RX_COMMIT, 0) != 0) { wpa_printf(MSG_ERROR, "failed to queue commit build event"); + dl_list_del(&q->list); + os_free(q); return -1; } return 0;