From b1523e9133b4b54665d36df43383202b829ff2e2 Mon Sep 17 00:00:00 2001 From: yinqingzhao Date: Fri, 26 Dec 2025 12:33:44 +0800 Subject: [PATCH] fix(wpa_supplicant): fix race where STA is freed before WPA3 SAE finishes --- components/wpa_supplicant/src/ap/sta_info.c | 7 +++---- 1 file changed, 3 insertions(+), 4 deletions(-) diff --git a/components/wpa_supplicant/src/ap/sta_info.c b/components/wpa_supplicant/src/ap/sta_info.c index 0894486373..28daefb547 100644 --- a/components/wpa_supplicant/src/ap/sta_info.c +++ b/components/wpa_supplicant/src/ap/sta_info.c @@ -173,15 +173,14 @@ struct sta_info * ap_sta_add(struct hostapd_data *hapd, const u8 *addr) /* initialize STA info data */ os_memcpy(sta->addr, addr, ETH_ALEN); sta->next = hapd->sta_list; - hapd->sta_list = sta; - hapd->num_sta++; - ap_sta_hash_add(hapd, sta); #ifdef CONFIG_SAE sta->sae_commit_processing = false; sta->remove_pending = false; sta->lock = os_semphr_create(1, 1); #endif /* CONFIG_SAE */ - + hapd->sta_list = sta; + hapd->num_sta++; + ap_sta_hash_add(hapd, sta); return sta; }