From: Daniel Drake <ddrake@brontes3d.com>
Date: Mon, 3 Sep 2007 22:29:35 +0000 (-0700)
Subject: Fix wpa_cli disconnect/reassociate race
X-Git-Url: http://hostap.epitest.fi/gitweb/gitweb.cgi?p=hostap.git;a=commitdiff_plain;h=ccd15740e11aad01b480d119e0620f355a1364ad

Fix wpa_cli disconnect/reassociate race

It's possible to trigger a race with the following steps:

 1. start wpa_supplicant and wait for it to complete association
 2. run "wpa_cli disconnect" and wait for it to disconnect
 3. run "wpa_cli reassociate; wpa_cli disconnect"

At this point, wpa_cli will complete reassociation, effectively ignoring the
final disconnect command.

The reason behind this is that the reassociate command has already triggered
a scan before the disconnect command is processed. The disconnect command
puts the interface into disconnected state, but then the scan results come in
wpa_supplicant processes the results regardless, and decides to associate to
one of the networks.
---

diff --git a/wpa_supplicant/ctrl_iface.c b/wpa_supplicant/ctrl_iface.c
index ae17511..a1e63bc 100644
--- a/wpa_supplicant/ctrl_iface.c
+++ b/wpa_supplicant/ctrl_iface.c
@@ -1263,6 +1263,7 @@ char * wpa_supplicant_ctrl_iface_process(struct wpa_supplicant *wpa_s,
 		reply_len = wpa_supplicant_ctrl_iface_list_networks(
 			wpa_s, reply, reply_size);
 	} else if (os_strcmp(buf, "DISCONNECT") == 0) {
+		wpa_s->reassociate = 0;
 		wpa_s->disconnected = 1;
 		wpa_supplicant_disassociate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
 	} else if (os_strcmp(buf, "SCAN") == 0) {
diff --git a/wpa_supplicant/events.c b/wpa_supplicant/events.c
index 3782c58..f59b2a2 100644
--- a/wpa_supplicant/events.c
+++ b/wpa_supplicant/events.c
@@ -520,7 +520,7 @@ static void wpa_supplicant_event_scan_results(struct wpa_supplicant *wpa_s)
 
 	wpa_supplicant_dbus_notify_scan_results(wpa_s);
 
-	if (wpa_s->conf->ap_scan == 2)
+	if (wpa_s->conf->ap_scan == 2 || wpa_s->disconnected)
 		return;
 	results = wpa_s->scan_results;
 	num = wpa_s->num_scan_results;