Re: [PATCH] Fix the crash issue when restarting the wpa_supplicant or wifi driver while BackgroundScanning is enable

Chen:

I have been working towards integrating support for connman into Matter =
<https://github.com/project-chip/connectedhomeip>.

In the process of doing so, I have found myself doing many cycles of =
=E2=80=98connmanctl disable wifi; sleep 1; connmanctl enable wifi=E2=80=99=
 while Ethernet is enabled and connected while logged in over a ssh =
session.

In about 50% of those cases, command crashes.

With the latest instance of your patch in place against =
wpa_supplicant-2.11:

diff --git a/plugins/wifi.c b/plugins/wifi.c
index 12389fa6..191c4fa0 100644
--- a/plugins/wifi.c
+++ b/plugins/wifi.c
@@ -1999,13 +1999,25 @@ static int wifi_scan(struct connman_device =
*device,
 		}
 	}
=20
+	/*
+	 * If BackgroundScanning is enable, passive auto scanning =
timeout work need to
+	 * be removed when a new active scanning is triggered.Because =
wifi->autoscan
+	 * and auto scanning timeout work will be receated for new =
active scanning, but
+	 * old passive auto scanning timeout work is still running, if =
wifi firmware or
+	 * wpa_supplicant is restarted at some time in the future, old =
wifi and autoscan
+	 * objects pointers will be freed, so wifi and wifi->autoscan =
objects pointers will
+	 * be dangling pointers when the timeout handler function of old =
passive scanning
+	 * work will obtain wifi and wifi->autoscan objects, it will =
trigger a crash of connman.
+	 */
+	if (connman_setting_get_bool("BackgroundScanning") ||
+			wifi->scanning_type !=3D WIFI_SCANNING_PASSIVE) =
{
+		connman_device_ref(device);
+		reset_autoscan(device);
+	}
+
 	/* Distinguish between devices performing passive and active =
scanning */
 	wifi_update_scanner_type(wifi, WIFI_SCANNING_ACTIVE);
=20
-	connman_device_ref(device);
-
-	reset_autoscan(device);
-
 	ret =3D g_supplicant_interface_scan(wifi->interface, =
scan_params,
 						scan_callback, device);
 	if (ret =3D=3D 0) {

the following two tests pass:

    for i in `seq 1 100`; do
        echo "Running test ${i}=E2=80=A6"
        connmanctl disable wifi
        sleep 5
        connmanctl enable wifi
        sleep 2
        connmanctl scan wifi
        sleep 1; ps ax | grep connmand
    done

    for i in `seq 1 100`; do
        echo "Running test ${i}=E2=80=A6"
        connmanctl disable wifi
        sleep 1
        connmanctl enable wifi
        sleep 1
        ps ax | grep connmand
    done

So, I would say that this patch is quite effective and worth of =
upstreaming. Can you resubmit it against top-of-tree using =
git-send-email?

Best,

Grant Erickson

--=20
Principal
Nuovations

[email protected]
https://www.nuovations.com/

On Dec 18, 2025, at 1:48=E2=80=AFAM, Chen Yaming (BSH GDE-EDSCD) =
<[email protected]> wrote:
> Hello Michael:
>            Thank you for your reminder. I did overlook the importance =
of device ->refcount before, now I have modified the code again and =
generated a new patch. Please check the attachment.
>           In this modification, I moved both connman_device_ref and =
reset_autoscan ahead of wifi_update_scanner_type to ensure that the old =
auto scan task was removed before the new auto scan task was =
initialized. However, when background scanning was not enabled and the =
new active scanning task was about to replace the old passive scanning =
task, I skipped connman_device_ref and reset_autoscan functions because =
I noticed that setup_autoscan would not create autoscan objects and =
tasks for passive scanning without background scanning enabled, if =
connman_device_ref and reset_autoscan are executed, it will cause the =
device ->refcount to increase inefficiently. What is your opinion?
>           I have done test in several scenarios for this modification, =
such as staying idle and restarting wpa_supplicant when wifi was =
disconnected, connected and factory reset states , to ensure that no =
crashes occurred and to monitor the device ->refcount value in real-time =
to prevent leakage or ineffective increase.
>             Best regards!!
>=20
>=20
> Yaming Chen
> Senior Engineer GDE-EDSCD
>=20
> [email protected]; www.bsh-group.cn