Re: [PATCH] wifi:Fix the crash issue when restarting the wpa_supplicant or wifi driver while BackgroundScanning is enable

Hi

Some nit, try to reduce the subject of the patch to < 80 chars, for
rendering problem

On Wed, Jan 14, 2026 at 9:07=E2=80=AFAM yaming.chen <[email protected]> =
wrote:
>
> If BackgroundScanning is enable, passive auto scanning timeout work need =
to
> be removed when a new active scanning is triggered.Because wifi->autoscan
> and auto scanning timeout work will be receated for new active scanning, =
but
> old passive auto scanning timeout work is still running, if wifi firmware=
 or
> wpa_supplicant is restarted at some time in the future, old wifi and auto=
scan
> objects pointers will be freed, so wifi and wifi->autoscan objects pointe=
rs will
> be dangling pointers when the timeout handler function of old passive sca=
nning
> work will obtain wifi and wifi->autoscan objects, it will trigger a crash=
 of connman.
> ---
>  plugins/wifi.c | 20 ++++++++++++++++----
>  1 file changed, 16 insertions(+), 4 deletions(-)
>

Reviewed-by: Michael Trimarchi <[email protected]>

> diff --git a/plugins/wifi.c b/plugins/wifi.c
> index 12389fa6..191c4fa0 100644
> --- a/plugins/wifi.c
> +++ b/plugins/wifi.c
> @@ -1999,13 +1999,25 @@ static int wifi_scan(struct connman_device *devic=
e,
>                 }
>         }
>
> +       /*
> +        * If BackgroundScanning is enable, passive auto scanning timeout=
 work need to
> +        * be removed when a new active scanning is triggered.Because wif=
i->autoscan
> +        * and auto scanning timeout work will be receated for new active=
 scanning, but
> +        * old passive auto scanning timeout work is still running, if wi=
fi firmware or
> +        * wpa_supplicant is restarted at some time in the future, old wi=
fi and autoscan
> +        * objects pointers will be freed, so wifi and wifi->autoscan obj=
ects pointers will
> +        * be dangling pointers when the timeout handler function of old =
passive scanning
> +        * work will obtain wifi and wifi->autoscan objects, it will trig=
ger a crash of connman.
> +        */
> +       if (connman_setting_get_bool("BackgroundScanning") ||
> +                       wifi->scanning_type !=3D WIFI_SCANNING_PASSIVE) {
> +               connman_device_ref(device);
> +               reset_autoscan(device);
> +       }
> +
>         /* Distinguish between devices performing passive and active scan=
ning */
>         wifi_update_scanner_type(wifi, WIFI_SCANNING_ACTIVE);
>
> -       connman_device_ref(device);
> -
> -       reset_autoscan(device);
> -
>         ret =3D g_supplicant_interface_scan(wifi->interface, scan_params,
>                                                 scan_callback, device);
>         if (ret =3D=3D 0) {
> --
> 2.34.1
>


--=20
Michael Nazzareno Trimarchi
Co-Founder & Chief Executive Officer
M. +39 347 913 2170
[email protected]
__________________________________

Amarula Solutions BV
Joop Geesinkweg 125, 1114 AB, Amsterdam, NL
T. +31 (0)85 111 9172
[email protected]
www.amarulasolutions.com