DPP: Stop Action frame sequence on DPP_STOP_LISTEN and PKEX failure

Previously it was possible for the PKEX/DPP exchange to terminate with
an error and the ongoing Action frame TX/RX offchannel operation not
getting terminated. This could leave the driver waiting on offchannel
until timeout and failing following operations before that timeout
happens. Fix this by explicitly stopping the Action frame sequence in
the driver in the previously missed cases.

This fixes a case that was showing up with the following test sequence
every now and then:
dpp_qr_code_chan_list_unicast dpp_pkex_test_fail dpp_enrollee_reject_config

dpp_pkex_test_fail was adding a large number of pending offchannel
operations and dpp_enrollee_reject_config could fail if those pending
operations were blocking new remain-on-channel or offchannel TX
operation for a sufficiently long time.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/wpa_supplicant/dpp_supplicant.c b/wpa_supplicant/dpp_supplicant.c
index 0a13213b0535eebae97f2cd0cb0e9f097ff6e575..6d9427bb39b1c3213788b93c30b59a5fdff01252 100644 (file)
--- a/wpa_supplicant/dpp_supplicant.c
+++ b/wpa_supplicant/dpp_supplicant.c
@@ -2144,6 +2144,7 @@ wpas_dpp_rx_pkex_commit_reveal_resp(struct wpa_supplicant *wpa_s, const u8 *src,
        if (wpas_dpp_auth_init(wpa_s, cmd) < 0) {
                wpa_printf(MSG_DEBUG,
                           "DPP: Authentication initialization failed");
+               offchannel_send_action_done(wpa_s);
                return;
        }
 }
@@ -2617,6 +2618,8 @@ int wpas_dpp_pkex_remove(struct wpa_supplicant *wpa_s, const char *id)
 
 void wpas_dpp_stop(struct wpa_supplicant *wpa_s)
 {
+       if (wpa_s->dpp_auth || wpa_s->dpp_pkex)
+               offchannel_send_action_done(wpa_s);
        dpp_auth_deinit(wpa_s->dpp_auth);
        wpa_s->dpp_auth = NULL;
        dpp_pkex_free(wpa_s->dpp_pkex);