Remove pending connect and sme-connect radio works on disconnect

There was a race condition in a case where a new connection attempt was
scheduled as a pending radio work and that was followed by a DISCONNECT
command before the pending radio work is started. The pending radio work
would not have been deleted in that sequence and instead, it was
executed when the radio became available next. This could result in an
unexpected connection after an explicit request to disconnect.

Fix this by removing pending connect and sme-connect radio works on
disconnection request.

Signed-off-by: Jouni Malinen <jouni@codeaurora.org>

diff --git a/wpa_supplicant/wpa_supplicant.c b/wpa_supplicant/wpa_supplicant.c
index 20ae588ad18800a1446615003b9bb46dae914def..0b269225fb9b89afe9b6155cb588d9c92d3c8a01 100644 (file)
--- a/wpa_supplicant/wpa_supplicant.c
+++ b/wpa_supplicant/wpa_supplicant.c
@@ -7075,6 +7075,8 @@ void wpas_request_disconnection(struct wpa_supplicant *wpa_s)
        wpa_supplicant_cancel_scan(wpa_s);
        wpa_supplicant_deauthenticate(wpa_s, WLAN_REASON_DEAUTH_LEAVING);
        eloop_cancel_timeout(wpas_network_reenabled, wpa_s, NULL);
+       radio_remove_works(wpa_s, "connect", 0);
+       radio_remove_works(wpa_s, "sme-connect", 0);
 }