From 73e10e74328d58930577f100b9dd01bc8ea6edd5 Mon Sep 17 00:00:00 2001 From: Hauke Mehrtens Date: Fri, 18 Sep 2026 00:52:48 +0200 Subject: [PATCH] hostapd: free the APuP peer when no AID is available apup_process_beacon() adds the peer with ap_sta_add() and only asks for an AID with hostapd_get_aid() further down. When that fails the function returns without undoing anything, leaving the station in hapd->sta_list with WLAN_STA_AUTH set but with no AID, no WLAN_STA_ASSOC and no WDS interface. The driver entry added by the preceding hostapd_sta_add() and the hapd->num_sta reference are leaked as well. The leftover entry is then found by the ap_get_sta() check at the top of the function, so every later beacon from that BSSID returns early and the peer can never be set up again until hostapd is restarted. Release the half-initialised station with ap_free_sta(), which removes the driver entry, cancels the inactivity timer registered by ap_sta_add(), unlinks it from the list and drops the counters. Fixes: e80520197c9c ("hostapd: Add support for APuP") Assisted-by: Claude:claude-opus-5 Link: https://github.com/openwrt/openwrt/pull/25242 Signed-off-by: Hauke Mehrtens --- .../780-Implement-APuP-Access-Point-Micro-Peering.patch | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch b/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch index fbed196c475..02ada8935d8 100644 --- a/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch +++ b/package/network/services/hostapd/patches/780-Implement-APuP-Access-Point-Micro-Peering.patch @@ -164,7 +164,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6 int hostapd_sta_add(struct hostapd_data *hapd, --- /dev/null +++ b/src/ap/apup.c -@@ -0,0 +1,175 @@ +@@ -0,0 +1,176 @@ +/* + * hostapd / APuP Access Point Micro Peering + * @@ -288,6 +288,7 @@ Hotfix-by: Sebastian Gottschall https://github.com/mirror/dd-wrt/commit/0c3001a6 + if (hostapd_get_aid(hapd, sta_ret) < 0) + { + wpa_printf(MSG_INFO, "apup_process_beacon(...) No room for more AIDs"); ++ ap_free_sta(hapd, sta_ret); + return; + } +