mirror of
https://github.com/openwrt/openwrt.git
synced 2026-10-12 06:57:57 +04:00
Felix Fietkau
a75b4c405f
The bss_remove hook of hostapd.uc sends a service event with a synchronous ubus call. While libubus waits for that reply, it runs the completion callbacks of other pending requests, among them the wpa_supplicant phy_status or phy_set_state request of an interface setup in progress. The callback advanced the setup to hostapd.add_iface() nested inside the teardown that called the hook. With an AP MLD, a config_set for radio 0 followed by one for radio 1 added the radio 0 link while the radio 1 link was half removed and still held its driver BSS and management frame registrations. The add failed with "Match already configured", and its cleanup crashed hostapd in hostapd_wpa_event(). This happened on the first such reconfiguration after a bring-up. Run the next step of the pending setup from a uloop timer instead, and cancel the timer where the pending request is aborted. Signed-off-by: Felix Fietkau <nbd@nbd.name>