[PATCH] PR: Cancel timeouts and reset state on auth radio work deinit

[Emily Xia]

When pr-pasn-start-auth radio work is active (work->started == 1),
cancelling the work (e.g. on ranging abort or interface removal) calls
its callback with deinit=1.

Previously, wpas_pr_pasn_auth_start_cb() checked !work->started before
cancelling wpas_pr_pasn_timeout. Since work->started was already 1, this
check skipped cancelling the timer, leaving the 10-second timeout active
on eloop. In addition, wpas_pr_pasn_auth_retry_timeout was not cancelled
and wpa_s->pr_pasn_auth_work was not reset to NULL.

Fix this by cancelling both wpas_pr_pasn_timeout and
wpas_pr_pasn_auth_retry_timeout and setting wpa_s->pr_pasn_auth_work
to NULL when work->started is true during deinit.

Signed-off-by: Emily Xia <xiayucheng at google.com>
---
 wpa_supplicant/pr_supplicant.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/wpa_supplicant/pr_supplicant.c b/wpa_supplicant/pr_supplicant.c
index dac2626fa..c08167890 100644
--- a/wpa_supplicant/pr_supplicant.c
+++ b/wpa_supplicant/pr_supplicant.c
@@ -1245,8 +1245,12 @@ static void wpas_pr_pasn_auth_start_cb(struct wpa_radio_work *work, int deinit)
 	const u8 *peer_addr = NULL;
 
 	if (deinit) {
-		if (!work->started)
+		if (work->started) {
 			eloop_cancel_timeout(wpas_pr_pasn_timeout, wpa_s, NULL);
+			eloop_cancel_timeout(wpas_pr_pasn_auth_retry_timeout,
+					     wpa_s, NULL);
+			wpa_s->pr_pasn_auth_work = NULL;
+		}
 
 		wpas_pr_pasn_free_auth_work(awork);
 		work->ctx = NULL;
-- 
2.55.0.699.gb54405d56f-goog