[PATCH v2] P2P: Clear pending_listen_freq when radio work is cancelled

[Arowa Suliman]

When a P2P listen radio work is deinitialized before starting (e.g.,
preempted by a scan or stopped during provision discovery),
pending_listen_freq was not cleared in wpa_supplicant and the P2P core.
This left the state machine with a pending listen state, causing
subsequent listen operations to be rejected and stalling the event loop.

Fix this by:
1. Clearing pending_listen_freq and notifying the P2P core in
   wpas_start_listen_cb() on deinit and in wpas_stop_listen().
2. Adding p2p_cancel_pending_listen() helper to clear pending_listen_freq
   and pending_listen_wait_drv in struct p2p_data.

Signed-off-by: Arowa Suliman <arowa at chromium.org>
---
 src/p2p/p2p.c                   | 13 +++++++++++++
 src/p2p/p2p.h                   |  1 +
 wpa_supplicant/p2p_supplicant.c |  6 ++++++
 3 files changed, 20 insertions(+)

diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index 09ed2fe0f..ba1148a38 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -1418,6 +1418,19 @@ void p2p_stop_listen(struct p2p_data *p2p)
 }
 
 
+void p2p_cancel_pending_listen(struct p2p_data *p2p)
+{
+	if (p2p) {
+		if (p2p->pending_listen_freq) {
+			p2p_dbg(p2p, "Clear pending_listen_freq (%u) for p2p_cancel_pending_listen",
+				p2p->pending_listen_freq);
+			p2p->pending_listen_freq = 0;
+		}
+		p2p->pending_listen_wait_drv = false;
+	}
+}
+
+
 void p2p_stop_find(struct p2p_data *p2p)
 {
 	p2p->pending_listen_freq = 0;
diff --git a/src/p2p/p2p.h b/src/p2p/p2p.h
index 7c89c8c35..0d1b81a18 100644
--- a/src/p2p/p2p.h
+++ b/src/p2p/p2p.h
@@ -1606,6 +1606,7 @@ int p2p_listen(struct p2p_data *p2p, unsigned int timeout);
  * @p2p: P2P module context from p2p_init()
  */
 void p2p_stop_listen(struct p2p_data *p2p);
+void p2p_cancel_pending_listen(struct p2p_data *p2p);
 
 /**
  * p2p_connect - Start P2P group formation (GO negotiation)
diff --git a/wpa_supplicant/p2p_supplicant.c b/wpa_supplicant/p2p_supplicant.c
index e5d4afe3c..f9d893528 100644
--- a/wpa_supplicant/p2p_supplicant.c
+++ b/wpa_supplicant/p2p_supplicant.c
@@ -3235,6 +3235,9 @@ static void wpas_start_listen_cb(struct wpa_radio_work *work, int deinit)
 	unsigned int duration;
 
 	if (deinit) {
+		wpa_s->pending_listen_freq = 0;
+		if (wpa_s->global->p2p)
+			p2p_cancel_pending_listen(wpa_s->global->p2p);
 		if (work->started && !wpa_s->p2p_removing_listen_work)
 			wpas_stop_started_listen_work(work);
 		wpas_p2p_listen_work_free(lwork);
@@ -3341,6 +3344,9 @@ static void wpas_stop_listen(void *ctx)
 		radio_remove_works(wpa_s, "p2p-listen", 0);
 		wpa_s->p2p_removing_listen_work = false;
 	}
+	wpa_s->pending_listen_freq = 0;
+	if (wpa_s->global->p2p)
+		p2p_cancel_pending_listen(wpa_s->global->p2p);
 }
 
 
-- 
2.55.0.897.gb25b4bd76c-goog