[PATCH 3/4] wpa_supplicant: Fix sending ANQP request to an unknown bss while associated

[Ilan Peer]

From: Matti Gottlieb <matti.gottlieb at intel.com>

While being associated, if an ANQP request is received for a different
AP that doesn't exist in the bss list, the ANQP request will be sent on
the frequency of the AP that we are currently associated to.

In such a case, it is possible that the anqp request would be sent on
a channel different than that of the requested AP, potentially delaying
other requests/activities.

Avoid sending the ANQP request to an AP that is not in the bss list.

Signed-off-by: Matti Gottlieb <matti.gottlieb at intel.com>
---
 wpa_supplicant/hs20_supplicant.c | 14 ++++++++------
 wpa_supplicant/interworking.c    | 14 ++++++++------
 2 files changed, 16 insertions(+), 12 deletions(-)

diff --git a/wpa_supplicant/hs20_supplicant.c b/wpa_supplicant/hs20_supplicant.c
index 98af530..a1afc85 100644
--- a/wpa_supplicant/hs20_supplicant.c
+++ b/wpa_supplicant/hs20_supplicant.c
@@ -188,14 +188,16 @@ int hs20_anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst, u32 stypes,
 	struct wpa_bss *bss;
 	int res;
 
-	freq = wpa_s->assoc_freq;
 	bss = wpa_bss_get_bssid(wpa_s, dst);
-	if (bss) {
-		wpa_bss_anqp_unshare_alloc(bss);
-		freq = bss->freq;
-	}
-	if (freq <= 0)
+	if (!bss) {
+		wpa_printf(MSG_WARNING,
+			   "ANQP: Cannot send query to unknown BSS "
+			   MACSTR, MAC2STR(dst));
 		return -1;
+	}
+
+	wpa_bss_anqp_unshare_alloc(bss);
+	freq = bss->freq;
 
 	wpa_printf(MSG_DEBUG, "HS20: ANQP Query Request to " MACSTR " for "
 		   "subtypes 0x%x", MAC2STR(dst), stypes);
diff --git a/wpa_supplicant/interworking.c b/wpa_supplicant/interworking.c
index 35885ee..fd47c17 100644
--- a/wpa_supplicant/interworking.c
+++ b/wpa_supplicant/interworking.c
@@ -2673,14 +2673,16 @@ int anqp_send_req(struct wpa_supplicant *wpa_s, const u8 *dst,
 	struct wpa_bss *bss;
 	int res;
 
-	freq = wpa_s->assoc_freq;
 	bss = wpa_bss_get_bssid(wpa_s, dst);
-	if (bss) {
-		wpa_bss_anqp_unshare_alloc(bss);
-		freq = bss->freq;
-	}
-	if (freq <= 0)
+	if (!bss) {
+		wpa_printf(MSG_WARNING,
+			   "ANQP: Cannot send query to unknown BSS "
+			   MACSTR, MAC2STR(dst));
 		return -1;
+	}
+
+	wpa_bss_anqp_unshare_alloc(bss);
+	freq = bss->freq;
 
 	wpa_msg(wpa_s, MSG_DEBUG,
 		"ANQP: Query Request to " MACSTR " for %u id(s)",
-- 
1.9.1