#1136709 wpasupplicant: wpa_supplicant blocks in sendto syscall when trying to send ping frame to a powered down (gone) AP

Package:
wpasupplicant
Source:
wpasupplicant
Description:
client support for WPA and WPA2 (IEEE 802.11i)
Submitter:
Filippe Duke
Date:
2026-05-14 22:31:02 UTC
Severity:
normal
Tags:
#1136709#5
Date:
2026-05-14 22:28:45 UTC
From:
To:
wpa_supplicant process gets blocked when trying to send ping frame to
the AP that was powered down or power cycled without proper deassociation.
The event loop of wpa_supplicant blocks completely rendering NetworkManager
unusable for Wi-Fi connections.
I observe the bug when using open access point (no security) connecting
through the NetworkManager when putting wifi interface inside VRF.

(gdb) bt
  #0  __internal_syscall_cancel (a1=24, a2=a2@entry=367381808464, a3=a3@entry=0, a4=a4@entry=0, a5=549500786560, a6=a6@entry=20, nr=nr@entry=206)
      at ./nptl/cancellation.c:40
  #1  0x0000007faeb5265c in __syscall_cancel (a1=<optimized out>, a2=a2@entry=367381808464, a3=a3@entry=0, a4=a4@entry=0, a5=<optimized out>,
      a6=a6@entry=20, nr=nr@entry=206) at ./nptl/cancellation.c:75
  #2  0x0000007faebc0358 in __libc_sendto (fd=<optimized out>, buf=buf@entry=0x5589a98550, len=len@entry=0, flags=flags@entry=0, addr=...,
      addr@entry=..., addrlen=addrlen@entry=20) at ../sysdeps/unix/sysv/linux/sendto.c:27
  #3  0x0000005589a476f0 in l2_packet_send (l2=<optimized out>, dst_addr=dst_addr@entry=0x559e9f7130 "\020VʢWh", proto=proto@entry=2048,
      buf=buf@entry=0x5589a98550 "", len=len@entry=0) at ../src/l2_packet/l2_packet_linux.c:137
  #4  0x0000005589a099d0 in wnm_bss_keep_alive (sock_ctx=0xffff00ff00000000, eloop_ctx=0x559e9f6fe0) at ./wpa_supplicant/events.c:2479
  #5  wnm_bss_keep_alive (eloop_ctx=eloop_ctx@entry=0x559e9f6fe0, sock_ctx=sock_ctx@entry=0x0) at ./wpa_supplicant/events.c:2465
  #6  0x0000005589869a60 in eloop_run () at ../src/utils/eloop.c:1206
  #7  0x0000005589a012a4 in wpa_supplicant_run (global=global@entry=0x559e9326d0) at ./wpa_supplicant/wpa_supplicant.c:7477
  #8  0x000000558984f30c in main (argc=<optimized out>, argv=<optimized out>) at ./wpa_supplicant/main.c:392

dmesg:

   [290611.134170] wlan1: Connection to AP 10:56:ca:a2:57:68 lost .

The fix should consist of using sendto() with MSG_DONTWAIT flag.
Attaching patch candidate developed by Claude Code as separated file for your review.