* [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: @ 2026-07-08 6:16 dierk.modrow.opensource 2026-07-08 8:12 ` Paul Menzel 0 siblings, 1 reply; 3+ messages in thread From: dierk.modrow.opensource @ 2026-07-08 6:16 UTC (permalink / raw) To: iwd; +Cc: DEMODDIE From: DEMODDIE <dierk.modrow@sew-eurodrive.de> src/eapol.c: next try for a fix of SEGV fault at eapol_rx_packets when using mwifiex / NXP 88W9098 driver src/station.c: potential bugfix in station_roam_scan_notify to avoid NULL-Ptr access to var hs src/station.c: next try to fix a SEGV after auth timeout at FT roaming --- src/eapol.c | 4 ++++ src/station.c | 12 ++++++------ 2 files changed, 10 insertions(+), 6 deletions(-) diff --git a/src/eapol.c b/src/eapol.c index 372549c6..c2dc4e4c 100644 --- a/src/eapol.c +++ b/src/eapol.c @@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm) l_queue_push_head(state_machines, sm); + /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */ + if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) { + l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id); + } sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex, rx_handler, sm); sm->protocol_version = sm->handshake->proto_version; diff --git a/src/station.c b/src/station.c index 8fcf8c70..077e510e 100644 --- a/src/station.c +++ b/src/station.c @@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station, { uint16_t mdid; - if (!hs->mde) + if (!hs || !hs->mde) return false; if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, @@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, orig_security = network_get_security(network); - if (hs->mde) + if (hs && hs->mde) ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, &mdid, NULL, NULL); @@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, if (bss && !station->ap_directed_roaming) { double cur_bss_rank = bss->rank; - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) cur_bss_rank *= RANK_FT_FACTOR; cur_bss_group_rank = evaluate_bss_group_rank(bss->addr, @@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, goto next; /* Skip result if it is not part of the ESS */ - if (bss->ssid_len != hs->ssid_len || - memcmp(bss->ssid, hs->ssid, hs->ssid_len)) + if (hs && (bss->ssid_len != hs->ssid_len || + memcmp(bss->ssid, hs->ssid, hs->ssid_len))) goto next; if (scan_bss_get_security(bss, &security) < 0) @@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, rank = bss->rank; - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) rank *= RANK_FT_FACTOR; group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency, -- 2.53.0.windows.2 ^ permalink raw reply related [flat|nested] 3+ messages in thread
* Re: [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: 2026-07-08 6:16 [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: dierk.modrow.opensource @ 2026-07-08 8:12 ` Paul Menzel [not found] ` <686f8b3498e645d89bc538456bb847e9@sew-eurodrive.de> 0 siblings, 1 reply; 3+ messages in thread From: Paul Menzel @ 2026-07-08 8:12 UTC (permalink / raw) To: dierk.modrow.opensource; +Cc: iwd, dierk.modrow Dear Dierk, Thank you for your patch. Am 08.07.26 um 08:16 schrieb dierk.modrow.opensource@gmail.com: > From: DEMODDIE <dierk.modrow@sew-eurodrive.de> DEMODDIE doesn’t look right. `git config --global user.name "Dierk Modrow"` and `git commit --amend --author="Dierk Modrow <dierk.modrow@sew-eurodrive.de>" should help. > src/eapol.c: next try for a fix of SEGV fault at eapol_rx_packets when using mwifiex / NXP 88W9098 driver > src/station.c: potential bugfix in station_roam_scan_notify to avoid NULL-Ptr access to var hs > src/station.c: next try to fix a SEGV after auth timeout at FT roaming It’d be great if you could make one commit for each bug. > --- > src/eapol.c | 4 ++++ > src/station.c | 12 ++++++------ > 2 files changed, 10 insertions(+), 6 deletions(-) > > diff --git a/src/eapol.c b/src/eapol.c > index 372549c6..c2dc4e4c 100644 > --- a/src/eapol.c > +++ b/src/eapol.c > @@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm) > > l_queue_push_head(state_machines, sm); > > + /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */ > + if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) { > + l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id); > + } > sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex, > rx_handler, sm); > sm->protocol_version = sm->handshake->proto_version; > diff --git a/src/station.c b/src/station.c > index 8fcf8c70..077e510e 100644 > --- a/src/station.c > +++ b/src/station.c > @@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station, > { > uint16_t mdid; > > - if (!hs->mde) > + if (!hs || !hs->mde) > return false; > > if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, > @@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > > orig_security = network_get_security(network); > > - if (hs->mde) > + if (hs && hs->mde) > ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, > &mdid, NULL, NULL); > > @@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > if (bss && !station->ap_directed_roaming) { > double cur_bss_rank = bss->rank; > > - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > cur_bss_rank *= RANK_FT_FACTOR; > > cur_bss_group_rank = evaluate_bss_group_rank(bss->addr, > @@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > goto next; > > /* Skip result if it is not part of the ESS */ > - if (bss->ssid_len != hs->ssid_len || > - memcmp(bss->ssid, hs->ssid, hs->ssid_len)) > + if (hs && (bss->ssid_len != hs->ssid_len || > + memcmp(bss->ssid, hs->ssid, hs->ssid_len))) > goto next; > > if (scan_bss_get_security(bss, &security) < 0) > @@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > > rank = bss->rank; > > - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > rank *= RANK_FT_FACTOR; > > group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency, Kind regards, Paul ^ permalink raw reply [flat|nested] 3+ messages in thread
[parent not found: <686f8b3498e645d89bc538456bb847e9@sew-eurodrive.de>]
* AW: [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: [not found] ` <686f8b3498e645d89bc538456bb847e9@sew-eurodrive.de> @ 2026-07-08 15:41 ` Dierk.Modrow 0 siblings, 0 replies; 3+ messages in thread From: Dierk.Modrow @ 2026-07-08 15:41 UTC (permalink / raw) To: pmenzel; +Cc: iwd Dear Paul, I split the patch in two different patches and corrected git config user.name / author. I will do git send-email for the patches with another mail-account & PC due to firewall issues in the company network. Thank you! /BR Dierk Von: Paul Menzel <mailto:pmenzel@molgen.mpg.de> Gesendet: Mittwoch, 8. Juli 2026 10:12 An: mailto:dierk.modrow.opensource@gmail.com Cc: mailto:iwd@lists.linux.dev; Modrow, Dierk <mailto:Dierk.Modrow@sew-eurodrive.de> Betreff: Re: [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: Dear Dierk, Thank you for your patch. Am 08.07.26 um 08:16 schrieb mailto:dierk.modrow.opensource@gmail.com: > From: DEMODDIE <mailto:dierk.modrow@sew-eurodrive.de> DEMODDIE doesn’t look right. `git config --global user.name "Dierk Modrow"` and `git commit --amend --author="Dierk Modrow <mailto:dierk.modrow@sew-eurodrive.de>" should help. > src/eapol.c: next try for a fix of SEGV fault at eapol_rx_packets when using mwifiex / NXP 88W9098 driver > src/station.c: potential bugfix in station_roam_scan_notify to avoid NULL-Ptr access to var hs > src/station.c: next try to fix a SEGV after auth timeout at FT roaming It’d be great if you could make one commit for each bug. > --- > src/eapol.c | 4 ++++ > src/station.c | 12 ++++++------ > 2 files changed, 10 insertions(+), 6 deletions(-) > > diff --git a/src/eapol.c b/src/eapol.c > index 372549c6..c2dc4e4c 100644 > --- a/src/eapol.c > +++ b/src/eapol.c > @@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm) > > l_queue_push_head(state_machines, sm); > > + /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */ > + if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) { > + l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id); > + } > sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex, > rx_handler, sm); > sm->protocol_version = sm->handshake->proto_version; > diff --git a/src/station.c b/src/station.c > index 8fcf8c70..077e510e 100644 > --- a/src/station.c > +++ b/src/station.c > @@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station, > { > uint16_t mdid; > > - if (!hs->mde) > + if (!hs || !hs->mde) > return false; > > if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, > @@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > > orig_security = network_get_security(network); > > - if (hs->mde) > + if (hs && hs->mde) > ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2, > &mdid, NULL, NULL); > > @@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > if (bss && !station->ap_directed_roaming) { > double cur_bss_rank = bss->rank; > > - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > cur_bss_rank *= RANK_FT_FACTOR; > > cur_bss_group_rank = evaluate_bss_group_rank(bss->addr, > @@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > goto next; > > /* Skip result if it is not part of the ESS */ > - if (bss->ssid_len != hs->ssid_len || > - memcmp(bss->ssid, hs->ssid, hs->ssid_len)) > + if (hs && (bss->ssid_len != hs->ssid_len || > + memcmp(bss->ssid, hs->ssid, hs->ssid_len))) > goto next; > > if (scan_bss_get_security(bss, &security) < 0) > @@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list, > > rank = bss->rank; > > - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid) > rank *= RANK_FT_FACTOR; > > group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency, Kind regards, Paul ________________________________ SEW-EURODRIVE GmbH & Co KG Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970 Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207 Geschäftsführender Gesellschafter: Jürgen Blickle Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann ^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-07-08 15:41 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-08 6:16 [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg with legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout occurred: dierk.modrow.opensource
2026-07-08 8:12 ` Paul Menzel
[not found] ` <686f8b3498e645d89bc538456bb847e9@sew-eurodrive.de>
2026-07-08 15:41 ` AW: " Dierk.Modrow
This is an external index of several public inboxes, see mirroring instructions on how to clone and mirror all data and code used by this external index.