[PATCH] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[PATCH] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[Dierk Modrow]

From: Dierk Modrow <dierk.modrow@sew-eurodrive.de>

---
 src/eapol.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/src/eapol.c b/src/eapol.c
index 372549c6..c2dc4e4c 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm)
 
 	l_queue_push_head(state_machines, sm);
 
+	/* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */
+	if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+		l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id);
+	}
 	sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex,
 						rx_handler, sm);
 	sm->protocol_version = sm->handshake->proto_version;
-- 
2.53.0.windows.2

[PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[Dierk Modrow]

From: Dierk Modrow <dierk.modrow@sew-eurodrive.de>

---
 src/station.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
 {
 	uint16_t mdid;
 
-	if (!hs->mde)
+	if (!hs || !hs->mde)
 		return false;
 
 	if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
 
 	orig_security = network_get_security(network);
 
-	if (hs->mde)
+	if (hs && hs->mde)
 		ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
 							&mdid, NULL, NULL);
 
@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
 	if (bss && !station->ap_directed_roaming) {
 		double cur_bss_rank = bss->rank;
 
-		if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+		if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
 			cur_bss_rank *= RANK_FT_FACTOR;
 
 		cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
 			goto next;
 
 		/* Skip result if it is not part of the ESS */
-		if (bss->ssid_len != hs->ssid_len ||
-				memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+		if (hs && (bss->ssid_len != hs->ssid_len ||
+				memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
 			goto next;
 
 		if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
 
 		rank = bss->rank;
 
-		if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+		if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
 			rank *= RANK_FT_FACTOR;
 
 		group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
-- 
2.53.0.windows.2

[PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[Dierk Modrow]

From: DEMODDIE <dierk.modrow@sew-eurodrive.de>

---
 src/station.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
 {
        uint16_t mdid;

-       if (!hs->mde)
+       if (!hs || !hs->mde)
                return false;

        if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

        orig_security = network_get_security(network);

-       if (hs->mde)
+       if (hs && hs->mde)
                ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
                                                        &mdid, NULL, NULL);

@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
        if (bss && !station->ap_directed_roaming) {
                double cur_bss_rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        cur_bss_rank *= RANK_FT_FACTOR;

                cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
                        goto next;

                /* Skip result if it is not part of the ESS */
-               if (bss->ssid_len != hs->ssid_len ||
-                               memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+               if (hs && (bss->ssid_len != hs->ssid_len ||
+                               memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
                        goto next;

                if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

                rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        rank *= RANK_FT_FACTOR;

                group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2


________________________________


SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207

Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann

[PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[Dierk Modrow]

From: DEMODDIE <dierk.modrow@sew-eurodrive.de>

---
 src/station.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
 {
        uint16_t mdid;

-       if (!hs->mde)
+       if (!hs || !hs->mde)
                return false;

        if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

        orig_security = network_get_security(network);

-       if (hs->mde)
+       if (hs && hs->mde)
                ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
                                                        &mdid, NULL, NULL);

@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
        if (bss && !station->ap_directed_roaming) {
                double cur_bss_rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        cur_bss_rank *= RANK_FT_FACTOR;

                cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
                        goto next;

                /* Skip result if it is not part of the ESS */
-               if (bss->ssid_len != hs->ssid_len ||
-                               memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+               if (hs && (bss->ssid_len != hs->ssid_len ||
+                               memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
                        goto next;

                if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

                rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        rank *= RANK_FT_FACTOR;

                group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2


________________________________


SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207

Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann

[PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[Dierk Modrow]

From: DEMODDIE <dierk.modrow@sew-eurodrive.de>

---
 src/station.c | 12 ++++++------
 1 file changed, 6 insertions(+), 6 deletions(-)

diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
 {
        uint16_t mdid;

-       if (!hs->mde)
+       if (!hs || !hs->mde)
                return false;

        if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

        orig_security = network_get_security(network);

-       if (hs->mde)
+       if (hs && hs->mde)
                ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
                                                        &mdid, NULL, NULL);

@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
        if (bss && !station->ap_directed_roaming) {
                double cur_bss_rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        cur_bss_rank *= RANK_FT_FACTOR;

                cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
                        goto next;

                /* Skip result if it is not part of the ESS */
-               if (bss->ssid_len != hs->ssid_len ||
-                               memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+               if (hs && (bss->ssid_len != hs->ssid_len ||
+                               memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
                        goto next;

                if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,

                rank = bss->rank;

-               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
                        rank *= RANK_FT_FACTOR;

                group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2


________________________________


SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207

Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann

Re: [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver

[James Prestwood]

Hi Dierk,

On 7/13/26 4:35 AM, Dierk Modrow wrote:
> From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
>
> ---
>   src/station.c | 12 ++++++------
>   1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/src/station.c b/src/station.c
> index 8fcf8c70..077e510e 100644
> --- a/src/station.c
> +++ b/src/station.c
> @@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
>   {
>          uint16_t mdid;
>
> -       if (!hs->mde)
> +       if (!hs || !hs->mde)
>                  return false;
>
>          if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
> @@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>
>          orig_security = network_get_security(network);
>
> -       if (hs->mde)
> +       if (hs && hs->mde)
>                  ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
>                                                          &mdid, NULL, NULL);
>
> @@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>          if (bss && !station->ap_directed_roaming) {
>                  double cur_bss_rank = bss->rank;
>
> -               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> +               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
>                          cur_bss_rank *= RANK_FT_FACTOR;
>
>                  cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
> @@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>                          goto next;
>
>                  /* Skip result if it is not part of the ESS */
> -               if (bss->ssid_len != hs->ssid_len ||
> -                               memcmp(bss->ssid, hs->ssid, hs->ssid_len))
> +               if (hs && (bss->ssid_len != hs->ssid_len ||
> +                               memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
>                          goto next;
>
>                  if (scan_bss_get_security(bss, &security) < 0)
> @@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>
>                  rank = bss->rank;
>
> -               if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> +               if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
>                          rank *= RANK_FT_FACTOR;
>
>                  group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
> --
> 2.53.0.windows.2
>
Are you sure you're not looking in the wrong place? You mention ft_auth 
and ft_associate, but the behavior differs significantly if there's a 
timeout:

- If ft_auth times out IWD will try another BSS and the handshake is 
preserved.
- If ft_reassoc times out the kernel forces a disconnect, destroying the 
handshake

That said I'm not sure how we can get into station_roam_scan_notify 
without a handshake... If we ever disconnect the scan callback should be 
canceled, even if its still in-flight ELL will null out the callback, we 
should just never get there.

Is there a bug causing the callback to get called? (maybe?) but if so 
that's where we should fix this, not checking if the handshake exists 
when it always should. An L_WARN_ON check might be appropriate at the 
top level to both prevent a hard crash and provide a warning that there 
is a bug.


Thanks,

James