* [PATCH] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
@ 2026-07-08 15:22 Dierk Modrow
2026-07-08 15:22 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
0 siblings, 1 reply; 6+ messages in thread
From: Dierk Modrow @ 2026-07-08 15:22 UTC (permalink / raw)
To: iwd; +Cc: pmenzel, Dierk Modrow
From: Dierk Modrow <dierk.modrow@sew-eurodrive.de>
---
src/eapol.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/eapol.c b/src/eapol.c
index 372549c6..c2dc4e4c 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm)
l_queue_push_head(state_machines, sm);
+ /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */
+ if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+ l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id);
+ }
sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex,
rx_handler, sm);
sm->protocol_version = sm->handshake->proto_version;
--
2.53.0.windows.2
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
2026-07-08 15:22 [PATCH] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver Dierk Modrow
@ 2026-07-08 15:22 ` Dierk Modrow
0 siblings, 0 replies; 6+ messages in thread
From: Dierk Modrow @ 2026-07-08 15:22 UTC (permalink / raw)
To: iwd; +Cc: pmenzel, Dierk Modrow
From: Dierk Modrow <dierk.modrow@sew-eurodrive.de>
---
src/station.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
{
uint16_t mdid;
- if (!hs->mde)
+ if (!hs || !hs->mde)
return false;
if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
orig_security = network_get_security(network);
- if (hs->mde)
+ if (hs && hs->mde)
ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
&mdid, NULL, NULL);
@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
if (bss && !station->ap_directed_roaming) {
double cur_bss_rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
cur_bss_rank *= RANK_FT_FACTOR;
cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
goto next;
/* Skip result if it is not part of the ESS */
- if (bss->ssid_len != hs->ssid_len ||
- memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+ if (hs && (bss->ssid_len != hs->ssid_len ||
+ memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
goto next;
if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
rank *= RANK_FT_FACTOR;
group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
@ 2026-07-13 11:22 Dierk Modrow
2026-07-13 11:22 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
0 siblings, 1 reply; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:22 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/eapol.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/eapol.c b/src/eapol.c
index 372549c6..c2dc4e4c 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm)
l_queue_push_head(state_machines, sm);
+ /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */
+ if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+ l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id);
+ }
sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex,
rx_handler, sm);
sm->protocol_version = sm->handshake->proto_version;
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
2026-07-13 11:22 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
@ 2026-07-13 11:22 ` Dierk Modrow
0 siblings, 0 replies; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:22 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/station.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
{
uint16_t mdid;
- if (!hs->mde)
+ if (!hs || !hs->mde)
return false;
if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
orig_security = network_get_security(network);
- if (hs->mde)
+ if (hs && hs->mde)
ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
&mdid, NULL, NULL);
@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
if (bss && !station->ap_directed_roaming) {
double cur_bss_rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
cur_bss_rank *= RANK_FT_FACTOR;
cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
goto next;
/* Skip result if it is not part of the ESS */
- if (bss->ssid_len != hs->ssid_len ||
- memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+ if (hs && (bss->ssid_len != hs->ssid_len ||
+ memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
goto next;
if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
rank *= RANK_FT_FACTOR;
group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
@ 2026-07-13 11:29 Dierk Modrow
2026-07-13 11:29 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
0 siblings, 1 reply; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:29 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/eapol.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/eapol.c b/src/eapol.c
index 372549c6..c2dc4e4c 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm)
l_queue_push_head(state_machines, sm);
+ /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */
+ if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+ l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id);
+ }
sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex,
rx_handler, sm);
sm->protocol_version = sm->handshake->proto_version;
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
2026-07-13 11:29 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
@ 2026-07-13 11:29 ` Dierk Modrow
0 siblings, 0 replies; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:29 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/station.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
{
uint16_t mdid;
- if (!hs->mde)
+ if (!hs || !hs->mde)
return false;
if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
orig_security = network_get_security(network);
- if (hs->mde)
+ if (hs && hs->mde)
ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
&mdid, NULL, NULL);
@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
if (bss && !station->ap_directed_roaming) {
double cur_bss_rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
cur_bss_rank *= RANK_FT_FACTOR;
cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
goto next;
/* Skip result if it is not part of the ESS */
- if (bss->ssid_len != hs->ssid_len ||
- memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+ if (hs && (bss->ssid_len != hs->ssid_len ||
+ memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
goto next;
if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
rank *= RANK_FT_FACTOR;
group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread
* [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
@ 2026-07-13 11:35 Dierk Modrow
2026-07-13 11:35 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
0 siblings, 1 reply; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:35 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/eapol.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/src/eapol.c b/src/eapol.c
index 372549c6..c2dc4e4c 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2824,6 +2824,10 @@ void eapol_register(struct eapol_sm *sm)
l_queue_push_head(state_machines, sm);
+ /* workaround against SEGV on fct. eapol_rx_packet by avoiding for two different eapol_frame_watches with different ids, but same eapol_sm ptr */
+ if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+ l_debug("existing frame_watch for sm=%p with id=%u successfully removed", sm, sm->watch_id);
+ }
sm->watch_id = eapol_frame_watch_add(sm->handshake->ifindex,
rx_handler, sm);
sm->protocol_version = sm->handshake->proto_version;
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread* [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
2026-07-13 11:35 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
@ 2026-07-13 11:35 ` Dierk Modrow
2026-07-14 13:37 ` James Prestwood
0 siblings, 1 reply; 6+ messages in thread
From: Dierk Modrow @ 2026-07-13 11:35 UTC (permalink / raw)
To: iwd; +Cc: DEMODDIE
From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
---
src/station.c | 12 ++++++------
1 file changed, 6 insertions(+), 6 deletions(-)
diff --git a/src/station.c b/src/station.c
index 8fcf8c70..077e510e 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
{
uint16_t mdid;
- if (!hs->mde)
+ if (!hs || !hs->mde)
return false;
if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
orig_security = network_get_security(network);
- if (hs->mde)
+ if (hs && hs->mde)
ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
&mdid, NULL, NULL);
@@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
if (bss && !station->ap_directed_roaming) {
double cur_bss_rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
cur_bss_rank *= RANK_FT_FACTOR;
cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
@@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
goto next;
/* Skip result if it is not part of the ESS */
- if (bss->ssid_len != hs->ssid_len ||
- memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+ if (hs && (bss->ssid_len != hs->ssid_len ||
+ memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
goto next;
if (scan_bss_get_security(bss, &security) < 0)
@@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
rank = bss->rank;
- if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
+ if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
rank *= RANK_FT_FACTOR;
group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2
________________________________
SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplementärin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannheim HRB 230207
Geschäftsführender Gesellschafter: Jürgen Blickle
Geschäftsführung: Jürgen Blickle (Vorsitzender), Dr. Jörg Hermes, Dr. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus Wöppermann
^ permalink raw reply related [flat|nested] 6+ messages in thread* Re: [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver
2026-07-13 11:35 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
@ 2026-07-14 13:37 ` James Prestwood
0 siblings, 0 replies; 6+ messages in thread
From: James Prestwood @ 2026-07-14 13:37 UTC (permalink / raw)
To: Dierk Modrow, iwd
Hi Dierk,
On 7/13/26 4:35 AM, Dierk Modrow wrote:
> From: DEMODDIE <dierk.modrow@sew-eurodrive.de>
>
> ---
> src/station.c | 12 ++++++------
> 1 file changed, 6 insertions(+), 6 deletions(-)
>
> diff --git a/src/station.c b/src/station.c
> index 8fcf8c70..077e510e 100644
> --- a/src/station.c
> +++ b/src/station.c
> @@ -2253,7 +2253,7 @@ static bool station_can_fast_transition(struct station *station,
> {
> uint16_t mdid;
>
> - if (!hs->mde)
> + if (!hs || !hs->mde)
> return false;
>
> if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
> @@ -2917,7 +2917,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>
> orig_security = network_get_security(network);
>
> - if (hs->mde)
> + if (hs && hs->mde)
> ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
> &mdid, NULL, NULL);
>
> @@ -2930,7 +2930,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
> if (bss && !station->ap_directed_roaming) {
> double cur_bss_rank = bss->rank;
>
> - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> cur_bss_rank *= RANK_FT_FACTOR;
>
> cur_bss_group_rank = evaluate_bss_group_rank(bss->addr,
> @@ -2967,8 +2967,8 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
> goto next;
>
> /* Skip result if it is not part of the ESS */
> - if (bss->ssid_len != hs->ssid_len ||
> - memcmp(bss->ssid, hs->ssid, hs->ssid_len))
> + if (hs && (bss->ssid_len != hs->ssid_len ||
> + memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
> goto next;
>
> if (scan_bss_get_security(bss, &security) < 0)
> @@ -2986,7 +2986,7 @@ static bool station_roam_scan_notify(int err, struct l_queue *bss_list,
>
> rank = bss->rank;
>
> - if (hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> + if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) == mdid)
> rank *= RANK_FT_FACTOR;
>
> group_rank = evaluate_bss_group_rank(bss->addr, bss->frequency,
> --
> 2.53.0.windows.2
>
Are you sure you're not looking in the wrong place? You mention ft_auth
and ft_associate, but the behavior differs significantly if there's a
timeout:
- If ft_auth times out IWD will try another BSS and the handshake is
preserved.
- If ft_reassoc times out the kernel forces a disconnect, destroying the
handshake
That said I'm not sure how we can get into station_roam_scan_notify
without a handshake... If we ever disconnect the scan callback should be
canceled, even if its still in-flight ELL will null out the callback, we
should just never get there.
Is there a bug causing the callback to get called? (maybe?) but if so
that's where we should fix this, not checking if the handshake exists
when it always should. An L_WARN_ON check might be appropriate at the
top level to both prevent a hard crash and provide a warning that there
is a bug.
Thanks,
James
^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2026-07-14 13:37 UTC | newest]
Thread overview: 6+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-08 15:22 [PATCH] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg at legacy roaming after ft_auth-/ft_reassoc-timeout when using mwifiex / NXP 88W9098 driver Dierk Modrow
2026-07-08 15:22 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
-- strict thread matches above, loose matches on Subject: below --
2026-07-13 11:22 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
2026-07-13 11:22 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
2026-07-13 11:29 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
2026-07-13 11:29 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
2026-07-13 11:35 [PATCH 1/2] src/eapol.c: fix of SEGV in eapol_rx_packets at receipt of EAPOL M1 msg " Dierk Modrow
2026-07-13 11:35 ` [PATCH 2/2] src/station.c: fix of SEGV in station_roam_scan_notify when performing repeated roam scan " Dierk Modrow
2026-07-14 13:37 ` James Prestwood
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox