[BUG] Crash in network_info_get_roam_frequencies() when a neighbor report completes with -ENOTCONN during disconnect teardown

[BUG] Crash in network_info_get_roam_frequencies() when a neighbor report completes with -ENOTCONN during disconnect teardown

[Muhammed Izzet Saglam]

Hi,

iwd 3.12 crashes with SIGSEGV while roaming, when a pending 802.11k
neighbor report request completes during connection teardown. The
neighbor report callback only bails out on -ENODEV, so an -ENOTCONN
completion falls through to a roam scan that dereferences the connection
state netdev_connect_free() has just torn down.

I hit this twice within one minute on 2026-07-25 and captured both core
dumps. The backtraces are identical, so this looks deterministic rather
than memory corruption.

Backtrace (both dumps, identical):

  #0  network_info_get_roam_frequencies (info=0x0, current_freq=2462,
          max=max@entry=5 '\005') at src/knownnetworks.c:391
  #1  station_roam_scan_known_freqs (station=station@entry=0x564903a82b50)
          at src/station.c:3088
  #2  station_neighbor_report_cb (netdev=<optimized out>, err=-107,
          reports=<optimized out>, reports_len=0,
          user_data=0x564903a82b50) at src/station.c:3129
  #3  netdev_connect_free (netdev=netdev@entry=0x564903a77c40)
          at src/netdev.c:867
  #4  netdev_connect_failed (netdev=0x564903a77c40, result=<optimized out>,
          status_or_reason=<optimized out>) at src/netdev.c:937
  #5  netdev_disconnected (netdev=0x564903a77c40, result=<optimized out>,
          event=NETDEV_EVENT_DISCONNECT_BY_SME,
          status_or_reason=<optimized out>) at src/netdev.c:1004
  #6  netdev_disconnect_by_sme_cb (msg=<optimized out>,
          user_data=0x564903a77c40) at src/netdev.c:1019
  #7  process_unicast (genl=<optimized out>, nlmsg=0x7ffffcf571d0)
          at ell/genl.c:860
  #8  received_data (io=<optimized out>, user_data=0x564903a69bb0)
          at ell/genl.c:972
  #9  io_callback (fd=<optimized out>, events=1, user_data=0x564903a69b00)
          at ell/io.c:105
  #10 l_main_iterate (timeout=<optimized out>) at ell/main.c:463
  #11 l_main_run () at ell/main.c:511
  #12 l_main_run () at ell/main.c:492
  #13 l_main_run_with_signal (callback=0x5648f3df5bc0 <signal_handler>,
          user_data=0x0) at ell/main.c:633
  #14 main (argc=<optimized out>, argv=<optimized out>) at src/main.c:610

The faulting line is knownnetworks.c:391, with info == NULL:

  for (entry = l_queue_get_entries(info->known_frequencies); entry && max;

Sequence, as I read it:

  1. The AP disconnects us, so netdev_disconnect_by_sme_cb() runs
     (NETDEV_EVENT_DISCONNECT_BY_SME).
  2. netdev_connect_failed() -> netdev_connect_free() tears the
     connection down and completes the outstanding neighbor report
     request with an error.
  3. station_neighbor_report_cb() is invoked with err = -107
     (-ENOTCONN).
  4. The guard at the top of that callback only returns early for
     -ENODEV:

        if (!station->preparing_roam || err == -ENODEV)
                return;

     so -ENOTCONN continues to:

        if (!reports || err) {
                r = station_roam_scan_known_freqs(station);

  5. station_roam_scan_known_freqs() then reaches
     network_info_get_roam_frequencies() with the network info already
     gone, and dereferences NULL.

Commit 155c266 ("station: add checks to prevent multiple roam scans",
Jan 2023) fixed a different path to the same crash signature and is of
course already in 3.12. This one arrives through the disconnect teardown
rather than the roam rearm timer, and the code in master still looks
affected: station_neighbor_report_cb() special-cases -ENODEV only, and
station_roam_scan_known_freqs() has no NULL check on the connected
network.

I have not written a patch because I do not know which fix you would
prefer -- treating any err as terminal in the callback, checking
station->connected_network before the fallback scan, or cancelling the
neighbor report request earlier in netdev_connect_free(). Happy to test
a patch on this hardware.

System:

  iwd            3.12 (Arch Linux, iwd 3.12-1)
  kernel         7.1.5-zen1-1-zen (x86_64)
  device         Intel Wi-Fi 6E AX210/AX1675 2x2 [Typhoon Peak]
                 [8086:2725] rev 1a, iwlwifi
  firmware       89.735b75a4.0 ty-a0-gf-a0-89.ucode, op_mode iwlmvm
  band at crash  2462 MHz (2.4 GHz, channel 11), roaming on a weak link

Both core dumps are still on disk if anything else would help.

Thanks,
Muhammed Izzet Saglam

Re: [BUG] Crash in network_info_get_roam_frequencies() when a neighbor report completes with -ENOTCONN during disconnect teardown

[James Prestwood]

Hi Muhammed,

On 7/27/26 1:03 PM, Muhammed Izzet Saglam wrote:
> Hi,
>
> iwd 3.12 crashes with SIGSEGV while roaming, when a pending 802.11k
> neighbor report request completes during connection teardown. The
> neighbor report callback only bails out on -ENODEV, so an -ENOTCONN
> completion falls through to a roam scan that dereferences the connection
> state netdev_connect_free() has just torn down.
>
> I hit this twice within one minute on 2026-07-25 and captured both core
> dumps. The backtraces are identical, so this looks deterministic rather
> than memory corruption.
>
> Backtrace (both dumps, identical):
>
>    #0  network_info_get_roam_frequencies (info=0x0, current_freq=2462,
>            max=max@entry=5 '\005') at src/knownnetworks.c:391
>    #1  station_roam_scan_known_freqs (station=station@entry=0x564903a82b50)
>            at src/station.c:3088
>    #2  station_neighbor_report_cb (netdev=<optimized out>, err=-107,
>            reports=<optimized out>, reports_len=0,
>            user_data=0x564903a82b50) at src/station.c:3129
>    #3  netdev_connect_free (netdev=netdev@entry=0x564903a77c40)
>            at src/netdev.c:867
>    #4  netdev_connect_failed (netdev=0x564903a77c40, result=<optimized out>,
>            status_or_reason=<optimized out>) at src/netdev.c:937
>    #5  netdev_disconnected (netdev=0x564903a77c40, result=<optimized out>,
>            event=NETDEV_EVENT_DISCONNECT_BY_SME,
>            status_or_reason=<optimized out>) at src/netdev.c:1004
>    #6  netdev_disconnect_by_sme_cb (msg=<optimized out>,
>            user_data=0x564903a77c40) at src/netdev.c:1019
>    #7  process_unicast (genl=<optimized out>, nlmsg=0x7ffffcf571d0)
>            at ell/genl.c:860
>    #8  received_data (io=<optimized out>, user_data=0x564903a69bb0)
>            at ell/genl.c:972
>    #9  io_callback (fd=<optimized out>, events=1, user_data=0x564903a69b00)
>            at ell/io.c:105
>    #10 l_main_iterate (timeout=<optimized out>) at ell/main.c:463
>    #11 l_main_run () at ell/main.c:511
>    #12 l_main_run () at ell/main.c:492
>    #13 l_main_run_with_signal (callback=0x5648f3df5bc0 <signal_handler>,
>            user_data=0x0) at ell/main.c:633
>    #14 main (argc=<optimized out>, argv=<optimized out>) at src/main.c:610
>
> The faulting line is knownnetworks.c:391, with info == NULL:
>
>    for (entry = l_queue_get_entries(info->known_frequencies); entry && max;
>
> Sequence, as I read it:
>
>    1. The AP disconnects us, so netdev_disconnect_by_sme_cb() runs
>       (NETDEV_EVENT_DISCONNECT_BY_SME).
>    2. netdev_connect_failed() -> netdev_connect_free() tears the
>       connection down and completes the outstanding neighbor report
>       request with an error.
>    3. station_neighbor_report_cb() is invoked with err = -107
>       (-ENOTCONN).
>    4. The guard at the top of that callback only returns early for
>       -ENODEV:
>
>          if (!station->preparing_roam || err == -ENODEV)
>                  return;
>
>       so -ENOTCONN continues to:
>
>          if (!reports || err) {
>                  r = station_roam_scan_known_freqs(station);
>
>    5. station_roam_scan_known_freqs() then reaches
>       network_info_get_roam_frequencies() with the network info already
>       gone, and dereferences NULL.
>
> Commit 155c266 ("station: add checks to prevent multiple roam scans",
> Jan 2023) fixed a different path to the same crash signature and is of
> course already in 3.12. This one arrives through the disconnect teardown
> rather than the roam rearm timer, and the code in master still looks
> affected: station_neighbor_report_cb() special-cases -ENODEV only, and
> station_roam_scan_known_freqs() has no NULL check on the connected
> network.
>
> I have not written a patch because I do not know which fix you would
> prefer -- treating any err as terminal in the callback, checking
> station->connected_network before the fallback scan, or cancelling the
> neighbor report request earlier in netdev_connect_free(). Happy to test
> a patch on this hardware.
>
> System:
>
>    iwd            3.12 (Arch Linux, iwd 3.12-1)
>    kernel         7.1.5-zen1-1-zen (x86_64)
>    device         Intel Wi-Fi 6E AX210/AX1675 2x2 [Typhoon Peak]
>                   [8086:2725] rev 1a, iwlwifi
>    firmware       89.735b75a4.0 ty-a0-gf-a0-89.ucode, op_mode iwlmvm
>    band at crash  2462 MHz (2.4 GHz, channel 11), roaming on a weak link
>
> Both core dumps are still on disk if anything else would help.
>
> Thanks,
> Muhammed Izzet Saglam

Thanks for reporting this. A quick fix is certainly to just add 
-ENOTCONN to station_neighbor_report_cb(). The only thing that makes me 
nervous is if -ENOTCONN is a possible return from netlink. I'm also 
questioning why netdev needs to call the callback in the first place 
(e.g. with -ENODEV). We just bail out and ignore it. I can see the 
argument for netdev completing the API contract with the caller, but it 
also feels like a waste of cycles to me.

Thanks,

James