IWD bugfixes for SEGVs at corner cases after failed ft_handover with NXP-driver/firmware

From 0addb322ae01a8b9120882c061a328a99d36cad2 Mon Sep 17 00:00:00 2001
From: DEMODDIE <[email protected]>
Date: Thu, 2 Jul 2026 08:36:52 +0200
Subject: [PATCH] Three bugfixes for iwd SEGVs at receipt of EAPOL M1 msg wi=
th
 legacy roaming and repeated roam scan after ft_auth-/ft_reassoc-timeout
 occurred: src/eapol.c: next try for a fix of SEGV fault at eapol_rx_packet=
s
 when using mwifiex / NXP 88W9098 driver src/station.c: potential bugfix in
 station_roam_scan_notify to avoid NULL-Ptr access to var hs src/station.c:
 next try to fix a SEGV after auth timeout at FT roaming

---
 src/eapol.c   |  4 ++++
 src/station.c | 12 ++++++------
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/src/eapol.c b/src/eapol.c
index aba47d6e5..5f8fcea55 100644
--- a/src/eapol.c
+++ b/src/eapol.c
@@ -2827,6 +2827,10 @@ void eapol_register(struct eapol_sm *sm)
 eapol_rx_auth_packet : eapol_rx_packet;

 l_queue_push_head(state_machines, sm);
+/* workaround against SEGV on fct. eapol_rx_packet by avoiding for two dif=
ferent eapol_frame_watches with different ids, but same eapol_sm ptr */
+if ((sm->watch_id > 0) && eapol_frame_watch_remove(sm->watch_id)) {
+l_debug("existing frame_watch for sm=3D%p with id=3D%u successfully remove=
d", sm, sm->watch_id);
+}

 sm->watch_id =3D eapol_frame_watch_add(sm->handshake->ifindex,
 rx_handler, sm);
diff --git a/src/station.c b/src/station.c
index 8c342ceb7..e2a68e225 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2369,7 +2369,7 @@ static bool station_can_fast_transition(struct statio=
n *station,
 {
 uint16_t mdid;

-if (!hs->mde)
+if (!hs || !hs->mde)
 return false;

 if (ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
@@ -3050,7 +3050,7 @@ static bool station_roam_scan_notify(int err, struct =
l_queue *bss_list,

 orig_security =3D network_get_security(network);

-if (hs->mde)
+if (hs && hs->mde)
 ie_parse_mobility_domain_from_data(hs->mde, hs->mde[1] + 2,
 &mdid, NULL, NULL);

@@ -3070,7 +3070,7 @@ static bool station_roam_scan_notify(int err, struct =
l_queue *bss_list,
 cur_bss_rank =3D bss->rank;
 #endif

-if (hs->mde && bss->mde_present && l_get_le16(bss->mde) =3D=3D mdid)
+if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) =3D=3D mdid)
 cur_bss_rank *=3D RANK_FT_FACTOR;

 cur_bss_group_rank =3D evaluate_bss_group_rank(bss->addr,
@@ -3134,8 +3134,8 @@ static bool station_roam_scan_notify(int err, struct =
l_queue *bss_list,
 }

 /* Skip result if it is not part of the ESS */
-if (bss->ssid_len !=3D hs->ssid_len ||
-memcmp(bss->ssid, hs->ssid, hs->ssid_len))
+if (hs && (bss->ssid_len !=3D hs->ssid_len ||
+memcmp(bss->ssid, hs->ssid, hs->ssid_len)))
 goto next;

 if (scan_bss_get_security(bss, &security) < 0)
@@ -3153,7 +3153,7 @@ static bool station_roam_scan_notify(int err, struct =
l_queue *bss_list,

 rank =3D bss->rank;

-if (hs->mde && bss->mde_present && l_get_le16(bss->mde) =3D=3D mdid)
+if (hs && hs->mde && bss->mde_present && l_get_le16(bss->mde) =3D=3D mdid)
 rank *=3D RANK_FT_FACTOR;

 group_rank =3D evaluate_bss_group_rank(bss->addr, bss->frequency,
--
2.53.0.windows.2


Mit freundlichen Gr=FC=DFen,
Dipl.-Ing. Dierk Modrow
Entwicklungsingenieur
Development Electronics -
Industrial Controller & Communication 2 (DE-AT-ICC2)

SEW-EURODRIVE GmbH & Co KG
Ernst-Blickle-Str. 42
76646 Bruchsal

T:+49 7251 75-5123
F:+49 7251 75-505123
[email protected]










________________________________


SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplement=E4rin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannhe=
im HRB 230207

Gesch=E4ftsf=FChrender Gesellschafter: J=FCrgen Blickle
Gesch=E4ftsf=FChrung: J=FCrgen Blickle (Vorsitzender), Dr. J=F6rg Hermes, D=
r. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus W=F6pperman=
n