[PATCH v4] src/station.c: fix of segv in station_roam_scan_notify when performing repeated roam scan at legacy roaming after FT-TO

---
Hello James,

here is my modified patch for the topic 'fix of SEGV in station_roam_scan_n=
otify
 when performing repeated roam scan at legacy roaming after ft_auth-/ft_rea=
ssoc-timeout
 when using mwifiex / NXP 88W9098 driver'
 As suggested I added only one "L_WARN_ON(!hs)"-query on method station_roa=
m_scan and two
 debug traces at methods station_try_next_transition & station_roam_scan_no=
tify. So we
 could detect if handshake might be reset to NULL unexpectedly in meantime.
 I will do tests with this variant and come back to you later with results.

 Best regards!

 src/station.c | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/src/station.c b/src/station.c
index 8fcf8c70..8d6ebb0b 100644
--- a/src/station.c
+++ b/src/station.c
@@ -2764,6 +2764,10 @@ static bool station_try_next_transition(struct stati=
on *station,
        /* Reset AP roam flag, at this point the roaming behaves the same *=
/
        station->ap_directed_roaming =3D false;

+       /* ### START: check if hs is unexpectedly set to NULL here ### */
+       l_debug("handshake pointer: %p", hs);
+       /* ### END ### */
+
        /* Can we use Fast Transition? */
        if (station_can_fast_transition(station, hs, bss) && !no_ft)
                return station_fast_transition(station, bss);
@@ -2909,6 +2913,10 @@ static bool station_roam_scan_notify(int err, struct=
 l_queue *bss_list,
                return false;
        }

+       /* ### START: check if hs is unexpectedly set to NULL here ### */
+       l_debug("handshake pointer: %p", hs);
+       /* ### END ### */
+
        /*
         * Do not call station_set_scan_results because this may have been
         * a partial scan.  We could at most update the current networks' B=
SS
@@ -3041,6 +3049,7 @@ static void station_roam_scan_destroy(void *userdata)
 static int station_roam_scan(struct station *station,
                                struct scan_freq_set *freq_set)
 {
+       struct handshake_state *hs;
        struct scan_parameters params =3D { .freqs =3D freq_set, .flush =3D=
 true };
        _auto_(scan_freq_set_free) struct scan_freq_set *allowed =3D
                                        station_get_allowed_freqs(station);
@@ -3049,6 +3058,12 @@ static int station_roam_scan(struct station *station=
,
                return -ENOTSUP;

        l_debug("ifindex: %u", netdev_get_ifindex(station->netdev));
+
+       /* ### START: check if hs is unexpectedly set to NULL here ### */
+       hs =3D netdev_get_handshake(station->netdev);
+       if (L_WARN_ON(!hs))
+               return -ENOTSUP;
+       /* ### END ### */

        if (station->connected_network) {
                const char *ssid =3D network_get_ssid(station->connected_ne=
twork);
--
2.53.0.windows.2


________________________________


SEW-EURODRIVE GmbH & Co KG
Kommanditgesellschaft, Sitz: Bruchsal, RG Mannheim HRA 230970
Komplement=E4rin: SEW-EURODRIVE Verwaltungs-GmbH, Sitz: Bruchsal, RG Mannhe=
im HRB 230207

Gesch=E4ftsf=FChrender Gesellschafter: J=FCrgen Blickle
Gesch=E4ftsf=FChrung: J=FCrgen Blickle (Vorsitzender), Dr. J=F6rg Hermes, D=
r. Hans Krattenmacher, Michael Luz, Christian Mayer, Dr. Markus W=F6pperman=
n