[PW_SID:1128473] Fix two station roaming crashes - #508
Conversation
station_preauthenticate_cb() falls through its error branch: after unreffing new_hs on a failed station_transition_reassociate(), it proceeds to swap station->hs to a reference on the freed handshake. Return instead. Assisted-by: Claude:claude-fable-5
netdev_reassociate() replaces netdev->handshake and unrefs the old handshake without freeing netdev->ap or dequeuing a pending connection work item. If a reassociation begins while an earlier attempt's radio work is still queued (reachable since station_cannot_roam() does not cover the connecting states), the stale auth proto keeps a raw pointer to the freed handshake. On the PMKSA-cache path netdev_connect_common() does not replace netdev->ap, and it re-inserts the already-queued embedded work item; when the work finally runs, netdev_begin_connection() starts the stale auth proto and sae_start() dereferences the freed handshake: #0 sae_choose_next_group <- reads handshake->ecc_sae_pts == NULL #1 sae_start #2 netdev_begin_connection #3 netdev_connection_work_ready #4 wiphy_radio_work_next #5 get_scan_done Mirror netdev_connect(), which already refuses to start while netdev->connect_cmd_id or netdev->work.id is set. Both are zero at any legitimate roam start since netdev_connect_ok() completes the work item, and the station roam paths handle a negative return by failing the roam cleanly. Assisted-by: Claude:claude-fable-5
station_ap_directed_roam() initialized ignore_candidates from station->connected_bss->vendor_quirks before the state != CONNECTED guard. station_disconnect() clears connected_bss before entering DISCONNECTING and the WNM frame watch outlives the connection, so a BSS Transition Management frame arriving in that window crashes on the dereference the guard was meant to prevent. Assign it after the state check, which guarantees connected_bss is set (the frame-sanitize memcmp below already relies on the same invariant). Assisted-by: Claude:claude-fable-5
|
Fetch PR Prep - Setup ELL Make Distcheck Build - Configure Make Check Make Check w/Valgrind Incremental Build with patches |
|
Fetch PR GitLint Prep - Setup ELL Make Distcheck Build - Configure Make Check Make Check w/Valgrind Incremental Build with patches Autotest Runner Clang Build |
2 participants
station_preauthenticate_cb() falls through its error branch: after
unreffing new_hs on a failed station_transition_reassociate(), it
proceeds to swap station->hs to a reference on the freed handshake.
Return instead.
Assisted-by: Claude:claude-fable-5
src/station.c | 1 +
1 file changed, 1 insertion(+)