Endless loop in hostapd trunk SHA implementation

[michael-dev]

Hi,

I'm using OpenWRT trunk on a P1020WLAN (MPC85xx) SMP PPC32 system, 
which uses the 2012-04-28 snapshot of hostapd with some patches [1].
Sometimes, the hostapd hangs in an infinite loop and all backtraces I 
got look similar (sometimes it is in SHA1Final)

I'm trying to gather more detailled information so I am asking here if 
somebody has seen something similar himself already.

I'll so checkout vanilla hostapd to make sure that those patches did 
not affect this.

Regards,
  M. Braun

#0  0x1005d520 in SHA1Transform (state=0xbf959f38, buffer=<value 
optimized out>) at ../src/crypto/sha1-internal.c:193
#1  0x1005e628 in SHA1Update (context=0xbf959f38, _data=0xbf95a100, 
len=76) at ../src/crypto/sha1-internal.c:257
#2  0x1005e7f0 in sha1_vector (num_elem=4, addr=0xbf959ff4, 
len=0xbf959fdc, mac=0xbf95a0a4 "???p?rt", '\\' <repeats 20 times>, 
"?\225??\225?\220\020b?\020")
     at ../src/crypto/sha1-internal.c:258
#3  0x1005d28c in hmac_sha1_vector (key=0x1062a710 
"f\035T???\202?\004??\022\232?\206=?\003\227???mL\2243T\234\226?K0H`l", 
key_len=32, num_elem=3, addr=0xbf95a098,
     len=0xbf95a08c, mac=0xbf95a0a4 "???p?rt", '\\' <repeats 20 times>, 
"?\225??\225?\220\020b?\020") at ../src/crypto/sha1.c:63
#4  0x1005d414 in sha1_prf (key=0x1062a710 
"f\035T???\202?\004??\022\232?\206=?\003\227???mL\2243T\234\226?K0H`l", 
key_len=32, label=<value optimized out>,
     data=<value optimized out>, data_len=76, buf=0xbf95a190 
"Q\016Iy??5??\206??,?.(-X??\0256\031\204?`?a?\237\222\030VN6?\024(-?\b\025??\033???\225??\020\001?l", 
buf_len=48)
     at ../src/crypto/sha1.c:63
#5  0x1001ce34 in wpa_pmk_to_ptk (pmk=0x1062a710 
"f\035T???\202?\004??\022\232?\206=?\003\227???mL\2243T\234\226?K0H`l", 
pmk_len=32, label=0x1006d4b0 "Pairwise key expansion",
     addr1=0x106264e4 "", addr2=0x1062ae08 "$w\003&w?", 
nonce1=0x1062ae4c 
"v?\037|\220??$\024\237h&?@??\005?\v?\227-\215riO\217&?\021?\200\025R?\234?A\017$\227Lt\024[",
     nonce2=0x1062ae6c "\200\025R?\234?A\017$\227Lt\024[", 
ptk=0xbf95a190 
"Q\016Iy??5??\206??,?.(-X??\0256\031\204?`?a?\237\222\030VN6?\024(-?\b\025??\033???\225??\020\001?l",
     ptk_len=48, use_sha256=0) at ../src/common/wpa_common.c:118
#6  0x100128a4 in sm_WPA_PTK_PTKCALCNEGOTIATING_Enter (sm=0x1062ae00) 
at ../src/ap/wpa_auth.c:2491
#7  0x10014828 in wpa_sm_step (sm=0x1062ae00) at 
../src/ap/wpa_auth.c:2491
#8  0x100158dc in wpa_receive (wpa_auth=0x10626420, sm=0x1062ae00, 
data=0xbf95a490 "\001\003", data_len=121) at ../src/ap/wpa_auth.c:2491
#9  0x1000cc80 in ieee802_1x_receive (hapd=0x10622940, sa=<value 
optimized out>, buf=0xbf95a490 "\001\003", len=121) at 
../src/ap/ieee802_1x.c:1218
#10 0x100099a4 in hostapd_wpa_event (ctx=0x10624860, event=<value 
optimized out>, data=<value optimized out>) at 
../src/ap/drv_callbacks.c:309
#11 0x1002d91c in handle_eapol (sock=<value optimized out>, 
eloop_ctx=<value optimized out>, sock_ctx=<value optimized out>) at 
../src/drivers/driver_nl80211.c:7585
#12 0x1001a0a8 in eloop_sock_table_dispatch (table=0x10098e70, 
fds=0x1062bf78) at ../src/utils/eloop.c:371
#13 0x1001aa30 in eloop_run () at ../src/utils/eloop.c:371
#14 0x10002140 in main (argc=<value optimized out>, argv=0xbf95b444)

[1]
http://git.fem.tu-ilmenau.de/?p=fem-wlan.git;a=tree;f=package/hostapd;h=51324f504ef665e72f536ac716956b5dc83292a6;hb=refs/heads/femwlan_stage2