wpa_supplicant segfault in large WLAN

[Matt Causey]

On Thu, Sep 26, 2013 at 6:03 PM, Jouni Malinen <j at w1.fi> wrote:

> On Thu, Sep 26, 2013 at 05:19:20PM -0400, Matt Causey wrote:
> > So perhaps I'm revealing my ignorance here, but I cannot repro this
> > segfault under valgrind:
> >
> > sudo valgrind wpa_supplicant -t -Dnl80211 -onl80211 -dddd -i wlan0 -c
> > /var/tmp/nerf.conf
> >
> > Is there something I'm missing here?
>
> valgrind can actually "hide" some crashes, but if that happened, you
> should see valgrind error messages.. May be it is easiest to direct them
> to a file ("sudo valgrind --log-file=/tmp/valgrind.log wpa_supplicant
> ...") and check whether you'll get entries there about invalid memory
> accesses.
>

I can't seem to do anything that will cause this segfault to happen
w/valgrind.  :-(  What do you think about this:

==25997== LEAK SUMMARY:
==25997==    definitely lost: 0 bytes in 0 blocks
==25997==    indirectly lost: 0 bytes in 0 blocks
==25997==      possibly lost: 205 bytes in 18 blocks
==25997==    still reachable: 36 bytes in 2 blocks
==25997==         suppressed: 0 bytes in 0 blocks
==25997== Reachable blocks (those to which a pointer was found) are not
shown.
==25997== To see them, rerun with: --leak-check=full --show-reachable=yes
==25997==
==25997== For counts of detected and suppressed errors, rerun with: -v
==25997== Use --track-origins=yes to see where uninitialised values come
from
==25997== ERROR SUMMARY: 155711 errors from 129 contexts (suppressed: 27
from 6)

I've attached the full and compressed valgrind log, though it may end up
being scrubbed by the server.

Thoughts?

--
Matt
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.shmoo.com/pipermail/hostap/attachments/20130926/a6a5697d/attachment.htm>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: wpa_valgrind.log.gz
Type: application/x-gzip
Size: 3563 bytes
Desc: not available
URL: <http://lists.shmoo.com/pipermail/hostap/attachments/20130926/a6a5697d/attachment.bin>