SIGSEGV with timeouted WiFi 6 driver

[Maciej Witkowski]

Hi,

i'm running a WiFi 6 USB dongle CF-953AX that sometimes times out.

When driver mt7921u is in timeouted state, every time I start hostapd, 
it crashes with SIGSEGV.

The driver or the device is faulty [1] but it's independent to the 
hostapd issue,

because hostapd should exit normally, without memory violations.


# /root/hostapd -P /run/hostapd.pid /etc/hostapd/hostapd.conf
Could not set interface wlan1 flags (UP): Connection timed out
nl80211: Could not set interface 'wlan1' UP
nl80211: deinit ifname=wlan1 disabled_11b_rates=0
nl80211: remove link (0) failed. ret=-100 (Network is down)
Segmentation fault


$ uname -r
6.7.0-rc5-v8-Upgrade_RasPiOS_Kernel-wifi-rpi-6.7.y+

Reading symbols from /root/hostapd...
(gdb) run
Starting program: /root/hostapd -P /run/hostapd.pid 
/etc/hostapd/hostapd.conf
[Thread debugging using libthread_db enabled]
Using host libthread_db library "/lib/aarch64-linux-gnu/libthread_db.so.1".
Could not set interface wlan1 flags (UP): Connection timed out
nl80211: Could not set interface 'wlan1' UP
nl80211: deinit ifname=wlan1 disabled_11b_rates=0
nl80211: remove link (0) failed. ret=-100 (Network is down)

Program received signal SIGSEGV, Segmentation fault.
0x00000055555cb470 in nl80211_cmd (cmd=5 '\005', flags=0, 
msg=0x55556bce10, drv=0x556b92b0) at ../src/drivers/driver_nl80211.c:737
737             return genlmsg_put(msg, 0, 0, drv->global->nl80211_id,
(gdb)
(gdb) bt
#0  0x00000055555cb470 in nl80211_cmd (cmd=5 '\005', flags=0, 
msg=0x55556bce10, drv=0x556b92b0) at ../src/drivers/driver_nl80211.c:737
#1  nl80211_cmd_msg (bss=bss at entry=0x55556b99b0, flags=flags at entry=0, 
cmd=cmd at entry=5 '\005') at ../src/drivers/driver_nl80211.c:758
#2  0x00000055555cb514 in nl80211_get_ifmode 
(bss=bss at entry=0x55556b99b0) at ../src/drivers/driver_nl80211.c:868
#3  0x00000055555cb714 in i802_set_iface_flags (bss=0x55556b99b0, up=0) 
at ../src/drivers/driver_nl80211.c:2923
#4  0x00000055555d1e74 in wpa_driver_nl80211_deinit (bss=0x55556b99b0) 
at ../src/drivers/driver_nl80211.c:3213
#5  0x00000055555d26f4 in wpa_driver_nl80211_drv_init (ctx=0x55556b7d70, 
ifname=0x55556b7680 "wlan1", global_priv=0x55556b8c70, 
hostapd=hostapd at entry=1, set_addr=0x0, driver_params=0x0)
     at ../src/drivers/driver_nl80211.c:2433
#6  0x00000055555d2808 in i802_init (hapd=<optimized out>, 
params=0x7ffffff100) at ../src/drivers/driver_nl80211.c:8619
#7  0x000000555555e178 in hostapd_driver_init (iface=0x55556b6a50) at 
main.c:274
#8  0x000000555555d84c in main (argc=<optimized out>, argv=<optimized 
out>) at main.c:1002

```
void * nl80211_cmd(struct wpa_driver_nl80211_data *drv,
                    struct nl_msg *msg, int flags, uint8_t cmd)
{
         if (TEST_FAIL())
                 return NULL;
         return genlmsg_put(msg, 0, 0, drv->global->nl80211_id, // here 
SIGSEGV
                            0, flags, cmd, 0);
}
```


[1] https://github.com/morrownr/USB-WiFi/issues/107#issuecomment-1850778201



Best regards,

Maciej Witkowski