[PATCH 00/18] Various bugfixes and small improvements for debugging
Benjamin Berg
benjamin at sipsolutions.net
Thu Oct 30 03:44:21 PDT 2025
Hi,
After the merge, I also started seeing the below use-after-free. It
happens only when I have some other bug that causes the usual hwsim
test flow to fail. For example, I just broke
eht_mld_owe_two_links_one_disabled with a mac80211 patch and triggered
it that way.
So, it seems like there are some MLD association failure flows that do
not have proper test coverage currently. If I find a way to reproduce
the issue, then I'll post the test to help with debugging.
Benjamin
=================================================================
==614==ERROR: AddressSanitizer: heap-use-after-free on address 0x51c00000c940 at pc 0x0000005774a2 bp 0x7f7fffb69310 sp 0x7f7fffb69308
READ of size 8 at 0x51c00000c940 thread T0
#0 0x5774a1 in wpa_auth_sta_deinit ../src/ap/wpa_auth.c:1168
#1 0x5531b5 in ap_free_sta ../src/ap/sta_info.c:395
#2 0x558bc1 in ap_sta_remove_link_sta ../src/ap/sta_info.c:2026
#3 0x559149 in ap_sta_re_add ../src/ap/sta_info.c:2060
#4 0xb4e9b8 in handle_auth ../src/ap/ieee802_11.c:3527
#5 0xb6084d in ieee802_11_mgmt ../src/ap/ieee802_11.c:6911
#6 0x4d754b in hostapd_mgmt_rx ../src/ap/drv_callbacks.c:2061
#7 0x4ea517 in wpa_supplicant_event ../src/ap/drv_callbacks.c:2702
#8 0x824a44 in mlme_event_mgmt ../src/drivers/driver_nl80211_event.c:1475
#9 0x825afe in mlme_event ../src/drivers/driver_nl80211_event.c:1913
#10 0x832bd7 in process_bss_event ../src/drivers/driver_nl80211_event.c:4878
#11 0x4113b6b8 in nl_recvmsgs_report (/nix/store/635dz3p1afjwym9snp2r9hm0vaznwngy-libnl-3.11.0/lib/libnl-3.so.200+0x146b8)
#12 0x4113bb38 in nl_recvmsgs (/nix/store/635dz3p1afjwym9snp2r9hm0vaznwngy-libnl-3.11.0/lib/libnl-3.so.200+0x14b38)
#13 0x78b80b in wpa_driver_nl80211_event_receive ../src/drivers/driver_nl80211.c:2096
#14 0x60ea5e in eloop_sock_table_dispatch ../src/utils/eloop.c:603
#15 0x611feb in eloop_run ../src/utils/eloop.c:1234
#16 0x437f71 in hostapd_global_run /home/bergbenj/Projects/intel/iwlwifi-vlab/hostap/hostapd/main.c:591
#17 0x43dd26 in main /home/bergbenj/Projects/intel/iwlwifi-vlab/hostap/hostapd/main.c:1069
#18 0x4216247d in __libc_start_call_main (/nix/store/svgs03522r9qndw6j9kljafjq3w34rwa-glibc-multi-2.40-66/lib/libc.so.6+0x2a47d) (BuildId: 295697e46737532f05317823a9a421b7e462a933)
#19 0x42162538 in __libc_start_main_alias_1 (/nix/store/svgs03522r9qndw6j9kljafjq3w34rwa-glibc-multi-2.40-66/lib/libc.so.6+0x2a538) (BuildId: 295697e46737532f05317823a9a421b7e462a933)
#20 0x434be4 in _start (/tmp/.host/tmp/vlab_mnt/iwlwifi-vlab/hostap/hostapd/hostapd+0x434be4)
0x51c00000c940 is located 192 bytes inside of 1728-byte region [0x51c00000c880,0x51c00000cf40)
freed by thread T0 here:
#0 0x401373f8 in free.part.0 (/nix/store/4h2hwl6gf5b8dwk379b55270cbdakrrn-gcc-14.2.1.20250322-lib/lib64/libasan.so.8+0xfb3f8)
#1 0x623394 in os_free ../src/utils/os_unix.c:784
#2 0x619fda in bin_clear_free ../src/utils/common.c:1061
#3 0x5626f0 in wpa_free_sta_sm ../src/ap/wpa_auth.c:1157
#4 0x5777ec in wpa_auth_sta_deinit ../src/ap/wpa_auth.c:1201
#5 0xb4e344 in handle_auth ../src/ap/ieee802_11.c:3460
#6 0xb6084d in ieee802_11_mgmt ../src/ap/ieee802_11.c:6911
#7 0x4d754b in hostapd_mgmt_rx ../src/ap/drv_callbacks.c:2061
#8 0x4ea517 in wpa_supplicant_event ../src/ap/drv_callbacks.c:2702
#9 0x824a44 in mlme_event_mgmt ../src/drivers/driver_nl80211_event.c:1475
#10 0x825afe in mlme_event ../src/drivers/driver_nl80211_event.c:1913
#11 0x832bd7 in process_bss_event ../src/drivers/driver_nl80211_event.c:4878
#12 0x4113b6b8 in nl_recvmsgs_report (/nix/store/635dz3p1afjwym9snp2r9hm0vaznwngy-libnl-3.11.0/lib/libnl-3.so.200+0x146b8)
previously allocated by thread T0 here:
#0 0x40138757 in malloc (/nix/store/4h2hwl6gf5b8dwk379b55270cbdakrrn-gcc-14.2.1.20250322-lib/lib64/libasan.so.8+0xfc757)
#1 0x622edb in os_malloc ../src/utils/os_unix.c:726
#2 0x6238eb in os_zalloc ../src/utils/os_unix.c:790
#3 0x576cf2 in wpa_auth_sta_init ../src/ap/wpa_auth.c:1032
#4 0xb2de65 in __check_assoc_ies ../src/ap/ieee802_11.c:4503
#5 0xb323f0 in check_assoc_ies ../src/ap/ieee802_11.c:4861
#6 0xb5b15d in handle_assoc ../src/ap/ieee802_11.c:6098
#7 0xb60887 in ieee802_11_mgmt ../src/ap/ieee802_11.c:6916
#8 0x4d754b in hostapd_mgmt_rx ../src/ap/drv_callbacks.c:2061
#9 0x4ea517 in wpa_supplicant_event ../src/ap/drv_callbacks.c:2702
#10 0x824a44 in mlme_event_mgmt ../src/drivers/driver_nl80211_event.c:1475
#11 0x825afe in mlme_event ../src/drivers/driver_nl80211_event.c:1913
#12 0x832bd7 in process_bss_event ../src/drivers/driver_nl80211_event.c:4878
#13 0x4113b6b8 in nl_recvmsgs_report (/nix/store/635dz3p1afjwym9snp2r9hm0vaznwngy-libnl-3.11.0/lib/libnl-3.so.200+0x146b8)
SUMMARY: AddressSanitizer: heap-use-after-free ../src/ap/wpa_auth.c:1168 in wpa_auth_sta_deinit
Shadow bytes around the buggy address:
0x51c00000c680: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x51c00000c700: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
0x51c00000c780: 00 00 00 fa fa fa fa fa fa fa fa fa fa fa fa fa
0x51c00000c800: fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa fa
0x51c00000c880: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
=>0x51c00000c900: fd fd fd fd fd fd fd fd[fd]fd fd fd fd fd fd fd
0x51c00000c980: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x51c00000ca00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x51c00000ca80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x51c00000cb00: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
0x51c00000cb80: fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd fd
Shadow byte legend (one shadow byte represents 8 application bytes):
Addressable: 00
Partially addressable: 01 02 03 04 05 06 07
Heap left redzone: fa
Freed heap region: fd
Stack left redzone: f1
Stack mid redzone: f2
Stack right redzone: f3
Stack after return: f5
Stack use after scope: f8
Global redzone: f9
Global init order: f6
Poisoned by user: f7
Container overflow: fc
Array cookie: ac
Intra object redzone: bb
ASan internal: fe
Left alloca redzone: ca
Right alloca redzone: cb
==614==ABORTING
On Thu, 2025-10-30 at 09:24 +0100, Benjamin Berg wrote:
> From: Benjamin Berg <benjamin.berg at intel.com>
>
> Hi,
>
> We are finally updating our internal hostap tree to the latest
> upstream
> version. These patches address the issues that I ran into which seem
> to
> be applicable to upstream. Note that with some of the patches in the
> series I have taken the approach of just fixing the immediate issue.
> In
> those cases, I have added comments into the patch as we may want to
> solve the underlying issues differently.
>
> Benjamin
>
> Benjamin Berg (18):
> AP: fix use after free in link reconfiguration
> nl80211: put nl_cb in error paths
> eloop: remove references before destroying socket table
> WNM: Clear the target BSS on reset
> int_array: Only iterate existing elements in equality check
> wpa_supplicant: define last_scan_freqs as int array
> tests: Fetch BSS from P2P device interface
> utils: Provide hexdump stubs as inline functions
> wpa_debug: use separate buffer for path and improve error checking
> tests: check for WPA_TRACE messages in hostapd log
> utils: Keep the last NOTE message as context for backtraces
> wpa_supplicant: Accept NOTE command on global socket
> tests: Issue TEST-START NOTE to hostapd instance
> tests: Issue TEST-START NOTE to extra wpa_suplicant instances
> P2P2: Handle identity ID consistently within files
> tests: add network to P2P device
> common: Fix definition of EHT_ML_EML_CAPA_RESERVED
> common: Use signed return value for ieee802_11_defrag_mle_subelem
>
> hostapd/ctrl_iface.c | 2 ++
> src/ap/ieee802_11_eht.c | 2 +-
> src/common/ieee802_11_common.c | 6 ++---
> src/common/ieee802_11_common.h | 6 ++---
> src/common/ieee802_11_defs.h | 2 +-
> src/drivers/driver_nl80211.c | 2 ++
> src/utils/common.c | 2 +-
> src/utils/eloop.c | 1 +
> src/utils/trace.c | 34 +++++++++++++++++++++++++-
> src/utils/trace.h | 25 +++++++++++++++----
> src/utils/wpa_debug.c | 23 ++++++++++--------
> src/utils/wpa_debug.h | 36 +++++++++++++++++++++++---
> --
> tests/hwsim/run-tests.py | 16 +++++++++++++
> tests/hwsim/test_eht.py | 10 ++++++--
> tests/hwsim/test_p2p2.py | 10 ++++----
> tests/hwsim/test_p2p_wifi_display.py | 3 ++-
> tests/hwsim/wpasupplicant.py | 6 ++---
> wpa_supplicant/config_file.c | 28 ++++++++++++++++++----
> wpa_supplicant/ctrl_iface.c | 5 ++++
> wpa_supplicant/dpp_supplicant.c | 9 +++----
> wpa_supplicant/events.c | 7 +++---
> wpa_supplicant/wnm_sta.c | 2 ++
> wpa_supplicant/wpa_supplicant_i.h | 1 -
> 23 files changed, 181 insertions(+), 57 deletions(-)
More information about the Hostap
mailing list