segfault while connecting to wifi

[illiliti]

Due to unknown circumstances(something related to dhcp/ipv6), eiwd may cause segfault while connecting to wifi.

Further investigation revealed that it was caused by passing NULL to inet_ntop function.

[0] The problem is here:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/icmp6.c#n291

[1] NULL is set to client->ra by l_icmp6_client_stop:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/icmp6.c#n516

[2] Which may be called by l_dhcp6_client_stop:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/dhcp6.c#n1854

[3] Which is called by dhcp6_client_icmp6_event:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/dhcp6.c#n1479

[4] Which is called via client->event_handler:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/icmp6.c#n268

[5] client->event_handler is set by l_icmp6_client_set_event_handler:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/dhcp6.c#n1513

[6] The actual problem is here:
https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/dhcp6.c#n1478

If managed and other is false, client->ra will be set to NULL and later deferenced by inet_ntop.

https://git.kernel.org/pub/scm/libs/ell/ell.git/tree/ell/icmp6.c#n333:

if (!client->ra) {
    client->ra = r;
    // client->ra will be set to NULL if `managed` and `other` is false[6]
    icmp6_client_event_notify(client, L_ICMP6_CLIENT_EVENT_ROUTER_FOUND);
    // client->ra will deferenced by `inet_ntop` in `icmp6_client_setup_routes`[0]
    icmp6_client_setup_routes(client); 
    return 0;
}

The fix is trivial:

diff --git a/ell/icmp6.c b/ell/icmp6.c
index fe8a506..c7f1458 100644
--- a/ell/icmp6.c
+++ b/ell/icmp6.c
@@ -288,6 +288,10 @@ static void icmp6_client_setup_routes(struct l_icmp6_client *client)
 	char buf[INET6_ADDRSTRLEN];
 	unsigned int i;
 
+	if (!ra) {
+	    return;
+	}
+
 	rt = l_rtnl_route_new_gateway(inet_ntop(AF_INET6, ra->address,
 							buf, sizeof(buf)));
 	if (!rt) {

Looks like upstream is affected too? If so, i will try to send patch to mailing list.

[illiliti]

Can't reproduce anymore