Bug 215377

Summary:	net-wireless/iwd-1.18 - free(): double free detected in tcache 2
Product:	Tools	Reporter:	Vasile M. (vasile.m3)
Component:	Other	Assignee:	Tools.Other (tools_other)
Status:	NEW ---
Severity:	blocking
Priority:	P1
Hardware:	All
OS:	Linux
Kernel Version:	Linux pc 5.10.76-gentoo-r1 #58 SMP Sun Dec 19 22:57:25 CET 2021 x86_64 Intel(R) Core(TM) i7-6700HQ CPU @ 2.60GHz GenuineIntel GNU/Linux	Subsystem:
Regression:	No	Bisected commit-id:

Description Vasile M. 2021-12-20 15:11:49 UTC

Crash on connecting.

iwctl
=====

[iwd]# station wlan0 connect-hidden "Hidden-network"
Type the network passphrase for Hidden-network psk.
Passphrase: ************************
Message recipient disconnected from message bus without replying


iwd -d output
=============

src/station.c:__station_connect_network() connecting to BSS <MAC-ADDRESS>
src/station.c:station_enter_state() Old State: autoconnect_full, new state: connecting
src/scan.c:scan_periodic_stop() Stopping periodic scan for wdev c
src/scan.c:scan_cancel() Trying to cancel scan id 14 for wdev c
src/netdev.c:netdev_mlme_notify() MLME notification New Station(19)
src/station.c:station_netdev_event() Associating
src/netdev.c:netdev_mlme_notify() MLME notification Authenticate(37)
src/netdev.c:netdev_authenticate_event()
src/netdev.c:netdev_unicast_notify() Unicast notification 129
src/netdev.c:netdev_control_port_frame_event()
src/netdev.c:netdev_mlme_notify() MLME notification Associate(38)
src/netdev.c:netdev_associate_event()
src/netdev.c:netdev_link_notify() event 16 on ifindex 9
src/netdev.c:netdev_mlme_notify() MLME notification Connect(46)
src/netdev.c:netdev_connect_event()
src/eapol.c:eapol_handle_ptk_1_of_4() ifindex=9
4-Way handshake failed for ifindex: 9, reason: 1
src/wiphy.c:wiphy_radio_work_done() Work item 15 done
free(): double free detected in tcache 2

Comment 1 Vasile M. 2021-12-20 16:45:07 UTC

Please read https://bugs.gentoo.org/829577#c4 and implement privilege separation and limit regular user access to iwd.

I like iwd because it is user friendly, but if iwd tries to replace wpa_supplicant, it should not be less secure.

Comment 2 Vasile M. 2022-06-18 23:39:21 UTC

Anyone here?

I recently updated the system and it still gives the same error.

net-wireless/iwd-1.26::gentoo was built with the following:
USE="client monitor -crda -ofono -standalone -systemd -wired" ABI_X86="(64)" CPU_FLAGS_X86="aes ssse3"
CFLAGS="-march=skylake -O2 -pipe -fsigned-char"