From: Inti Manuel Yabar-Pagaza <intimyp@gmail.com>
To: iwd@lists.linux.dev
Cc: Inti Manuel Yabar-Pagaza <intimyp@gmail.com>
Subject: [PATCH 0/2] Fix two crashes in the agent request path
Date: Wed, 12 Aug 2026 11:16:50 +0200
Message-ID: <cover.1786525748.git.intimyp@gmail.com>
Precedence: bulk
MIME-Version: 1.0
Content-Transfer-Encoding: 8bit

Both of these turn up in one scenario: an 802.1X network whose
provisioning file leaves a credential out, so the daemon has to ask the
agent for it, and the request is not answered before the 120 s timeout.
They are independent bugs in independent components, but the first is
what made the second easy to reach, so they are sent together.

The client bug has been latent since 2019 and the daemon bug since
2021; both are present at d003d0e (Release 3.12) by inspection.

Patch 1 - iwctl aborts with "free(): double free detected in tcache 2".
display_agent_prompt_release() destroys the stdin l_io without clearing
the file-static pointer, and the creation sites are guarded by
"if (!io)", so the second prompt of a username+password request installs
a read handler on freed memory. A side effect is that the credentials
are never sent at all, so the user sees a two minute hang rather than an
authentication failure.

Patch 2 - iwd segfaults in agent_finalize_pending(). request_timeout()
does not clear agent->pending_id, so after a timeout the daemon holds a
stale id with an empty request queue; when the agent's name drops off
the bus, agent_disconnect() pops NULL off that queue and dereferences
it. Any agent that exits after a request timeout reproduces this,
whether or not it hit patch 1's bug.

Both were verified at runtime by building the same tree patched and
unpatched and running the identical sequence against each: the stock
binaries abort and segfault respectively, the patched ones complete the
prompt and stay up. Tested on iwd 3.12 with ell 0.83, kernel 7.1.4,
MediaTek MT7925 (mt7925e), PEAP/MSCHAPv2.

Heads up that the analysis, patches and commit messages here are largely
AI-generated (Claude), reviewed and tested by me.

Inti Manuel Yabar-Pagaza (2):
  client: fix double free in agent prompts
  agent: clear pending_id on request timeout

 client/display.c | 2 ++
 src/agent.c      | 3 +++
 2 files changed, 5 insertions(+)

-- 
2.55.0