Page MenuHomeFreeBSD

net80211: fix a NULL deref in ieee80211_sta_join1()
ClosedPublic

Authored by bz on Jan 16 2024, 7:00 PM.
Tags
None
Referenced Files
F87275502: D43469.id132843.diff
Mon, Jul 1, 3:07 AM
Unknown Object (File)
Sat, Jun 29, 1:20 AM
Unknown Object (File)
Fri, Jun 28, 1:46 PM
Unknown Object (File)
May 24 2024, 8:02 AM
Unknown Object (File)
May 17 2024, 6:02 AM
Unknown Object (File)
May 15 2024, 10:15 AM
Unknown Object (File)
May 15 2024, 7:22 AM
Unknown Object (File)
May 13 2024, 6:27 AM

Details

Summary

When ieee80211_sta_join1() gets an obss without ni_nt trying to lock
that will cause a NULL pointer deref. Check for the table to be
valid and deal with the obss node accordingly.

This can happen if sta_newstate() calls ieee80211_reset_bss() for
nstate == INIT and ostate != INIT. ieee80211_reset_bss() itself
calls ieee80211_node_table_reset() which calls node_reclaim()
which ends up in ieee80211_del_node_nt() which does remove the
node from the table and sets ni_table to NULL.
That node (former iv_bss) can then be returned as obss in the
(*iv_update_bss)() call in join1().

MFC after: 3 days

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Not Applicable
Unit
Tests Not Applicable