Page MenuHomeFreeBSD

net80211: don't dereference a NULL HTINFO IE if it's presented
ClosedPublic

Authored by adrian on Jun 11 2025, 6:19 PM.
Referenced Files
F142366824: D50794.id158613.diff
Mon, Jan 19, 4:00 AM
F142359297: D50794.id.diff
Mon, Jan 19, 1:15 AM
F142342465: D50794.id.diff
Sun, Jan 18, 8:05 PM
F142340452: D50794.id156833.diff
Sun, Jan 18, 7:33 PM
F142340254: D50794.diff
Sun, Jan 18, 7:28 PM
Unknown Object (File)
Thu, Jan 15, 10:04 PM
Unknown Object (File)
Wed, Jan 14, 12:21 AM
Unknown Object (File)
Tue, Jan 6, 12:07 PM

Details

Summary

ieee80211_vht_get_vhtflags() is checking the htinfo IE for the
20/40MHz flag as part of deciding valid channel widths.

However, in the hostapd path, the ASSOC_REQ/REASSOC_REQ path
will parse the IEs, do some HT/VHT setup, then call
ieee80211_ht_updatehtcap_final(). In a HT ASSOC/REASSOC request
there won't be a HTINFO IE, however ieee80211_vht_get_vhtflags()
still checks for it, leading to a panic.

Instead, treat it as if we don't yet know if it's HT40 or not.
I'm not sure if we should do that or have it just do
_RETURN_CHAN_BITS(0).

Diff Detail

Repository
rG FreeBSD src repository
Lint
Lint Skipped
Unit
Tests Skipped
Build Status
Buildable 64763
Build 61647: arc lint + arc unit