⬢ DragonFlyBSD Kernel Audit
DF-3285 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
--- a/sys/netproto/802_11/ieee80211_proto.h	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/ieee80211_proto.h	2026-10-26 03:31:47.211168877 +0000
@@ -397,6 +397,7 @@
 	uint16_t	bo_csa_trailer_len;
 	uint8_t		*bo_csa;	/* start of CSA element */
 	uint8_t		*bo_quiet;	/* start of Quiet element */
+	int		bo_quiet_set;	/* Quiet IE was constructed */
 	uint8_t		*bo_meshconf;	/* start of MESHCONF element */
 	uint8_t		*bo_spare[3];
 };
--- a/sys/netproto/802_11/wlan/ieee80211_output.c	2026-06-29 12:51:19.000000000 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_output.c	2026-10-26 03:31:47.239168522 +0000
@@ -3171,13 +3171,18 @@
 
 	if (vap->iv_flags & IEEE80211_F_DOTH) {
 		bo->bo_quiet = frm;
+		bo->bo_quiet_set = 0;
 		if (IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
 		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS)) {
-			if (vap->iv_quiet)
+			if (vap->iv_quiet) {
 				frm = ieee80211_add_quiet(frm,vap);
+				bo->bo_quiet_set = 1;
+			}
 		}
-	} else
+	} else {
 		bo->bo_quiet = frm;
+		bo->bo_quiet_set = 0;
+	}
 
 	if (IEEE80211_IS_CHAN_ANYG(ni->ni_chan)) {
 		bo->bo_erp = frm;
@@ -3571,7 +3576,8 @@
 		}
 		if (IEEE80211_IS_CHAN_DFS(ic->ic_bsschan) &&
 		    (vap->iv_flags_ext & IEEE80211_FEXT_DFS) ){
-			if (vap->iv_quiet)
+			/* only update in place when the IE was built */
+			if (vap->iv_quiet && bo->bo_quiet_set)
 				ieee80211_add_quiet(bo->bo_quiet, vap);
 		}
 		if (isset(bo->bo_flags, IEEE80211_BEACON_ERP)) {