⬢ DragonFlyBSD Kernel Audit
DF-3460 / fix.diff
← back to finding ↓ download raw 
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
--- a/sys/netproto/802_11/wlan/ieee80211_rssadapt.c	2026-09-13 07:10:01.797256875 +0000
+++ b/sys/netproto/802_11/wlan/ieee80211_rssadapt.c	2026-09-13 07:10:25.748951062 +0000
@@ -151,7 +151,13 @@
 static void
 rssadapt_deinit(struct ieee80211vap *vap)
 {
-	IEEE80211_FREE(vap->iv_rs, M_80211_RATECTL);
+	if (vap->iv_rs != NULL) {
+		IEEE80211_FREE(vap->iv_rs, M_80211_RATECTL);
+		/* Clear the pointer: the sysctl oid outlives this free until
+		 * ieee80211_sysctl_vdetach() at the END of
+		 * ieee80211_vap_detach() removes it. */
+		vap->iv_rs = NULL;
+	}
 }
 
 static void
@@ -342,8 +348,12 @@
 {
 	struct ieee80211vap *vap = arg1;
 	struct ieee80211_rssadapt *rs = vap->iv_rs;
-	int msecs = ticks_to_msecs(rs->interval);
 	int error;
+	int msecs;
+
+	if (rs == NULL)			/* vap being torn down */
+		return (ENXIO);
+	msecs = ticks_to_msecs(rs->interval);
 
 	error = sysctl_handle_int(oidp, &msecs, 0, req);
 	if (error || !req->newptr)