git: wlan: Fix NULL deref bug in hwmp_discover()

[Aaron LI]

commit 95d8adeb803ca84d74c48df44e3a31f4dffe5ed2
Author: Aaron LI <aly at aaronly.me>
Date:   Tue Oct 13 09:24:31 2026 +0800

    wlan: Fix NULL deref bug in hwmp_discover()
    
    The 'ni' is explicitly NULL, but IEEE80211_NOTE() expands to
    ieee80211_note_mac() that would access 'ni->ni_macaddr', causing a NULL
    deref.  Fix it by porting the FreeBSD's fix: replacing IEEE80211_NOTE()
    with IEEE80211_DPRINTF() without accessing 'ni'.
    
    Caught by GCC 12.5 warning:
    
    ```
    In file included from /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:63:
    /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c: In function 'hwmp_discover':
    dragonfly/netproto/802_11/ieee80211_var.h:963:17: warning: 'ieee80211_note_mac' reading 6 bytes from a region of size 0 [-Wstringop-overread]
      963 |                 ieee80211_note_mac(_vap, (_ni)->ni_macaddr, _fmt, __VA_ARGS__);\
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:2137:33: note: in expansion of macro 'IEEE80211_NOTE'
     2137 |                                 IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
          |                                 ^~~~~~~~~~~~~~
    dragonfly/netproto/802_11/ieee80211_var.h:963:17: note: referencing argument 2 of type 'const uint8_t[6]' {aka 'const unsigned char[6]'}
      963 |                 ieee80211_note_mac(_vap, (_ni)->ni_macaddr, _fmt, __VA_ARGS__);\
          |                 ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    /usr/src/sys/netproto/802_11/wlan/ieee80211_hwmp.c:2137:33: note: in expansion of macro 'IEEE80211_NOTE'
     2137 |                                 IEEE80211_NOTE(vap, IEEE80211_MSG_HWMP,
          |                                 ^~~~~~~~~~~~~~
    dragonfly/netproto/802_11/ieee80211_var.h:975:9: note: in a call to function 'ieee80211_note_mac'
      975 | void    ieee80211_note_mac(const struct ieee80211vap *,
          |         ^~~~~~~~~~~~~~~~~~
    ```

Summary of changes:
 sys/netproto/802_11/wlan/ieee80211_hwmp.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

http://gitweb.dragonflybsd.org/dragonfly.git/commitdiff/95d8adeb803ca84d74c48df44e3a31f4dffe5ed2


-- 
DragonFly BSD source repository