Ticket #1071: ieee80211_input_crash_fix.3.diff

net80211/ieee80211_input.c

@@ -222 +222 @@
-        struct sk_buff *skb, int rssi, u_int32_t rstamp)
-{
-#define HAS_SEQ(type)   ((type & 0x4) == 0)
-ni->ni_vap;
-vap->iv_ic
+NULL; 
+NULL
-        struct ieee80211_node *ni_wds = NULL;
-vap->iv_dev
+NULL
-        struct ieee80211_frame *wh;
-        struct ieee80211_key *key;
-        struct ether_header *eh;
@@ -236 +236 @@
-        u_int8_t dir, type, subtype;
-        u_int8_t *bssid;
-        u_int16_t rxseq;
+        
+        KASSERT(ni != NULL, ("null node"));
+        
+        type = -1;                      /* undefined */
-
-
+
+
+
+
+
+
+
+
+
-        ni->ni_inact = ni->ni_inact_reload;
-
-        KASSERT(skb->len >= sizeof(struct ieee80211_frame_min),
-                ("frame length too short: %u", skb->len));
-
-        /* XXX adjust device in sk_buff? */
-
-
+
-        /*
-         * In monitor mode, send everything directly to bpf.
-         * Also do not process frames w/o i_addr2 any further.