kern/143163: Radiotap bug in ieee80211_sta.c:sta_input

Alexander Egorenkov egorenar at
Sun Jan 24 13:30:02 UTC 2010

>Number:         143163
>Category:       kern
>Synopsis:       Radiotap bug in ieee80211_sta.c:sta_input
>Confidential:   no
>Severity:       non-critical
>Priority:       low
>Responsible:    freebsd-bugs
>State:          open
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Sun Jan 24 13:30:01 UTC 2010
>Originator:     Alexander Egorenkov
>Release:        FreeBSD 8.0 STABLE
FreeBSD dantooine 8.0-RELEASE FreeBSD 8.0-RELEASE #2: Tue Dec 15 17:56:06 CET 2009     root at dantooine:/usr/obj/usr/src/sys/MYKERNEL  i386
I have found a bug in ieee80211_sta.c:sta_input which causes some problems with wireshark.

Here is a code fragment:


        /* copy to listener after decrypt */
	if (ieee80211_radiotap_active_vap(vap))
		ieee80211_radiotap_tx(vap, m);   <------- Bug
	need_tap = 0;
I have found this bug by analyzing data packets with wireshark.
It causes wireshark to display wrong data.

Sniff some incoming packets with wireshark on a WLAN NIC.
he function sta_input handles incoming packets in STA mode in net80211 stack.
Thus, the right thing to do would be to call

       ieee80211_radiotap_rx(vap, m)
and not
       ieee80211_radiotap_tx(vap, m)


More information about the freebsd-bugs mailing list