kern/160391: Panic in mesh mode

[Edgar Martinez]

>Number:         160391
>Category:       kern
>Synopsis:       Panic in mesh mode
>Confidential:   no
>Severity:       serious
>Priority:       medium
>Responsible:    freebsd-bugs
>State:          open
>Quarter:        
>Keywords:       
>Date-Required:
>Class:          sw-bug
>Submitter-Id:   current-users
>Arrival-Date:   Fri Sep 02 11:10:11 UTC 2011
>Closed-Date:
>Last-Modified:
>Originator:     Edgar Martinez
>Release:        9.0-BETA2
>Organization:
>Environment:
FreeBSD chuckles.local 9.0-BETA2 FreeBSD 9.0-BETA2 #0: Mon Aug 29 09:38:20 PDT 2011     root at chuckles.local:/usr/obj/usr/src/sys/GENERIC  i386

>Description:
Kernel Panic when in mesh mode
>How-To-Repeat:
create two mesh nodes, pass traffic
>Fix:
*** ieee80211_mesh.c    Tue May  3 19:23:59 2011
--- ieee80211_mesh.c.mod        Fri Sep  2 04:05:20 2011
***************
*** 1460,1470 ****
                                meshid = frm;
                                break;
                        }
                        frm += frm[1] + 2;
                }
!               IEEE80211_VERIFY_ELEMENT(ssid, IEEE80211_NWID_LEN, return);
                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
                if (xrates != NULL)
                        IEEE80211_VERIFY_ELEMENT(xrates,
                            IEEE80211_RATE_MAXSIZE - rates[1], return);
                if (meshid != NULL) {
--- 1460,1470 ----
                                meshid = frm;
                                break;
                        }
                        frm += frm[1] + 2;
                }
!               IEEE80211_VERIFY_ELEMENT(meshid, IEEE80211_NWID_LEN, return);
                IEEE80211_VERIFY_ELEMENT(rates, IEEE80211_RATE_MAXSIZE, return);
                if (xrates != NULL)
                        IEEE80211_VERIFY_ELEMENT(xrates,
                            IEEE80211_RATE_MAXSIZE - rates[1], return);
                if (meshid != NULL) {


>Release-Note:
>Audit-Trail:
>Unformatted: