The branch main has been updated by bz: URL: https://cgit.FreeBSD.org/src/commit/?id=0211e64ce1e5ba208f4b96453ce6740a49689b91
commit 0211e64ce1e5ba208f4b96453ce6740a49689b91 Author: Kim Shrier <[email protected]> AuthorDate: 2026-08-31 16:28:51 +0000 Commit: Bjoern A. Zeeb <[email protected]> CommitDate: 2026-08-31 16:46:55 +0000 LinuxKPI: 802.11: add != NULL check in ieee80211_tx_status_ext() There seems to be another possible race with net80211 state machine changing the bss from under us (another lvif_bss_synched case). Just do the != NULL check to avoid a NULL pointer deref in ieee80211_ratectl_rate(). (bz extended the original comment and wrote the commit message). Sponosred by: The FreeBSD Foundation (commit) PR: 297184 MFC after: 3 days --- sys/compat/linuxkpi/common/src/linux_80211.c | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/sys/compat/linuxkpi/common/src/linux_80211.c b/sys/compat/linuxkpi/common/src/linux_80211.c index fd92f1dcf75b..f1eef91af0da 100644 --- a/sys/compat/linuxkpi/common/src/linux_80211.c +++ b/sys/compat/linuxkpi/common/src/linux_80211.c @@ -9128,7 +9128,15 @@ linuxkpi_ieee80211_tx_status_ext(struct ieee80211_hw *hw, IMPROVE("only update rate if needed but that requires us to get a proper rate from mo_sta_statistics"); ieee80211_ratectl_tx_complete(ni, &txs); - ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0); + /* + * A tx completion can land here after the vap has been torn + * down (iv_bss cleared on the way to INIT) while frames were + * still in flight; there is no bss node left to rate-adjust. + * This is another case of !lvif->lvif_bss_synched but checking + * that seems too cumbersome. + */ + if (ni->ni_vap->iv_bss != NULL) + ieee80211_ratectl_rate(ni->ni_vap->iv_bss, NULL, 0); #ifdef LINUXKPI_DEBUG_80211 if (linuxkpi_debug_80211 & D80211_TRACE_TX) {
