[BUG] Potential Null Pointer Dereference in ieee80211_rx_mgmt_beacon Function

[冯嘉仪]

Dear Maintainer,

Our team recently developed a null-pointer-dereference (NPD) vulnerability detection tool, and we used it to scan the Linux Kernel (version 6.9.6). After manual review, we identified a potentially vulnerable code snippet that could lead to a null-pointer dereference bug. We would appreciate your expert insight to confirm whether this vulnerability could indeed pose a risk to the system.

Vulnerability Description:
File:  net/mac80211/mlme.c
In the function ieee80211_rx_mgmt_beacon, we found the following line of code:

ieee80211_rx_our_beacon(bssid, ifmgd->assoc_data->link[0].bss)) {

The issue arises because the bssid pointer may be passed as NULL in certain situations. The statement passes the bssid pointer to ieee80211_rx_our_beacon without any check, but ieee80211_rx_our_beacon might contain a dereference operation on the bssid pointer, which could result in a null-pointer dereference.

Proposed Fix:
To prevent the potential null-pointer dereference, we suggest adding a NULL check for the bssid pointer before attempting to pass the pointer to ieee80211_rx_our_beacon.

Request for Review:
We would appreciate your expert insight to confirm whether this vulnerability indeed poses a risk to the system, and if the proposed fix is appropriate. If there are reasons why this issue does not present a real risk (e.g., the NULL check is redundant or unnecessary), we would be grateful for clarification.

Thank you for your time and consideration.