Be more careful handling off-channel frames: if the driver (wrongly)

sends frames up the stack after changing the current channel then
the lookup by ieee channel number may fail leaving a null ptr in
se_chan; if this happens fallback to the channel recorded when the
frame is processed (curchan).  Since the frame doesn't contribute
to scan results for the sta this is acceptable.

Reviewed by:	thompsa
MFC after:	3 days

1 files changed, 4 insertions, 3 deletions

diff --git a/sys/net80211/ieee80211_scan_sta.c b/sys/net80211/ieee80211_scan_sta.c
index eb21259..7d7548c 100644
--- a/sys/net80211/ieee80211_scan_sta.c
+++ b/sys/net80211/ieee80211_scan_sta.c
@@ -290,11 +290,12 @@ found:
 		 */
 		c = ieee80211_find_channel_byieee(ic, sp->bchan,
 		    sp->curchan->ic_flags);
-		if (c == NULL && ise->se_chan == NULL) {
+		if (c != NULL) {
+			ise->se_chan = c;
+		} else if (ise->se_chan == NULL) {
 			/* should not happen, pick something */
-			c = sp->curchan;
+			ise->se_chan = sp->curchan;
 		}
-		ise->se_chan = c;
 	} else
 		ise->se_chan = sp->curchan;
 	ise->se_fhdwell = sp->fhdwell;