diff options
| author |   stsp <stsp@openbsd.org> | 2020-04-30 08:52:56 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2020-04-30 08:52:56 +0000 |
| commit | b2d0c33fd6ecfc7a08d61b1d7f82992f207e1a6e (patch) | |
| tree | de50490541716a4beb469c4a9b7208c296dc19d5 | |
| parent | drm/amd/display: Not doing optimize bandwidth if flip pending. (diff) | |
| download | wireguard-openbsd-b2d0c33fd6ecfc7a08d61b1d7f82992f207e1a6e.tar.xz wireguard-openbsd-b2d0c33fd6ecfc7a08d61b1d7f82992f207e1a6e.zip | |
Fix use of uninitialized 'wh' variable in error path of ar5008_rx_process().
This fix simplifies HW decrytion error checking: Frame header contents aren't
relevant because we are going to drop frames that had errors in any case.
I made a mistake by trying to add an exception for multicast frames at this
point. Frame header contents might not even be valid.
This problem was introduced with CCMP hardware offload support and detected
by Coverity (CID 1492755).
ok mestre@ kevlo@
| -rw-r--r-- | sys/dev/ic/ar5008.c | 10 |
1 files changed, 4 insertions, 6 deletions
diff --git a/sys/dev/ic/ar5008.c b/sys/dev/ic/ar5008.c index 3d1235de376..9193ae3c7b5 100644 --- a/sys/dev/ic/ar5008.c +++ b/sys/dev/ic/ar5008.c @@ -1,4 +1,4 @@ -/* $OpenBSD: ar5008.c,v 1.56 2020/04/27 08:21:34 stsp Exp $ */ +/* $OpenBSD: ar5008.c,v 1.57 2020/04/30 08:52:56 stsp Exp $ */ /*- * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr> @@ -947,9 +947,8 @@ ar5008_rx_process(struct athn_softc *sc, struct mbuf_list *ml) else if (ds->ds_status8 & AR_RXS8_PHY_ERR) DPRINTFN(6, ("PHY error=0x%x\n", MS(ds->ds_status8, AR_RXS8_PHY_ERR_CODE))); - else if ((ds->ds_status8 & AR_RXS8_DECRYPT_CRC_ERR) || - (!IEEE80211_IS_MULTICAST(wh->i_addr1) && - (ds->ds_status8 & AR_RXS8_KEY_MISS))) { + else if (ds->ds_status8 & (AR_RXS8_DECRYPT_CRC_ERR | + AR_RXS8_KEY_MISS | AR_RXS8_DECRYPT_BUSY_ERR)) { DPRINTFN(6, ("Decryption CRC error\n")); ic->ic_stats.is_ccmp_dec_errs++; } else if (ds->ds_status8 & AR_RXS8_MICHAEL_ERR) { @@ -961,8 +960,7 @@ ar5008_rx_process(struct athn_softc *sc, struct mbuf_list *ml) * XXX Check that it is not a control frame * (invalid MIC failures on valid ctl frames). */ - } else if (ds->ds_status8 & AR_RXS8_DECRYPT_BUSY_ERR) - ic->ic_stats.is_ccmp_dec_errs++; + } ifp->if_ierrors++; goto skip; } |