diff options
| author |   stsp <stsp@openbsd.org> | 2020-02-28 14:16:34 +0000 |
|---|---|---|
| committer | stsp <stsp@openbsd.org> | 2020-02-28 14:16:34 +0000 |
| commit | c8d0bd279eb49d1518f162961d7f789c6564823d (patch) | |
| tree | 3b1c04e255fefc3ff0532f10469b5862214844f6 | |
| parent | In iwm(4), free mbufs that won't be passed to if_inputm(). (diff) | |
| download | wireguard-openbsd-c8d0bd279eb49d1518f162961d7f789c6564823d.tar.xz wireguard-openbsd-c8d0bd279eb49d1518f162961d7f789c6564823d.zip | |
In iwm(4), do not drop short control frames in monitor mode and do not
include the CRC trailer in the minimum length check for regular frames.
ok mpi@
| -rw-r--r-- | sys/dev/pci/if_iwm.c | 22 |
1 files changed, 19 insertions, 3 deletions
diff --git a/sys/dev/pci/if_iwm.c b/sys/dev/pci/if_iwm.c index 757c4e370c2..63e38fba2e6 100644 --- a/sys/dev/pci/if_iwm.c +++ b/sys/dev/pci/if_iwm.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_iwm.c,v 1.298 2020/02/28 13:27:25 stsp Exp $ */ +/* $OpenBSD: if_iwm.c,v 1.299 2020/02/28 14:16:34 stsp Exp $ */ /* * Copyright (c) 2014, 2016 genua gmbh <info@genua.de> @@ -3989,7 +3989,15 @@ iwm_rx_mpdu(struct iwm_softc *sc, struct mbuf *m, void *pktdata, phy_info = &sc->sc_last_phy_info; rx_res = (struct iwm_rx_mpdu_res_start *)pktdata; len = le16toh(rx_res->byte_count); - if (len < IEEE80211_MIN_LEN) { + if (ic->ic_opmode == IEEE80211_M_MONITOR) { + /* Allow control frames in monitor mode. */ + if (len < sizeof(struct ieee80211_frame_cts)) { + ic->ic_stats.is_rx_tooshort++; + IC2IFP(ic)->if_ierrors++; + m_freem(m); + return; + } + } else if (len < sizeof(struct ieee80211_frame)) { ic->ic_stats.is_rx_tooshort++; IC2IFP(ic)->if_ierrors++; m_freem(m); @@ -4055,7 +4063,15 @@ iwm_rx_mpdu_mq(struct iwm_softc *sc, struct mbuf *m, void *pktdata, } len = le16toh(desc->mpdu_len); - if (len < IEEE80211_MIN_LEN) { + if (ic->ic_opmode == IEEE80211_M_MONITOR) { + /* Allow control frames in monitor mode. */ + if (len < sizeof(struct ieee80211_frame_cts)) { + ic->ic_stats.is_rx_tooshort++; + IC2IFP(ic)->if_ierrors++; + m_freem(m); + return; + } + } else if (len < sizeof(struct ieee80211_frame)) { ic->ic_stats.is_rx_tooshort++; IC2IFP(ic)->if_ierrors++; m_freem(m); |