diff options
| author |   tobhe <tobhe@openbsd.org> | 2020-12-07 20:12:04 +0000 |
|---|---|---|
| committer | tobhe <tobhe@openbsd.org> | 2020-12-07 20:12:04 +0000 |
| commit | 0d77fc8efeb9d26ddfc5f5aec27e456a1a0eb519 (patch) | |
| tree | 2d2b5f896c0e4bddfe757bf7784c4c5d6abe677e /sys/dev/pci/if_iwx.c | |
| parent | Fix calculation of "maxlen" if there are multiple MPDUs in one packet. (diff) | |
| download | wireguard-openbsd-0d77fc8efeb9d26ddfc5f5aec27e456a1a0eb519.tar.xz wireguard-openbsd-0d77fc8efeb9d26ddfc5f5aec27e456a1a0eb519.zip | |
Fix calculation of "maxlen" if there are multiple MPDUs in one packet.
Calculating "remain" by subtracting the offset after every parsed MPDU
is wrong and not necessary. "offset" always points to the current position
in the receive buffer and the maximum size of the buffer is fixed,
thus knowing "offset" is sufficient for finding "maxlen".
Found by and fix from Christian Erhardt
ok stsp@
Diffstat (limited to 'sys/dev/pci/if_iwx.c')
| -rw-r--r-- | sys/dev/pci/if_iwx.c | 10 |
1 files changed, 2 insertions, 8 deletions
diff --git a/sys/dev/pci/if_iwx.c b/sys/dev/pci/if_iwx.c index 724cbc696ea..09ffce6713a 100644 --- a/sys/dev/pci/if_iwx.c +++ b/sys/dev/pci/if_iwx.c @@ -1,4 +1,4 @@ -/* $OpenBSD: if_iwx.c,v 1.46 2020/10/22 11:24:01 stsp Exp $ */ +/* $OpenBSD: if_iwx.c,v 1.47 2020/12/07 20:12:04 tobhe Exp $ */ /* * Copyright (c) 2014, 2016 genua gmbh <info@genua.de> @@ -7141,7 +7141,6 @@ iwx_rx_pkt(struct iwx_softc *sc, struct iwx_rx_data *data, struct mbuf_list *ml) uint32_t offset = 0, nextoff = 0, nmpdu = 0, len; struct mbuf *m0, *m; const size_t minsz = sizeof(pkt->len_n_flags) + sizeof(pkt->hdr); - size_t remain = IWX_RBUF_SIZE; int qid, idx, code, handled = 1; bus_dmamap_sync(sc->sc_dmat, data->map, 0, IWX_RBUF_SIZE, @@ -7178,7 +7177,7 @@ iwx_rx_pkt(struct iwx_softc *sc, struct iwx_rx_data *data, struct mbuf_list *ml) break; case IWX_REPLY_RX_MPDU_CMD: { - size_t maxlen = remain - minsz; + size_t maxlen = IWX_RBUF_SIZE - offset - minsz; nextoff = offset + roundup(len, IWX_FH_RSCSR_FRAME_ALIGN); nextpkt = (struct iwx_rx_packet *) @@ -7206,11 +7205,6 @@ iwx_rx_pkt(struct iwx_softc *sc, struct iwx_rx_data *data, struct mbuf_list *ml) m_adj(m, offset); iwx_rx_mpdu_mq(sc, m, pkt->data, maxlen, ml); } - - if (offset + minsz < remain) - remain -= offset; - else - remain = minsz; break; } |