Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5871d2d7 authored by Sujith Manoharan's avatar Sujith Manoharan Committed by John W. Linville
Browse files

ath9k: Discard invalid frames early 



Frames with invalid or zero length can be discarded
early, there is no need to check the crypto bits.

Signed-off-by: default avatarSujith Manoharan <c_manoha@qca.qualcomm.com>
Signed-off-by: default avatarJohn W. Linville <linville@tuxdriver.com>
parent 0cab329d

drivers/net/wireless/ath/ath9k/recv.c

+22 −16
Original line number Diff line number Diff line
@@ -764,7 +764,6 @@ static bool ath9k_rx_accept(struct ath_common *common, 
	bool is_mc, is_valid_tkip, strip_mic, mic_error;

	struct ath_hw *ah = common->ah;

	__le16 fc;

	u8 rx_status_len = ah->caps.rx_status_len;



	fc = hdr->frame_control;
@@ -786,21 +785,6 @@ static bool ath9k_rx_accept(struct ath_common *common, 
	    !test_bit(rx_stats->rs_keyix, common->ccmp_keymap))

		rx_stats->rs_status &= ~ATH9K_RXERR_KEYMISS;



	if (!rx_stats->rs_datalen) {

		RX_STAT_INC(rx_len_err);

		return false;

	}



        /*

         * rs_status follows rs_datalen so if rs_datalen is too large

         * we can take a hint that hardware corrupted it, so ignore

         * those frames.

         */

	if (rx_stats->rs_datalen > (common->rx_bufsize - rx_status_len)) {

		RX_STAT_INC(rx_len_err);

		return false;

	}



	/* Only use error bits from the last fragment */

	if (rx_stats->rs_more)

		return true;
@@ -949,10 +933,32 @@ static int ath9k_rx_skb_preprocess(struct ath_softc *sc, 
	struct ath_common *common = ath9k_hw_common(ah);

	bool discard_current = sc->rx.discard_next;



	/*

	 * Discard corrupt descriptors which are marked in

	 * ath_get_next_rx_buf().

	 */

	sc->rx.discard_next = rx_stats->rs_more;

	if (discard_current)

		return -EINVAL;



	/*

	 * Discard zero-length packets.

	 */

	if (!rx_stats->rs_datalen) {

		RX_STAT_INC(rx_len_err);

		return -EINVAL;

	}



        /*

         * rs_status follows rs_datalen so if rs_datalen is too large

         * we can take a hint that hardware corrupted it, so ignore

         * those frames.

         */

	if (rx_stats->rs_datalen > (common->rx_bufsize - ah->caps.rx_status_len)) {

		RX_STAT_INC(rx_len_err);

		return -EINVAL;

	}



	/*

	 * everything but the rate is checked here, the rate check is done

	 * separately to avoid doing two lookups for a rate for each frame.