Skip site navigation (1)Skip section navigation (2) 
Date:      Sun, 14 Feb 2016 07:16:36 +0000 (UTC)
From:      Hans Petter Selasky <hselasky@FreeBSD.org>
To:        src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-head@freebsd.org
Subject:   svn commit: r295607 - head/sys/dev/usb/wlan
Message-ID:  <201602140716.u1E7Gaot040504@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help 
Author: hselasky
Date: Sun Feb 14 07:16:36 2016
New Revision: 295607
URL: https://svnweb.freebsd.org/changeset/base/295607

Log:
  Reduce the number of supported WLAN keys in the rum driver, else we
  risk bit shifting overflows. Found by D5245 / PVS.
  
  MFC after:	1 week

Modified:
  head/sys/dev/usb/wlan/if_rum.c
  head/sys/dev/usb/wlan/if_rumreg.h

Modified: head/sys/dev/usb/wlan/if_rum.c
==============================================================================
--- head/sys/dev/usb/wlan/if_rum.c	Sun Feb 14 02:28:59 2016	(r295606)
+++ head/sys/dev/usb/wlan/if_rum.c	Sun Feb 14 07:16:36 2016	(r295607)
@@ -2732,7 +2732,7 @@ rum_pair_key_del_cb(struct rum_softc *sc
 	DPRINTF("%s: removing key %d\n", __func__, k->wk_keyix);
 	rum_clrbits(sc, (k->wk_keyix < 32) ? RT2573_SEC_CSR2 : RT2573_SEC_CSR3,
 	    1 << (k->wk_keyix % 32));
-	sc->keys_bmap &= ~(1 << k->wk_keyix);
+	sc->keys_bmap &= ~(1ULL << k->wk_keyix);
 	if (--sc->vap_key_count[rvp_id] == 0)
 		rum_clrbits(sc, RT2573_SEC_CSR4, 1 << rvp_id);
 }
@@ -2749,8 +2749,8 @@ rum_key_alloc(struct ieee80211vap *vap, 
 		if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
 			RUM_LOCK(sc);
 			for (i = 0; i < RT2573_ADDR_MAX; i++) {
-				if ((sc->keys_bmap & (1 << i)) == 0) {
-					sc->keys_bmap |= 1 << i;
+				if ((sc->keys_bmap & (1ULL << i)) == 0) {
+					sc->keys_bmap |= (1ULL << i);
 					*keyix = i;
 					break;
 				}

Modified: head/sys/dev/usb/wlan/if_rumreg.h
==============================================================================
--- head/sys/dev/usb/wlan/if_rumreg.h	Sun Feb 14 02:28:59 2016	(r295606)
+++ head/sys/dev/usb/wlan/if_rumreg.h	Sun Feb 14 07:16:36 2016	(r295607)
@@ -47,7 +47,7 @@
  * H/w encryption/decryption support
  */
 #define KEY_SIZE		(IEEE80211_KEYBUF_SIZE + IEEE80211_MICBUF_SIZE)
-#define RT2573_ADDR_MAX         64
+#define RT2573_ADDR_MAX         (32 / RT2573_SKEY_MAX)
 #define RT2573_SKEY_MAX		4
 
 #define RT2573_SKEY(vap, kidx)	(0x1000 + ((vap) * RT2573_SKEY_MAX + \

Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201602140716.u1E7Gaot040504>