Date: Sat, 26 Jan 2019 12:28:47 +0000 (UTC) From: Andriy Voskoboinyk <avos@FreeBSD.org> To: src-committers@freebsd.org, svn-src-all@freebsd.org, svn-src-stable@freebsd.org, svn-src-stable-12@freebsd.org Subject: svn commit: r343463 - stable/12/sys/net80211 Message-ID: <201901261228.x0QCSlj3010677@repo.freebsd.org>
next in thread | raw e-mail | index | archive | help
Author: avos Date: Sat Jan 26 12:28:47 2019 New Revision: 343463 URL: https://svnweb.freebsd.org/changeset/base/343463 Log: MFC r343190: net80211: drop m_pullup call from ieee80211_crypto_decap. For most wireless drivers Rx mbuf is allocated as one contiguous chunk; only few are using chains for allocations - but even then at least MCLBYTES (minus Rx descriptor size) is available in the first mbuf. In addition to the above, m_pullup was never called here - otherwise, reallocation will break post-crypto_decap logic (ieee80211_decap, ieee80211_deliver_data...), so just remove it; length check is left in case if some truncated frame appears here. PR: 234241 Modified: stable/12/sys/net80211/ieee80211_crypto.c Directory Properties: stable/12/ (props changed) Modified: stable/12/sys/net80211/ieee80211_crypto.c ============================================================================== --- stable/12/sys/net80211/ieee80211_crypto.c Sat Jan 26 05:35:24 2019 (r343462) +++ stable/12/sys/net80211/ieee80211_crypto.c Sat Jan 26 12:28:47 2019 (r343463) @@ -662,14 +662,15 @@ ieee80211_crypto_decap(struct ieee80211_node *ni, stru k = &ni->ni_ucastkey; /* - * Insure crypto header is contiguous for all decap work. + * Insure crypto header is contiguous and long enough for all + * decap work. */ cip = k->wk_cipher; - if (m->m_len < hdrlen + cip->ic_header && - (m = m_pullup(m, hdrlen + cip->ic_header)) == NULL) { + if (m->m_len < hdrlen + cip->ic_header) { IEEE80211_NOTE_MAC(vap, IEEE80211_MSG_CRYPTO, wh->i_addr2, - "unable to pullup %s header", cip->ic_name); - vap->iv_stats.is_rx_wepfail++; /* XXX */ + "frame is too short (%d < %u) for crypto decap", + cip->ic_name, m->m_len, hdrlen + cip->ic_header); + vap->iv_stats.is_rx_tooshort++; *key = NULL; return (0); }
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?201901261228.x0QCSlj3010677>