d/freebsd-nq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

More RSU fixes:

Browse Source 
- Properly align temporary buffer to 32-bit.
- Add an extra parenthesis to make expression clear.
- Range check the association ID received from hardware.

MFC after:	1 week
This commit is contained in:
Hans Petter Selasky 2014-06-04 16:58:35 +00:00
parent c26e5fc2ed
commit bb03cd6fa1
1 changed files with 11 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

15
sys/dev/usb/wlan/if_rsu.c
View File

@ -1057,7 +1057,8 @@ rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
struct ndis_wlan_bssid_ex *bss; struct ndis_wlan_bssid_ex *bss;
struct ndis_802_11_fixed_ies *fixed; struct ndis_802_11_fixed_ies *fixed;
struct r92s_fw_cmd_auth auth; struct r92s_fw_cmd_auth auth;
uint8_t buf[sizeof(*bss) + 128], *frm; uint8_t buf[sizeof(*bss) + 128] __aligned(4);
uint8_t *frm;
uint8_t opmode; uint8_t opmode;
int error; int error;
@ -1071,7 +1072,7 @@ rsu_join_bss(struct rsu_softc *sc, struct ieee80211_node *ni)
memset(&auth, 0, sizeof(auth)); memset(&auth, 0, sizeof(auth));
if (vap->iv_flags & IEEE80211_F_WPA) { if (vap->iv_flags & IEEE80211_F_WPA) {
auth.mode = R92S_AUTHMODE_WPA; auth.mode = R92S_AUTHMODE_WPA;
auth.dot1x = ni->ni_authmode == IEEE80211_AUTH_8021X; auth.dot1x = (ni->ni_authmode == IEEE80211_AUTH_8021X);
} else } else
auth.mode = R92S_AUTHMODE_OPEN; auth.mode = R92S_AUTHMODE_OPEN;
DPRINTF("setting auth mode to %d\n", auth.mode); DPRINTF("setting auth mode to %d\n", auth.mode);
@ -1192,6 +1193,7 @@ rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps); struct ieee80211vap *vap = TAILQ_FIRST(&ic->ic_vaps);
struct ieee80211_node *ni = vap->iv_bss; struct ieee80211_node *ni = vap->iv_bss;
struct r92s_event_join_bss *rsp; struct r92s_event_join_bss *rsp;
uint32_t tmp;
int res; int res;
if (__predict_false(len < sizeof(*rsp))) if (__predict_false(len < sizeof(*rsp)))
@ -1206,9 +1208,14 @@ rsu_event_join_bss(struct rsu_softc *sc, uint8_t *buf, int len)
RSU_LOCK(sc); RSU_LOCK(sc);
return; return;
} }
tmp = le32toh(rsp->associd);
if (tmp >= vap->iv_max_aid) {
DPRINTF("Assoc ID overflow\n");
tmp = 1;
}
DPRINTF("associated with %s associd=%d\n", DPRINTF("associated with %s associd=%d\n",
ether_sprintf(rsp->bss.macaddr), le32toh(rsp->associd)); ether_sprintf(rsp->bss.macaddr), tmp);
ni->ni_associd = le32toh(rsp->associd) | 0xc000; ni->ni_associd = tmp | 0xc000;
RSU_UNLOCK(sc); RSU_UNLOCK(sc);
ieee80211_new_state(vap, IEEE80211_S_RUN, ieee80211_new_state(vap, IEEE80211_S_RUN,
IEEE80211_FC0_SUBTYPE_ASSOC_RESP); IEEE80211_FC0_SUBTYPE_ASSOC_RESP);