aboutsummaryrefslogtreecommitdiffstats
path: root/drivers
diff options
context:
space:
mode:
authorBob Copeland <me@bobcopeland.com>2008-05-12 21:16:44 -0400
committerJohn W. Linville <linville@tuxdriver.com>2008-05-14 16:29:50 -0400
commitd6894b5be1d674a31a94ed8f057c9f7d98c53999 (patch)
tree6d7ba98e768595f31505e29e5bfcb83d06b5b3d4 /drivers
parentb0a6717994a4e00ee19372e1bdaab53572ae025c (diff)
ath5k: Fix loop variable initializations
In ath5k_tasklet_rx, both status structures 'rxs' and 'rs' are initialized at the top of the tasklet, but not within the loop. If the loop is executed multiple times in the tasklet then the variables may see changes from previous packets. For TKIP, this results in 'Invalid Michael MIC' errors if two packets are processed in the tasklet: rxs.flag gets set to RX_DECRYPTED by mac80211 when it decrypts the first encrypted packet. The subsequent packet will have RX_DECRYPTED set upon entry to mac80211, so mac80211 will not try to decrypt it. We currently initialize all but two fields in the structures, so fix the other two. Signed-off-by: Bob Copeland <me@bobcopeland.com> Signed-off-by: John W. Linville <linville@tuxdriver.com>
Diffstat (limited to 'drivers')
-rw-r--r--drivers/net/wireless/ath5k/base.c2
-rw-r--r--drivers/net/wireless/ath5k/hw.c6
2 files changed, 6 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index dd8adaddd7a0..c76ada178781 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -1785,6 +1785,8 @@ ath5k_tasklet_rx(unsigned long data)
1785 1785
1786 spin_lock(&sc->rxbuflock); 1786 spin_lock(&sc->rxbuflock);
1787 do { 1787 do {
1788 rxs.flag = 0;
1789
1788 if (unlikely(list_empty(&sc->rxbuf))) { 1790 if (unlikely(list_empty(&sc->rxbuf))) {
1789 ATH5K_WARN(sc, "empty rx buf pool\n"); 1791 ATH5K_WARN(sc, "empty rx buf pool\n");
1790 break; 1792 break;
diff --git a/drivers/net/wireless/ath5k/hw.c b/drivers/net/wireless/ath5k/hw.c
index 5fb1ae6ad3e2..77990b56860b 100644
--- a/drivers/net/wireless/ath5k/hw.c
+++ b/drivers/net/wireless/ath5k/hw.c
@@ -4119,6 +4119,7 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
4119 rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1, 4119 rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
4120 AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP); 4120 AR5K_5210_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
4121 rs->rs_status = 0; 4121 rs->rs_status = 0;
4122 rs->rs_phyerr = 0;
4122 4123
4123 /* 4124 /*
4124 * Key table status 4125 * Key table status
@@ -4145,7 +4146,7 @@ static int ath5k_hw_proc_5210_rx_status(struct ath5k_hw *ah,
4145 if (rx_status->rx_status_1 & 4146 if (rx_status->rx_status_1 &
4146 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR) { 4147 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR) {
4147 rs->rs_status |= AR5K_RXERR_PHY; 4148 rs->rs_status |= AR5K_RXERR_PHY;
4148 rs->rs_phyerr = AR5K_REG_MS(rx_status->rx_status_1, 4149 rs->rs_phyerr |= AR5K_REG_MS(rx_status->rx_status_1,
4149 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR); 4150 AR5K_5210_RX_DESC_STATUS1_PHY_ERROR);
4150 } 4151 }
4151 4152
@@ -4193,6 +4194,7 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
4193 rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1, 4194 rs->rs_tstamp = AR5K_REG_MS(rx_status->rx_status_1,
4194 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP); 4195 AR5K_5212_RX_DESC_STATUS1_RECEIVE_TIMESTAMP);
4195 rs->rs_status = 0; 4196 rs->rs_status = 0;
4197 rs->rs_phyerr = 0;
4196 4198
4197 /* 4199 /*
4198 * Key table status 4200 * Key table status
@@ -4215,7 +4217,7 @@ static int ath5k_hw_proc_5212_rx_status(struct ath5k_hw *ah,
4215 if (rx_status->rx_status_1 & 4217 if (rx_status->rx_status_1 &
4216 AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) { 4218 AR5K_5212_RX_DESC_STATUS1_PHY_ERROR) {
4217 rs->rs_status |= AR5K_RXERR_PHY; 4219 rs->rs_status |= AR5K_RXERR_PHY;
4218 rs->rs_phyerr = AR5K_REG_MS(rx_err->rx_error_1, 4220 rs->rs_phyerr |= AR5K_REG_MS(rx_err->rx_error_1,
4219 AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE); 4221 AR5K_RX_DESC_ERROR1_PHY_ERROR_CODE);
4220 } 4222 }
4221 4223