diff options
| -rw-r--r-- | drivers/staging/rtl8723au/core/rtw_security.c | 34 |
1 files changed, 14 insertions, 20 deletions
diff --git a/drivers/staging/rtl8723au/core/rtw_security.c b/drivers/staging/rtl8723au/core/rtw_security.c index bcb5ea68acbe..0ed048fcb36f 100644 --- a/drivers/staging/rtl8723au/core/rtw_security.c +++ b/drivers/staging/rtl8723au/core/rtw_security.c | |||
| @@ -210,7 +210,7 @@ void rtw_wep_decrypt23a(struct rtw_adapter *padapter, | |||
| 210 | struct recv_frame *precvframe) | 210 | struct recv_frame *precvframe) |
| 211 | { | 211 | { |
| 212 | /* exclude ICV */ | 212 | /* exclude ICV */ |
| 213 | u8 crc[4]; | 213 | u32 actual_crc, expected_crc; |
| 214 | struct arc4context mycontext; | 214 | struct arc4context mycontext; |
| 215 | int length; | 215 | int length; |
| 216 | u32 keylength; | 216 | u32 keylength; |
| @@ -243,16 +243,14 @@ void rtw_wep_decrypt23a(struct rtw_adapter *padapter, | |||
| 243 | arcfour_encrypt(&mycontext, payload, payload, length); | 243 | arcfour_encrypt(&mycontext, payload, payload, length); |
| 244 | 244 | ||
| 245 | /* calculate icv and compare the icv */ | 245 | /* calculate icv and compare the icv */ |
| 246 | *((u32 *)crc) = le32_to_cpu(getcrc32(payload, length - 4)); | 246 | actual_crc = le32_to_cpu(getcrc32(payload, length - 4)); |
| 247 | expected_crc = le32_to_cpu(get_unaligned_le32(&payload[length - 4])); | ||
| 247 | 248 | ||
| 248 | if (crc[3] != payload[length - 1] || crc[2] != payload[length - 2] || | 249 | if (actual_crc != expected_crc) { |
| 249 | crc[1] != payload[length - 3] || crc[0] != payload[length - 4]) { | ||
| 250 | RT_TRACE(_module_rtl871x_security_c_, _drv_err_, | 250 | RT_TRACE(_module_rtl871x_security_c_, _drv_err_, |
| 251 | "rtw_wep_decrypt23a:icv error crc[3](%x)!= payload[length-1](%x) || crc[2](%x)!= payload[length-2](%x) || crc[1](%x)!= payload[length-3](%x) || crc[0](%x)!= payload[length-4](%x)\n", | 251 | "rtw_wep_decrypt23a:icv CRC mismatch: " |
| 252 | crc[3], payload[length - 1], | 252 | "actual: %08x, expected: %08x\n", |
| 253 | crc[2], payload[length - 2], | 253 | actual_crc, expected_crc); |
| 254 | crc[1], payload[length - 3], | ||
| 255 | crc[0], payload[length - 4]); | ||
| 256 | } | 254 | } |
| 257 | } | 255 | } |
| 258 | 256 | ||
| @@ -714,7 +712,7 @@ int rtw_tkip_decrypt23a(struct rtw_adapter *padapter, | |||
| 714 | u32 pnh; | 712 | u32 pnh; |
| 715 | u8 rc4key[16]; | 713 | u8 rc4key[16]; |
| 716 | u8 ttkey[16]; | 714 | u8 ttkey[16]; |
| 717 | u8 crc[4]; | 715 | u32 actual_crc, expected_crc; |
| 718 | struct arc4context mycontext; | 716 | struct arc4context mycontext; |
| 719 | int length; | 717 | int length; |
| 720 | u32 prwskeylen; | 718 | u32 prwskeylen; |
| @@ -771,18 +769,14 @@ int rtw_tkip_decrypt23a(struct rtw_adapter *padapter, | |||
| 771 | arcfour_init(&mycontext, rc4key, 16); | 769 | arcfour_init(&mycontext, rc4key, 16); |
| 772 | arcfour_encrypt(&mycontext, payload, payload, length); | 770 | arcfour_encrypt(&mycontext, payload, payload, length); |
| 773 | 771 | ||
| 774 | *((u32 *)crc) = le32_to_cpu(getcrc32(payload, length - 4)); | 772 | actual_crc = le32_to_cpu(getcrc32(payload, length - 4)); |
| 773 | expected_crc = le32_to_cpu(get_unaligned_le32(&payload[length - 4])); | ||
| 775 | 774 | ||
| 776 | if (crc[3] != payload[length - 1] || | 775 | if (actual_crc != expected_crc) { |
| 777 | crc[2] != payload[length - 2] || | ||
| 778 | crc[1] != payload[length - 3] || | ||
| 779 | crc[0] != payload[length - 4]) { | ||
| 780 | RT_TRACE(_module_rtl871x_security_c_, _drv_err_, | 776 | RT_TRACE(_module_rtl871x_security_c_, _drv_err_, |
| 781 | "rtw_wep_decrypt23a:icv error crc[3](%x)!= payload[length-1](%x) || crc[2](%x)!= payload[length-2](%x) || crc[1](%x)!= payload[length-3](%x) || crc[0](%x)!= payload[length-4](%x)\n", | 777 | "rtw_wep_decrypt23a:icv CRC mismatch: " |
| 782 | crc[3], payload[length - 1], | 778 | "actual: %08x, expected: %08x\n", |
| 783 | crc[2], payload[length - 2], | 779 | actual_crc, expected_crc); |
| 784 | crc[1], payload[length - 3], | ||
| 785 | crc[0], payload[length - 4]); | ||
| 786 | res = _FAIL; | 780 | res = _FAIL; |
| 787 | } | 781 | } |
| 788 | 782 | ||
