1 files changed, 32 insertions, 21 deletions

diff --git a/drivers/net/wireless/ath/ath9k/recv.c b/drivers/net/wireless/ath/ath9k/recv.c
index 70dc8ecdad4d..9a4850154fb2 100644
--- a/drivers/net/wireless/ath/ath9k/recv.c
+++ b/drivers/net/wireless/ath/ath9k/recv.c
@@ -815,16 +815,19 @@ static bool ath9k_rx_accept(struct ath_common *common,
                             struct ath_rx_status *rx_stats,
                             bool *decrypt_error)
 {
-#define is_mc_or_valid_tkip_keyix ((is_mc ||                    \
-                (rx_stats->rs_keyix != ATH9K_RXKEYIX_INVALID && \
-                test_bit(rx_stats->rs_keyix, common->tkip_keymap))))
-
+        bool is_mc, is_valid_tkip, strip_mic, mic_error;
         struct ath_hw *ah = common->ah;
         __le16 fc;
         u8 rx_status_len = ah->caps.rx_status_len;
 
         fc = hdr->frame_control;
 
+        is_mc = !!is_multicast_ether_addr(hdr->addr1);
+        is_valid_tkip = rx_stats->rs_keyix != ATH9K_RXKEYIX_INVALID &&
+                test_bit(rx_stats->rs_keyix, common->tkip_keymap);
+        strip_mic = is_valid_tkip && !(rx_stats->rs_status &
+                (ATH9K_RXERR_DECRYPT | ATH9K_RXERR_CRC | ATH9K_RXERR_MIC));
+
         if (!rx_stats->rs_datalen)
                 return false;
         /*
@@ -839,6 +842,11 @@ static bool ath9k_rx_accept(struct ath_common *common,
         if (rx_stats->rs_more)
                 return true;
 
+        mic_error = is_valid_tkip && !ieee80211_is_ctl(fc) &&
+                !ieee80211_has_morefrags(fc) &&
+                !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
+                (rx_stats->rs_status & ATH9K_RXERR_MIC);
+
         /*
          * The rx_stats->rs_status will not be set until the end of the
          * chained descriptors so it can be ignored if rs_more is set. The
@@ -846,30 +854,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
          * descriptors.
          */
         if (rx_stats->rs_status != 0) {
-                if (rx_stats->rs_status & ATH9K_RXERR_CRC)
+                if (rx_stats->rs_status & ATH9K_RXERR_CRC) {
                         rxs->flag |= RX_FLAG_FAILED_FCS_CRC;
+                        mic_error = false;
+                }
                 if (rx_stats->rs_status & ATH9K_RXERR_PHY)
                         return false;
 
                 if (rx_stats->rs_status & ATH9K_RXERR_DECRYPT) {
                         *decrypt_error = true;
-                } else if (rx_stats->rs_status & ATH9K_RXERR_MIC) {
-                        bool is_mc;
-                        /*
-                         * The MIC error bit is only valid if the frame
-                         * is not a control frame or fragment, and it was
-                         * decrypted using a valid TKIP key.
-                         */
-                        is_mc = !!is_multicast_ether_addr(hdr->addr1);
-
-                        if (!ieee80211_is_ctl(fc) &&
-                            !ieee80211_has_morefrags(fc) &&
-                            !(le16_to_cpu(hdr->seq_ctrl) & IEEE80211_SCTL_FRAG) &&
-                            is_mc_or_valid_tkip_keyix)
-                                rxs->flag |= RX_FLAG_MMIC_ERROR;
-                        else
-                                rx_stats->rs_status &= ~ATH9K_RXERR_MIC;
+                        mic_error = false;
                 }
+
                 /*
                  * Reject error frames with the exception of
                  * decryption and MIC failures. For monitor mode,
@@ -887,6 +883,18 @@ static bool ath9k_rx_accept(struct ath_common *common,
                         }
                 }
         }
+
+        /*
+         * For unicast frames the MIC error bit can have false positives,
+         * so all MIC error reports need to be validated in software.
+         * False negatives are not common, so skip software verification
+         * if the hardware considers the MIC valid.
+         */
+        if (strip_mic)
+                rxs->flag |= RX_FLAG_MMIC_STRIPPED;
+        else if (is_mc && mic_error)
+                rxs->flag |= RX_FLAG_MMIC_ERROR;
+
         return true;
 }
 
@@ -1939,6 +1947,9 @@ int ath_rx_tasklet(struct ath_softc *sc, int flush, bool hp)
                         sc->rx.rxotherant = 0;
                 }
 
+                if (rxs->flag & RX_FLAG_MMIC_STRIPPED)
+                        skb_trim(skb, skb->len - 8);
+
                 spin_lock_irqsave(&sc->sc_pm_lock, flags);
 
                 if ((sc->ps_flags & (PS_WAIT_FOR_BEACON |