Frame status frequently gets corrupted in hardware with 802.11n which
can lead to corrupt frames being forwarded to mac80211. This in turn may
trigger countermeasures in reponse to false MIC-errors or cause receive
to stall when frames are dropped after processing a frame with corrupt PN.
Verify frame status by making sure that no error flags are set if frame
is marked ok and that reserved bits 19 through 28 (0x1ff80000) are all
zero, otherwise discarded frame (as ATH9K_PHYERR_HT_CRC_ERROR).
Tested with AR9280 (WEP, TKIP and CCMP).
Signed-off-by: Johan Hovold <johan.hovold@xxxxxxxxxxxx>
---
drivers/net/wireless/ath/ath9k/mac.c | 13 +++++++++++++
1 files changed, 13 insertions(+), 0 deletions(-)
diff --git a/drivers/net/wireless/ath/ath9k/mac.c b/drivers/net/wireless/ath/ath9k/mac.c
index 4a2060e..2afe72f 100644
--- a/drivers/net/wireless/ath/ath9k/mac.c
+++ b/drivers/net/wireless/ath/ath9k/mac.c
@@ -934,9 +934,22 @@ int ath9k_hw_rxprocdesc(struct ath_hw *ah, struct ath_desc *ds,
rs->rs_status |= ATH9K_RXERR_DECRYPT;
else if (ads.ds_rxstatus8 & AR_MichaelErr)
rs->rs_status |= ATH9K_RXERR_MIC;
+ } else {
+ if (ads.ds_rxstatus8 & (AR_CRCErr |
+ AR_PHYErr |
+ AR_DecryptCRCErr |
+ AR_MichaelErr |
+ AR_DecryptBusyErr))
+ goto corrupt;
}
+ if (ads.ds_rxstatus8 & 0x1ff80000)
+ goto corrupt;
return 0;
+corrupt:
+ rs->rs_status |= ATH9K_RXERR_PHY;
+ rs->rs_phyerr = ATH9K_PHYERR_HT_CRC_ERROR;
+ return 0;
}
EXPORT_SYMBOL(ath9k_hw_rxprocdesc);
--
1.7.0.3
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at http://vger.kernel.org/majordomo-info.html
