Author: hselasky
Date: Sun Feb 14 07:16:36 2016
New Revision: 295607
URL: https://svnweb.freebsd.org/changeset/base/295607
Log:
Reduce the number of supported WLAN keys in the rum driver, else we
risk bit shifting overflows. Found by D5245 / PVS.
MFC after: 1 week
Modified:
head/sys/dev/usb/wlan/if_rum.c
head/sys/dev/usb/wlan/if_rumreg.h
Modified: head/sys/dev/usb/wlan/if_rum.c
==============================================================================
--- head/sys/dev/usb/wlan/if_rum.c Sun Feb 14 02:28:59 2016
(r295606)
+++ head/sys/dev/usb/wlan/if_rum.c Sun Feb 14 07:16:36 2016
(r295607)
@@ -2732,7 +2732,7 @@ rum_pair_key_del_cb(struct rum_softc *sc
DPRINTF("%s: removing key %d\n", __func__, k->wk_keyix);
rum_clrbits(sc, (k->wk_keyix < 32) ? RT2573_SEC_CSR2 : RT2573_SEC_CSR3,
1 << (k->wk_keyix % 32));
- sc->keys_bmap &= ~(1 << k->wk_keyix);
+ sc->keys_bmap &= ~(1ULL << k->wk_keyix);
if (--sc->vap_key_count[rvp_id] == 0)
rum_clrbits(sc, RT2573_SEC_CSR4, 1 << rvp_id);
}
@@ -2749,8 +2749,8 @@ rum_key_alloc(struct ieee80211vap *vap,
if (!(k->wk_flags & IEEE80211_KEY_SWCRYPT)) {
RUM_LOCK(sc);
for (i = 0; i < RT2573_ADDR_MAX; i++) {
- if ((sc->keys_bmap & (1 << i)) == 0) {
- sc->keys_bmap |= 1 << i;
+ if ((sc->keys_bmap & (1ULL << i)) == 0) {
+ sc->keys_bmap |= (1ULL << i);
*keyix = i;
break;
}
Modified: head/sys/dev/usb/wlan/if_rumreg.h
==============================================================================
--- head/sys/dev/usb/wlan/if_rumreg.h Sun Feb 14 02:28:59 2016
(r295606)
+++ head/sys/dev/usb/wlan/if_rumreg.h Sun Feb 14 07:16:36 2016
(r295607)
@@ -47,7 +47,7 @@
* H/w encryption/decryption support
*/
#define KEY_SIZE (IEEE80211_KEYBUF_SIZE + IEEE80211_MICBUF_SIZE)
-#define RT2573_ADDR_MAX 64
+#define RT2573_ADDR_MAX (32 / RT2573_SKEY_MAX)
#define RT2573_SKEY_MAX 4
#define RT2573_SKEY(vap, kidx) (0x1000 + ((vap) * RT2573_SKEY_MAX + \
_______________________________________________
svn-src-head@freebsd.org mailing list
https://lists.freebsd.org/mailman/listinfo/svn-src-head
To unsubscribe, send any mail to "svn-src-head-unsubscr...@freebsd.org"
