From owner-freebsd-bugs@FreeBSD.ORG Wed Mar 7 15:10:12 2012 Return-Path: Delivered-To: freebsd-bugs@hub.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id B4AEA1065672 for ; Wed, 7 Mar 2012 15:10:12 +0000 (UTC) (envelope-from gnats@FreeBSD.org) Received: from freefall.freebsd.org (freefall.freebsd.org [IPv6:2001:4f8:fff6::28]) by mx1.freebsd.org (Postfix) with ESMTP id 8E24B8FC16 for ; Wed, 7 Mar 2012 15:10:12 +0000 (UTC) Received: from freefall.freebsd.org (localhost [127.0.0.1]) by freefall.freebsd.org (8.14.5/8.14.5) with ESMTP id q27FACZm077472 for ; Wed, 7 Mar 2012 15:10:12 GMT (envelope-from gnats@freefall.freebsd.org) Received: (from gnats@localhost) by freefall.freebsd.org (8.14.5/8.14.5/Submit) id q27FAC5P077471; Wed, 7 Mar 2012 15:10:12 GMT (envelope-from gnats) Resent-Date: Wed, 7 Mar 2012 15:10:12 GMT Resent-Message-Id: <201203071510.q27FAC5P077471@freefall.freebsd.org> Resent-From: FreeBSD-gnats-submit@FreeBSD.org (GNATS Filer) Resent-To: freebsd-bugs@FreeBSD.org Resent-Reply-To: FreeBSD-gnats-submit@FreeBSD.org, Mitsuru IWASAKI Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52]) by hub.freebsd.org (Postfix) with ESMTP id C537E1065691 for ; Wed, 7 Mar 2012 15:02:13 +0000 (UTC) (envelope-from nobody@FreeBSD.org) Received: from red.freebsd.org (red.freebsd.org [IPv6:2001:4f8:fff6::22]) by mx1.freebsd.org (Postfix) with ESMTP id 9851B8FC27 for ; Wed, 7 Mar 2012 15:02:13 +0000 (UTC) Received: from red.freebsd.org (localhost [127.0.0.1]) by red.freebsd.org (8.14.4/8.14.4) with ESMTP id q27F2DdY061003 for ; Wed, 7 Mar 2012 15:02:13 GMT (envelope-from nobody@red.freebsd.org) Received: (from nobody@localhost) by red.freebsd.org (8.14.4/8.14.4/Submit) id q27F2Dw1061002; Wed, 7 Mar 2012 15:02:13 GMT (envelope-from nobody) Message-Id: <201203071502.q27F2Dw1061002@red.freebsd.org> Date: Wed, 7 Mar 2012 15:02:13 GMT From: Mitsuru IWASAKI To: freebsd-gnats-submit@FreeBSD.org X-Send-Pr-Version: www-3.1 Cc: Subject: kern/165819: [iwi][patch]iwi(4) broken >= 8.0-RELEASE X-BeenThere: freebsd-bugs@freebsd.org X-Mailman-Version: 2.1.5 Precedence: list List-Id: Bug reports List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Wed, 07 Mar 2012 15:10:12 -0000 >Number: 165819 >Category: kern >Synopsis: [iwi][patch]iwi(4) broken >= 8.0-RELEASE >Confidential: no >Severity: non-critical >Priority: low >Responsible: freebsd-bugs >State: open >Quarter: >Keywords: >Date-Required: >Class: sw-bug >Submitter-Id: current-users >Arrival-Date: Wed Mar 07 15:10:12 UTC 2012 >Closed-Date: >Last-Modified: >Originator: Mitsuru IWASAKI >Release: 10.0-CURRENT >Organization: FreeBSD committer >Environment: >Description: After 8.0-RELEASE, iwi(4) doesn't send any data frames in infrastructure mode. There is a problem in iwi_checkforqos(), wrong asresp frame parsing. Bacause of the condition `while (frm < efrm)', IEEE80211_VERIFY_LENGTH() was checking item length beyond the ieee80211_frame region, and returned from iwi_checkforqos() without setting flags, capinfo and associd! In infrastructure mode associd is required, so this problem causes discarding mbuf in ieee80211_start(). >How-To-Repeat: dhclient wlan0 >Fix: patch file attached. Patch attached with submission follows: Index: dev/iwi/if_iwi.c =================================================================== RCS file: /home/ncvs/src/sys/dev/iwi/if_iwi.c,v retrieving revision 1.80 diff -u -r1.80 if_iwi.c --- dev/iwi/if_iwi.c 17 Dec 2011 10:23:17 -0000 1.80 +++ dev/iwi/if_iwi.c 7 Mar 2012 04:32:22 -0000 @@ -168,6 +168,7 @@ struct ieee80211_node *, int); static int iwi_raw_xmit(struct ieee80211_node *, struct mbuf *, const struct ieee80211_bpf_params *); +static void iwi_update_mcast(struct ifnet *); static void iwi_start_locked(struct ifnet *); static void iwi_start(struct ifnet *); static void iwi_watchdog(void *); @@ -413,6 +414,7 @@ sc->sc_node_free = ic->ic_node_free; ic->ic_node_free = iwi_node_free; ic->ic_raw_xmit = iwi_raw_xmit; + ic->ic_update_mcast = iwi_update_mcast; ic->ic_scan_start = iwi_scan_start; ic->ic_scan_end = iwi_scan_end; ic->ic_set_channel = iwi_set_channel; @@ -1357,8 +1359,8 @@ frm += 2; wme = NULL; - while (frm < efrm) { - IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1], return); + while (efrm - frm > 1) { + IEEE80211_VERIFY_LENGTH(efrm - frm, frm[1] + 2, return); switch (*frm) { case IEEE80211_ELEMID_VENDOR: if (iswmeoui(frm)) @@ -1953,6 +1955,12 @@ } static void +iwi_update_mcast(struct ifnet *ifp) +{ + /* Ignore */ +} + +static void iwi_start_locked(struct ifnet *ifp) { struct iwi_softc *sc = ifp->if_softc; >Release-Note: >Audit-Trail: >Unformatted: