From: kettenis <kettenis@openbsd.org>
Date: Sun, 3 Oct 2021 20:19:55 +0000 (+0000)
Subject: Apparently some athn(4) variants are buggy and may hand us corrupt frames
X-Git-Url: http://artulab.com/gitweb/?a=commitdiff_plain;h=6dc210665feafa2e49100f4b95aa3a8630ef20d7;p=openbsd

Apparently some athn(4) variants are buggy and may hand us corrupt frames
that are marked "ok".  Linux has some workarounds for this and checks whether
the status word has error bits set in it regardless of the bit that marks
the frame as "ok".  Adapt this workaround to our driver and drop the frame
after setting input errors.  This doesn't filter out all corrupted frames,
but it does keep things down to a level where it doesn't fill up the node
cache anymore when athn(4) is used in hostap mode.

Seen with:

athn0 at pci1 dev 0 function 0 "Atheros AR9281" rev 0x01: intx
athn0: AR9280 rev 2 (2T2R), ROM rev 16, address xx:xx:xx:xx:xx:xx

ok stsp@
---

diff --git a/sys/dev/ic/ar5008.c b/sys/dev/ic/ar5008.c
index ea1f278ed8f..fbf2059a157 100644
--- a/sys/dev/ic/ar5008.c
+++ b/sys/dev/ic/ar5008.c
@@ -1,4 +1,4 @@
-/*	$OpenBSD: ar5008.c,v 1.67 2021/07/01 11:51:55 stsp Exp $	*/
+/*	$OpenBSD: ar5008.c,v 1.68 2021/10/03 20:19:55 kettenis Exp $	*/
 
 /*-
  * Copyright (c) 2009 Damien Bergamini <damien.bergamini@free.fr>
@@ -921,6 +921,12 @@ ar5008_rx_process(struct athn_softc *sc, struct mbuf_list *ml)
 			ifp->if_ierrors++;
 			goto skip;
 		}
+	} else {
+		if (ds->ds_status8 & (AR_RXS8_CRC_ERR | AR_RXS8_PHY_ERR |
+		    AR_RXS8_DECRYPT_CRC_ERR | AR_RXS8_MICHAEL_ERR)) {
+			ifp->if_ierrors++;
+			goto skip;
+		}
 	}
 
 	len = MS(ds->ds_status1, AR_RXS1_DATA_LEN);