[Bcm43xx-dev] "bugs" in bcm43xx_rx

[Johannes Berg]

Hi,

after the functionality was added to unpack WEP frames in bcm43xx_rx,
problems result:
 1) the skb->len is reduced appropriately, but stats.len is not adjusted
 2) wlhdr is used for passing the frame to ieee80211_rx_mgt, but
    if the frame was encrypted wlhdr points to something wrong

NOTE: before you start shouting about this causing problems for you,
think again. Especially about the facts that a) stats.len isn't used in
ieee80211_rx and b) management packets are never encrypted.

Yeah. This means that the above problems I listed aren't really problems
at all. But they do implicitly rely on things that aren't really
guaranteed.

johannes

signature.asc
Description: This is a digitally signed message part