OSEC

Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email hr@neohapsis.com
[PATCH] rate == 0 bug in sys/dev/ic/rt2661.c

From: Stephen Lewis (stephensock.org.uk)
Date: Thu Mar 08 2007 - 09:00:20 CST


The workaround reintroduced in r1.83 of sys/dev/usb/if_ral.c seems to be
necessary in rt2661.c as well, otherwise there's a potential divide by
zero at line 1424 of that file (in rt2661_setup_tx_desc).

I started preparing a proper report for this back in December, but never
got around to posting it:

   http://www.sock.org.uk/volatile/ral/panic
   http://www.sock.org.uk/volatile/ral/dmesg

(As the dmesg shows it's quite old, but I don't think anything has
changed that would fix this particular problem. I'm quite happy to try
to reproduce this on -current if necessary. I'm now running -current as
of about a week ago with the patch below, and it works for me.)

Stephen

Index: rt2661.c
===================================================================
RCS file: /cvs/src/sys/dev/ic/rt2661.c,v
retrieving revision 1.35
diff -p -u -r1.35 rt2661.c
--- rt2661.c 3 Jan 2007 18:16:43 -0000 1.35
+++ rt2661.c 8 Mar 2007 14:42:30 -0000
-1576,6 +1576,8 rt2661_tx_data(struct rt2661_softc *sc,
                     rs_rates[ic->ic_fixed_rate];
         } else
                 rate = ni->ni_rates.rs_rates[ni->ni_txrate];
+ if (rate == 0)
+ rate = 2; /* XXX should not happen */
         rate &= IEEE80211_RATE_VAL;

         /*

--
Stephen Lewis