Change the ath_dfs_process_phy_err() method to take an mbuf rather than

a buffer pointer.

For large radar pulses, the AR9130 and later will return a series of
FFT results for software processing.  These can overflow a single 2KB
buffer on longer pulses.  This would result in undefined buffer behaviour.

3 files changed, 14 insertions, 10 deletions

diff --git a/sys/dev/ath/ath_dfs/null/dfs_null.c b/sys/dev/ath/ath_dfs/null/dfs_null.c
index a8aabb4..299969f 100644
--- a/sys/dev/ath/ath_dfs/null/dfs_null.c
+++ b/sys/dev/ath/ath_dfs/null/dfs_null.c
@@ -102,7 +102,7 @@ __FBSDID("$FreeBSD$");
 int
 ath_dfs_attach(struct ath_softc *sc)
 {
-	return 1;
+	return (1);
 }
 
 /*
@@ -111,11 +111,12 @@ ath_dfs_attach(struct ath_softc *sc)
 int
 ath_dfs_detach(struct ath_softc *sc)
 {
-	return 1;
+	return (1);
 }
 
 /*
- * Enable radar check
+ * Enable radar check.  Return 1 if the driver should
+ * enable radar PHY errors, or 0 if not.
  */
 int
 ath_dfs_radar_enable(struct ath_softc *sc, struct ieee80211_channel *chan)
@@ -163,9 +164,12 @@ ath_dfs_radar_enable(struct ath_softc *sc, struct ieee80211_channel *chan)
 
 /*
  * Process DFS related PHY errors
+ *
+ * The mbuf is not "ours" and if we want a copy, we have
+ * to take a copy.  It'll be freed after this function returns.
  */
 void
-ath_dfs_process_phy_err(struct ath_softc *sc, const char *buf,
+ath_dfs_process_phy_err(struct ath_softc *sc, struct mbuf *m,
     uint64_t tsf, struct ath_rx_status *rxstat)
 {
 
@@ -182,7 +186,7 @@ int
 ath_dfs_process_radar_event(struct ath_softc *sc,
     struct ieee80211_channel *chan)
 {
-	return 0;
+	return (0);
 }
 
 /*
@@ -195,7 +199,7 @@ ath_dfs_process_radar_event(struct ath_softc *sc,
 int
 ath_dfs_tasklet_needed(struct ath_softc *sc, struct ieee80211_channel *chan)
 {
-	return 0;
+	return (0);
 }
 
 /*
@@ -272,7 +276,7 @@ bad:
 		free(indata, M_TEMP);
 	if ((ad->ad_id & ATH_DIAG_DYN) && outdata != NULL)
 		free(outdata, M_TEMP);
-	return error;
+	return (error);
 }
 
 /*
@@ -282,5 +286,5 @@ int
 ath_dfs_get_thresholds(struct ath_softc *sc, HAL_PHYERR_PARAM *param)
 {
 	ath_hal_getdfsthresh(sc->sc_ah, param);
-	return 1;
+	return (1);
 }
diff --git a/sys/dev/ath/if_ath_rx.c b/sys/dev/ath/if_ath_rx.c
index c1bc25c..532f200 100644
--- a/sys/dev/ath/if_ath_rx.c
+++ b/sys/dev/ath/if_ath_rx.c
@@ -536,7 +536,7 @@ ath_rx_pkt(struct ath_softc *sc, struct ath_rx_status *rs, HAL_STATUS status,
 				    bf->bf_dmamap,
 				    BUS_DMASYNC_POSTREAD);
 				/* Now pass it to the radar processing code */
-				ath_dfs_process_phy_err(sc, mtod(m, char *), rstamp, rs);
+				ath_dfs_process_phy_err(sc, m, rstamp, rs);
 			}
 
 			/* Be suitably paranoid about receiving phy errors out of the stats array bounds */
diff --git a/sys/dev/ath/if_athdfs.h b/sys/dev/ath/if_athdfs.h
index 215b8ca..3529671 100644
--- a/sys/dev/ath/if_athdfs.h
+++ b/sys/dev/ath/if_athdfs.h
@@ -35,7 +35,7 @@ extern	int ath_dfs_attach(struct ath_softc *sc);
 extern	int ath_dfs_detach(struct ath_softc *sc);
 extern	int ath_dfs_radar_enable(struct ath_softc *,
     struct ieee80211_channel *chan);
-extern	void ath_dfs_process_phy_err(struct ath_softc *sc, const char *buf,
+extern	void ath_dfs_process_phy_err(struct ath_softc *sc, struct mbuf *m,
     uint64_t tsf, struct ath_rx_status *rxstat);
 extern	int ath_dfs_process_radar_event(struct ath_softc *sc,
     struct ieee80211_channel *chan);