diff options
| author | sam <sam@FreeBSD.org> | 2009-05-29 23:41:31 +0000 |
|---|---|---|
| committer | sam <sam@FreeBSD.org> | 2009-05-29 23:41:31 +0000 |
| commit | 36bf6c9b02de093f113d81dc2ba7c54d7ba93926 (patch) | |
| tree | 9787d1f6e3cc4539910d1507c1a24f4aee473ecf /sys/dev/iwn | |
| parent | a025c3b40e2c37699d82b576a11975bb3c4c06c3 (diff) | |
| download | FreeBSD-src-36bf6c9b02de093f113d81dc2ba7c54d7ba93926.zip FreeBSD-src-36bf6c9b02de093f113d81dc2ba7c54d7ba93926.tar.gz | |
validate tx rate(s) in the raw xmit path
Tested by: "Paul B. Mahol" <onemda@gmail.com> (rum, bwi)
Diffstat (limited to 'sys/dev/iwn')
| -rw-r--r-- | sys/dev/iwn/if_iwn.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/sys/dev/iwn/if_iwn.c b/sys/dev/iwn/if_iwn.c index cc12828..b520d8d 100644 --- a/sys/dev/iwn/if_iwn.c +++ b/sys/dev/iwn/if_iwn.c @@ -2227,6 +2227,7 @@ iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m0, const struct ieee80211_bpf_params *params) { struct ieee80211vap *vap = ni->ni_vap; + struct ieee80211com *ic = ni->ni_ic; struct iwn_tx_cmd *cmd; struct iwn_cmd_data *tx; struct ieee80211_frame *wh; @@ -2263,6 +2264,11 @@ iwn_tx_data_raw(struct iwn_softc *sc, struct mbuf *m0, /* pick a tx rate */ rate = params->ibp_rate0; + if (!ieee80211_isratevalid(ic->ic_rt, rate)) { + /* XXX fall back to mcast/mgmt rate? */ + m_freem(m0); + return EINVAL; + } if (ieee80211_radiotap_active_vap(vap)) { struct iwn_tx_radiotap_header *tap = &sc->sc_txtap; |
