# Re: \[PATCH net-next 3/3\] macsec: add brackets and indentation after calling macsec\_decrypt

- From: Andreas Steinmetz \<hidden\>
- Date: 2019-07-02 04:38:29 
- List: netdev
- Page: https://ratatoskr.run/netdev/2019/07/11141023
- Thread: https://ratatoskr.run/netdev/2019/06/11140831/t.md

```text
Ouch, I missed that when Andreas sent me that patch before. No, it is
> actually intended. If we skip macsec_decrypt(), we should still
> account for that packet in the InPktsUnchecked/InPktsDelayed
> counters. That's in Figure 10-5 in the standard.
> 
> Thanks for catching this, Willem. That patch should only move the
> IS_ERR(skb) case under the block where macsec_decrypt() is called, but
> not move the call to macsec_post_decrypt().

Updated patch below.

Signed-off-by: Andreas Steinmetz <redacted>

--- a/drivers/net/macsec.c	2019-07-02 06:31:27.550120145 +0200
+++ b/drivers/net/macsec.c	2019-07-02 06:33:38.637599529 +0200
@@ -1205,17 +1205,18 @@
 
 	/* Disabled && !changed text => skip validation */
 	if (hdr->tci_an & MACSEC_TCI_C ||
-	    secy->validate_frames != MACSEC_VALIDATE_DISABLED)
+	    secy->validate_frames != MACSEC_VALIDATE_DISABLED) {
 		skb = macsec_decrypt(skb, dev, rx_sa, sci, secy);
 
-	if (IS_ERR(skb)) {
-		/* the decrypt callback needs the reference */
-		if (PTR_ERR(skb) != -EINPROGRESS) {
-			macsec_rxsa_put(rx_sa);
-			macsec_rxsc_put(rx_sc);
+		if (IS_ERR(skb)) {
+			/* the decrypt callback needs the reference */
+			if (PTR_ERR(skb) != -EINPROGRESS) {
+				macsec_rxsa_put(rx_sa);
+				macsec_rxsc_put(rx_sc);
+			}
+			rcu_read_unlock();
+			return RX_HANDLER_CONSUMED;
 		}
-		rcu_read_unlock();
-		return RX_HANDLER_CONSUMED;
 	}
 
 	if (!macsec_post_decrypt(skb, secy, pn))

```