aboutsummaryrefslogtreecommitdiffstats
path: root/drivers/net/wireless/ath/ath6kl/cfg80211.c
diff options
context:
space:
mode:
authorVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>2012-04-10 04:05:47 -0400
committerKalle Valo <kvalo@qca.qualcomm.com>2012-04-12 03:35:03 -0400
commit798985c688722479191f6d6f4e5ab1a473904f0a (patch)
tree7945cf0dc64e78a8d53074f7cba4fe6939535057 /drivers/net/wireless/ath/ath6kl/cfg80211.c
parentc4f7863eae6f580a0373cbd8dc2731d082570e69 (diff)
ath6kl: Fix possible unaligned memory access in ath6kl_get_rsn_capab()
alignment is not taken care in accessing pairwise cipher and AKM suite count which are parsed from rsn ie. Fix this alignment issue. Reported-by: Joe Perches <joe@perches.com> Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl/cfg80211.c')
-rw-r--r--drivers/net/wireless/ath/ath6kl/cfg80211.c4
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index 6ea5ae54c160..6b6bf938feef 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -2591,14 +2591,14 @@ static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
2591 /* skip pairwise cipher suite */ 2591 /* skip pairwise cipher suite */
2592 if (rsn_ie_len < 2) 2592 if (rsn_ie_len < 2)
2593 return -EINVAL; 2593 return -EINVAL;
2594 cnt = *((u16 *) rsn_ie); 2594 cnt = get_unaligned_le16(rsn_ie);
2595 rsn_ie += (2 + cnt * 4); 2595 rsn_ie += (2 + cnt * 4);
2596 rsn_ie_len -= (2 + cnt * 4); 2596 rsn_ie_len -= (2 + cnt * 4);
2597 2597
2598 /* skip akm suite */ 2598 /* skip akm suite */
2599 if (rsn_ie_len < 2) 2599 if (rsn_ie_len < 2)
2600 return -EINVAL; 2600 return -EINVAL;
2601 cnt = *((u16 *) rsn_ie); 2601 cnt = get_unaligned_le16(rsn_ie);
2602 rsn_ie += (2 + cnt * 4); 2602 rsn_ie += (2 + cnt * 4);
2603 rsn_ie_len -= (2 + cnt * 4); 2603 rsn_ie_len -= (2 + cnt * 4);
2604 2604