diff options
author | Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com> | 2012-04-10 04:05:47 -0400 |
---|---|---|
committer | Kalle Valo <kvalo@qca.qualcomm.com> | 2012-04-12 03:35:03 -0400 |
commit | 798985c688722479191f6d6f4e5ab1a473904f0a (patch) | |
tree | 7945cf0dc64e78a8d53074f7cba4fe6939535057 /drivers/net/wireless/ath/ath6kl/cfg80211.c | |
parent | c4f7863eae6f580a0373cbd8dc2731d082570e69 (diff) |
ath6kl: Fix possible unaligned memory access in ath6kl_get_rsn_capab()
alignment is not taken care in accessing pairwise cipher and AKM suite
count which are parsed from rsn ie. Fix this alignment issue.
Reported-by: Joe Perches <joe@perches.com>
Signed-off-by: Vasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: Kalle Valo <kvalo@qca.qualcomm.com>
Diffstat (limited to 'drivers/net/wireless/ath/ath6kl/cfg80211.c')
-rw-r--r-- | drivers/net/wireless/ath/ath6kl/cfg80211.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c index 6ea5ae54c160..6b6bf938feef 100644 --- a/drivers/net/wireless/ath/ath6kl/cfg80211.c +++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c | |||
@@ -2591,14 +2591,14 @@ static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon, | |||
2591 | /* skip pairwise cipher suite */ | 2591 | /* skip pairwise cipher suite */ |
2592 | if (rsn_ie_len < 2) | 2592 | if (rsn_ie_len < 2) |
2593 | return -EINVAL; | 2593 | return -EINVAL; |
2594 | cnt = *((u16 *) rsn_ie); | 2594 | cnt = get_unaligned_le16(rsn_ie); |
2595 | rsn_ie += (2 + cnt * 4); | 2595 | rsn_ie += (2 + cnt * 4); |
2596 | rsn_ie_len -= (2 + cnt * 4); | 2596 | rsn_ie_len -= (2 + cnt * 4); |
2597 | 2597 | ||
2598 | /* skip akm suite */ | 2598 | /* skip akm suite */ |
2599 | if (rsn_ie_len < 2) | 2599 | if (rsn_ie_len < 2) |
2600 | return -EINVAL; | 2600 | return -EINVAL; |
2601 | cnt = *((u16 *) rsn_ie); | 2601 | cnt = get_unaligned_le16(rsn_ie); |
2602 | rsn_ie += (2 + cnt * 4); | 2602 | rsn_ie += (2 + cnt * 4); |
2603 | rsn_ie_len -= (2 + cnt * 4); | 2603 | rsn_ie_len -= (2 + cnt * 4); |
2604 | 2604 | ||