Commit 6d68ac8b authored by Jérôme Pouiller's avatar Jérôme Pouiller Committed by Greg Kroah-Hartman

staging: wfx: le16_to_cpus() takes a reference as parameter

Original code caused an (100% reproducible) invalid memory access on
big-endian targets.

Fixes: b0998f0c "staging: wfx: add IRQ handling"
Reported-by: default avatarkbuild test robot <lkp@intel.com>
Reported-by: default avatarStephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: default avatarJérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20191008094232.10014-4-Jerome.Pouiller@silabs.comSigned-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 488d3490
...@@ -83,12 +83,12 @@ static int rx_helper(struct wfx_dev *wdev, size_t read_len, int *is_cnf) ...@@ -83,12 +83,12 @@ static int rx_helper(struct wfx_dev *wdev, size_t read_len, int *is_cnf)
// piggyback is probably correct. // piggyback is probably correct.
return piggyback; return piggyback;
} }
le16_to_cpus(hif->len); le16_to_cpus(&hif->len);
computed_len = round_up(hif->len - sizeof(hif->len), 16) computed_len = round_up(hif->len - sizeof(hif->len), 16)
+ sizeof(struct hif_sl_msg) + sizeof(struct hif_sl_msg)
+ sizeof(struct hif_sl_tag); + sizeof(struct hif_sl_tag);
} else { } else {
le16_to_cpus(hif->len); le16_to_cpus(&hif->len);
computed_len = round_up(hif->len, 2); computed_len = round_up(hif->len, 2);
} }
if (computed_len != read_len) { if (computed_len != read_len) {
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment