Commit 798985c6 authored by Vasanthakumar Thiagarajan's avatar Vasanthakumar Thiagarajan Committed by Kalle Valo

ath6kl: Fix possible unaligned memory access in ath6kl_get_rsn_capab()

alignment is not taken care in accessing pairwise cipher and AKM suite
count which are parsed from rsn ie. Fix this alignment issue.
Reported-by: default avatarJoe Perches <joe@perches.com>
Signed-off-by: default avatarVasanthakumar Thiagarajan <vthiagar@qca.qualcomm.com>
Signed-off-by: default avatarKalle Valo <kvalo@qca.qualcomm.com>
parent c4f7863e
...@@ -2591,14 +2591,14 @@ static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon, ...@@ -2591,14 +2591,14 @@ static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
/* skip pairwise cipher suite */ /* skip pairwise cipher suite */
if (rsn_ie_len < 2) if (rsn_ie_len < 2)
return -EINVAL; return -EINVAL;
cnt = *((u16 *) rsn_ie); cnt = get_unaligned_le16(rsn_ie);
rsn_ie += (2 + cnt * 4); rsn_ie += (2 + cnt * 4);
rsn_ie_len -= (2 + cnt * 4); rsn_ie_len -= (2 + cnt * 4);
/* skip akm suite */ /* skip akm suite */
if (rsn_ie_len < 2) if (rsn_ie_len < 2)
return -EINVAL; return -EINVAL;
cnt = *((u16 *) rsn_ie); cnt = get_unaligned_le16(rsn_ie);
rsn_ie += (2 + cnt * 4); rsn_ie += (2 + cnt * 4);
rsn_ie_len -= (2 + cnt * 4); rsn_ie_len -= (2 + cnt * 4);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment