lkml.org 
[lkml]   [2022]   [Oct]   [19]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 6.0 285/862] wifi: mt76: connac: fix possible unaligned access in mt76_connac_mcu_add_nested_tlv
    Date
    From: Lorenzo Bianconi <lorenzo@kernel.org>

    [ Upstream commit 0a4860f627f1f2b2b777f54f993de1638a79da9f ]

    Fix possible unaligned pointer in mt76_connac_mcu_add_nested_tlv
    routine.

    Reported-by: kernel test robot <lkp@intel.com>
    Fixes: 25702d9c55dc5 ("mt76: connac: rely on le16_add_cpu in mt76_connac_mcu_add_nested_tlv")
    Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
    Signed-off-by: Felix Fietkau <nbd@nbd.name>
    Signed-off-by: Sasha Levin <sashal@kernel.org>
    ---
    drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c | 6 ++++--
    1 file changed, 4 insertions(+), 2 deletions(-)

    diff --git a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
    index 9b17bd97ec09..13d4722e4186 100644
    --- a/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
    +++ b/drivers/net/wireless/mediatek/mt76/mt76_connac_mcu.c
    @@ -260,8 +260,10 @@ mt76_connac_mcu_add_nested_tlv(struct sk_buff *skb, int tag, int len,
    ntlv = le16_to_cpu(ntlv_hdr->tlv_num);
    ntlv_hdr->tlv_num = cpu_to_le16(ntlv + 1);

    - if (sta_hdr)
    - le16_add_cpu(&sta_hdr->len, len);
    + if (sta_hdr) {
    + len += le16_to_cpu(sta_hdr->len);
    + sta_hdr->len = cpu_to_le16(len);
    + }

    return ptlv;
    }
    --
    2.35.1


    \
     
     \ /
      Last update: 2022-10-19 15:28    [W:4.047 / U:0.404 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site