linux-kernel - [PATCH] wifi: mwifiex: fix endianness handling in mwifiex_send_rgpower

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-Id: <20250910-for-next-v1-1-3ee311706231@pengutronix.de>
Date: Wed, 10 Sep 2025 15:03:32 +0200
From: Stefan Kerkmann <s.kerkmann@...gutronix.de>
To: Brian Norris <briannorris@...omium.org>, 
 Francesco Dolcini <francesco@...cini.it>, 
 Johannes Berg <johannes.berg@...el.com>, 
 Dan Carpenter <dan.carpenter@...aro.org>
Cc: linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org, 
 Stefan Kerkmann <s.kerkmann@...gutronix.de>
Subject: [PATCH] wifi: mwifiex: fix endianness handling in
 mwifiex_send_rgpower_table

The length of the host command is a u16 stored in little endian byte
order, which needs byte order conversion to work correctly on big endian
systems.

Reported-by: Dan Carpenter <dan.carpenter@...aro.org>
Closes: https://lore.kernel.org/linux-wireless/aLqZI4FfOI4iJZtf@stanley.mountain
Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support")
Signed-off-by: Stefan Kerkmann <s.kerkmann@...gutronix.de>
---
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 91d5098081e8b97420322484a229654c026e4618..dcca71158fc682902c0bd3376da32e81f8f6561f 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -1537,7 +1537,7 @@ int mwifiex_send_rgpower_table(struct mwifiex_private *priv, const u8 *data,
 		}
 
 		if (*pos == '}' && start_raw) {
-			memcpy(&hostcmd->len, &hostcmd->cmd[2], sizeof(u16));
+			hostcmd->len = get_unaligned_le16(&hostcmd->cmd[2]);
 			ret = mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, false);
 			if (ret) {
 				mwifiex_dbg(adapter, ERROR,

---
base-commit: e3ac93e9d916ebae0711a42f524429dad89c4887
change-id: 20250910-for-next-008ed8e8a74e

Best regards,
-- 
Stefan Kerkmann <s.kerkmann@...gutronix.de>