| From linville@tuxdriver.com Wed Oct 31 07:40:46 2007 |
| From: "John W. Linville" <linville@tuxdriver.com> |
| Date: Tue, 9 Oct 2007 22:46:33 -0400 |
| Subject: Add get_unaligned to ieee80211_get_radiotap_len |
| To: stable@kernel.org |
| Cc: warmcat <andy@warmcat.com>, "John W. Linville" <linville@tuxdriver.com> |
| Message-ID: <11919843974140-git-send-email-linville@tuxdriver.com> |
| |
| |
| From: Andy Green <andy@warmcat.com> |
| |
| patch dfe6e81deaa79c85086c0cc8d85b229e444ab97f in mainline. |
| |
| ieee80211_get_radiotap_len() tries to dereference radiotap length without |
| taking care that it is completely unaligned and get_unaligned() |
| is required. |
| |
| Signed-off-by: Andy Green <andy@warmcat.com> |
| Signed-off-by: John W. Linville <linville@tuxdriver.com> |
| Signed-off-by: Greg Kroah-Hartman <gregkh@suse.de> |
| |
| --- |
| net/mac80211/ieee80211.c | 2 +- |
| 1 file changed, 1 insertion(+), 1 deletion(-) |
| |
| --- a/net/mac80211/ieee80211.c |
| +++ b/net/mac80211/ieee80211.c |
| @@ -350,7 +350,7 @@ static int ieee80211_get_radiotap_len(st |
| struct ieee80211_radiotap_header *hdr = |
| (struct ieee80211_radiotap_header *) skb->data; |
| |
| - return le16_to_cpu(hdr->it_len); |
| + return le16_to_cpu(get_unaligned(&hdr->it_len)); |
| } |
| |
| #ifdef CONFIG_MAC80211_LOWTX_FRAME_DUMP |
