From: Matthieu CASTET <[email protected]>

Fix possible unaligned u32 access in b43_generate_plcp_hdr().
Unaligned data is read/write with a u32 pointer instead of using the
packed structure. Some versions of gcc ignore the "packed" attribute, if the
structure element is accessed through a local pointer.

Signed-off-by: Matthieu CASTET <[email protected]>
Signed-off-by: Michael Buesch <[email protected]>

---

Please queue this bugfix.


diff --git a/drivers/net/wireless/b43/xmit.c b/drivers/net/wireless/b43/xmit.c
index a63d888..55f36a7 100644
--- a/drivers/net/wireless/b43/xmit.c
+++ b/drivers/net/wireless/b43/xmit.c
@@ -118,7 +118,6 @@ u8 b43_plcp_get_ratecode_ofdm(const u8 bitrate)
 void b43_generate_plcp_hdr(struct b43_plcp_hdr4 *plcp,
                           const u16 octets, const u8 bitrate)
 {
-       __le32 *data = &(plcp->data);
        __u8 *raw = plcp->raw;
 
        if (b43_is_ofdm_rate(bitrate)) {
@@ -127,7 +126,7 @@ void b43_generate_plcp_hdr(struct b43_plcp_hdr4 *plcp,
                d = b43_plcp_get_ratecode_ofdm(bitrate);
                B43_WARN_ON(octets & 0xF000);
                d |= (octets << 5);
-               *data = cpu_to_le32(d);
+               plcp->data = cpu_to_le32(d);
        } else {
                u32 plen;
 
@@ -141,7 +140,7 @@ void b43_generate_plcp_hdr(struct b43_plcp_hdr4 *plcp,
                                raw[1] = 0x04;
                } else
                        raw[1] = 0x04;
-               *data |= cpu_to_le32(plen << 16);
+               plcp->data |= cpu_to_le32(plen << 16);
                raw[0] = b43_plcp_get_ratecode_cck(bitrate);
        }
 }

-- 
Greetings, Michael.
_______________________________________________
Bcm43xx-dev mailing list
[email protected]
https://lists.berlios.de/mailman/listinfo/bcm43xx-dev

Reply via email to