Re: [PATCH V2] ath6kl: Fix 4-way handshake failure in AP and P2P GO mode

[Vasanthakumar Thiagarajan <vthiagar@xxxxxxxxxxxxxxxx>]

> > +static int ath6kl_get_rsn_capab(struct cfg80211_beacon_data *beacon,
> > +				u8 *rsn_capab)
> > +{
> > +	const u8 *rsn_ie;
> > +	size_t rsn_ie_len;
> > +	u16 cnt;
> > +
> > +	if (!beacon->tail)
> > +		return -EINVAL;
> > +
> > +	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, beacon->tail, beacon->tail_len);
> > +	if (!rsn_ie)
> > +		return -EINVAL;
> > +
> > +	rsn_ie_len = *(rsn_ie + 1);
> > +	/* skip element id and length */
> > +	rsn_ie += 2;
> > +
> > +	/* skip version, group cipher */
> > +	if (rsn_ie_len<  6)
> > +		return -EINVAL;
> > +	rsn_ie +=  6;
> > +	rsn_ie_len -= 6;
> > +
> > +	/* skip pairwise cipher suite */
> > +	if (rsn_ie_len<  2)
> > +		return -EINVAL;
> > +	cnt = *((u16 *) rsn_ie);
>
> Any endian or alignment issues?

Indeed this can pretty much result in unaligned memory access.
I'll fix that. Thanks for pointing this out.
> > +	rsn_ie += (2 + cnt * 4);
> > +	rsn_ie_len -= (2 + cnt * 4);
> > +
> > +	/* skip akm suite */
> > +	if (rsn_ie_len<  2)
> > +		return -EINVAL;
> > +	cnt = *((u16 *) rsn_ie);

This too.

Vasanth
--
To unsubscribe from this list: send the line "unsubscribe linux-wireless" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html