mwifiex: Fix unalignment access for casting variables
The main scenario that run into unaligned access problem is
casting variable of diffrent lengths/size.
This can be prevented by the use of accessor functions
get_unaligned_le*() and put_unaligned_le*().
This patch make use of above accessor functions during casting of
variables in mwifiex driver
Signed-off-by: Karthik D A <karthida@marvell.com>
Change-Id: I4e4c0ca9c32a6de388b960c61563d5eb66310ac1
diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
index 6bc2011..25d6d84 100644
--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
@@ -242,7 +242,7 @@
mwifiex_dbg(adapter, CMD,
"cmd: DNLD_CMD: %#x, act %#x, len %d, seqno %#x\n",
cmd_code,
- le16_to_cpu(*(__le16 *)((u8 *)host_cmd + S_DS_GEN)),
+ get_unaligned_le16((u8 *)host_cmd + S_DS_GEN),
cmd_size, le16_to_cpu(host_cmd->seq_num));
mwifiex_dbg_dump(adapter, CMD_D, "cmd buffer:", host_cmd, cmd_size);
@@ -286,7 +286,7 @@
(adapter->dbg.last_cmd_index + 1) % DBG_CMD_NUM;
adapter->dbg.last_cmd_id[adapter->dbg.last_cmd_index] = cmd_code;
adapter->dbg.last_cmd_act[adapter->dbg.last_cmd_index] =
- le16_to_cpu(*(__le16 *) ((u8 *) host_cmd + S_DS_GEN));
+ get_unaligned_le16((u8 *)host_cmd + S_DS_GEN);
/* Clear BSS_NO_BITS from HostCmd */
cmd_code &= HostCmd_CMD_ID_MASK;
diff --git a/drivers/net/wireless/marvell/mwifiex/pcie.c b/drivers/net/wireless/marvell/mwifiex/pcie.c
index 28dfd39..329ac98 100644
--- a/drivers/net/wireless/marvell/mwifiex/pcie.c
+++ b/drivers/net/wireless/marvell/mwifiex/pcie.c
@@ -69,7 +69,7 @@
*/
static bool mwifiex_pcie_ok_to_access_hw(struct mwifiex_adapter *adapter)
{
- u32 *cookie_addr;
+ u32 cookie_value;
struct pcie_service_card *card = adapter->card;
const struct mwifiex_pcie_card_reg *reg = card->pcie.reg;
@@ -77,11 +77,11 @@
return true;
if (card->sleep_cookie_vbase) {
- cookie_addr = (u32 *)card->sleep_cookie_vbase;
+ cookie_value = get_unaligned_le32(card->sleep_cookie_vbase);
mwifiex_dbg(adapter, INFO,
"info: ACCESS_HW: sleep cookie=0x%x\n",
- *cookie_addr);
- if (*cookie_addr == FW_AWAKE_COOKIE)
+ cookie_value);
+ if (cookie_value == FW_AWAKE_COOKIE)
return true;
}
@@ -362,7 +362,7 @@
for (count = 0; count < max_delay_loop_cnt; count++) {
buffer = card->cmdrsp_buf->data - INTF_HEADER_LEN;
- sleep_cookie = *(u32 *)buffer;
+ sleep_cookie = get_unaligned_le32(buffer);
if (sleep_cookie == MWIFIEX_DEF_SLEEP_COOKIE) {
mwifiex_dbg(adapter, INFO,
@@ -954,6 +954,7 @@
static int mwifiex_pcie_alloc_sleep_cookie_buf(struct mwifiex_adapter *adapter)
{
struct pcie_service_card *card = adapter->card;
+ u32 tmp;
card->sleep_cookie_vbase = pci_alloc_consistent(card->dev, sizeof(u32),
&card->sleep_cookie_pbase);
@@ -963,11 +964,12 @@
return -ENOMEM;
}
/* Init val of Sleep Cookie */
- *(u32 *)card->sleep_cookie_vbase = FW_AWAKE_COOKIE;
+ tmp = FW_AWAKE_COOKIE;
+ put_unaligned(tmp, card->sleep_cookie_vbase);
mwifiex_dbg(adapter, INFO,
"alloc_scook: sleep cookie=0x%x\n",
- *((u32 *)card->sleep_cookie_vbase));
+ get_unaligned(card->sleep_cookie_vbase));
return 0;
}
@@ -1127,7 +1129,6 @@
dma_addr_t buf_pa;
struct mwifiex_pcie_buf_desc *desc = NULL;
struct mwifiex_pfu_buf_desc *desc2 = NULL;
- __le16 *tmp;
if (!(skb->data && skb->len)) {
mwifiex_dbg(adapter, ERROR,
@@ -1148,10 +1149,8 @@
adapter->data_sent = true;
payload = skb->data;
- tmp = (__le16 *)&payload[0];
- *tmp = cpu_to_le16((u16)skb->len);
- tmp = (__le16 *)&payload[2];
- *tmp = cpu_to_le16(MWIFIEX_TYPE_DATA);
+ put_unaligned_le16((u16)skb->len, payload + 0);
+ put_unaligned_le16(MWIFIEX_TYPE_DATA, payload + 2);
if (mwifiex_map_pci_memory(adapter, skb, skb->len,
PCI_DMA_TODEVICE))
@@ -1501,8 +1500,8 @@
adapter->cmd_sent = true;
- *(__le16 *)&payload[0] = cpu_to_le16((u16)skb->len);
- *(__le16 *)&payload[2] = cpu_to_le16(MWIFIEX_TYPE_CMD);
+ put_unaligned_le16((u16)skb->len, &payload[0]);
+ put_unaligned_le16(MWIFIEX_TYPE_CMD, &payload[2]);
if (mwifiex_map_pci_memory(adapter, skb, skb->len, PCI_DMA_TODEVICE))
return -1;
@@ -1740,7 +1739,7 @@
desc = card->evtbd_ring[rdptr];
memset(desc, 0, sizeof(*desc));
- event = *(u32 *) &skb_cmd->data[INTF_HEADER_LEN];
+ event = get_unaligned_le32(&skb_cmd->data[INTF_HEADER_LEN]);
adapter->event_cause = event;
/* The first 4bytes will be the event transfer header
len is 2 bytes followed by type which is 2 bytes */
diff --git a/drivers/net/wireless/marvell/mwifiex/sdio.c b/drivers/net/wireless/marvell/mwifiex/sdio.c
index c443464..1042f7d 100644
--- a/drivers/net/wireless/marvell/mwifiex/sdio.c
+++ b/drivers/net/wireless/marvell/mwifiex/sdio.c
@@ -1226,10 +1226,11 @@
struct sk_buff *skb, u32 upld_typ)
{
u8 *cmd_buf;
- __le16 *curr_ptr = (__le16 *)skb->data;
- u16 pkt_len = get_unaligned_le16(curr_ptr);
+ u16 pkt_len;
struct mwifiex_rxinfo *rx_info;
+ pkt_len = get_unaligned_le16(skb->data);
+
if (upld_typ != MWIFIEX_TYPE_AGGR_DATA) {
skb_trim(skb, pkt_len);
skb_pull(skb, INTF_HEADER_LEN);
@@ -1289,7 +1290,7 @@
case MWIFIEX_TYPE_EVENT:
mwifiex_dbg(adapter, EVENT,
"info: --- Rx: Event ---\n");
- adapter->event_cause = le32_to_cpu(*(__le32 *) skb->data);
+ adapter->event_cause = get_unaligned_le32(skb->data);
if ((skb->len > 0) && (skb->len < MAX_EVENT_SIZE))
memcpy(adapter->event_body,
@@ -1928,8 +1929,9 @@
/* Allocate buffer and copy payload */
blk_size = MWIFIEX_SDIO_BLOCK_SIZE;
buf_block_len = (pkt_len + blk_size - 1) / blk_size;
- *(__le16 *)&payload[0] = cpu_to_le16((u16)pkt_len);
- *(__le16 *)&payload[2] = cpu_to_le16(type);
+ put_unaligned_le16((u16)pkt_len, payload + 0);
+ put_unaligned_le16((u32)type, payload + 2);
+
/*
* This is SDIO specific header
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 78e1061..055d3ce 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -130,7 +130,7 @@
} else if (cmd_action == HostCmd_ACT_GEN_SET) {
snmp_mib->query_type = cpu_to_le16(HostCmd_ACT_GEN_SET);
snmp_mib->buf_size = cpu_to_le16(sizeof(u16));
- *((__le16 *) (snmp_mib->value)) = cpu_to_le16(*ul_temp);
+ put_unaligned_le16(*ul_temp, snmp_mib->value);
le16_unaligned_add_cpu(&cmd->size, sizeof(u16));
}
@@ -138,7 +138,7 @@
"cmd: SNMP_CMD: Action=0x%x, OID=0x%x,\t"
"OIDSize=0x%x, Value=0x%x\n",
cmd_action, cmd_oid, le16_to_cpu(snmp_mib->buf_size),
- le16_to_cpu(*(__le16 *)snmp_mib->value));
+ get_unaligned_le16(snmp_mib->value));
return 0;
}
@@ -1366,7 +1366,7 @@
filter = &mef_entry->filter[i];
if (!filter->filt_type)
break;
- *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->repeat);
+ put_unaligned_le32((u32)filter->repeat, stack_ptr);
stack_ptr += 4;
*stack_ptr = TYPE_DNUM;
stack_ptr += 1;
@@ -1378,8 +1378,7 @@
stack_ptr += 1;
*stack_ptr = TYPE_BYTESEQ;
stack_ptr += 1;
-
- *(__le32 *)stack_ptr = cpu_to_le32((u32)filter->offset);
+ put_unaligned_le32((u32)filter->offset, stack_ptr);
stack_ptr += 4;
*stack_ptr = TYPE_DNUM;
stack_ptr += 1;
@@ -1740,7 +1739,7 @@
return -ENODATA;
}
- *(__le16 *)pos = cpu_to_le16(params->capability);
+ put_unaligned_le16(params->capability, pos);
config_len += sizeof(params->capability);
qos_info = params->uapsd_queues | (params->max_sp << 5);
@@ -1964,7 +1963,7 @@
case HostCmd_CMD_VERSION_EXT:
cmd_ptr->command = cpu_to_le16(cmd_no);
cmd_ptr->params.verext.version_str_sel =
- (u8) (*((u32 *) data_buf));
+ (u8)(get_unaligned((u32 *)data_buf));
memcpy(&cmd_ptr->params, data_buf,
sizeof(struct host_cmd_ds_version_ext));
cmd_ptr->size =
@@ -1975,7 +1974,8 @@
case HostCmd_CMD_MGMT_FRAME_REG:
cmd_ptr->command = cpu_to_le16(cmd_no);
cmd_ptr->params.reg_mask.action = cpu_to_le16(cmd_action);
- cmd_ptr->params.reg_mask.mask = cpu_to_le32(*(u32 *)data_buf);
+ cmd_ptr->params.reg_mask.mask = cpu_to_le32(
+ get_unaligned((u32 *)data_buf));
cmd_ptr->size =
cpu_to_le16(sizeof(struct host_cmd_ds_mgmt_frame_reg) +
S_DS_GEN);
@@ -1995,7 +1995,8 @@
case HostCmd_CMD_P2P_MODE_CFG:
cmd_ptr->command = cpu_to_le16(cmd_no);
cmd_ptr->params.mode_cfg.action = cpu_to_le16(cmd_action);
- cmd_ptr->params.mode_cfg.mode = cpu_to_le16(*(u16 *)data_buf);
+ cmd_ptr->params.mode_cfg.mode = cpu_to_le16(
+ get_unaligned((u16 *)data_buf));
cmd_ptr->size =
cpu_to_le16(sizeof(struct host_cmd_ds_p2p_mode_cfg) +
S_DS_GEN);
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
index d18c797..d35bcfb 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmdresp.c
@@ -183,7 +183,7 @@
"query_type = %#x, buf size = %#x\n",
oid, query_type, le16_to_cpu(smib->buf_size));
if (query_type == HostCmd_ACT_GEN_GET) {
- ul_temp = le16_to_cpu(*((__le16 *) (smib->value)));
+ ul_temp = get_unaligned_le16(smib->value);
if (data_buf)
*data_buf = ul_temp;
switch (oid) {
@@ -736,7 +736,7 @@
struct host_cmd_ds_p2p_mode_cfg *mode_cfg = &resp->params.mode_cfg;
if (data_buf)
- *((u16 *)data_buf) = le16_to_cpu(mode_cfg->mode);
+ put_unaligned_le16(le16_to_cpu(mode_cfg->mode), data_buf);
return 0;
}
diff --git a/drivers/net/wireless/marvell/mwifiex/tdls.c b/drivers/net/wireless/marvell/mwifiex/tdls.c
index 040a878..e228c03 100644
--- a/drivers/net/wireless/marvell/mwifiex/tdls.c
+++ b/drivers/net/wireless/marvell/mwifiex/tdls.c
@@ -857,7 +857,7 @@
struct mwifiex_sta_node *sta_ptr;
u8 *peer, *pos, *end;
u8 i, action, basic;
- __le16 cap = 0;
+ u16 cap = 0;
int ie_len = 0;
if (len < (sizeof(struct ethhdr) + 3))
@@ -879,7 +879,7 @@
pos = buf + sizeof(struct ethhdr) + 4;
/* payload 1+ category 1 + action 1 + dialog 1 */
- cap = cpu_to_le16(*(u16 *)pos);
+ cap = get_unaligned_le16(pos);
ie_len = len - sizeof(struct ethhdr) - TDLS_REQ_FIX_LEN;
pos += 2;
break;
@@ -889,7 +889,7 @@
return;
/* payload 1+ category 1 + action 1 + dialog 1 + status code 2*/
pos = buf + sizeof(struct ethhdr) + 6;
- cap = cpu_to_le16(*(u16 *)pos);
+ cap = get_unaligned_le16(pos);
ie_len = len - sizeof(struct ethhdr) - TDLS_RESP_FIX_LEN;
pos += 2;
break;
@@ -909,7 +909,7 @@
if (!sta_ptr)
return;
- sta_ptr->tdls_cap.capab = cap;
+ sta_ptr->tdls_cap.capab = cpu_to_le16(cap);
for (end = pos + ie_len; pos + 1 < end; pos += 2 + pos[1]) {
if (pos + 2 + pos[1] > end)
diff --git a/drivers/net/wireless/marvell/mwifiex/util.c b/drivers/net/wireless/marvell/mwifiex/util.c
index 6681be0..18839f8 100644
--- a/drivers/net/wireless/marvell/mwifiex/util.c
+++ b/drivers/net/wireless/marvell/mwifiex/util.c
@@ -289,13 +289,13 @@
val = *((u8 *)addr);
break;
case 2:
- val = *((u16 *)addr);
+ val = get_unaligned((u16 *)addr);
break;
case 4:
- val = *((u32 *)addr);
+ val = get_unaligned((u32 *)addr);
break;
case 8:
- val = *((long long *)addr);
+ val = get_unaligned((long long *)addr);
break;
default:
val = -1;
