From ee6d67f245d15de47b45ee947a7cf4a19cb7ef28 Mon Sep 17 00:00:00 2001 From: Amitkumar Karwar Date: Tue, 19 Aug 2014 08:24:24 -0400 Subject: [PATCH] mwifiex: fix left_len calculation issue While updating 'left_len' in each iteration, we should subtract last TLV length not the accumulated length of TLVs parsed till now. This bug in parsing logic is exposed by newer firmware which adds two TLVs in GET_HW_SPEC command response. Earlier firmwares used to add only one TLV. Signed-off-by: Amitkumar Karwar Signed-off-by: Avinash Patil Signed-off-by: Cathy Luo Signed-off-by: John W. Linville --- drivers/net/wireless/mwifiex/cmdevt.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/mwifiex/cmdevt.c b/drivers/net/wireless/mwifiex/cmdevt.c index baf0aab63c04d..0c212394dc1fd 100644 --- a/drivers/net/wireless/mwifiex/cmdevt.c +++ b/drivers/net/wireless/mwifiex/cmdevt.c @@ -1567,7 +1567,8 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv, } parsed_len += le16_to_cpu(tlv->len) + sizeof(struct mwifiex_ie_types_header); - left_len -= parsed_len; + left_len -= le16_to_cpu(tlv->len) + + sizeof(struct mwifiex_ie_types_header); } } -- 2.39.5