Bluetooth: fix unaligned access to l2cap conf data

In function l2cap_get_conf_opt() and l2cap_add_conf_opt() the address of
opt->val sometimes is not at the edge of 2-bytes/4-bytes, so 2-bytes/4 bytes
access will cause data misalignment exeception.  Use get_unaligned_le16/32
and put_unaligned_le16/32 function to avoid data misalignment execption.

Signed-off-by: steven miao <[email protected]>
Signed-off-by: Mike Frysinger <[email protected]>
Acked-by: Marcel Holtmann <[email protected]>
Signed-off-by: Gustavo F. Padovan <[email protected]>

diff --git a/net/bluetooth/l2cap.c b/net/bluetooth/l2cap.c
index daa7a988d9a6b4de7c7767748f1f18e1524cb78f..b3fb02ab2292f54674f6557a2c26a95782ba8232 100644 (file)
--- a/net/bluetooth/l2cap.c
+++ b/net/bluetooth/l2cap.c
@@ -2421,11 +2421,11 @@ static inline int l2cap_get_conf_opt(void **ptr, int *type, int *olen, unsigned
                break;
 
        case 2:
-               *val = __le16_to_cpu(*((__le16 *) opt->val));
+               *val = get_unaligned_le16(opt->val);
                break;
 
        case 4:
-               *val = __le32_to_cpu(*((__le32 *) opt->val));
+               *val = get_unaligned_le32(opt->val);
                break;
 
        default:
@@ -2452,11 +2452,11 @@ static void l2cap_add_conf_opt(void **ptr, u8 type, u8 len, unsigned long val)
                break;
 
        case 2:
-               *((__le16 *) opt->val) = cpu_to_le16(val);
+               put_unaligned_le16(cpu_to_le16(val), opt->val);
                break;
 
        case 4:
-               *((__le32 *) opt->val) = cpu_to_le32(val);
+               put_unaligned_le32(cpu_to_le32(val), opt->val);
                break;
 
        default: