staging: wfx: le16_to_cpus() takes a reference as parameter

Original code caused an (100% reproducible) invalid memory access on
big-endian targets.

Fixes: b0998f0c040d "staging: wfx: add IRQ handling"
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Stephen Rothwell <sfr@canb.auug.org.au>
Signed-off-by: Jérôme Pouiller <jerome.pouiller@silabs.com>
Link: https://lore.kernel.org/r/20191008094232.10014-4-Jerome.Pouiller@silabs.com
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/wfx/bh.c b/drivers/staging/wfx/bh.c
index 6000c03bb658b795b6e7a4066c748a95456175f0..3715bb18bd78cba727a5fb4f72cba7d9522e3bc4 100644 (file)
--- a/drivers/staging/wfx/bh.c
+++ b/drivers/staging/wfx/bh.c
@@ -83,12 +83,12 @@ static int rx_helper(struct wfx_dev *wdev, size_t read_len, int *is_cnf)
                        // piggyback is probably correct.
                        return piggyback;
                }
-               le16_to_cpus(hif->len);
+               le16_to_cpus(&hif->len);
                computed_len = round_up(hif->len - sizeof(hif->len), 16)
                               + sizeof(struct hif_sl_msg)
                               + sizeof(struct hif_sl_tag);
        } else {
-               le16_to_cpus(hif->len);
+               le16_to_cpus(&hif->len);
                computed_len = round_up(hif->len, 2);
        }
        if (computed_len != read_len) {