The length of the host command is a u16 stored in little endian byte
order, which needs byte order conversion to work correctly on big endian
systems.

Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
Closes: https://lore.kernel.org/linux-wireless/aLqZI4FfOI4iJZtf@stanley.mountain
Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support")
Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>
---
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 91d5098081e8b97420322484a229654c026e4618..dcca71158fc682902c0bd3376da32e81f8f6561f 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -1537,7 +1537,7 @@ int mwifiex_send_rgpower_table(struct mwifiex_private *priv, const u8 *data,
 		}
 
 		if (*pos == '}' && start_raw) {
-			memcpy(&hostcmd->len, &hostcmd->cmd[2], sizeof(u16));
+			hostcmd->len = get_unaligned_le16(&hostcmd->cmd[2]);
 			ret = mwifiex_send_cmd(priv, 0, 0, 0, hostcmd, false);
 			if (ret) {
 				mwifiex_dbg(adapter, ERROR,

---
base-commit: e3ac93e9d916ebae0711a42f524429dad89c4887
change-id: 20250910-for-next-008ed8e8a74e

Best regards,
-- 
Stefan Kerkmann <s.kerkmann@pengutronix.de>

On Wed, Sep 10, 2025 at 03:03:32PM +0200, Stefan Kerkmann wrote:
> The length of the host command is a u16 stored in little endian byte
> order, which needs byte order conversion to work correctly on big endian
> systems.
> 
> Reported-by: Dan Carpenter <dan.carpenter@linaro.org>
> Closes: https://lore.kernel.org/linux-wireless/aLqZI4FfOI4iJZtf@stanley.mountain
> Fixes: 7b6f16a25806 ("wifi: mwifiex: add rgpower table loading support")
> Signed-off-by: Stefan Kerkmann <s.kerkmann@pengutronix.de>

Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>