linux-hardening - Re: [PATCH] iwlwifi: calib: Refactor iwl_calib

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <87ilm6ea2t.fsf@kernel.org>
Date:   Fri, 02 Sep 2022 06:20:26 +0300
From:   Kalle Valo <kvalo@...nel.org>
To:     Kees Cook <keescook@...omium.org>
Cc:     Luca Coelho <luciano.coelho@...el.com>,
        "David S. Miller" <davem@...emloft.net>,
        Jakub Kicinski <kuba@...nel.org>,
        Lee Jones <lee.jones@...aro.org>,
        Johannes Berg <johannes.berg@...el.com>,
        linux-wireless@...r.kernel.org, netdev@...r.kernel.org,
        Andy Lavr <andy.lavr@...il.com>,
        Gregory Greenman <gregory.greenman@...el.com>,
        Eric Dumazet <edumazet@...gle.com>,
        Paolo Abeni <pabeni@...hat.com>, linux-kernel@...r.kernel.org,
        linux-hardening@...r.kernel.org
Subject: Re: [PATCH] iwlwifi: calib: Refactor iwl_calib_result usage for clarity

Kees Cook <keescook@...omium.org> writes:

> In preparation for FORTIFY_SOURCE performing run-time destination buffer
> bounds checking for memcpy(), refactor the use of struct iwl_calib_result:
>
> - Have struct iwl_calib_result contain struct iwl_calib_cmd since
>   functions expect to operate on the "data" flex array in "cmd", which
>   follows the "hdr" member.
> - Switch argument passing around to use struct iwl_calib_cmd instead of
>   struct iwl_calib_hdr to prepare functions to see the "data" member.
> - Change iwl_calib_set()'s "len" argument to a size_t since it is always
>   unsigned and is normally receiving the output of sizeof().
> - Add an explicit length sanity check in iwl_calib_set().
> - Adjust the memcpy() to avoid copying across the now visible composite
>   flex array structure.
>
> This avoids the future run-time warning:
>
>   memcpy: detected field-spanning write (size 8) of single field "&res->hdr" (size 4)
>
> Cc: Luca Coelho <luciano.coelho@...el.com>
> Cc: Kalle Valo <kvalo@...eaurora.org>
> Cc: "David S. Miller" <davem@...emloft.net>
> Cc: Jakub Kicinski <kuba@...nel.org>
> Cc: Lee Jones <lee.jones@...aro.org>
> Cc: Johannes Berg <johannes.berg@...el.com>
> Cc: linux-wireless@...r.kernel.org
> Cc: netdev@...r.kernel.org
> Reported-by: Andy Lavr <andy.lavr@...il.com>
> Signed-off-by: Kees Cook <keescook@...omium.org>

Gregory, as this fixes a future warning can I take this directly to
wireless-next?

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches