linux-hardening - [PATCH v2 2/3] wifi: ath11k: annotate ch_param of struct scan_chan_list_params with __counted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241024111921.93105-2-dmantipov@yandex.ru>
Date: Thu, 24 Oct 2024 14:19:20 +0300
From: Dmitry Antipov <dmantipov@...dex.ru>
To: Jeff Johnson <jjohnson@...nel.org>
Cc: Kalle Valo <kvalo@...nel.org>,
	Kees Cook <kees@...nel.org>,
	"Gustavo A . R . Silva" <gustavoars@...nel.org>,
	linux-wireless@...r.kernel.org,
	linux-hardening@...r.kernel.org,
	lvc-project@...uxtesting.org,
	Dmitry Antipov <dmantipov@...dex.ru>
Subject: [PATCH v2 2/3] wifi: ath11k: annotate ch_param of struct scan_chan_list_params with __counted_by

According to 'ath11k_reg_update_chan_list()', annotate flexible
array member 'ch_param' of 'struct scan_chan_list_params' with
'__counted_by()' attribute to improve runtime bounds checking
when CONFIG_UBSAN_BOUNDS is enabled. Compile tested only.

Signed-off-by: Dmitry Antipov <dmantipov@...dex.ru>
---
v2: add related comment in ath11k_reg_update_chan_list()
---
 drivers/net/wireless/ath/ath11k/reg.c | 3 +++
 drivers/net/wireless/ath/ath11k/wmi.h | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/drivers/net/wireless/ath/ath11k/reg.c b/drivers/net/wireless/ath/ath11k/reg.c
index b0f289784dd3..0a8a0ea2bdc7 100644
--- a/drivers/net/wireless/ath/ath11k/reg.c
+++ b/drivers/net/wireless/ath/ath11k/reg.c
@@ -164,6 +164,9 @@ int ath11k_reg_update_chan_list(struct ath11k *ar, bool wait)
 		return -ENOMEM;
 
 	params->pdev_id = ar->pdev->pdev_id;
+	/* Note nallchans should be set before populating ch_param[],
+	 * otherwise __counted_by() might raise false positives.
+	 */
 	params->nallchans = num_channels;
 
 	ch = params->ch_param;
diff --git a/drivers/net/wireless/ath/ath11k/wmi.h b/drivers/net/wireless/ath/ath11k/wmi.h
index 8982b909c821..58471da42087 100644
--- a/drivers/net/wireless/ath/ath11k/wmi.h
+++ b/drivers/net/wireless/ath/ath11k/wmi.h
@@ -3819,7 +3819,7 @@ struct wmi_stop_scan_cmd {
 struct scan_chan_list_params {
 	u32 pdev_id;
 	u16 nallchans;
-	struct channel_param ch_param[];
+	struct channel_param ch_param[] __counted_by(nallchans);
 };
 
 struct wmi_scan_chan_list_cmd {
-- 
2.47.0