linux-hardening - [PATCH 1/2] wifi: cfg80211: annotate struct cfg80211_mgmt_registration with __counted

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [thread-next>] [day] [month] [year] [list]

Message-ID: <20241210143951.5685-1-dmantipov@yandex.ru>
Date: Tue, 10 Dec 2024 17:39:50 +0300
From: Dmitry Antipov <dmantipov@...dex.ru>
To: Johannes Berg <johannes.berg@...el.com>
Cc: Kees Cook <kees@...nel.org>,
	"Gustavo A . R . Silva" <gustavoars@...nel.org>,
	linux-hardening@...r.kernel.org,
	linux-wireless@...r.kernel.org,
	Dmitry Antipov <dmantipov@...dex.ru>
Subject: [PATCH 1/2] wifi: cfg80211: annotate struct cfg80211_mgmt_registration with __counted_by()

Add the '__counted_by()' compiler attribute to the flexible array member
'match[]' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE, adjust 'cfg80211_mlme_register_mgmt()' accordingly.

Signed-off-by: Dmitry Antipov <dmantipov@...dex.ru>
---
 net/wireless/mlme.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/net/wireless/mlme.c b/net/wireless/mlme.c
index 9d577523462d..4790136758d5 100644
--- a/net/wireless/mlme.c
+++ b/net/wireless/mlme.c
@@ -575,7 +575,7 @@ struct cfg80211_mgmt_registration {
 
 	bool multicast_rx;
 
-	u8 match[];
+	u8 match[] __counted_by(match_len);
 };
 
 static void cfg80211_mgmt_registrations_update(struct wireless_dev *wdev)
@@ -710,8 +710,8 @@ int cfg80211_mlme_register_mgmt(struct wireless_dev *wdev, u32 snd_portid,
 	if (update_multicast) {
 		kfree(nreg);
 	} else {
-		memcpy(nreg->match, match_data, match_len);
 		nreg->match_len = match_len;
+		memcpy(nreg->match, match_data, match_len);
 		nreg->nlportid = snd_portid;
 		nreg->frame_type = cpu_to_le16(frame_type);
 		nreg->wdev = wdev;
-- 
2.47.1