linux-kernel - Re: memcpy: detected field-spanning write (size 101) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2251 (size 1)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Date: Wed, 31 Jan 2024 00:46:58 +0100
From: 
	Ahelenia Ziemiańska <nabijaczleweli@...ijaczleweli.xyz>
To: Dmitry Antipov <dmantipov@...dex.ru>
Cc: Brian Norris <briannorris@...omium.org>, Kalle Valo <kvalo@...nel.org>, 
	linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org
Subject: Re: memcpy: detected field-spanning write (size 101) of single field
 "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2251
 (size 1)

On Mon, Jan 29, 2024 at 04:55:26PM +0300, Dmitry Antipov wrote:
> On 1/26/24 22:47, Ahelenia Ziemiańska wrote:
> > [   41.314634] memcpy: detected field-spanning write (size 101) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2251 (size 1)
> Short answer: if your device works as expected, most likely you can ignore this.
It does.

> if you're brave
> enough, you can help the maintainers by trying this:
> --- linux-6.6.11/drivers/net/wireless/marvell/mwifiex/fw.h	2024-01-10 19:17:02.000000000 +0300
> +++ linux-6.6.11/drivers/net/wireless/marvell/mwifiex/fw.h	2024-01-29 14:21:55.574280719 +0300
> @@ -1586,7 +1586,7 @@
> 
>  struct host_cmd_ds_802_11_scan_ext {
>  	u32   reserved;
> -	u8    tlv_buffer[1];
> +	u8    tlv_buffer[];
>  } __packed;
> 
>  struct mwifiex_ie_types_bss_mode {

Tested-by: Ahelenia Ziemiańska <nabijaczleweli@...ijaczleweli.xyz>

That works and makes the warning go away for me on 6.6.11 ‒
now all mwifiex-related log is confined to
  mwifiex_sdio mmc2:0001:1: firmware: direct-loading firmware mrvl/sd8897_uapsta.bin
  mwifiex_sdio mmc2:0001:1: WLAN is not the winner! Skip FW dnld
  mwifiex_sdio mmc2:0001:1: WLAN FW is active
  mwifiex_sdio mmc2:0001:1: Bad HW revision detected, disabling deep sleep
  mwifiex_sdio mmc2:0001:1: info: MWIFIEX VERSION: mwifiex 1.0 (15.68.19.p54) 
  mwifiex_sdio mmc2:0001:1: driver_version = mwifiex 1.0 (15.68.19.p54) 
  mwifiex_sdio mmc2:0001:1: info: trying to associate to bssid de:0d:17:ad:84:d9
  mwifiex_sdio mmc2:0001:1: info: associated to bssid de:0d:17:ad:84:d9 successfully
  mwifiex_sdio mmc2:0001:1: event: unknown event id: 0x79

Thanks!

Download attachment "signature.asc" of type "application/pgp-signature" (834 bytes)