[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-ID: <202402061029.F0937444B2@keescook>
Date: Tue, 6 Feb 2024 10:29:46 -0800
From: Kees Cook <keescook@...omium.org>
To: Brian Norris <briannorris@...omium.org>
Cc: Kalle Valo <kvalo@...nel.org>, Dmitry Antipov <dmantipov@...dex.ru>,
Johannes Berg <johannes.berg@...el.com>,
zuoqilin <zuoqilin@...ong.com>, Ruan Jinjie <ruanjinjie@...wei.com>,
Thomas Gleixner <tglx@...utronix.de>,
Christophe JAILLET <christophe.jaillet@...adoo.fr>,
"Gustavo A . R . Silva" <gustavoars@...nel.org>,
linux-wireless@...r.kernel.org, linux-kernel@...r.kernel.org,
linux-hardening@...r.kernel.org
Subject: Re: [PATCH] wifi: mwifiex: Refactor 1-element array into flexible
array in struct mwifiex_ie_types_chan_list_param_set
Apologies -- this patch is incomplete. My "git add" failed me. ;) I'll
send a v2!
-Kees
On Tue, Feb 06, 2024 at 08:35:04AM -0800, Kees Cook wrote:
> struct mwifiex_ie_types_chan_list_param_set::chan_scan_param is treated
> as a flexible array, so convert it into one so that it doesn't trip the
> array bounds sanitizer[1]. The code was already calculating sizes by not
> including the trailing single element, so no sizeof() change are needed.
>
> Link: https://github.com/KSPP/linux/issues/51 [1]
> Cc: Brian Norris <briannorris@...omium.org>
> Cc: Kalle Valo <kvalo@...nel.org>
> Cc: Dmitry Antipov <dmantipov@...dex.ru>
> Cc: Johannes Berg <johannes.berg@...el.com>
> Cc: zuoqilin <zuoqilin@...ong.com>
> Cc: Ruan Jinjie <ruanjinjie@...wei.com>
> Cc: Thomas Gleixner <tglx@...utronix.de>
> Cc: Christophe JAILLET <christophe.jaillet@...adoo.fr>
> Cc: Gustavo A. R. Silva <gustavoars@...nel.org>
> Cc: linux-wireless@...r.kernel.org
> Signed-off-by: Kees Cook <keescook@...omium.org>
> ---
> drivers/net/wireless/marvell/mwifiex/scan.c | 14 ++++++--------
> 1 file changed, 6 insertions(+), 8 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
> index a2ddac363b10..0326b121747c 100644
> --- a/drivers/net/wireless/marvell/mwifiex/scan.c
> +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
> @@ -664,15 +664,14 @@ mwifiex_scan_channel_list(struct mwifiex_private *priv,
>
> /* Copy the current channel TLV to the command being
> prepared */
> - memcpy(chan_tlv_out->chan_scan_param + tlv_idx,
> + memcpy(&chan_tlv_out->chan_scan_param[tlv_idx],
> tmp_chan_list,
> - sizeof(chan_tlv_out->chan_scan_param));
> + sizeof(*chan_tlv_out->chan_scan_param));
>
> /* Increment the TLV header length by the size
> appended */
> le16_unaligned_add_cpu(&chan_tlv_out->header.len,
> - sizeof(
> - chan_tlv_out->chan_scan_param));
> + sizeof(*chan_tlv_out->chan_scan_param));
>
> /*
> * The tlv buffer length is set to the number of bytes
> @@ -2369,12 +2368,11 @@ int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
> chan_idx < MWIFIEX_BG_SCAN_CHAN_MAX &&
> bgscan_cfg_in->chan_list[chan_idx].chan_number;
> chan_idx++) {
> - temp_chan = chan_list_tlv->chan_scan_param + chan_idx;
> + temp_chan = &chan_list_tlv->chan_scan_param[chan_idx];
>
> /* Increment the TLV header length by size appended */
> le16_unaligned_add_cpu(&chan_list_tlv->header.len,
> - sizeof(
> - chan_list_tlv->chan_scan_param));
> + sizeof(*chan_list_tlv->chan_scan_param));
>
> temp_chan->chan_number =
> bgscan_cfg_in->chan_list[chan_idx].chan_number;
> @@ -2413,7 +2411,7 @@ int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
> chan_scan_param);
> le16_unaligned_add_cpu(&chan_list_tlv->header.len,
> chan_num *
> - sizeof(chan_list_tlv->chan_scan_param[0]));
> + sizeof(*chan_list_tlv->chan_scan_param));
> }
>
> tlv_pos += (sizeof(chan_list_tlv->header)
> --
> 2.34.1
>
--
Kees Cook
Powered by blists - more mailing lists