linux-kernel - Re: [RFC PATCH] staging: rtl8723bs: fix fortify warnings by using struct

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <aLBTehFv_VfOWEj3@stanley.mountain>
Date: Thu, 28 Aug 2025 16:02:50 +0300
From: Dan Carpenter <dan.carpenter@...aro.org>
To: yingche <zxcv2569763104@...il.com>
Cc: gregkh@...uxfoundation.org, linux-staging@...ts.linux.dev,
	linux-kernel@...r.kernel.org
Subject: Re: [RFC PATCH] staging: rtl8723bs: fix fortify warnings by using
 struct_group

On Thu, Aug 28, 2025 at 05:45:37PM +0800, yingche wrote:
> Fix fortify_memcpy_chk warnings in rtw_BIP_verify() and
> rtw_mgmt_xmitframe_coalesce() functions by using struct_group
> to access consecutive address fields.
> 
> Changed memcpy calls to use &hdr->addrs instead of hdr->addr1
> when copying 18 bytes (addr1 + addr2 + addr3).
> 
> This resolves 'detected read beyond size of field' warnings
> by using the proper struct_group mechanism as suggested by
> the compiler.
> 
> Signed-off-by: yingche <zxcv2569763104@...il.com>
> ---
>  drivers/staging/rtl8723bs/core/rtw_security.c | 2 +-
>  drivers/staging/rtl8723bs/core/rtw_xmit.c     | 2 +-
>  2 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c
> index 8367fd15c6b1..314ec5894d47 100644
> --- a/drivers/staging/rtl8723bs/core/rtw_security.c
> +++ b/drivers/staging/rtl8723bs/core/rtw_security.c
> @@ -1363,7 +1363,7 @@ u32 rtw_BIP_verify(struct adapter *padapter, u8 *precvframe)
>  		ClearPwrMgt(BIP_AAD);
>  		ClearMData(BIP_AAD);
>  		/* conscruct AAD, copy address 1 to address 3 */
> -		memcpy(BIP_AAD+2, pwlanhdr->addr1, 18);
> +		memcpy(BIP_AAD + 2, &pwlanhdr->addrs, 18);

Use sizeof(pwlanhdr->addrs) instead of 18 and on the other too.

regards,
dan carpenter