• Kees Cook's avatar
    mac80211: Use flex-array for radiotap header bitmap · 8c89f7b3
    Kees Cook authored
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.
    
    The it_present member of struct ieee80211_radiotap_header is treated as a
    flexible array (multiple u32s can be conditionally present). In order for
    memcpy() to reason (or really, not reason) about the size of operations
    against this struct, use of bytes beyond it_present need to be treated
    as part of the flexible array. Add a trailing flexible array and
    initialize its initial index via pointer arithmetic.
    
    Cc: Johannes Berg <johannes@sipsolutions.net>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: linux-wireless@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Link: https://lore.kernel.org/r/20210806215305.2875621-1-keescook@chromium.orgSigned-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
    8c89f7b3
radiotap.c 11.8 KB