Commit 1a30a6b2 authored by Kees Cook's avatar Kees Cook Committed by Johannes Berg

wifi: brcmfmac: p2p: Introduce generic flexible array frame member

Silence run-time memcpy() false positive warning when processing
management frames:

  memcpy: detected field-spanning write (size 27) of single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1469 (size 26)

Due to this (soon to be fixed) GCC bug[1], FORTIFY_SOURCE (via
__builtin_dynamic_object_size) doesn't recognize that the union may end
with a flexible array, and returns "26" (the fixed size of the union),
rather than the remaining size of the allocation. Add an explicit
flexible array member and set it as the destination here, so that we
get the correct coverage for the memcpy().

[1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832Reported-by: default avatarArd Biesheuvel <ardb@kernel.org>
Cc: Arend van Spriel <aspriel@gmail.com>
Cc: Franky Lin <franky.lin@broadcom.com>
Cc: Hante Meuleman <hante.meuleman@broadcom.com>
Cc: Kalle Valo <kvalo@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: "Jason A. Donenfeld" <Jason@zx2c4.com>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: "Darrick J. Wong" <djwong@kernel.org>
Cc: Colin Ian King <colin.i.king@gmail.com>
Cc: Brian Henriquez <brian.henriquez@cypress.com>
Cc: linux-wireless@vger.kernel.org
Cc: brcm80211-dev-list.pdl@broadcom.com
Cc: SHA-cyfmac-dev-list@infineon.com
Cc: netdev@vger.kernel.org
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20230215224110.never.022-kees@kernel.org
[rename 'frame' to 'body']
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent 3caf31e7
...@@ -1466,8 +1466,8 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp, ...@@ -1466,8 +1466,8 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp,
ETH_ALEN); ETH_ALEN);
memcpy(mgmt_frame->sa, e->addr, ETH_ALEN); memcpy(mgmt_frame->sa, e->addr, ETH_ALEN);
mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_ACTION); mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_ACTION);
memcpy(&mgmt_frame->u, frame, mgmt_frame_len); memcpy(mgmt_frame->u.body, frame, mgmt_frame_len);
mgmt_frame_len += offsetof(struct ieee80211_mgmt, u); mgmt_frame_len += offsetof(struct ieee80211_mgmt, u.body);
freq = ieee80211_channel_to_frequency(ch.control_ch_num, freq = ieee80211_channel_to_frequency(ch.control_ch_num,
ch.band == BRCMU_CHAN_BAND_2G ? ch.band == BRCMU_CHAN_BAND_2G ?
......
...@@ -1356,6 +1356,7 @@ struct ieee80211_mgmt { ...@@ -1356,6 +1356,7 @@ struct ieee80211_mgmt {
} __packed wnm_timing_msr; } __packed wnm_timing_msr;
} u; } u;
} __packed action; } __packed action;
DECLARE_FLEX_ARRAY(u8, body); /* Generic frame body */
} u; } u;
} __packed __aligned(2); } __packed __aligned(2);
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment