| Message ID | 20230215224110.never.022-kees@kernel.org |
|---|---|
| State | New |
| Headers | show |
| Series | wifi: brcmfmac: p2p: Introduce generic flexible array frame member | expand |
On Wed, Feb 15, 2023 at 11:41 PM Kees Cook <keescook@chromium.org> wrote: > Silence run-time memcpy() false positive warning when processing > management frames: > > memcpy: detected field-spanning write (size 27) of single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1469 (size 26) > > Due to this (soon to be fixed) GCC bug[1], FORTIFY_SOURCE (via > __builtin_dynamic_object_size) doesn't recognize that the union may end > with a flexible array, and returns "26" (the fixed size of the union), > rather than the remaining size of the allocation. Add an explicit > flexible array member and set it as the destination here, so that we > get the correct coverage for the memcpy(). > > [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832 > > Reported-by: Ard Biesheuvel <ardb@kernel.org> > Cc: Arend van Spriel <aspriel@gmail.com> > Cc: Franky Lin <franky.lin@broadcom.com> > Cc: Hante Meuleman <hante.meuleman@broadcom.com> > Cc: Kalle Valo <kvalo@kernel.org> > Cc: "David S. Miller" <davem@davemloft.net> > Cc: Eric Dumazet <edumazet@google.com> > Cc: Jakub Kicinski <kuba@kernel.org> > Cc: Paolo Abeni <pabeni@redhat.com> > Cc: Johannes Berg <johannes@sipsolutions.net> > Cc: "Jason A. Donenfeld" <Jason@zx2c4.com> > Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> > Cc: "Darrick J. Wong" <djwong@kernel.org> > Cc: Colin Ian King <colin.i.king@gmail.com> > Cc: Brian Henriquez <brian.henriquez@cypress.com> > Cc: linux-wireless@vger.kernel.org > Cc: brcm80211-dev-list.pdl@broadcom.com > Cc: SHA-cyfmac-dev-list@infineon.com > Cc: netdev@vger.kernel.org > Signed-off-by: Kees Cook <keescook@chromium.org> Us having to deal with this kind of stuff is why we need Rust. Thanks for doing this Kees, Reviewed-by: Linus Walleij <linus.walleij@linaro.org> Yours, Linus Walleij
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c index e975d10e6009..4d0db7107e65 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c @@ -1466,8 +1466,8 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp, ETH_ALEN); memcpy(mgmt_frame->sa, e->addr, ETH_ALEN); mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_ACTION); - memcpy(&mgmt_frame->u, frame, mgmt_frame_len); - mgmt_frame_len += offsetof(struct ieee80211_mgmt, u); + memcpy(mgmt_frame->u.frame, frame, mgmt_frame_len); + mgmt_frame_len += offsetof(struct ieee80211_mgmt, u.frame); freq = ieee80211_channel_to_frequency(ch.control_ch_num, ch.band == BRCMU_CHAN_BAND_2G ? diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index 80d6308dea06..990d204d918a 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -1356,6 +1356,7 @@ struct ieee80211_mgmt { } __packed wnm_timing_msr; } u; } __packed action; + DECLARE_FLEX_ARRAY(u8, frame); /* Generic frame contents. */ } u; } __packed __aligned(2);
Silence run-time memcpy() false positive warning when processing management frames: memcpy: detected field-spanning write (size 27) of single field "&mgmt_frame->u" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c:1469 (size 26) Due to this (soon to be fixed) GCC bug[1], FORTIFY_SOURCE (via __builtin_dynamic_object_size) doesn't recognize that the union may end with a flexible array, and returns "26" (the fixed size of the union), rather than the remaining size of the allocation. Add an explicit flexible array member and set it as the destination here, so that we get the correct coverage for the memcpy(). [1] https://gcc.gnu.org/bugzilla/show_bug.cgi?id=101832 Reported-by: Ard Biesheuvel <ardb@kernel.org> Cc: Arend van Spriel <aspriel@gmail.com> Cc: Franky Lin <franky.lin@broadcom.com> Cc: Hante Meuleman <hante.meuleman@broadcom.com> Cc: Kalle Valo <kvalo@kernel.org> Cc: "David S. Miller" <davem@davemloft.net> Cc: Eric Dumazet <edumazet@google.com> Cc: Jakub Kicinski <kuba@kernel.org> Cc: Paolo Abeni <pabeni@redhat.com> Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "Jason A. Donenfeld" <Jason@zx2c4.com> Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Cc: "Darrick J. Wong" <djwong@kernel.org> Cc: Colin Ian King <colin.i.king@gmail.com> Cc: Brian Henriquez <brian.henriquez@cypress.com> Cc: linux-wireless@vger.kernel.org Cc: brcm80211-dev-list.pdl@broadcom.com Cc: SHA-cyfmac-dev-list@infineon.com Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 4 ++-- include/linux/ieee80211.h | 1 + 2 files changed, 3 insertions(+), 2 deletions(-)