On 2/6/24 12:39, Kees Cook wrote:
> struct mwifiex_ie_types_chan_list_param_set::chan_scan_param is treated
> as a flexible array, so convert it into one so that it doesn't trip the
> array bounds sanitizer[1]. Only once place was using sizeof() on the
> whole struct (in 11n.c), so adjust it to follow the calculation pattern
> used by scan.c to avoid including the trailing single element.
>
> Link: https://github.com/KSPP/linux/issues/51 [1]
> Cc: Brian Norris <[email protected]>
> Cc: Kalle Valo <[email protected]>
> Cc: Dmitry Antipov <[email protected]>
> Cc: Johannes Berg <[email protected]>
> Cc: zuoqilin <[email protected]>
> Cc: Ruan Jinjie <[email protected]>
> Cc: Thomas Gleixner <[email protected]>
> Cc: Christophe JAILLET <[email protected]>
> Cc: Gustavo A. R. Silva <[email protected]>
> Cc: [email protected]
> Signed-off-by: Kees Cook <[email protected]>
> ---
> drivers/net/wireless/marvell/mwifiex/11n.c | 8 +++-----
> drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
> drivers/net/wireless/marvell/mwifiex/scan.c | 14 ++++++--------
> 3 files changed, 10 insertions(+), 14 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
> index 90e401100898..9ed90da4dfcf 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n.c
> @@ -392,12 +392,10 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
>
> chan_list =
> (struct mwifiex_ie_types_chan_list_param_set *) *buffer;
> - memset(chan_list, 0,
> - sizeof(struct mwifiex_ie_types_chan_list_param_set));
> + memset(chan_list, 0, struct_size(chan_list, chan_scan_param, 1));
> chan_list->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
> - chan_list->header.len = cpu_to_le16(
> - sizeof(struct mwifiex_ie_types_chan_list_param_set) -
> - sizeof(struct mwifiex_ie_types_header));
> + chan_list->header.len =
> + cpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));
> chan_list->chan_scan_param[0].chan_number =
> bss_desc->bcn_ht_oper->primary_chan;
> chan_list->chan_scan_param[0].radio_type =
This probably still needs a bit more work.
There are a couple more instances of `sizeof()` that should probably be
audited and adjusted:
drivers/net/wireless/marvell/mwifiex/11n.c:414: *buffer += sizeof(struct mwifiex_ie_types_chan_list_param_set);
drivers/net/wireless/marvell/mwifiex/11n.c:415: ret_len += sizeof(struct mwifiex_ie_types_chan_list_param_set);
--
Gustavo
> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
> index 62f3c9a52a1d..3adc447b715f 100644
> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
> @@ -770,7 +770,7 @@ struct mwifiex_chan_scan_param_set {
>
> struct mwifiex_ie_types_chan_list_param_set {
> struct mwifiex_ie_types_header header;
> - struct mwifiex_chan_scan_param_set chan_scan_param[1];
> + struct mwifiex_chan_scan_param_set chan_scan_param[];
> } __packed;
>
> struct mwifiex_ie_types_rxba_sync {
> diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
> index a2ddac363b10..0326b121747c 100644
> --- a/drivers/net/wireless/marvell/mwifiex/scan.c
> +++ b/drivers/net/wireless/marvell/mwifiex/scan.c
> @@ -664,15 +664,14 @@ mwifiex_scan_channel_list(struct mwifiex_private *priv,
>
> /* Copy the current channel TLV to the command being
> prepared */
> - memcpy(chan_tlv_out->chan_scan_param + tlv_idx,
> + memcpy(&chan_tlv_out->chan_scan_param[tlv_idx],
> tmp_chan_list,
> - sizeof(chan_tlv_out->chan_scan_param));
> + sizeof(*chan_tlv_out->chan_scan_param));
>
> /* Increment the TLV header length by the size
> appended */
> le16_unaligned_add_cpu(&chan_tlv_out->header.len,
> - sizeof(
> - chan_tlv_out->chan_scan_param));
> + sizeof(*chan_tlv_out->chan_scan_param));
>
> /*
> * The tlv buffer length is set to the number of bytes
> @@ -2369,12 +2368,11 @@ int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
> chan_idx < MWIFIEX_BG_SCAN_CHAN_MAX &&
> bgscan_cfg_in->chan_list[chan_idx].chan_number;
> chan_idx++) {
> - temp_chan = chan_list_tlv->chan_scan_param + chan_idx;
> + temp_chan = &chan_list_tlv->chan_scan_param[chan_idx];
>
> /* Increment the TLV header length by size appended */
> le16_unaligned_add_cpu(&chan_list_tlv->header.len,
> - sizeof(
> - chan_list_tlv->chan_scan_param));
> + sizeof(*chan_list_tlv->chan_scan_param));
>
> temp_chan->chan_number =
> bgscan_cfg_in->chan_list[chan_idx].chan_number;
> @@ -2413,7 +2411,7 @@ int mwifiex_cmd_802_11_bg_scan_config(struct mwifiex_private *priv,
> chan_scan_param);
> le16_unaligned_add_cpu(&chan_list_tlv->header.len,
> chan_num *
> - sizeof(chan_list_tlv->chan_scan_param[0]));
> + sizeof(*chan_list_tlv->chan_scan_param));
> }
>
> tlv_pos += (sizeof(chan_list_tlv->header)
On Tue, Feb 06, 2024 at 02:32:32PM -0600, Gustavo A. R. Silva wrote:
>
>
> On 2/6/24 12:39, Kees Cook wrote:
> > struct mwifiex_ie_types_chan_list_param_set::chan_scan_param is treated
> > as a flexible array, so convert it into one so that it doesn't trip the
> > array bounds sanitizer[1]. Only once place was using sizeof() on the
> > whole struct (in 11n.c), so adjust it to follow the calculation pattern
> > used by scan.c to avoid including the trailing single element.
> >
> > Link: https://github.com/KSPP/linux/issues/51 [1]
> > Cc: Brian Norris <[email protected]>
> > Cc: Kalle Valo <[email protected]>
> > Cc: Dmitry Antipov <[email protected]>
> > Cc: Johannes Berg <[email protected]>
> > Cc: zuoqilin <[email protected]>
> > Cc: Ruan Jinjie <[email protected]>
> > Cc: Thomas Gleixner <[email protected]>
> > Cc: Christophe JAILLET <[email protected]>
> > Cc: Gustavo A. R. Silva <[email protected]>
> > Cc: [email protected]
> > Signed-off-by: Kees Cook <[email protected]>
> > ---
> > drivers/net/wireless/marvell/mwifiex/11n.c | 8 +++-----
> > drivers/net/wireless/marvell/mwifiex/fw.h | 2 +-
> > drivers/net/wireless/marvell/mwifiex/scan.c | 14 ++++++--------
> > 3 files changed, 10 insertions(+), 14 deletions(-)
> >
> > diff --git a/drivers/net/wireless/marvell/mwifiex/11n.c b/drivers/net/wireless/marvell/mwifiex/11n.c
> > index 90e401100898..9ed90da4dfcf 100644
> > --- a/drivers/net/wireless/marvell/mwifiex/11n.c
> > +++ b/drivers/net/wireless/marvell/mwifiex/11n.c
> > @@ -392,12 +392,10 @@ mwifiex_cmd_append_11n_tlv(struct mwifiex_private *priv,
> > chan_list =
> > (struct mwifiex_ie_types_chan_list_param_set *) *buffer;
> > - memset(chan_list, 0,
> > - sizeof(struct mwifiex_ie_types_chan_list_param_set));
> > + memset(chan_list, 0, struct_size(chan_list, chan_scan_param, 1));
> > chan_list->header.type = cpu_to_le16(TLV_TYPE_CHANLIST);
> > - chan_list->header.len = cpu_to_le16(
> > - sizeof(struct mwifiex_ie_types_chan_list_param_set) -
> > - sizeof(struct mwifiex_ie_types_header));
> > + chan_list->header.len =
> > + cpu_to_le16(sizeof(struct mwifiex_chan_scan_param_set));
> > chan_list->chan_scan_param[0].chan_number =
> > bss_desc->bcn_ht_oper->primary_chan;
> > chan_list->chan_scan_param[0].radio_type =
> This probably still needs a bit more work.
>
> There are a couple more instances of `sizeof()` that should probably be
> audited and adjusted:
>
> drivers/net/wireless/marvell/mwifiex/11n.c:414: *buffer += sizeof(struct mwifiex_ie_types_chan_list_param_set);
> drivers/net/wireless/marvell/mwifiex/11n.c:415: ret_len += sizeof(struct mwifiex_ie_types_chan_list_param_set);
Good call. I think this is the right delta:
- *buffer += sizeof(struct mwifiex_ie_types_chan_list_param_set);
- ret_len += sizeof(struct mwifiex_ie_types_chan_list_param_set);
+ *buffer += struct_size(chan_list, chan_scan_param, 1);
+ ret_len += struct_size(chan_list, chan_scan_param, 1);
I will send a v3.
--
Kees Cook