Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 23.128.96.35 as permitted sender) client-ip=23.128.96.35;
Date:   Thu, 14 Sep 2023 08:53:10 +0200
From:   Juerg Haefliger <juerg.haefliger@canonical.com>
To:     "Gustavo A. R. Silva" <gustavo@embeddedor.com>
Cc:     aspriel@gmail.com, franky.lin@broadcom.com,
        hante.meuleman@broadcom.com, kvalo@kernel.org,
        linux-wireless@vger.kernel.org,
        brcm80211-dev-list.pdl@broadcom.com,
        SHA-cyfmac-dev-list@infineon.com, linux-kernel@vger.kernel.org,
        linus.walleij@linaro.org, marcan@marcan.st, keescook@chromium.org,
        gustavoars@kernel.org, hdegoede@redhat.com,
        ryohei.kondo@cypress.com
Subject: Re: [PATCH] wifi: brcmfmac: Replace 1-element arrays with flexible
 arrays
Message-ID: <20230914085310.334e4c09@smeagol>
In-Reply-To: <0f23e4a2-b11b-98bd-c419-d9a9fb7ddb4e@embeddedor.com>
References: <20230913065421.12615-1-juerg.haefliger@canonical.com>
        <0f23e4a2-b11b-98bd-c419-d9a9fb7ddb4e@embeddedor.com>
Organization: Canonical Ltd
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="Sig_/SB99e06DGpk4FarBJmna.kW";
 protocol="application/pgp-signature"; micalg=pgp-sha512
Precedence: bulk

--Sig_/SB99e06DGpk4FarBJmna.kW
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Wed, 13 Sep 2023 10:02:12 -0600
"Gustavo A. R. Silva" <gustavo@embeddedor.com> wrote:

> On 9/13/23 00:54, Juerg Haefliger wrote:
> > Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"),
> > UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking
> > 'element' and 'channel_list' will trigger warnings, so make them proper
> > flexible arrays.
> >=20
> > False positive warnings were:
> >=20
> >    UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/br=
cm80211/brcmfmac/cfg80211.c:6984:20
> >    index 1 is out of range for type '__le32 [1]'
> >=20
> >    UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/br=
cm80211/brcmfmac/cfg80211.c:1126:27
> >    index 1 is out of range for type '__le16 [1]'
> >=20
> > for these lines of code:
> >=20
> >    6884  ch.chspec =3D (u16)le32_to_cpu(list->element[i]);
> >=20
> >    1126  params_le->channel_list[i] =3D cpu_to_le16(chanspec);
> >=20
> > Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com>
> > ---
> >   .../wireless/broadcom/brcm80211/brcmfmac/fwil_types.h    | 9 +++++++--
> >   1 file changed, 7 insertions(+), 2 deletions(-)
> >=20
> > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_type=
s.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
> > index bece26741d3a..ed723a5b5d54 100644
> > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
> > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
> > @@ -442,7 +442,12 @@ struct brcmf_scan_params_v2_le {
> >   				 * fixed parameter portion is assumed, otherwise
> >   				 * ssid in the fixed portion is ignored
> >   				 */
> > -	__le16 channel_list[1];	/* list of chanspecs */
> > +	union {
> > +		__le16 padding;	/* Reserve space for at least 1 entry for abort
> > +				 * which uses an on stack brcmf_scan_params_v2_le
> > +				 */
> > +		DECLARE_FLEX_ARRAY(__le16, channel_list);	/* chanspecs */
> > +	};
> >   };
> >  =20
> >   struct brcmf_scan_results {
> > @@ -702,7 +707,7 @@ struct brcmf_sta_info_le {
> >  =20
> >   struct brcmf_chanspec_list {
> >   	__le32	count;		/* # of entries */
> > -	__le32	element[1];	/* variable length uint32 list */
> > +	DECLARE_FLEX_ARRAY(__le32, element);	/* variable length uint32 list *=
/ =20
>=20
> If no padding is needed, as in the other case, then DFA() is not necessar=
y.
> Just remove the 1 from the array declaration:
>=20
>   struct brcmf_chanspec_list {
>          __le32  count;          /* # of entries */
> -       __le32  element[1];     /* variable length uint32 list */
> +       __le32  element[];      /* variable length uint32 list */
>   };

Ah, I wasn't sure if that is still acceptable. Will send a v2.

...Juerg

=20
> --
> Gustavo
>=20
> >   };
> >  =20
> >   /* =20


--Sig_/SB99e06DGpk4FarBJmna.kW
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEhZfU96IuprviLdeLD9OLCQumQrcFAmUCrdYACgkQD9OLCQum
QreEhg/8C6JzNKkwPCXJ14Nhx2JA/oY9A5EkPWKnZNJvJkKRINnnPsYwOL02fkkR
AlhjKGuPP5kpqq80ybANO6ke1CLqNJ1qHvmHpIK4M8BX6fQofLPPrszRiFF2K5Ny
WNmdMmn8cV8Yu/xkkTPHT8EsWN1/5HNrG1aHV8im4OV3v3Dw1+0JQuhdYvQU1Ogu
FWECYLscSYiwkeSaJ7khVhMakS9brskZh5OpvNRkmJQu3EKvp7HpEWmaAIiBjyWt
7+MeC9W/yY037Wksh3kmLCAYEXh3037WyZ+sGjHigGl5h8ygUyCJO8TW83ALpaaS
3WDG4cRNNjR3BgnoBeBWpjiR3PRc7JMlRYzG0a+7WGgcybJMTvf/W/RooLFuMDZ+
KvQlQs+9lIrl8XKtUEhoqWCbkSKgf4ZWQ9vH76sT4Wv9qqx3A5MJ06bPWWY/A72v
6TL4H+0d/kvpQ+qZwBg6t16it3hm7U+bJo9KFtbRgtmcIgWYjpK5QXQoiPOpVVec
RP/p9SUy6iseTLMIevQ9fvNN5e/rwqRVEAq8dzyADXmg8FhC7lCnXOMmJMdTbMNj
Cb6px7h+Yexa+5g5ZzN6Xv3cJEWplKHe+Uml0XtnWuk7SLLZzu6EgUN4cwyOEFwd
gROXMdp/2OHpSU1xUYtI4kezz8aSz/EqJtxGH/xtUe4l4RUJkgE=
=pv6c
-----END PGP SIGNATURE-----

--Sig_/SB99e06DGpk4FarBJmna.kW--