Received-SPF: pass (google.com: domain of linux-kernel+bounces-171136-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <10256004963b6e1a1813c6f07c5d21abfc843070.camel@sipsolutions.net>
Subject: Re: [PATCH] wifi: nl80211: Avoid address calculations via out of
 bounds array indexing
From: Johannes Berg <johannes@sipsolutions.net>
To: Nathan Chancellor <nathan@kernel.org>, Kees Cook <keescook@chromium.org>
Cc: "David S. Miller" <davem@davemloft.net>, Eric Dumazet
 <edumazet@google.com>,  Jakub Kicinski <kuba@kernel.org>, Paolo Abeni
 <pabeni@redhat.com>,  linux-wireless@vger.kernel.org,
 netdev@vger.kernel.org, Jeff Johnson <quic_jjohnson@quicinc.com>, "Gustavo
 A. R. Silva" <gustavoars@kernel.org>,  linux-kernel@vger.kernel.org,
 linux-hardening@vger.kernel.org
Date: Tue, 07 May 2024 12:46:46 +0200
In-Reply-To: <20240425181342.GA657080@dev-arch.thelio-3990X>
References: <20240424220057.work.819-kees@kernel.org>
	 <20240425181342.GA657080@dev-arch.thelio-3990X>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2024-04-25 at 11:13 -0700, Nathan Chancellor wrote:
> On Wed, Apr 24, 2024 at 03:01:01PM -0700, Kees Cook wrote:
> > Before request->channels[] can be used, request->n_channels must be set=
.
> > Additionally, address calculations for memory after the "channels" arra=
y
> > need to be calculated from the allocation base ("request") rather than
> > via the first "out of bounds" index of "channels", otherwise run-time
> > bounds checking will throw a warning.
> >=20
> > Reported-by: Nathan Chancellor <nathan@kernel.org>
> > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_req=
uest with __counted_by")
> > Signed-off-by: Kees Cook <keescook@chromium.org>
>=20
> Tested-by: Nathan Chancellor <nathan@kernel.org>
>=20

How do you get this tested? We have the same, and more, bugs in
cfg80211_scan_6ghz() which I'm fixing right now, but no idea how to
actually get the checks done?

johannes