Received-SPF: pass (google.com: domain of linux-kernel+bounces-201289-linux.lists.archive=gmail.com@vger.kernel.org designates 147.75.80.249 as permitted sender) client-ip=147.75.80.249;
Message-ID: <ab59089feac4cfbc1d681fcaa4a828ca13088ce1.camel@sipsolutions.net>
Subject: Re: [PATCH v2] wifi: mac80211: Avoid address calculations via out
 of bounds array indexing
From: Johannes Berg <johannes@sipsolutions.net>
To: Kenton Groombridge <concord@gentoo.org>
Cc: davem@davemloft.net, edumazet@google.com, kuba@kernel.org,
 pabeni@redhat.com,  linux-wireless@vger.kernel.org, netdev@vger.kernel.org,
  linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org, Kees Cook
 <keescook@chromium.org>
Date: Tue, 04 Jun 2024 21:29:57 +0200
In-Reply-To: <cx2oet5b5lavjywcbf7u4c32krtoglvt3xbe2sxac55e36iibw@lrd5iuhtxz2g>
References: <20240517145420.8891-1-concord@gentoo.org>
	 <d1fea590e53cb1b00dc64f4f8a4c8aec84610401.camel@sipsolutions.net>
	 <cx2oet5b5lavjywcbf7u4c32krtoglvt3xbe2sxac55e36iibw@lrd5iuhtxz2g>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.50.4 (3.50.4-1.fc39) 
Precedence: bulk
MIME-Version: 1.0

On Tue, 2024-06-04 at 14:53 -0400, Kenton Groombridge wrote:
> On 24/05/29 04:54PM, Johannes Berg wrote:
> > On Fri, 2024-05-17 at 10:54 -0400, Kenton Groombridge wrote:
> > > req->n_channels must be set before req->channels[] can be used.
> > >=20
> >=20
> > I don't know why, but this patch breaks a number of hwsim test cases.
> >=20
> > https://w1.fi/cgit/hostap/tree/tests/hwsim/
> >=20
> > johannes
>=20
> Pardon my absence.
>=20
> I'm also not sure why these tests are failing. Unless I'm missing
> something, the runtime behavior of these code paths shouldn't have
> changed significantly.
>=20

Looking at your patch again, this seems wrong?

> +				local->hw_scan_req->req.channels[*n_chans++] =3D
>  							req->channels[i];
>=20

This will increment n_chans rather than *n_chans, no?

johannes