Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <6993afb1b9e19d3435e512e71f04054cdc6bee30.camel@sipsolutions.net>
Subject: Re: [PATCH 1/1] cfg80211: Update Transition Disable policy during
 port authorization
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Vinayak Yadawad <vinayak.yadawad@broadcom.com>
Cc:     linux-wireless@vger.kernel.org, jithu.jance@broadcom.com
Date:   Tue, 06 Sep 2022 11:54:46 +0200
In-Reply-To: <e8fb69386675e5d128db141dabb9e6dad75eb841.1661516424.git.vinayak.yadawad@broadcom.com>
References: <e8fb69386675e5d128db141dabb9e6dad75eb841.1661516424.git.vinayak.yadawad@broadcom.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.44.4 (3.44.4-1.fc36) 
MIME-Version: 1.0
Precedence: bulk

On Fri, 2022-08-26 at 18:25 +0530, Vinayak Yadawad wrote:
>=20
> @@ -1267,6 +1268,7 @@ void cfg80211_port_authorized(struct net_device *de=
v, const u8 *bssid,
> =20
>  	ev->type =3D EVENT_PORT_AUTHORIZED;
>  	memcpy(ev->pa.bssid, bssid, ETH_ALEN);
> +	ev->pa.td_bitmap =3D td_bitmap;
> =20
>=20

Surely this will cause some kind of use-after-free, or stack use after
stack frame return??

In the event, I guess you need to size it for the max possible bitmap
size and copy it.

(also nit somewhere: "u8 *x" instead of "u8* x")

The function argument should probably also be const.


FWIW, I didn't really mind having a fixed two-byte bitmap, but that
doesn't address the case of it being not valid.

We could just use an "int" and say "-1 for invalid, otherwise a 16-bit
bitmap value"?

johannes