Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <8104db6eba0907be02759348eaf14e0512b44a63.camel@sipsolutions.net>
Subject: Re: iwlwifi "memcpy: detected field-spanning write" kernel oops
From:   Johannes Berg <johannes@sipsolutions.net>
To:     Hans de Goede <hdegoede@redhat.com>,
        Gregory Greenman <gregory.greenman@intel.com>,
        Benjamin Berg <benjamin.berg@intel.com>
Cc:     Kalle Valo <kvalo@kernel.org>,
        linux-wireless <linux-wireless@vger.kernel.org>,
        Kees Cook <keescook@chromium.org>
Date:   Mon, 27 Mar 2023 13:01:21 +0200
In-Reply-To: <1c71e611-42d0-daf6-3ef2-c404561b42f7@redhat.com>
References: <68760035-7f75-1b23-e355-bfb758a87d83@redhat.com>
         <569b7058d6a9807a98777bf7a0cfc4b3846477d8.camel@sipsolutions.net>
         <1c71e611-42d0-daf6-3ef2-c404561b42f7@redhat.com>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.46.4 (3.46.4-1.fc37) 
MIME-Version: 1.0
Precedence: bulk

On Mon, 2023-03-27 at 12:54 +0200, Hans de Goede wrote:
>=20
> Reading the thread I see that this seems to be an actual bug and there ar=
e=20
> some ideas how to fix this, but it needs someone to actually test the fix=
es.

There's kind of a bug, yes, but just applying the second hunk of Kees's
patch would squash the issue as well.

> I hit the reported oops whenever one of my laptops at home connects
> to my home router access-point.

Ok, that probably means you should upgrade your AP security settings ;-)

> So I can reproduce this at will; and given that I hit the oops I assume
> that my home network also actually uses the keys setup by the given path,
> so I should also be able to test that a fix does not break the wifi
> connection by misconfiguring the keys.

Right.

> So I'm hereby volunteering to test a fix on my setup.

You can just change the memcpy() that triggers the warning to copy only
16 bytes instead of key->keylen.

johannes