Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Kalle Valo <kvalo@kernel.org>
To:     Hans de Goede <hdegoede@redhat.com>
Cc:     Arend van Spriel <aspriel@gmail.com>,
        Franky Lin <franky.lin@broadcom.com>,
        Hante Meuleman <hante.meuleman@broadcom.com>,
        linux-wireless@vger.kernel.org,
        brcm80211-dev-list.pdl@broadcom.com,
        SHA-cyfmac-dev-list@infineon.com, Kees Cook <keescook@chromium.org>
Subject: Re: [PATCH] wifi: brcmfmac: Fix field-spanning write in
 brcmf_scan_params_v2_to_v1()
References: <20230729140500.27892-1-hdegoede@redhat.com>
        <169090065747.212423.9892152660352726427.kvalo@kernel.org>
        <57b9d6c8-557f-fbd7-0069-c84691a76ff4@redhat.com>
Date:   Tue, 01 Aug 2023 17:55:18 +0300
In-Reply-To: <57b9d6c8-557f-fbd7-0069-c84691a76ff4@redhat.com> (Hans de
        Goede's message of "Tue, 1 Aug 2023 16:47:36 +0200")
Message-ID: <873512yfqh.fsf@kernel.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain
Precedence: bulk

Hans de Goede <hdegoede@redhat.com> writes:

> Hi,
>
> On 8/1/23 16:37, Kalle Valo wrote:
>> Hans de Goede <hdegoede@redhat.com> wrote:
>> 
>>> Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers
>>> a backtrace caused by the following field-spanning error:
>>>
>>> memcpy: detected field-spanning write (size 120) of single field
>>>   "&params_le->channel_list[0]" at
>>>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2)
>>>
>>> Fix this by replacing the channel_list[1] declaration at the end of
>>> the struct with a flexible array declaration.
>>>
>>> Most users of struct brcmf_scan_params_le calculate the size to alloc
>>> using the size of the non flex-array part of the struct + needed extra
>>> space, so they do not care about sizeof(struct brcmf_scan_params_le).
>>>
>>> brcmf_notify_escan_complete() however uses the struct on the stack,
>>> expecting there to be room for at least 1 entry in the channel-list
>>> to store the special -1 abort channel-id.
>>>
>>> To make this work use an anonymous union with a padding member
>>> added + the actual channel_list flexible array.
>>>
>>> Cc: Kees Cook <keescook@chromium.org>
>>> Signed-off-by: Hans de Goede <hdegoede@redhat.com>
>>> Reviewed-by: Kees Cook <keescook@chromium.org>
>> 
>> Does the driver still work even if this warning is printed? I'm wondering
>> should I take this to wireless or wireless-next. Also a review from Broadcom
>> would be really good.
>
> It works fine, but it logs an oops / backtrace.

I'll add that info to the commit log.

> Note I did test the patch on a device where the warning was triggered
> and the warning is gone and wifi association still works.
>
> So there is a slight preference to get this as a fix into 6.5 from my side.

I'll queue this wireless then. But I really would like to Broadcom take
a look at this in case we are missing something.

>> What about a Fixes tag? 
>
> This is caused by the new field-spanning wtire checks enabled
> recently, so there is not really a brcmfmac commit to point to as the
> culprit.

Ok.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches