Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
From:   Kalle Valo <kvalo@kernel.org>
To:     Dmitry Antipov <dmantipov@yandex.ru>
Cc:     linux-wireless@vger.kernel.org, ath12k@lists.infradead.org
Subject: Re: ath12k: memcpy() source buffer overread
References: <5c114ed7-6e8a-76a7-c0da-4193d1288686@yandex.ru>
Date:   Thu, 03 Aug 2023 16:54:00 +0300
In-Reply-To: <5c114ed7-6e8a-76a7-c0da-4193d1288686@yandex.ru> (Dmitry
        Antipov's message of "Tue, 20 Jun 2023 09:18:03 +0300")
Message-ID: <875y5wteo7.fsf@kernel.org>
User-Agent: Gnus/5.13 (Gnus v5.13) Emacs/28.2 (gnu/linux)
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: quoted-printable
Precedence: bulk

+ ath12k list

Dmitry Antipov <dmantipov@yandex.ru> writes:

> When compiling with gcc 13.1 and CONFIG_FORTIFY_SOURCE=3Dy, I've noticed =
the following:
>
> ...
> In function =E2=80=98fortify_memcpy_chk=E2=80=99,
>     inlined from =E2=80=98ath12k_peer_assoc_h_he=E2=80=99 at drivers/net/=
wireless/ath/ath12k/mac.c:1640:2,
>     inlined from =E2=80=98ath12k_peer_assoc_prepare=E2=80=99 at drivers/n=
et/wireless/ath/ath12k/mac.c:2027:2:
> ./include/linux/fortify-string.h:529:25: warning: call to =E2=80=98__read=
_overflow2_field=E2=80=99 declared with
> attribute warning: detected read beyond size of field (2nd parameter); ma=
ybe use struct_group()?
> [-Wattribute-warning]
>   529 |                         __read_overflow2_field(q_size_field, size=
);
>       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function =E2=80=98fortify_memcpy_chk=E2=80=99,
>     inlined from =E2=80=98ath12k_peer_assoc_h_he=E2=80=99 at drivers/net/=
wireless/ath/ath12k/mac.c:1643:2,
>     inlined from =E2=80=98ath12k_peer_assoc_prepare=E2=80=99 at drivers/n=
et/wireless/ath/ath12k/mac.c:2027:2:
> ./include/linux/fortify-string.h:529:25: warning: call to =E2=80=98__read=
_overflow2_field=E2=80=99 declared with
> attribute warning: detected read beyond size of field (2nd parameter); ma=
ybe use struct_group()?
> [-Wattribute-warning]
>   529 |                         __read_overflow2_field(q_size_field, size=
);
>       |                         ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> ...
>
> And this seems correct because:
>
> /* dst: u32[2], src: u8[6], size: 8 so 2 byte source overread */
> memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info,
>        sizeof(arg->peer_he_cap_macinfo));
>
> and:
>
> /* dst: u32[3], src: u8[11], size: 12 so 1 byte source overread */
> memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info,
>        sizeof(arg->peer_he_cap_phyinfo));

Arnd fixed this:

https://git.kernel.org/kvalo/ath/c/603cf6c2fcdc

--=20
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatc=
hes