Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::3:6 as permitted sender) client-ip=2620:137:e000::3:6;
Subject: Re: [PATCH] wifi: wireless: Fix bad memory passed in
 inform_single_bss_data.
To:     James Dutton <james.dutton@gmail.com>
Cc:     linux-wireless@vger.kernel.org
References: <20231021154827.1142734-1-greearb@candelatech.com>
 <CAAMvbhHqbXXgF6FpPoWnqKbn=0A0br55wLN9T1xfnwRyiwvnuw@mail.gmail.com>
From:   Ben Greear <greearb@candelatech.com>
Organization: Candela Technologies
Message-ID: <4c25e9a2-1669-264d-4a86-a53f5a386f0e@candelatech.com>
Date:   Sun, 22 Oct 2023 11:30:59 -0700
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101
 Thunderbird/78.10.1
MIME-Version: 1.0
In-Reply-To: <CAAMvbhHqbXXgF6FpPoWnqKbn=0A0br55wLN9T1xfnwRyiwvnuw@mail.gmail.com>
Content-Type: text/plain; charset=utf-8; format=flowed
Content-Language: en-MW
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 10/22/23 5:14 AM, James Dutton wrote:
> On Sat, 21 Oct 2023 at 16:52, <greearb@candelatech.com> wrote:
>>
>> From: Ben Greear <greearb@candelatech.com>
>>
>> The sins of similar variable names and passing void pointers
>> are seen again in wireless-next tree.
>>
>> Wrong data was passed into the rdev_inform_bss method causing
>> crashes.
>>
> 
> Is there any good reason for the void pointers?
> The patch you propose fixes the immediate problem, but if the void
> pointers were replaced with struct pointers, the compiler could catch
> this sort of problem.
> I imagine there could be similar confusion with this struct and
> function having the same name:
> 0 scan.c 1999 struct cfg80211_inform_single_bss_data {
> 1 scan.c 2023 cfg80211_inform_single_bss_data(struct wiphy *wiphy,
> 
> Maybe renaming the following:
> struct cfg80211_inform_bss *drv_data = data->drv_data;
> to
> struct cfg80211_inform_bss *c_inform_bss1 = data->drv_data;
> would reduce the confusion.

It takes a lot of time and patience to get more complicated patches upstreamed,
so maybe someone else has interested in pursuing that.

Probably a somewhat generic call-back struct could be used to pass info back to
the mac80211 stack instead of using the void*, but that would require touching
a larger set of drivers most likely.

I am tracking down more crash bugs in the mean time.

Thanks,
Ben

-- 
Ben Greear <greearb@candelatech.com>
Candela Technologies Inc  http://www.candelatech.com