Received-SPF: pass (google.com: domain of linux-wireless+bounces-248-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Message-ID: <1cddf5467c79c0d3ab1e9ba67266d302f63b3fa4.camel@sipsolutions.net>
Subject: Re: [RFC PATCH] wifi: cfg80211: fix CQM for non-range use
From: Johannes Berg <johannes@sipsolutions.net>
To: Kees Cook <keescook@chromium.org>
Cc: Jeff Johnson <quic_jjohnson@quicinc.com>, Michael Walle
 <mwalle@kernel.org>,  lkp@intel.com, oe-kbuild-all@lists.linux.dev,
 linux-wireless@vger.kernel.org,  Max Schulze <max.schulze@online.de>
Date: Thu, 30 Nov 2023 19:54:41 +0100
In-Reply-To: <202311301050.C4BFFB9837@keescook>
References: <202311090752.hWcJWAHL-lkp@intel.com>
	 <202311090752.hWcJWAHL-lkp@intel.com>
	 <1c37d99f722f891a50c540853e54d4e36bdf0157.camel@sipsolutions.net>
	 <fc1dbe4a-a810-445c-9398-60a5e55990a2@quicinc.com>
	 <202311301016.84D0010@keescook>
	 <01e3663e9e1418a183ee86251e0352256494ee28.camel@sipsolutions.net>
	 <202311301050.C4BFFB9837@keescook>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable
User-Agent: Evolution 3.48.4 (3.48.4-1.fc38) 
Precedence: bulk
MIME-Version: 1.0

On Thu, 2023-11-30 at 10:52 -0800, Kees Cook wrote:
>=20
> I was able to see it with Ubuntu's GCC 12.3.0 and their config. This
> fixed it for me:

OK. I guess kernel tree also mattered somehow, and I got confused
because I'd applied the patch on wireless, where the robot did it on
wireless-next. Not sure how that's different, but OK.


> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index d0f499227c29..7735d178a393 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -12845,7 +12845,7 @@ static int cfg80211_cqm_rssi_update(struct cfg802=
11_registered_device *rdev,
>  }
> =20
>  static int nl80211_set_cqm_rssi(struct genl_info *info,
> -				const s32 *thresholds, int n_thresholds,
> +				const s32 *thresholds, u32 n_thresholds,
>  				u32 hysteresis)
>  {
>  	struct cfg80211_registered_device *rdev =3D info->user_ptr[0];
> @@ -12948,7 +12948,7 @@ static int nl80211_set_cqm(struct sk_buff *skb, s=
truct genl_info *info)
>  	    attrs[NL80211_ATTR_CQM_RSSI_HYST]) {
>  		const s32 *thresholds =3D
>  			nla_data(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
> -		int len =3D nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
> +		u32 len =3D nla_len(attrs[NL80211_ATTR_CQM_RSSI_THOLD]);
>  		u32 hysteresis =3D nla_get_u32(attrs[NL80211_ATTR_CQM_RSSI_HYST]);
> =20
>  		if (len % 4)
>=20
>=20
> If that's sensible, I can send a proper patch?

Sure, that seems reasonable.

> (Oh, it looks like nla_len is actually u16 ... should I use that instead
> of u32?)

Yeah it's a 16-bit field in the message format. Doesn't really matter?

johannes