2022-09-27 02:31:49

by Kees Cook

Subject: [PATCH v2] wifi: nl80211: Split memcpy() of struct nl80211_wowlan_tcp_data_token flexible array

To work around a misbehavior of the compiler's ability to see into
composite flexible array structs (as detailed in the coming memcpy()
hardening series[1]), split the memcpy() of the header and the payload
so no false positive run-time overflow warning will be generated.

[1] https://lore.kernel.org/linux-hardening/[email protected]/

Cc: Johannes Berg <[email protected]>
Cc: "David S. Miller" <[email protected]>
Cc: Eric Dumazet <[email protected]>
Cc: Jakub Kicinski <[email protected]>
Cc: Paolo Abeni <[email protected]>
Cc: [email protected]
Cc: [email protected]
Signed-off-by: Kees Cook <[email protected]>
---
v2: - fix typo leading "+" (Gustavo)
v1: https://lore.kernel.org/lkml/[email protected]
---
net/wireless/nl80211.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 2705e3ee8fc4..169e3ec33466 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13171,7 +13171,9 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
wake_mask_size);
if (tok) {
cfg->tokens_size = tokens_size;
- memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
+ cfg->payload_tok = *tok;
+ memcpy(cfg->payload_tok.token_stream, tok->token_stream,
+ tokens_size);
}

trig->tcp = cfg;
--
2.34.1

2022-09-27 19:55:17

by Gustavo A. R. Silva

Subject: Re: [PATCH v2] wifi: nl80211: Split memcpy() of struct nl80211_wowlan_tcp_data_token flexible array

On Mon, Sep 26, 2022 at 07:29:23PM -0700, Kees Cook wrote:
> To work around a misbehavior of the compiler's ability to see into
> composite flexible array structs (as detailed in the coming memcpy()
> hardening series[1]), split the memcpy() of the header and the payload
> so no false positive run-time overflow warning will be generated.
>
> [1] https://lore.kernel.org/linux-hardening/[email protected]/
>
> Cc: Johannes Berg <[email protected]>
> Cc: "David S. Miller" <[email protected]>
> Cc: Eric Dumazet <[email protected]>
> Cc: Jakub Kicinski <[email protected]>
> Cc: Paolo Abeni <[email protected]>
> Cc: [email protected]
> Cc: [email protected]
> Signed-off-by: Kees Cook <[email protected]>

Reviewed-by: Gustavo A. R. Silva <[email protected]>

Thanks!
--
Gustavo

> ---
> v2: - fix typo leading "+" (Gustavo)
> v1: https://lore.kernel.org/lkml/[email protected]
> ---
> net/wireless/nl80211.c | 4 +++-
> 1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
> index 2705e3ee8fc4..169e3ec33466 100644
> --- a/net/wireless/nl80211.c
> +++ b/net/wireless/nl80211.c
> @@ -13171,7 +13171,9 @@ static int nl80211_parse_wowlan_tcp(struct cfg80211_registered_device *rdev,
> wake_mask_size);
> if (tok) {
> cfg->tokens_size = tokens_size;
> - memcpy(&cfg->payload_tok, tok, sizeof(*tok) + tokens_size);
> + cfg->payload_tok = *tok;
> + memcpy(cfg->payload_tok.token_stream, tok->token_stream,
> + tokens_size);
> }
>
> trig->tcp = cfg;
> --
> 2.34.1
>