mirrors
/
linux-stable
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
1
0
Fork 0
Code Issues Releases Wiki Activity

intersil: Use struct_group() for memcpy() region 

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields.

Use struct_group() in struct hfa384x_tx_frame around members
frame_control, duration_id, addr1, addr2, addr3, and seq_ctrl, so they
can be referenced together. This will allow memcpy() and sizeof() to
more easily reason about sizes, improve readability, and avoid future
warnings about writing beyond the end of frame_control.

"pahole" shows no size nor member offset changes to struct
hfa384x_tx_frame. "objdump -d" shows no object code changes.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211119004646.2347920-1-keescook@chromium.org
This commit is contained in:
Kees Cook 2021-11-18 16:46:46 -08:00 committed by Kalle Valo
parent 642a57475b
commit 601d2293e2
2 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

5
drivers/net/wireless/intersil/hostap/hostap_hw.c
View File

@ -1815,8 +1815,9 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
memset(&txdesc, 0, sizeof(txdesc));
/* skb->data starts with txdesc->frame_control */
hdr_len = 24;
skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);
hdr_len = sizeof(txdesc.header);
BUILD_BUG_ON(hdr_len != 24);
skb_copy_from_linear_data(skb, &txdesc.header, hdr_len);
if (ieee80211_is_data(txdesc.frame_control) &&
ieee80211_has_a4(txdesc.frame_control) &&
skb->len >= 30) {

14
drivers/net/wireless/intersil/hostap/hostap_wlan.h
View File

@ -115,12 +115,14 @@ struct hfa384x_tx_frame {
__le16 tx_control; /* HFA384X_TX_CTRL_ flags */
/* 802.11 */
__le16 frame_control; /* parts not used */
__le16 duration_id;
u8 addr1[ETH_ALEN];
u8 addr2[ETH_ALEN]; /* filled by firmware */
u8 addr3[ETH_ALEN];
__le16 seq_ctrl; /* filled by firmware */
struct_group(header,
__le16 frame_control; /* parts not used */
__le16 duration_id;
u8 addr1[ETH_ALEN];
u8 addr2[ETH_ALEN]; /* filled by firmware */
u8 addr3[ETH_ALEN];
__le16 seq_ctrl; /* filled by firmware */
);
u8 addr4[ETH_ALEN];
__le16 data_len;