mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
synced 2024-10-03 23:58:05 +00:00
intersil: Use struct_group() for memcpy() region
In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memcpy(), memmove(), and memset(), avoid intentionally writing across neighboring fields. Use struct_group() in struct hfa384x_tx_frame around members frame_control, duration_id, addr1, addr2, addr3, and seq_ctrl, so they can be referenced together. This will allow memcpy() and sizeof() to more easily reason about sizes, improve readability, and avoid future warnings about writing beyond the end of frame_control. "pahole" shows no size nor member offset changes to struct hfa384x_tx_frame. "objdump -d" shows no object code changes. Signed-off-by: Kees Cook <keescook@chromium.org> Signed-off-by: Kalle Valo <kvalo@codeaurora.org> Link: https://lore.kernel.org/r/20211119004646.2347920-1-keescook@chromium.org
This commit is contained in:
parent
642a57475b
commit
601d2293e2
2 changed files with 11 additions and 8 deletions
|
@ -1815,8 +1815,9 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
|
||||||
memset(&txdesc, 0, sizeof(txdesc));
|
memset(&txdesc, 0, sizeof(txdesc));
|
||||||
|
|
||||||
/* skb->data starts with txdesc->frame_control */
|
/* skb->data starts with txdesc->frame_control */
|
||||||
hdr_len = 24;
|
hdr_len = sizeof(txdesc.header);
|
||||||
skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);
|
BUILD_BUG_ON(hdr_len != 24);
|
||||||
|
skb_copy_from_linear_data(skb, &txdesc.header, hdr_len);
|
||||||
if (ieee80211_is_data(txdesc.frame_control) &&
|
if (ieee80211_is_data(txdesc.frame_control) &&
|
||||||
ieee80211_has_a4(txdesc.frame_control) &&
|
ieee80211_has_a4(txdesc.frame_control) &&
|
||||||
skb->len >= 30) {
|
skb->len >= 30) {
|
||||||
|
|
|
@ -115,12 +115,14 @@ struct hfa384x_tx_frame {
|
||||||
__le16 tx_control; /* HFA384X_TX_CTRL_ flags */
|
__le16 tx_control; /* HFA384X_TX_CTRL_ flags */
|
||||||
|
|
||||||
/* 802.11 */
|
/* 802.11 */
|
||||||
__le16 frame_control; /* parts not used */
|
struct_group(header,
|
||||||
__le16 duration_id;
|
__le16 frame_control; /* parts not used */
|
||||||
u8 addr1[ETH_ALEN];
|
__le16 duration_id;
|
||||||
u8 addr2[ETH_ALEN]; /* filled by firmware */
|
u8 addr1[ETH_ALEN];
|
||||||
u8 addr3[ETH_ALEN];
|
u8 addr2[ETH_ALEN]; /* filled by firmware */
|
||||||
__le16 seq_ctrl; /* filled by firmware */
|
u8 addr3[ETH_ALEN];
|
||||||
|
__le16 seq_ctrl; /* filled by firmware */
|
||||||
|
);
|
||||||
u8 addr4[ETH_ALEN];
|
u8 addr4[ETH_ALEN];
|
||||||
__le16 data_len;
|
__le16 data_len;
|
||||||
|
|
||||||
|
|
Loading…
Reference in a new issue