Hans de Goede <hdegoede@xxxxxxxxxx> writes: > Hi, > > On 8/1/23 16:37, Kalle Valo wrote: >> Hans de Goede <hdegoede@xxxxxxxxxx> wrote: >> >>> Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers >>> a backtrace caused by the following field-spanning error: >>> >>> memcpy: detected field-spanning write (size 120) of single field >>> "¶ms_le->channel_list[0]" at >>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) >>> >>> Fix this by replacing the channel_list[1] declaration at the end of >>> the struct with a flexible array declaration. >>> >>> Most users of struct brcmf_scan_params_le calculate the size to alloc >>> using the size of the non flex-array part of the struct + needed extra >>> space, so they do not care about sizeof(struct brcmf_scan_params_le). >>> >>> brcmf_notify_escan_complete() however uses the struct on the stack, >>> expecting there to be room for at least 1 entry in the channel-list >>> to store the special -1 abort channel-id. >>> >>> To make this work use an anonymous union with a padding member >>> added + the actual channel_list flexible array. >>> >>> Cc: Kees Cook <keescook@xxxxxxxxxxxx> >>> Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx> >>> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> >> >> Does the driver still work even if this warning is printed? I'm wondering >> should I take this to wireless or wireless-next. Also a review from Broadcom >> would be really good. > > It works fine, but it logs an oops / backtrace. I'll add that info to the commit log. > Note I did test the patch on a device where the warning was triggered > and the warning is gone and wifi association still works. > > So there is a slight preference to get this as a fix into 6.5 from my side. I'll queue this wireless then. But I really would like to Broadcom take a look at this in case we are missing something. >> What about a Fixes tag? > > This is caused by the new field-spanning wtire checks enabled > recently, so there is not really a brcmfmac commit to point to as the > culprit. Ok. -- https://patchwork.kernel.org/project/linux-wireless/list/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
