Re: [PATCH] wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()

[Franky Lin <franky.lin@xxxxxxxxxxxx>]

On Tue, Aug 1, 2023 at 7:55 AM Kalle Valo <kvalo@xxxxxxxxxx> wrote:
>
> Hans de Goede <hdegoede@xxxxxxxxxx> writes:
>
> > Hi,
> >
> > On 8/1/23 16:37, Kalle Valo wrote:
> >> Hans de Goede <hdegoede@xxxxxxxxxx> wrote:
> >>
> >>> Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers
> >>> a backtrace caused by the following field-spanning error:
> >>>
> >>> memcpy: detected field-spanning write (size 120) of single field
> >>>   "&params_le->channel_list[0]" at
> >>>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2)
> >>>
> >>> Fix this by replacing the channel_list[1] declaration at the end of
> >>> the struct with a flexible array declaration.
> >>>
> >>> Most users of struct brcmf_scan_params_le calculate the size to alloc
> >>> using the size of the non flex-array part of the struct + needed extra
> >>> space, so they do not care about sizeof(struct brcmf_scan_params_le).
> >>>
> >>> brcmf_notify_escan_complete() however uses the struct on the stack,
> >>> expecting there to be room for at least 1 entry in the channel-list
> >>> to store the special -1 abort channel-id.
> >>>
> >>> To make this work use an anonymous union with a padding member
> >>> added + the actual channel_list flexible array.
> >>>
> >>> Cc: Kees Cook <keescook@xxxxxxxxxxxx>
> >>> Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
> >>> Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>

Looks good to me, thanks for taking care of it.

Reviewed-by: Franky Lin <franky.lin@xxxxxxxxxxxx>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature