Hans de Goede <hdegoede@xxxxxxxxxx> wrote: > Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers > a backtrace caused by the following field-spanning warning: > > memcpy: detected field-spanning write (size 120) of single field > "¶ms_le->channel_list[0]" at > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) > > The driver still works after this warning. The warning was introduced by the > new field-spanning write checks which were enabled recently. > > Fix this by replacing the channel_list[1] declaration at the end of > the struct with a flexible array declaration. > > Most users of struct brcmf_scan_params_le calculate the size to alloc > using the size of the non flex-array part of the struct + needed extra > space, so they do not care about sizeof(struct brcmf_scan_params_le). > > brcmf_notify_escan_complete() however uses the struct on the stack, > expecting there to be room for at least 1 entry in the channel-list > to store the special -1 abort channel-id. > > To make this work use an anonymous union with a padding member > added + the actual channel_list flexible array. > > Cc: Kees Cook <keescook@xxxxxxxxxxxx> > Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx> > Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx> > Reviewed-by: Franky Lin <franky.lin@xxxxxxxxxxxx> Patch applied to wireless.git, thanks. 16e455a465fc wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1() -- https://patchwork.kernel.org/project/linux-wireless/patch/20230729140500.27892-1-hdegoede@xxxxxxxxxx/ https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
