Patch "wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()" has been added to the 6.1-stable tree

[Sasha Levin <sashal@xxxxxxxxxx>]

This is a note to let you know that I've just added the patch titled

    wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()

to the 6.1-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     wifi-brcmfmac-fix-field-spanning-write-in-brcmf_scan.patch
and it can be found in the queue-6.1 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit eeef277ea40da82ce7c8f1e3f401269e1566348e
Author: Hans de Goede <hdegoede@xxxxxxxxxx>
Date:   Sat Jul 29 16:05:00 2023 +0200

    wifi: brcmfmac: Fix field-spanning write in brcmf_scan_params_v2_to_v1()
    
    [ Upstream commit 16e455a465fca91907af0108f3d013150386df30 ]
    
    Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers
    a backtrace caused by the following field-spanning warning:
    
    memcpy: detected field-spanning write (size 120) of single field
      "&params_le->channel_list[0]" at
      drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2)
    
    The driver still works after this warning. The warning was introduced by the
    new field-spanning write checks which were enabled recently.
    
    Fix this by replacing the channel_list[1] declaration at the end of
    the struct with a flexible array declaration.
    
    Most users of struct brcmf_scan_params_le calculate the size to alloc
    using the size of the non flex-array part of the struct + needed extra
    space, so they do not care about sizeof(struct brcmf_scan_params_le).
    
    brcmf_notify_escan_complete() however uses the struct on the stack,
    expecting there to be room for at least 1 entry in the channel-list
    to store the special -1 abort channel-id.
    
    To make this work use an anonymous union with a padding member
    added + the actual channel_list flexible array.
    
    Cc: Kees Cook <keescook@xxxxxxxxxxxx>
    Signed-off-by: Hans de Goede <hdegoede@xxxxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Reviewed-by: Franky Lin <franky.lin@xxxxxxxxxxxx>
    Signed-off-by: Kalle Valo <kvalo@xxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@xxxxxxxxxx
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
index f518e025d6e46..a8d88aedc4227 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/fwil_types.h
@@ -383,7 +383,12 @@ struct brcmf_scan_params_le {
 				 * fixed parameter portion is assumed, otherwise
 				 * ssid in the fixed portion is ignored
 				 */
-	__le16 channel_list[1];	/* list of chanspecs */
+	union {
+		__le16 padding;	/* Reserve space for at least 1 entry for abort
+				 * which uses an on stack brcmf_scan_params_le
+				 */
+		DECLARE_FLEX_ARRAY(__le16, channel_list);	/* chanspecs */
+	};
 };
 
 struct brcmf_scan_results {