Patch "mac80211: make ieee80211_tx_info padding explicit" has been added to the 6.4-stable tree

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This is a note to let you know that I've just added the patch titled

    mac80211: make ieee80211_tx_info padding explicit

to the 6.4-stable tree which can be found at:
    http://www.kernel.org/git/?p=linux/kernel/git/stable/stable-queue.git;a=summary

The filename of the patch is:
     mac80211-make-ieee80211_tx_info-padding-explicit.patch
and it can be found in the queue-6.4 subdirectory.

If you, or anyone else, feels it should not be added to the stable tree,
please let <stable@xxxxxxxxxxxxxxx> know about it.



commit 915f96a75ef660cc9bf4dbbca8e35b8a8d7a87d9
Author: Arnd Bergmann <arnd@xxxxxxxx>
Date:   Fri Jun 23 17:24:00 2023 +0200

    mac80211: make ieee80211_tx_info padding explicit
    
    [ Upstream commit a7a2ef0c4b3efbd7d6f3fabd87dbbc0b3f2de5af ]
    
    While looking at a bug, I got rather confused by the layout of the
    'status' field in ieee80211_tx_info. Apparently, the intention is that
    status_driver_data[] is used for driver specific data, and fills up the
    size of the union to 40 bytes, just like the other ones.
    
    This is indeed what actually happens, but only because of the
    combination of two mistakes:
    
     - "void *status_driver_data[18 / sizeof(void *)];" is intended
       to be 18 bytes long but is actually two bytes shorter because of
       rounding-down in the division, to a multiple of the pointer
       size (4 bytes or 8 bytes).
    
     - The other fields combined are intended to be 22 bytes long, but
       are actually 24 bytes because of padding in front of the
       unaligned tx_time member, and in front of the pointer array.
    
    The two mistakes cancel out. so the size ends up fine, but it seems
    more helpful to make this explicit, by having a multiple of 8 bytes
    in the size calculation and explicitly describing the padding.
    
    Fixes: ea5907db2a9cc ("mac80211: fix struct ieee80211_tx_info size")
    Fixes: 02219b3abca59 ("mac80211: add WMM admission control support")
    Signed-off-by: Arnd Bergmann <arnd@xxxxxxxx>
    Reviewed-by: Kees Cook <keescook@xxxxxxxxxxxx>
    Link: https://lore.kernel.org/r/20230623152443.2296825-2-arnd@xxxxxxxxxx
    Signed-off-by: Johannes Berg <johannes.berg@xxxxxxxxx>
    Signed-off-by: Sasha Levin <sashal@xxxxxxxxxx>

diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 67d81f7186660..52b336ada480c 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1192,9 +1192,11 @@ struct ieee80211_tx_info {
 			u8 ampdu_ack_len;
 			u8 ampdu_len;
 			u8 antenna;
+			u8 pad;
 			u16 tx_time;
 			u8 flags;
-			void *status_driver_data[18 / sizeof(void *)];
+			u8 pad2;
+			void *status_driver_data[16 / sizeof(void *)];
 		} status;
 		struct {
 			struct ieee80211_tx_rate driver_rates[



[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Index of Archives]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]

  Powered by Linux