wifi: cfg80211: Annotate with __counted_by
Subsystems (3)
cover wifi: cfg80211: Annotate with __counted_by
Hi,
This annotates several structures with the coming __counted_by attribute for bounds checking of flexible arrays at run-time. As a note toward applicability, had this mitigation been available already, the flaw fixed in commit 6311071a0562 ("wifi: nl80211: fix integer overflow in nl80211_parse_mbssid_elems()") would have already been unexploitable (i.e. writes through an out-of-bounds index would have been blocked).
Thanks!
-Kees
Kees Cook (7):
wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by
wifi: cfg80211: Annotate struct cfg80211_cqm_config with __counted_by
wifi: cfg80211: Annotate struct cfg80211_mbssid_elems with
__counted_by
wifi: cfg80211: Annotate struct cfg80211_pmsr_request with
__counted_by
wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by
wifi: cfg80211: Annotate struct cfg80211_scan_request with
__counted_by
wifi: cfg80211: Annotate struct cfg80211_tid_config with __counted_by
include/net/cfg80211.h | 12 ++++++------ net/wireless/core.h | 2 +- net/wireless/nl80211.c | 7 +++---- net/wireless/pmsr.c | 3 +-- 4 files changed, 11 insertions(+), 13 deletions(-)
Signature · 1 line
2.34.1
PATCH 1/7 wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by
Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
include/net/cfg80211.h +1 -1
@@ -1282,7 +1282,7 @@ struct cfg80211_acl_data {int n_acl_entries;/* Keep it last */ -struct mac_address mac_addrs[]; + struct mac_address mac_addrs[] __counted_by(n_acl_entries); };/**
net/wireless/nl80211.c +1 -2
@@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, acl =kzalloc (struct_size (acl, mac_addrs, n_entries),GFP_KERNEL );if (!acl)return ERR_PTR (-ENOMEM ); + acl->n_acl_entries = n_entries;nla_for_each_nested (attr, info->attrs[NL80211_ATTR_MAC_ADDRS ], tmp) {memcpy (acl->mac_addrs[i].addr,nla_data (attr),ETH_ALEN ); i++; } - - acl->n_acl_entries = n_entries; acl->acl_policy = acl_policy;return acl;
Signature · 1 line
2.34.1
Re: [PATCH 1/7] wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by
Quoted 13 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Quoted 40 lines
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)include/net/cfg80211.h +1
-1@@ -1282,7 +1282,7 @@ struct cfg80211_acl_data {int n_acl_entries;/* Keep it last */ -struct mac_address mac_addrs[]; + struct mac_address mac_addrs[] __counted_by(n_acl_entries); };/** net/wireless/nl80211.c +1
-3@@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, acl =kzalloc (struct_size (acl, mac_addrs, n_entries),GFP_KERNEL );if (!acl)return ERR_PTR (-ENOMEM ); + acl->n_acl_entries = n_entries;nla_for_each_nested (attr, info->attrs[NL80211_ATTR_MAC_ADDRS ], tmp) {memcpy (acl->mac_addrs[i].addr,nla_data (attr),ETH_ALEN ); i++; } - - acl->n_acl_entries = n_entries; acl->acl_policy = acl_policy;return acl; --2.34.1
Re: [PATCH 1/7] wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 37 lines
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)include/net/cfg80211.h +1
-1@@ -1282,7 +1282,7 @@ struct cfg80211_acl_data {int n_acl_entries;/* Keep it last */ -struct mac_address mac_addrs[]; + struct mac_address mac_addrs[] __counted_by(n_acl_entries); };/** net/wireless/nl80211.c +1
-2@@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, acl =kzalloc (struct_size (acl, mac_addrs, n_entries),GFP_KERNEL );if (!acl)return ERR_PTR (-ENOMEM ); + acl->n_acl_entries = n_entries;nla_for_each_nested (attr, info->attrs[NL80211_ATTR_MAC_ADDRS ], tmp) {memcpy (acl->mac_addrs[i].addr,nla_data (attr),ETH_ALEN ); i++; } - - acl->n_acl_entries = n_entries; acl->acl_policy = acl_policy;return acl;
Re: [PATCH 1/7] wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 2/7 wifi: cfg80211: Annotate struct cfg80211_cqm_config with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_cqm_config.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- net/wireless/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
net/wireless/core.h +1 -1
@@ -298,7 +298,7 @@ struct cfg80211_cqm_config {u32 rssi_hyst;s32 last_rssi_event_value;int n_rssi_thresholds; -s32 rssi_thresholds[]; + s32 rssi_thresholds[] __counted_by(n_rssi_thresholds); };void cfg80211_destroy_ifaces (struct cfg80211_registered_device *rdev);
Signature · 1 line
2.34.1
Re: [PATCH 2/7] wifi: cfg80211: Annotate struct cfg80211_cqm_config with __counted_by
Quoted 10 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_cqm_config.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 17 lines
--- net/wireless/core.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)net/wireless/core.h +1
-1@@ -298,7 +298,7 @@ struct cfg80211_cqm_config {u32 rssi_hyst;s32 last_rssi_event_value;int n_rssi_thresholds; -s32 rssi_thresholds[]; + s32 rssi_thresholds[] __counted_by(n_rssi_thresholds); };void cfg80211_destroy_ifaces (struct cfg80211_registered_device *rdev);
Re: [PATCH 2/7] wifi: cfg80211: Annotate struct cfg80211_cqm_config with __counted_by
In reply to Kees CookQuoted 10 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_cqm_config.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 3/7 wifi: cfg80211: Annotate struct cfg80211_mbssid_elems with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_mbssid_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/net/cfg80211.h +1 -1
@@ -1187,7 +1187,7 @@ struct cfg80211_mbssid_elems {struct {const u8 *data;size_t len; - } elem[]; + } elem[] __counted_by(cnt); };/**
net/wireless/nl80211.c +1 -1
@@ -5438,13 +5438,13 @@ nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs) elems =kzalloc (struct_size (elems, elem, num_elems),GFP_KERNEL );if (!elems)return ERR_PTR (-ENOMEM ); + elems->cnt = num_elems;nla_for_each_nested (nl_elems, attrs, rem_elems) { elems->elem[i].data =nla_data (nl_elems); elems->elem[i].len =nla_len (nl_elems); i++; } - elems->cnt = num_elems;return elems; }
Signature · 1 line
2.34.1
Re: [PATCH 3/7] wifi: cfg80211: Annotate struct cfg80211_mbssid_elems with __counted_by
Quoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_mbssid_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 37 lines
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)include/net/cfg80211.h +1
-1@@ -1187,7 +1187,7 @@ struct cfg80211_mbssid_elems {struct {const u8 *data;size_t len; - } elem[]; + } elem[] __counted_by(cnt); };/** net/wireless/nl80211.c +1
-1@@ -5438,13 +5438,13 @@ nl80211_parse_mbssid_elems(struct wiphy *wiphy, struct nlattr *attrs) elems =kzalloc (struct_size (elems, elem, num_elems),GFP_KERNEL );if (!elems)return ERR_PTR (-ENOMEM ); + elems->cnt = num_elems;nla_for_each_nested (nl_elems, attrs, rem_elems) { elems->elem[i].data =nla_data (nl_elems); elems->elem[i].len =nla_len (nl_elems); i++; } - elems->cnt = num_elems;return elems; }
Re: [PATCH 3/7] wifi: cfg80211: Annotate struct cfg80211_mbssid_elems with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_mbssid_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 4/7 wifi: cfg80211: Annotate struct cfg80211_pmsr_request with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_pmsr_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- net/wireless/pmsr.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)
include/net/cfg80211.h +1 -1
@@ -3948,7 +3948,7 @@ struct cfg80211_pmsr_request {struct list_head list; -struct cfg80211_pmsr_request_peer peers[]; + struct cfg80211_pmsr_request_peer peers[] __counted_by(n_peers); };/**
net/wireless/pmsr.c +1 -2
@@ -291,6 +291,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info) req =kzalloc (struct_size (req, peers, count),GFP_KERNEL );if (!req)return -ENOMEM ; + req->n_peers = count;if (info->attrs[NL80211_ATTR_TIMEOUT ]) req->timeout =nla_get_u32 (info->attrs[NL80211_ATTR_TIMEOUT ]);
@@ -321,8 +322,6 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info) goto out_err; idx++; } - - req->n_peers = count; req->cookie =cfg80211_assign_cookie (rdev); req->nl_portid = info->snd_portid;
Signature · 1 line
2.34.1
Re: [PATCH 4/7] wifi: cfg80211: Annotate struct cfg80211_pmsr_request with __counted_by
Quoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_pmsr_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 39 lines
--- include/net/cfg80211.h | 2 +- net/wireless/pmsr.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-)include/net/cfg80211.h +1
-1@@ -3948,7 +3948,7 @@ struct cfg80211_pmsr_request {struct list_head list; -struct cfg80211_pmsr_request_peer peers[]; + struct cfg80211_pmsr_request_peer peers[] __counted_by(n_peers); };/** net/wireless/pmsr.c +1
-2@@ -291,6 +291,7 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info) req =kzalloc (struct_size (req, peers, count),GFP_KERNEL );if (!req)return -ENOMEM ; + req->n_peers = count;if (info->attrs[NL80211_ATTR_TIMEOUT ]) req->timeout =nla_get_u32 (info->attrs[NL80211_ATTR_TIMEOUT ]);@@ -321,8 +322,6 @@ int nl80211_pmsr_start(struct sk_buff *skb, struct genl_info *info) goto out_err; idx++; } - - req->n_peers = count; req->cookie =cfg80211_assign_cookie (rdev); req->nl_portid = info->snd_portid;
Re: [PATCH 4/7] wifi: cfg80211: Annotate struct cfg80211_pmsr_request with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_pmsr_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 5/7 wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_rnr_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)
include/net/cfg80211.h +1 -1
@@ -1204,7 +1204,7 @@ struct cfg80211_rnr_elems {struct {const u8 *data;size_t len; - } elem[]; + } elem[] __counted_by(cnt); };/**
net/wireless/nl80211.c +1 -1
@@ -5470,13 +5470,13 @@ nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs, elems =kzalloc (struct_size (elems, elem, num_elems),GFP_KERNEL );if (!elems)return ERR_PTR (-ENOMEM ); + elems->cnt = num_elems;nla_for_each_nested (nl_elems, attrs, rem_elems) { elems->elem[i].data =nla_data (nl_elems); elems->elem[i].len =nla_len (nl_elems); i++; } - elems->cnt = num_elems;return elems; }
Signature · 1 line
2.34.1
Re: [PATCH 5/7] wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by
Quoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_rnr_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 37 lines
--- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-)include/net/cfg80211.h +1
-1@@ -1204,7 +1204,7 @@ struct cfg80211_rnr_elems {struct {const u8 *data;size_t len; - } elem[]; + } elem[] __counted_by(cnt); };/** net/wireless/nl80211.c +1
-1@@ -5470,13 +5470,13 @@ nl80211_parse_rnr_elems(struct wiphy *wiphy, struct nlattr *attrs, elems =kzalloc (struct_size (elems, elem, num_elems),GFP_KERNEL );if (!elems)return ERR_PTR (-ENOMEM ); + elems->cnt = num_elems;nla_for_each_nested (nl_elems, attrs, rem_elems) { elems->elem[i].data =nla_data (nl_elems); elems->elem[i].len =nla_len (nl_elems); i++; } - elems->cnt = num_elems;return elems; }
Re: [PATCH 5/7] wifi: cfg80211: Annotate struct cfg80211_rnr_elems with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_rnr_elems. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 6/7 wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_scan_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cfg80211.h +1 -1
@@ -2544,7 +2544,7 @@ struct cfg80211_scan_request {struct cfg80211_scan_6ghz_params *scan_6ghz_params;/* keep last */ -struct ieee80211_channel *channels[]; + struct ieee80211_channel *channels[] __counted_by(n_channels); };static inline void get_random_mask_addr (u8 *buf,const u8 *addr,const u8 *mask)
Signature · 1 line
2.34.1
Re: [PATCH 6/7] wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by
Quoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_scan_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 17 lines
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)include/net/cfg80211.h +1
-1@@ -2544,7 +2544,7 @@ struct cfg80211_scan_request {struct cfg80211_scan_6ghz_params *scan_6ghz_params;/* keep last */ -struct ieee80211_channel *channels[]; + struct ieee80211_channel *channels[] __counted_by(n_channels); };static inline void get_random_mask_addr (u8 *buf,const u8 *addr,const u8 *mask)
Re: [PATCH 6/7] wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by
In reply to Kees CookQuoted 12 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_scan_request. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
PATCH 7/7 wifi: cfg80211: Annotate struct cfg80211_tid_config with __counted_by
In reply to Kees CookPrepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions).
As found with Coccinelle[1], add __counted_by for struct cfg80211_tid_config.
[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)
include/net/cfg80211.h +1 -1
@@ -811,7 +811,7 @@ struct cfg80211_tid_cfg {struct cfg80211_tid_config {const u8 *peer;u32 n_tid_conf; -struct cfg80211_tid_cfg tid_conf[]; + struct cfg80211_tid_cfg tid_conf[] __counted_by(n_tid_conf); };/**
Signature · 1 line
2.34.1
Re: [PATCH 7/7] wifi: cfg80211: Annotate struct cfg80211_tid_config with __counted_by
Quoted 10 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_tid_config.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>
Thanks
--
Gustavo
Quoted 17 lines
--- include/net/cfg80211.h | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-)include/net/cfg80211.h +1
-1@@ -811,7 +811,7 @@ struct cfg80211_tid_cfg {struct cfg80211_tid_config {const u8 *peer;u32 n_tid_conf; -struct cfg80211_tid_cfg tid_conf[]; + struct cfg80211_tid_cfg tid_conf[] __counted_by(n_tid_conf); };/**
Re: [PATCH 7/7] wifi: cfg80211: Annotate struct cfg80211_tid_config with __counted_by
In reply to Kees CookQuoted 10 lines · Kees Cook
Prepare for the coming implementation by GCC and Clang of the
__counted_byattribute. Flexible array members annotated with__counted_bycan have their accesses bounds-checked at run-time checking viaCONFIG_UBSAN_BOUNDS(for array indexing) andCONFIG_FORTIFY_SOURCE(for strcpy/memcpy-family functions).As found with Coccinelle[1], add
__counted_byfor structcfg80211_tid_config.[1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci
Quoted 8 lines
Cc Johannes Berg <[email protected]>Cc "David S. Miller" <[email protected]>Cc Eric Dumazet <[email protected]>Cc Jakub Kicinski <[email protected]>Cc Paolo Abeni <[email protected]>Signed-off-by Kees Cook <[email protected]>