Skip to contentSkip to conversation

wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

PATCH In review Gustavo A. R. Silva 4 participants 4 messages Aug 21, 2024 – Sep 9, 2024 Marvell mwifiex wireless driver

lore
Share & tools
lore

Gustavo A. R. Silva

author
#0 lore raw

PATCH 1/1 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.

With this, fix the following warning:

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

Reported-by Andy Shevchenko <[email protected]>
Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here
Signed-off-by Gustavo A. R. Silva <[email protected]>
---
 drivers/net/wireless/marvell/mwifiex/fw.h   | 2 +-
 drivers/net/wireless/marvell/mwifiex/scan.c | 3 +--
 2 files changed, 2 insertions(+), 3 deletions(-)
drivers/net/wireless/marvell/mwifiex/fw.h +1 -1
index e91def0afa14..d03129d5d24e 100644
@@ -1627,7 +1627,7 @@ struct host_cmd_ds_802_11_scan_rsp {
 
 struct host_cmd_ds_802_11_scan_ext {
 	u32   reserved;
-	u8    tlv_buffer[1];
+	u8    tlv_buffer[];
 } __packed;
 
 struct mwifiex_ie_types_bss_mode {
drivers/net/wireless/marvell/mwifiex/scan.c +1 -2
index e782d652cb93..f7153472e2a2 100644
@@ -2536,8 +2536,7 @@ int mwifiex_ret_802_11_scan_ext(struct mwifiex_private *priv,
 	ext_scan_resp = &resp->params.ext_scan;
 
 	tlv = (void *)ext_scan_resp->tlv_buffer;
-	buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN
-					      - 1);
+	buf_left = le16_to_cpu(resp->size) - (sizeof(*ext_scan_resp) + S_DS_GEN);
 
 	while (buf_left >= sizeof(struct mwifiex_ie_types_header)) {
 		type = le16_to_cpu(tlv->type);
Signature · 1 line
2.34.1
Reviewed-by on v1 1/1
#1 lore raw
Quoted 8 lines · Gustavo A. R. Silva

Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.

With this, fix the following warning:

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

Reviewed-by Andy Shevchenko <[email protected]>

Thank you!

Signature · 2 lines
With Best Regards,
Andy Shevchenko
maintainer Acked-by on v1 1/1
#2 lore raw
In reply to Gustavo A. R. Silva
Quoted 5 lines · Gustavo A. R. Silva

Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.

With this, fix the following warning:

Quoted 7 lines

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

Reported-by Andy Shevchenko <[email protected]>
Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here
Signed-off-by Gustavo A. R. Silva <[email protected]>
Acked-by Brian Norris <[email protected]>
#3 lore raw
In reply to Gustavo A. R. Silva
Quoted 9 lines · Gustavo A. R. Silva

Replace one-element array with a flexible-array member in struct host_cmd_ds_802_11_scan_ext.

With this, fix the following warning:

elo 16 17:51:58 surfacebook kernel: ------------[ cut here ]------------
elo 16 17:51:58 surfacebook kernel: memcpy: detected field-spanning write (size 243) of single field "ext_scan->tlv_buffer" at drivers/net/wireless/marvell/mwifiex/scan.c:2239 (size 1) elo 16 17:51:58 surfacebook kernel: WARNING: CPU: 0 PID: 498 at drivers/net/wireless/marvell/mwifiex/scan.c:2239 mwifiex_cmd_802_11_scan_ext+0x83/0x90 [mwifiex]

Quoted 5 lines
Reported-by Andy Shevchenko <[email protected]>
Closes https://lore.kernel.org/linux-hardening/[email protected]/ open here
Signed-off-by Gustavo A. R. Silva <[email protected]>
Reviewed-by Andy Shevchenko <[email protected]>
Acked-by Brian Norris <[email protected]>

Patch applied to wireless-next.git, thanks.

498365e52beb wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_cmd_802_11_scan_ext()

Signature · 3 lines
https://patchwork.kernel.org/project/linux-wireless/patch/ZsZa5xRcsLq9D+RX@elsanto/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches