| Message ID | 20210818060533.3569517-45-keescook@chromium.org (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
| Series | Introduce strict memcpy() bounds checking | expand |
On Tue, 2021-08-17 at 23:05 -0700, Kees Cook wrote: > > @@ -275,12 +275,11 @@ static void carl9170_tx_release(struct kref *ref) > if (WARN_ON_ONCE(!ar)) > return; > > > > > - BUILD_BUG_ON( > - offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); > - > - memset(&txinfo->status.ack_signal, 0, > - sizeof(struct ieee80211_tx_info) - > - offsetof(struct ieee80211_tx_info, status.ack_signal)); > + /* > + * Should this call ieee80211_tx_info_clear_status() instead of clearing > + * manually? txinfo->status.rates do not seem to be used here. > + */ Since you insist, I went digging :) It should not, carl9170_tx_fill_rateinfo() has filled the rate information before we get to this point. johannes
On Wed, 2021-08-18 at 09:08 +0200, Johannes Berg wrote: > On Tue, 2021-08-17 at 23:05 -0700, Kees Cook wrote: > > > > @@ -275,12 +275,11 @@ static void carl9170_tx_release(struct kref *ref) > > if (WARN_ON_ONCE(!ar)) > > return; > > > > > > > > > > - BUILD_BUG_ON( > > - offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); > > - > > - memset(&txinfo->status.ack_signal, 0, > > - sizeof(struct ieee80211_tx_info) - > > - offsetof(struct ieee80211_tx_info, status.ack_signal)); > > + /* > > + * Should this call ieee80211_tx_info_clear_status() instead of clearing > > + * manually? txinfo->status.rates do not seem to be used here. > > + */ > > Since you insist, I went digging :) > > It should not, carl9170_tx_fill_rateinfo() has filled the rate > information before we get to this point. Otherwise, looks fine, FWIW. Are you going to apply all of these together somewhere? I (we) can't, since memset_after() doesn't exist yet. johannes
On Wed, Aug 18, 2021 at 10:06:51AM +0200, Johannes Berg wrote: > On Wed, 2021-08-18 at 09:08 +0200, Johannes Berg wrote: > > On Tue, 2021-08-17 at 23:05 -0700, Kees Cook wrote: > > > > > > @@ -275,12 +275,11 @@ static void carl9170_tx_release(struct kref *ref) > > > if (WARN_ON_ONCE(!ar)) > > > return; > > > > > > > > > > > > > > > - BUILD_BUG_ON( > > > - offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); > > > - > > > - memset(&txinfo->status.ack_signal, 0, > > > - sizeof(struct ieee80211_tx_info) - > > > - offsetof(struct ieee80211_tx_info, status.ack_signal)); > > > + /* > > > + * Should this call ieee80211_tx_info_clear_status() instead of clearing > > > + * manually? txinfo->status.rates do not seem to be used here. > > > + */ > > > > Since you insist, I went digging :) > > > > It should not, carl9170_tx_fill_rateinfo() has filled the rate > > information before we get to this point. Ah-ha! Thanks for checking. I'll update the comment to explain the rationale here. > Otherwise, looks fine, FWIW. Thanks! > Are you going to apply all of these together somewhere? I (we) can't, > since memset_after() doesn't exist yet. Right, given the dependencies, I am expecting to just carry the whole series, since the vast majority of it has no binary changes, etc. I'm hoping to get it into -next soon, but we're uncomfortably close to the merge window. :P
diff --git a/drivers/net/wireless/ath/carl9170/tx.c b/drivers/net/wireless/ath/carl9170/tx.c index 88444fe6d1c6..aa95d1a65882 100644 --- a/drivers/net/wireless/ath/carl9170/tx.c +++ b/drivers/net/wireless/ath/carl9170/tx.c @@ -275,12 +275,11 @@ static void carl9170_tx_release(struct kref *ref) if (WARN_ON_ONCE(!ar)) return; - BUILD_BUG_ON( - offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); - - memset(&txinfo->status.ack_signal, 0, - sizeof(struct ieee80211_tx_info) - - offsetof(struct ieee80211_tx_info, status.ack_signal)); + /* + * Should this call ieee80211_tx_info_clear_status() instead of clearing + * manually? txinfo->status.rates do not seem to be used here. + */ + memset_after(&txinfo->status, 0, rates); if (atomic_read(&ar->tx_total_queued)) ar->tx_schedule = true; diff --git a/drivers/net/wireless/intersil/p54/txrx.c b/drivers/net/wireless/intersil/p54/txrx.c index 873fea59894f..8414aa208655 100644 --- a/drivers/net/wireless/intersil/p54/txrx.c +++ b/drivers/net/wireless/intersil/p54/txrx.c @@ -431,11 +431,7 @@ static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb) * Clear manually, ieee80211_tx_info_clear_status would * clear the counts too and we need them. */ - memset(&info->status.ack_signal, 0, - sizeof(struct ieee80211_tx_info) - - offsetof(struct ieee80211_tx_info, status.ack_signal)); - BUILD_BUG_ON(offsetof(struct ieee80211_tx_info, - status.ack_signal) != 20); + memset_after(&info->status, 0, rates); if (entry_hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN)) pad = entry_data->align[0]; diff --git a/include/net/mac80211.h b/include/net/mac80211.h index d8a1d09a2141..4c469b04de37 100644 --- a/include/net/mac80211.h +++ b/include/net/mac80211.h @@ -1197,12 +1197,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info) /* clear the rate counts */ for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) info->status.rates[i].count = 0; - - BUILD_BUG_ON( - offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); - memset(&info->status.ampdu_ack_len, 0, - sizeof(struct ieee80211_tx_info) - - offsetof(struct ieee80211_tx_info, status.ampdu_ack_len)); + memset_after(&info->status, 0, rates); }
In preparation for FORTIFY_SOURCE performing compile-time and run-time field bounds checking for memset(), avoid intentionally writing across neighboring fields. Use memset_after() so memset() doesn't get confused about writing beyond the destination member that is intended to be the starting point of zeroing through the end of the struct. Additionally fix the common helper, ieee80211_tx_info_clear_status(), which was not clearing ack_signal, but the open-coded versions did. Johannes Berg points out this bug was introduced by commit e3e1a0bcb3f1 ("mac80211: reduce IEEE80211_TX_MAX_RATES") but was harmless. Also drops the associated unneeded BUILD_BUG_ON()s, and adds a note to carl9170 about usage. Cc: Johannes Berg <johannes@sipsolutions.net> Cc: "David S. Miller" <davem@davemloft.net> Cc: Jakub Kicinski <kuba@kernel.org> Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook <keescook@chromium.org> --- drivers/net/wireless/ath/carl9170/tx.c | 11 +++++------ drivers/net/wireless/intersil/p54/txrx.c | 6 +----- include/net/mac80211.h | 7 +------ 3 files changed, 7 insertions(+), 17 deletions(-)