lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 08/64] staging: rtl8192u: Use struct_group() for memcpy() region
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memcpy(), memmove(), and memset(), avoid
    intentionally writing across neighboring fields.

    Use struct_group() around members addr1, addr2, and addr3 in struct
    rtl_80211_hdr_4addr, and members qui, qui_type, qui_subtype, version,
    and ac_info in struct ieee80211_qos_information_element, so they can be
    referenced together. This will allow memcpy() and sizeof() to more easily
    reason about sizes, improve readability, and avoid future warnings about
    writing beyond the end of addr1 and qui. Additionally replace zero sized
    arrays with flexible arrays in struct ieee_param.

    "pahole" shows no size nor member offset changes to struct
    rtl_80211_hdr_4addr nor struct ieee80211_qos_information_element. "objdump
    -d" shows no meaningful object code changes (i.e. only source line number
    induced differences and optimizations).

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    .../staging/rtl8192u/ieee80211/ieee80211.h | 24 +++++++++++--------
    .../rtl8192u/ieee80211/ieee80211_crypt_ccmp.c | 3 ++-
    .../staging/rtl8192u/ieee80211/ieee80211_rx.c | 8 +++----
    3 files changed, 20 insertions(+), 15 deletions(-)

    diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211.h b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
    index 7903c777a417..6ae8d7504558 100644
    --- a/drivers/staging/rtl8192u/ieee80211/ieee80211.h
    +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211.h
    @@ -303,7 +303,7 @@ struct ieee_param {
    struct {
    u32 len;
    u8 reserved[32];
    - u8 data[0];
    + u8 data[];
    } wpa_ie;
    struct{
    int command;
    @@ -316,7 +316,7 @@ struct ieee_param {
    u8 idx;
    u8 seq[8]; /* sequence counter (set: RX, get: TX) */
    u16 key_len;
    - u8 key[0];
    + u8 key[];
    } crypt;
    } u;
    };
    @@ -917,9 +917,11 @@ struct rtl_80211_hdr_3addr {
    struct rtl_80211_hdr_4addr {
    __le16 frame_ctl;
    __le16 duration_id;
    - u8 addr1[ETH_ALEN];
    - u8 addr2[ETH_ALEN];
    - u8 addr3[ETH_ALEN];
    + struct_group(addrs,
    + u8 addr1[ETH_ALEN];
    + u8 addr2[ETH_ALEN];
    + u8 addr3[ETH_ALEN];
    + );
    __le16 seq_ctl;
    u8 addr4[ETH_ALEN];
    u8 payload[];
    @@ -1100,11 +1102,13 @@ typedef union _frameqos {
    struct ieee80211_qos_information_element {
    u8 elementID;
    u8 length;
    - u8 qui[QOS_OUI_LEN];
    - u8 qui_type;
    - u8 qui_subtype;
    - u8 version;
    - u8 ac_info;
    + struct_group(data,
    + u8 qui[QOS_OUI_LEN];
    + u8 qui_type;
    + u8 qui_subtype;
    + u8 version;
    + u8 ac_info;
    + );
    } __packed;

    struct ieee80211_qos_ac_parameter {
    diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
    index c241cf484023..61f9a189c90c 100644
    --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
    +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_crypt_ccmp.c
    @@ -141,7 +141,8 @@ static int ccmp_init_iv_and_aad(struct rtl_80211_hdr_4addr *hdr,
    pos = (u8 *)hdr;
    aad[0] = pos[0] & 0x8f;
    aad[1] = pos[1] & 0xc7;
    - memcpy(aad + 2, hdr->addr1, 3 * ETH_ALEN);
    + BUILD_BUG_ON(sizeof(hdr->addrs) != 3 * ETH_ALEN);
    + memcpy(aad + 2, &hdr->addrs, 3 * ETH_ALEN);
    pos = (u8 *)&hdr->seq_ctl;
    aad[20] = pos[0] & 0x0f;
    aad[21] = 0; /* all bits masked */
    diff --git a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
    index b0e01ee65f7f..d5557ee0a3b7 100644
    --- a/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
    +++ b/drivers/staging/rtl8192u/ieee80211/ieee80211_rx.c
    @@ -1332,13 +1332,13 @@ static int ieee80211_read_qos_param_element(struct ieee80211_qos_parameter_info
    *info_element)
    {
    int ret = 0;
    - u16 size = sizeof(struct ieee80211_qos_parameter_info) - 2;
    + u16 size = sizeof(element_param->info_element.data);

    if (!info_element || !element_param)
    return -1;

    if (info_element->id == QOS_ELEMENT_ID && info_element->len == size) {
    - memcpy(element_param->info_element.qui, info_element->data,
    + memcpy(&element_param->info_element.data, info_element->data,
    info_element->len);
    element_param->info_element.elementID = info_element->id;
    element_param->info_element.length = info_element->len;
    @@ -1358,7 +1358,7 @@ static int ieee80211_read_qos_info_element(
    struct ieee80211_info_element *info_element)
    {
    int ret = 0;
    - u16 size = sizeof(struct ieee80211_qos_information_element) - 2;
    + u16 size = sizeof(element_info->data);

    if (!element_info)
    return -1;
    @@ -1366,7 +1366,7 @@ static int ieee80211_read_qos_info_element(
    return -1;

    if ((info_element->id == QOS_ELEMENT_ID) && (info_element->len == size)) {
    - memcpy(element_info->qui, info_element->data,
    + memcpy(&element_info->data, info_element->data,
    info_element->len);
    element_info->elementID = info_element->id;
    element_info->length = info_element->len;
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 22:59    [W:4.141 / U:0.104 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site