lkml.org 
[lkml]   [2021]   [Jul]   [27]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 43/64] ath11k: Use memset_after() for clearing queue descriptors
    Date
    In preparation for FORTIFY_SOURCE performing compile-time and run-time
    field bounds checking for memset(), avoid intentionally writing across
    neighboring fields.

    Use memset_after() so memset() doesn't get confused about writing
    beyond the destination member that is intended to be the starting point
    of zeroing through the end of the struct. Additionally split up a later
    field-spanning memset() so that memset() can reason about the size.

    Signed-off-by: Kees Cook <keescook@chromium.org>
    ---
    drivers/net/wireless/ath/ath11k/hal_rx.c | 13 ++++++-------
    1 file changed, 6 insertions(+), 7 deletions(-)

    diff --git a/drivers/net/wireless/ath/ath11k/hal_rx.c b/drivers/net/wireless/ath/ath11k/hal_rx.c
    index 325055ca41ab..c72b6b45b3ba 100644
    --- a/drivers/net/wireless/ath/ath11k/hal_rx.c
    +++ b/drivers/net/wireless/ath/ath11k/hal_rx.c
    @@ -29,8 +29,7 @@ static int ath11k_hal_reo_cmd_queue_stats(struct hal_tlv_hdr *tlv,
    FIELD_PREP(HAL_TLV_HDR_LEN, sizeof(*desc));

    desc = (struct hal_reo_get_queue_stats *)tlv->value;
    - memset(&desc->queue_addr_lo, 0,
    - (sizeof(*desc) - sizeof(struct hal_reo_cmd_hdr)));
    + memset_after(desc, 0, cmd);

    desc->cmd.info0 &= ~HAL_REO_CMD_HDR_INFO0_STATUS_REQUIRED;
    if (cmd->flag & HAL_REO_CMD_FLG_NEED_STATUS)
    @@ -62,8 +61,7 @@ static int ath11k_hal_reo_cmd_flush_cache(struct ath11k_hal *hal, struct hal_tlv
    FIELD_PREP(HAL_TLV_HDR_LEN, sizeof(*desc));

    desc = (struct hal_reo_flush_cache *)tlv->value;
    - memset(&desc->cache_addr_lo, 0,
    - (sizeof(*desc) - sizeof(struct hal_reo_cmd_hdr)));
    + memset_after(desc, 0, cmd);

    desc->cmd.info0 &= ~HAL_REO_CMD_HDR_INFO0_STATUS_REQUIRED;
    if (cmd->flag & HAL_REO_CMD_FLG_NEED_STATUS)
    @@ -101,8 +99,7 @@ static int ath11k_hal_reo_cmd_update_rx_queue(struct hal_tlv_hdr *tlv,
    FIELD_PREP(HAL_TLV_HDR_LEN, sizeof(*desc));

    desc = (struct hal_reo_update_rx_queue *)tlv->value;
    - memset(&desc->queue_addr_lo, 0,
    - (sizeof(*desc) - sizeof(struct hal_reo_cmd_hdr)));
    + memset_after(desc, 0, cmd);

    desc->cmd.info0 &= ~HAL_REO_CMD_HDR_INFO0_STATUS_REQUIRED;
    if (cmd->flag & HAL_REO_CMD_FLG_NEED_STATUS)
    @@ -762,15 +759,17 @@ void ath11k_hal_reo_qdesc_setup(void *vaddr, int tid, u32 ba_window_size,
    * size changes and also send WMI message to FW to change the REO
    * queue descriptor in Rx peer entry as part of dp_rx_tid_update.
    */
    - memset(ext_desc, 0, 3 * sizeof(*ext_desc));
    + memset(ext_desc, 0, sizeof(*ext_desc));
    ath11k_hal_reo_set_desc_hdr(&ext_desc->desc_hdr, HAL_DESC_REO_OWNED,
    HAL_DESC_REO_QUEUE_EXT_DESC,
    REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_1);
    ext_desc++;
    + memset(ext_desc, 0, sizeof(*ext_desc));
    ath11k_hal_reo_set_desc_hdr(&ext_desc->desc_hdr, HAL_DESC_REO_OWNED,
    HAL_DESC_REO_QUEUE_EXT_DESC,
    REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_2);
    ext_desc++;
    + memset(ext_desc, 0, sizeof(*ext_desc));
    ath11k_hal_reo_set_desc_hdr(&ext_desc->desc_hdr, HAL_DESC_REO_OWNED,
    HAL_DESC_REO_QUEUE_EXT_DESC,
    REO_QUEUE_DESC_MAGIC_DEBUG_PATTERN_3);
    --
    2.30.2
    \
     
     \ /
      Last update: 2021-07-27 23:07    [W:4.648 / U:0.152 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site