Commit 3f26f766 authored by Kees Cook's avatar Kees Cook Committed by Kalle Valo
Browse files

mwl8k: Avoid memcpy() over-reading of mcs.rx_mask 



In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally reading across neighboring array fields. Use the
sub-structure address directly.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20210617041431.2168953-1-keescook@chromium.org
parent 70ca8441

drivers/net/wireless/marvell/mwl8k.c

+2 −2
Original line number Diff line number Diff line
@@ -4552,7 +4552,7 @@ static int mwl8k_cmd_update_stadb_add(struct ieee80211_hw *hw, 
	else

		rates = sta->supp_rates[NL80211_BAND_5GHZ] << 5;

	legacy_rate_mask_to_array(p->legacy_rates, rates);

	memcpy(p->ht_rates, sta->ht_cap.mcs.rx_mask, 16);

	memcpy(p->ht_rates, &sta->ht_cap.mcs, 16);

	p->interop = 1;

	p->amsdu_enabled = 0;
@@ -5034,7 +5034,7 @@ mwl8k_bss_info_changed_sta(struct ieee80211_hw *hw, struct ieee80211_vif *vif, 
			ap_legacy_rates =

				ap->supp_rates[NL80211_BAND_5GHZ] << 5;

		}

		memcpy(ap_mcs_rates, ap->ht_cap.mcs.rx_mask, 16);

		memcpy(ap_mcs_rates, &ap->ht_cap.mcs, 16);



		rcu_read_unlock();