Commit 601d2293 authored by Kees Cook's avatar Kees Cook Committed by Kalle Valo
Browse files

intersil: Use struct_group() for memcpy() region 



In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields.

Use struct_group() in struct hfa384x_tx_frame around members
frame_control, duration_id, addr1, addr2, addr3, and seq_ctrl, so they
can be referenced together. This will allow memcpy() and sizeof() to
more easily reason about sizes, improve readability, and avoid future
warnings about writing beyond the end of frame_control.

"pahole" shows no size nor member offset changes to struct
hfa384x_tx_frame. "objdump -d" shows no object code changes.

Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Signed-off-by: default avatarKalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211119004646.2347920-1-keescook@chromium.org
parent 642a5747

drivers/net/wireless/intersil/hostap/hostap_hw.c

+3 −2
Original line number Diff line number Diff line
@@ -1815,8 +1815,9 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev) 
	memset(&txdesc, 0, sizeof(txdesc));



	/* skb->data starts with txdesc->frame_control */

	hdr_len = 24;

	skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);

	hdr_len = sizeof(txdesc.header);

	BUILD_BUG_ON(hdr_len != 24);

	skb_copy_from_linear_data(skb, &txdesc.header, hdr_len);

	if (ieee80211_is_data(txdesc.frame_control) &&

	    ieee80211_has_a4(txdesc.frame_control) &&

	    skb->len >= 30) {

drivers/net/wireless/intersil/hostap/hostap_wlan.h

+8 −6
Original line number Diff line number Diff line
@@ -115,12 +115,14 @@ struct hfa384x_tx_frame { 
	__le16 tx_control; /* HFA384X_TX_CTRL_ flags */



	/* 802.11 */

	struct_group(header,

		__le16 frame_control; /* parts not used */

		__le16 duration_id;

		u8 addr1[ETH_ALEN];

		u8 addr2[ETH_ALEN]; /* filled by firmware */

		u8 addr3[ETH_ALEN];

		__le16 seq_ctrl; /* filled by firmware */

	);

	u8 addr4[ETH_ALEN];

	__le16 data_len;