niansa-misc/linux
1
0
Fork 0
mirror of synced 2025-03-06 20:59:54 +01:00
Code Issues Projects Releases Packages Wiki Activity

mac80211: Use memset_after() to clear tx status

Browse source 
In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring fields.

Use memset_after() so memset() doesn't get confused about writing
beyond the destination member that is intended to be the starting point
of zeroing through the end of the struct.

Additionally fix the common helper, ieee80211_tx_info_clear_status(),
which was not clearing ack_signal, but the open-coded versions
did. Johannes Berg points out this bug was introduced by commit
e3e1a0bcb3 ("mac80211: reduce IEEE80211_TX_MAX_RATES") but was harmless.

Also drops the associated unneeded BUILD_BUG_ON()s, and adds a note to
carl9170 about usage.

Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Christian Lamparter <chunkeey@gmail.com> [both CARL9170+P54USB on real HW]
Link: https://lore.kernel.org/r/20211118203839.1289276-1-keescook@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Kees Cook 2021-11-18 12:38:39 -08:00 • committed by Johannes Berg
parent eb87d3e089
commit fb5f6a0e80
3 changed files with 8 additions and 17 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

12
drivers/net/wireless/ath/carl9170/tx.c
View file

@ -275,12 +275,12 @@ static void carl9170_tx_release(struct kref *ref)
if (WARN_ON_ONCE(!ar)) if (WARN_ON_ONCE(!ar))
return; return;
BUILD_BUG_ON( /*
offsetof(struct ieee80211_tx_info, status.ack_signal) != 20); * This does not call ieee80211_tx_info_clear_status() because
* carl9170_tx_fill_rateinfo() has filled the rate information
memset(&txinfo->status.ack_signal, 0, * before we get to this point.
sizeof(struct ieee80211_tx_info) - */
offsetof(struct ieee80211_tx_info, status.ack_signal)); memset_after(&txinfo->status, 0, rates);
if (atomic_read(&ar->tx_total_queued)) if (atomic_read(&ar->tx_total_queued))
ar->tx_schedule = true; ar->tx_schedule = true;

6
drivers/net/wireless/intersil/p54/txrx.c
View file

@ -431,11 +431,7 @@ static void p54_rx_frame_sent(struct p54_common *priv, struct sk_buff *skb)
* Clear manually, ieee80211_tx_info_clear_status would * Clear manually, ieee80211_tx_info_clear_status would
* clear the counts too and we need them. * clear the counts too and we need them.
*/ */
memset(&info->status.ack_signal, 0, memset_after(&info->status, 0, rates);
sizeof(struct ieee80211_tx_info) -
offsetof(struct ieee80211_tx_info, status.ack_signal));
BUILD_BUG_ON(offsetof(struct ieee80211_tx_info,
status.ack_signal) != 20);
if (entry_hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN)) if (entry_hdr->flags & cpu_to_le16(P54_HDR_FLAG_DATA_ALIGN))
pad = entry_data->align[0]; pad = entry_data->align[0];

7
include/net/mac80211.h
View file

@ -1205,12 +1205,7 @@ ieee80211_tx_info_clear_status(struct ieee80211_tx_info *info)
/* clear the rate counts */ /* clear the rate counts */
for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) for (i = 0; i < IEEE80211_TX_MAX_RATES; i++)
info->status.rates[i].count = 0; info->status.rates[i].count = 0;
memset_after(&info->status, 0, rates);
BUILD_BUG_ON(
offsetof(struct ieee80211_tx_info, status.ack_signal) != 20);
memset(&info->status.ampdu_ack_len, 0,
sizeof(struct ieee80211_tx_info) -
offsetof(struct ieee80211_tx_info, status.ampdu_ack_len));
} }