shinys000114/linux
1
0
Fork 0
mirror of https://github.com/hardkernel/linux.git synced 2026-06-09 20:32:04 +09:00
Code Issues Packages Projects Releases Wiki Activity

wifi: ath: Silence memcpy run-time false positive warning

Browse Source 
[ Upstream commit bfcc8ba45e ]

The memcpy() in ath_key_config() was attempting to write across
neighboring struct members in struct ath_keyval. Introduce a wrapping
struct_group, kv_values, to be the addressable target of the memcpy
without overflowing an individual member. Silences the false positive
run-time warning:

  memcpy: detected field-spanning write (size 32) of single field "hk.kv_val" at drivers/net/wireless/ath/key.c:506 (size 16)

Link: https://bbs.archlinux.org/viewtopic.php?id=282254
Cc: Kalle Valo <kvalo@kernel.org>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com>
Link: https://lore.kernel.org/r/20230210054310.never.554-kees@kernel.org
Signed-off-by: Sasha Levin <sashal@kernel.org>
This commit is contained in:
Kees Cook
2023-02-15 20:31:38 +02:00
committed by Greg Kroah-Hartman
parent b8e7589f50
commit 30d041c18d
2 changed files with 8 additions and 6 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
drivers/net/wireless/ath/ath.h
View File

@@ -96,11 +96,13 @@ struct ath_keyval {
u8 kv_type; u8 kv_type;
u8 kv_pad; u8 kv_pad;
u16 kv_len; u16 kv_len;
u8 kv_val[16]; /* TK */ struct_group(kv_values,
u8 kv_mic[8]; /* Michael MIC key */ u8 kv_val[16]; /* TK */
u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware u8 kv_mic[8]; /* Michael MIC key */
* supports both MIC keys in the same key cache entry; u8 kv_txmic[8]; /* Michael MIC TX key (used only if the hardware
* in that case, kv_mic is the RX key) */ * supports both MIC keys in the same key cache entry;
* in that case, kv_mic is the RX key) */
);
}; };
enum ath_cipher { enum ath_cipher {

2
drivers/net/wireless/ath/key.c
View File

@@ -503,7 +503,7 @@ int ath_key_config(struct ath_common *common,
hk.kv_len = key->keylen; hk.kv_len = key->keylen;
if (key->keylen) if (key->keylen)
memcpy(hk.kv_val, key->key, key->keylen); memcpy(&hk.kv_values, key->key, key->keylen);
if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) { if (!(key->flags & IEEE80211_KEY_FLAG_PAIRWISE)) {
switch (vif->type) { switch (vif->type) {