mirror of
https://git.proxmox.com/git/mirror_ubuntu-kernels.git
synced 2025-11-22 15:58:40 +00:00
16e455a465
Using brcmfmac with 6.5-rc3 on a brcmfmac43241b4-sdio triggers a backtrace caused by the following field-spanning warning: memcpy: detected field-spanning write (size 120) of single field "¶ms_le->channel_list[0]" at drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:1072 (size 2) The driver still works after this warning. The warning was introduced by the new field-spanning write checks which were enabled recently. Fix this by replacing the channel_list[1] declaration at the end of the struct with a flexible array declaration. Most users of struct brcmf_scan_params_le calculate the size to alloc using the size of the non flex-array part of the struct + needed extra space, so they do not care about sizeof(struct brcmf_scan_params_le). brcmf_notify_escan_complete() however uses the struct on the stack, expecting there to be room for at least 1 entry in the channel-list to store the special -1 abort channel-id. To make this work use an anonymous union with a padding member added + the actual channel_list flexible array. Cc: Kees Cook <keescook@chromium.org> Signed-off-by: Hans de Goede <hdegoede@redhat.com> Reviewed-by: Kees Cook <keescook@chromium.org> Reviewed-by: Franky Lin <franky.lin@broadcom.com> Signed-off-by: Kalle Valo <kvalo@kernel.org> Link: https://lore.kernel.org/r/20230729140500.27892-1-hdegoede@redhat.com |
||
|---|---|---|
| .. | ||
| bca | ||
| cyw | ||
| wcc | ||
| acpi.c | ||
| bcdc.c | ||
| bcdc.h | ||
| bcmsdh.c | ||
| btcoex.c | ||
| btcoex.h | ||
| bus.h | ||
| cfg80211.c | ||
| cfg80211.h | ||
| chip.c | ||
| chip.h | ||
| common.c | ||
| common.h | ||
| commonring.c | ||
| commonring.h | ||
| core.c | ||
| core.h | ||
| debug.c | ||
| debug.h | ||
| dmi.c | ||
| feature.c | ||
| feature.h | ||
| firmware.c | ||
| firmware.h | ||
| flowring.c | ||
| flowring.h | ||
| fweh.c | ||
| fweh.h | ||
| fwil_types.h | ||
| fwil.c | ||
| fwil.h | ||
| fwsignal.c | ||
| fwsignal.h | ||
| fwvid.c | ||
| fwvid.h | ||
| Kconfig | ||
| Makefile | ||
| msgbuf.c | ||
| msgbuf.h | ||
| of.c | ||
| of.h | ||
| p2p.c | ||
| p2p.h | ||
| pcie.c | ||
| pcie.h | ||
| pno.c | ||
| pno.h | ||
| proto.c | ||
| proto.h | ||
| sdio.c | ||
| sdio.h | ||
| tracepoint.c | ||
| tracepoint.h | ||
| usb.c | ||
| usb.h | ||
| vendor.c | ||
| vendor.h | ||
| xtlv.c | ||
| xtlv.h | ||