From patchwork Wed Nov 30 21:26:45 2022 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 28018 Return-Path: Delivered-To: ouuuleilei@gmail.com Received: by 2002:adf:f944:0:0:0:0:0 with SMTP id q4csp1158674wrr; Wed, 30 Nov 2022 13:28:47 -0800 (PST) X-Google-Smtp-Source: AA0mqf52BEvOn2v5uZ/Le2tbeadsu1QrsTw1UB9ce2N1X3TACsyNtxsKj/wEiMmCbjbFuVGsVWsr X-Received: by 2002:a17:906:6c89:b0:7c0:83c2:24a4 with SMTP id s9-20020a1709066c8900b007c083c224a4mr8777460ejr.251.1669843726970; Wed, 30 Nov 2022 13:28:46 -0800 (PST) ARC-Seal: i=1; a=rsa-sha256; t=1669843726; cv=none; d=google.com; s=arc-20160816; b=HeDbwEAEfMsIr58TMJzzSPBE1xSewWO4pIuVl56+LF/E7/wgbr850cbhgF27h0tYz5 X6xx4qfdzxiRcntBTTGmi1aCAK8gx/SkOIUts/u7DqUbFVJWxmFbzxoi3LE7cGRVhiGW o+iNvrD30Ao4w1INA+AA4VX6CvLCniTjfjk+0c6ShBJNmUIHPg0Kr4vEokxRt9yS+4sq H/MPLyeJfclkfZ9tXU1TUX+TW8G480DmZZsx0fvUsezlCNNzN3glc+cLEFQmRwYKYnJZ G82eVN12W9xbPh5o3RSPJEukamFd8sEisE5sVhUBLiPImJeAfSR1L5LsQLOK+KA6+AaD 4hrQ== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=google.com; s=arc-20160816; h=list-id:precedence:content-transfer-encoding:mime-version :message-id:date:subject:cc:to:from:dkim-signature; bh=6saT+q5ezDQ177rT53B59Pf17d135h+Oe9v073LR0cQ=; b=oTYQbiKU4KD4BisX06KtsAl8rSAQy2HXFekYnCLREpt0g3YHFZwiaN0BxuH9Z/3Yei QGXUH37aSlu4eBEZknDALLjYhu9vk6HsvJAApu7ztKuHWzbpEIEkMxvwHJu+CLMFvyl0 iDk2r23e+oSJe9oYULE58sjmFXre6Bjcd5LZZ1kL9cFoqw4eb+jgj9mQwXZxC6+RsYDP WEeUxaE5QlVWgnp/DZKb8N9E/ZgqNwIhHO8DyvNlFZNm4zqS3QHxpt9Uk+jS3cuhxW1B aAlQ6LIWUCHtFm1V7Tjs85i9/MqiHZpS8csCOnqgdJWAJzHh6nMeevNQkGxNrDQ+OxeZ 7TuA== ARC-Authentication-Results: i=1; mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=TYLgl4SD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: from out1.vger.email (out1.vger.email. [2620:137:e000::1:20]) by mx.google.com with ESMTP id go18-20020a1709070d9200b0077b4248b138si2533895ejc.127.2022.11.30.13.28.23; Wed, 30 Nov 2022 13:28:46 -0800 (PST) Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20; Authentication-Results: mx.google.com; dkim=pass header.i=@chromium.org header.s=google header.b=TYLgl4SD; spf=pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) smtp.mailfrom=linux-kernel-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=chromium.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S229599AbiK3V0v (ORCPT + 99 others); Wed, 30 Nov 2022 16:26:51 -0500 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54910 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S229483AbiK3V0u (ORCPT ); Wed, 30 Nov 2022 16:26:50 -0500 Received: from mail-pl1-x636.google.com (mail-pl1-x636.google.com [IPv6:2607:f8b0:4864:20::636]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 5ED118DBD6 for ; Wed, 30 Nov 2022 13:26:49 -0800 (PST) Received: by mail-pl1-x636.google.com with SMTP id 4so18005750pli.0 for ; Wed, 30 Nov 2022 13:26:49 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=6saT+q5ezDQ177rT53B59Pf17d135h+Oe9v073LR0cQ=; b=TYLgl4SDIlOgIM1p5/s3P0/xE+k81DJUqppgCSnPchv8RIojqA/1XCiDCoxM93+n3i jYMlN9hLJMl30itHOyj8vzuPMhYxr4q/6FakXZFxsenGV25bvMIV3cmimYgHYOPhoiBJ DoM8sM3D6JrzbfwFyjn9nIBo3Bg3QK9iavMGI= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20210112; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=6saT+q5ezDQ177rT53B59Pf17d135h+Oe9v073LR0cQ=; b=lDUpKhkErKaNUCQF2wAZILVfxSNgd2x2uDqmr/8D1/VBWDsupsfmziEtO+/wZhK2MA yf7W2LmMXgy1RsPLTpO/a0BUIK3eJY+xkI/k9yV+VlZflBFyqsZFCJ5bgCMTbL2jwR5d W7OkSKTNXz9z3+Jd5jGh+LS5zIIc0BvdhEFuVNKk+9Iyb3xQGUA8UzB1DiXN072S2UgC TxR5dQHnhhz+tVagQLcNYzUJSCWpO/Q55r9KMSGpxDme32+0txETgj41AuquqI2VByAf M+1zRdoRhMxYHUlqwKpCfQuedvxSNWmfXEyKOxOX6BGe9lxiZz/cG0mieTGgWpGmpVRW 2GdA== X-Gm-Message-State: ANoB5pnP6Cu/9Dq/u5o85BKSUkd4fo9ALn39s/qPKgPnYb4C2IHrWaej bJ0mHtuhBPksNVVT0aWlLFhjhw== X-Received: by 2002:a17:90b:3c45:b0:20a:db08:8a8a with SMTP id pm5-20020a17090b3c4500b0020adb088a8amr72164973pjb.141.1669843608744; Wed, 30 Nov 2022 13:26:48 -0800 (PST) Received: from www.outflux.net (smtp.outflux.net. [198.145.64.163]) by smtp.gmail.com with ESMTPSA id m8-20020a1709026bc800b001897e2fd65dsm1965267plt.9.2022.11.30.13.26.47 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 30 Nov 2022 13:26:48 -0800 (PST) From: Kees Cook To: Johannes Berg Cc: Kees Cook , Kalle Valo , Gregory Greenman , "Gustavo A. R. Silva" , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, linux-hardening@vger.kernel.org Subject: [PATCH] wifi: ieee80211: Do not open-code qos address offsets Date: Wed, 30 Nov 2022 13:26:45 -0800 Message-Id: <20221130212641.never.627-kees@kernel.org> X-Mailer: git-send-email 2.34.1 MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3438; h=from:subject:message-id; bh=qZxXxI21JC4mN+ljaOuKqxqbLwAquUPCxUGbmUAdtlE=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBjh8qVfqRVaiLZwrWKZBsTnGkWYgjdX4AEocT03P5E +egjltSJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCY4fKlQAKCRCJcvTf3G3AJnGbD/ 9eLN44SC31Sfm16KmOEF+mtK8blu718iQGEZTvgbxx0w2aSj4UFjBWqJ1BEKMex8I87jo5WHNo922P ESqDuHRWT/xFXiHBP86/C93S5/ko/+1stUjOkZBJq0+/qR/eN78gpLx6Eo7xMzFB8DYT1EnSHDNwo/ ifPp2uYIaiAICdjVry3ZXELwzqZ70+xmsJuTzLxh+0V/d0ADGwSabRzjm34oD9QB+yxrLZeJrUCFS9 CtKMwLXVXBfQc7SBR47izPMtJlTr5TO1vqNXNjBl4DWDAjwLXUH1H5gyj5Lb0+icPqES1oYhtSo1kK kZzF5vEAMTwBVJx3dzDEmbxecHx8eJhgqHy22hsbHy1OfYr1GhINi5ItTltq0NjKCTotCyWhQATIB4 esln3aWsvU4q3zbvA6f22XnTtMUb1mAAJc/0fAQru5YjqI4eMc+TKIYtxx4FBpeEBBM4IPLd0d+U1y UW52ozdZHEITFf5/tVPObbZAZFTCNI3ISBYQvNXJYNoNbcVrPq2FeGLP+nN78afpxmxb9Qeat7YuRd inBgAjjtIjUE1gfsXLkoI0GT5ST2nll+8GX4DiPSkJ4G3wT/G8M0o2qpM5bfPbNi64tqYFdJA3FZT+ 4rJdCpRqYHSCOIbVvv7VqkxiV+ZVI4da0EKftcFprsutzwC5dG7Sv/CGygdA== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 X-Spam-Status: No, score=-2.1 required=5.0 tests=BAYES_00,DKIMWL_WL_HIGH, DKIM_SIGNED,DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_NONE, SPF_HELO_NONE,SPF_PASS autolearn=ham autolearn_force=no version=3.4.6 X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on lindbergh.monkeyblade.net Precedence: bulk List-ID: X-Mailing-List: linux-kernel@vger.kernel.org X-getmail-retrieved-from-mailbox: =?utf-8?q?INBOX?= X-GMAIL-THRID: =?utf-8?q?1750958056116777227?= X-GMAIL-MSGID: =?utf-8?q?1750958056116777227?= When building with -Wstringop-overflow, GCC's KASAN implementation does not correctly perform bounds checking within some complex structures when faced with literal offsets, and can get very confused. For example, this warning is seen due to literal offsets into sturct ieee80211_hdr that may or may not be large enough: drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c: In function 'iwl_mvm_rx_mpdu_mq': drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c:2022:29: warning: writing 1 byte into a region of size 0 [-Wstringop-overflow=] 2022 | *qc &= ~IEEE80211_QOS_CTL_A_MSDU_PRESENT; In file included from drivers/net/wireless/intel/iwlwifi/mvm/fw-api.h:32, from drivers/net/wireless/intel/iwlwifi/mvm/sta.h:15, from drivers/net/wireless/intel/iwlwifi/mvm/mvm.h:27, from drivers/net/wireless/intel/iwlwifi/mvm/rxmq.c:10: drivers/net/wireless/intel/iwlwifi/mvm/../fw/api/rx.h:559:16: note: at offset [78, 166] into destination object 'mpdu_len' of size 2 559 | __le16 mpdu_len; | ^~~~~~~~ Refactor ieee80211_get_qos_ctl() to avoid using literal offsets, requiring the creation of the actual structure that is described in the comments. Explicitly choose the desired offset, making the code more human-readable too. This is one of the last remaining warning to fix before enabling -Wstringop-overflow globally. Link: https://gcc.gnu.org/bugzilla/show_bug.cgi?id=97490 Link: https://github.com/KSPP/linux/issues/181 Cc: Johannes Berg Cc: Kalle Valo Cc: Gregory Greenman Cc: "Gustavo A. R. Silva" Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook --- include/linux/ieee80211.h | 28 ++++++++++++++++++++++------ 1 file changed, 22 insertions(+), 6 deletions(-) diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h index 6252f02f38b7..80d6308dea06 100644 --- a/include/linux/ieee80211.h +++ b/include/linux/ieee80211.h @@ -338,6 +338,17 @@ struct ieee80211_qos_hdr { __le16 qos_ctrl; } __packed __aligned(2); +struct ieee80211_qos_hdr_4addr { + __le16 frame_control; + __le16 duration_id; + u8 addr1[ETH_ALEN]; + u8 addr2[ETH_ALEN]; + u8 addr3[ETH_ALEN]; + __le16 seq_ctrl; + u8 addr4[ETH_ALEN]; + __le16 qos_ctrl; +} __packed __aligned(2); + struct ieee80211_trigger { __le16 frame_control; __le16 duration; @@ -4060,16 +4071,21 @@ struct ieee80211_he_6ghz_capa { * @hdr: the frame * * The qos ctrl bytes come after the frame_control, duration, seq_num - * and 3 or 4 addresses of length ETH_ALEN. - * 3 addr: 2 + 2 + 2 + 3*6 = 24 - * 4 addr: 2 + 2 + 2 + 4*6 = 30 + * and 3 or 4 addresses of length ETH_ALEN. Checks frame_control to choose + * between struct ieee80211_qos_hdr_4addr and struct ieee80211_qos_hdr. */ static inline u8 *ieee80211_get_qos_ctl(struct ieee80211_hdr *hdr) { - if (ieee80211_has_a4(hdr->frame_control)) - return (u8 *)hdr + 30; + union { + struct ieee80211_qos_hdr addr3; + struct ieee80211_qos_hdr_4addr addr4; + } *qos; + + qos = (void *)hdr; + if (ieee80211_has_a4(qos->addr3.frame_control)) + return (u8 *)&qos->addr4.qos_ctrl; else - return (u8 *)hdr + 24; + return (u8 *)&qos->addr3.qos_ctrl; } /**