From: Kalle Valo <kvalo@codeaurora.org>
To: Kees Cook <keescook@chromium.org>
Cc: netdev@vger.kernel.org, Kees Cook <keescook@chromium.org>,
"David S. Miller" <davem@davemloft.net>,
Jakub Kicinski <kuba@kernel.org>,
linux-kernel@vger.kernel.org, ath11k@lists.infradead.org,
linux-wireless@vger.kernel.org, linux-hardening@vger.kernel.org
Subject: Re: [PATCH] ath11k: Avoid memcpy() over-reading of he_cap
Date: Tue, 22 Jun 2021 15:28:14 +0000 (UTC) [thread overview]
Message-ID: <20210622152814.4EABCC43460@smtp.codeaurora.org> (raw)
In-Reply-To: <20210616195410.1232119-1-keescook@chromium.org>
Kees Cook <keescook@chromium.org> wrote:
> In preparation for FORTIFY_SOURCE performing compile-time and run-time
> field bounds checking for memcpy(), memmove(), and memset(), avoid
> intentionally writing across neighboring array fields.
>
> Since peer_he_cap_{mac,phy}info and he_cap_elem.{mac,phy}_cap_info are not
> the same sizes, memcpy() was reading beyond field boundaries. Instead,
> correctly cap the copy length and pad out any difference in size
> (peer_he_cap_macinfo is 8 bytes whereas mac_cap_info is 6, and
> peer_he_cap_phyinfo is 12 bytes whereas phy_cap_info is 11).
>
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Patch applied to ath-next branch of ath.git, thanks.
c8bcd82a4efd ath11k: Avoid memcpy() over-reading of he_cap
--
https://patchwork.kernel.org/project/linux-wireless/patch/20210616195410.1232119-1-keescook@chromium.org/
https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches
--
ath11k mailing list
ath11k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath11k
prev parent reply other threads:[~2021-06-22 15:28 UTC|newest]
Thread overview: 4+ messages / expand[flat|nested] mbox.gz Atom feed top
2021-06-16 19:54 [PATCH] ath11k: Avoid memcpy() over-reading of he_cap Kees Cook
2021-06-16 19:54 ` Kees Cook
2021-06-22 15:28 ` Kalle Valo
2021-06-22 15:28 ` Kalle Valo [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20210622152814.4EABCC43460@smtp.codeaurora.org \
--to=kvalo@codeaurora.org \
--cc=ath11k@lists.infradead.org \
--cc=davem@davemloft.net \
--cc=keescook@chromium.org \
--cc=kuba@kernel.org \
--cc=linux-hardening@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=linux-wireless@vger.kernel.org \
--cc=netdev@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.