From patchwork Thu Aug 17 21:15:23 2023 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Kees Cook X-Patchwork-Id: 13356975 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from vger.kernel.org (vger.kernel.org [23.128.96.18]) by smtp.lore.kernel.org (Postfix) with ESMTP id 46541C64EB4 for ; Thu, 17 Aug 2023 21:16:19 +0000 (UTC) Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1355222AbjHQVPs (ORCPT ); Thu, 17 Aug 2023 17:15:48 -0400 Received: from lindbergh.monkeyblade.net ([23.128.96.19]:54342 "EHLO lindbergh.monkeyblade.net" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1355197AbjHQVPf (ORCPT ); Thu, 17 Aug 2023 17:15:35 -0400 Received: from mail-pl1-x633.google.com (mail-pl1-x633.google.com [IPv6:2607:f8b0:4864:20::633]) by lindbergh.monkeyblade.net (Postfix) with ESMTPS id 484853590 for ; Thu, 17 Aug 2023 14:15:33 -0700 (PDT) Received: by mail-pl1-x633.google.com with SMTP id d9443c01a7336-1bc63ef9959so2130965ad.2 for ; Thu, 17 Aug 2023 14:15:33 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=chromium.org; s=google; t=1692306933; x=1692911733; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:from:to:cc:subject:date :message-id:reply-to; bh=8UofhjPFvRG631Ccgv2qHcV06RmLtv8X8B/5+W9lIA8=; b=TlEkdA0aHIpDhWACKGHLrkm5y9e4OB90g6PTzJ1l+cbGyrClX3h4fGqMnA+W3GTIHy lP+KdB7wLx+G2GYF76W564NATtk5HWp+4Rx8DoU5rzUBnYjtV1BE+7EJ2YTSjwpgYMph +5OXcqEe8DeO2ald44h2rUXsRTA4LQAQWdiso= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20221208; t=1692306933; x=1692911733; h=content-transfer-encoding:mime-version:references:in-reply-to :message-id:date:subject:cc:to:from:x-gm-message-state:from:to:cc :subject:date:message-id:reply-to; bh=8UofhjPFvRG631Ccgv2qHcV06RmLtv8X8B/5+W9lIA8=; b=KfY+2Kwe4g5OGekhTfBLVLPyrGfan6DZ4DOZhjzTd0GY9m0xGSdl4YStG8VXeRP91H tBELqmyLZ4z582+rfwQdkXzZhCro1pYX1IEcI7YHtixvupzacFOKsKJ3Ovv/DFUB8FPd +ysUR012Qb5s0jicMYZatZONOdlEOZMQfoPZCJj8RJsT8M6ZpSHZeK5k1CESER8UDfFk 4BtnKu2o2nD1fl1LXz5wXhnDKby8PWTVQQBmw5k/8AmIPoPy12RRYyyGdCAPMRv6MlKf k2rlW65n3KQmk3W2DrWhI+DxUdq6V9qlIOvbjbr97tbLBQ6/BqwZrYRO1oBqDhb25wBI 3BoQ== X-Gm-Message-State: AOJu0YyMqHnhqz4qeWQKrcn4ExtprcI94KImQIXgQs3iWvi6I7iRHU7M 7Zw1f/AkYx4yN1KWn8upSzIDuA== X-Google-Smtp-Source: AGHT+IFBZSHNzPvyZlBzEtJLJA9BTz4aD5fj9A34rHRZOf7eSuRvseMrGYRyhAolhTW3rZ+WlLEk7w== X-Received: by 2002:a17:902:bd45:b0:1bb:cf4e:ccd with SMTP id b5-20020a170902bd4500b001bbcf4e0ccdmr659710plx.28.1692306932698; Thu, 17 Aug 2023 14:15:32 -0700 (PDT) Received: from www.outflux.net (198-0-35-241-static.hfc.comcastbusiness.net. [198.0.35.241]) by smtp.gmail.com with ESMTPSA id x17-20020a170902ec9100b001bf35144a18sm110378plg.221.2023.08.17.14.15.31 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Thu, 17 Aug 2023 14:15:32 -0700 (PDT) From: Kees Cook To: Johannes Berg Cc: Kees Cook , "David S. Miller" , Eric Dumazet , Jakub Kicinski , Paolo Abeni , linux-wireless@vger.kernel.org, netdev@vger.kernel.org, Nathan Chancellor , Nick Desaulniers , Tom Rix , linux-kernel@vger.kernel.org, llvm@lists.linux.dev, linux-hardening@vger.kernel.org Subject: [PATCH 1/7] wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by Date: Thu, 17 Aug 2023 14:15:23 -0700 Message-Id: <20230817211531.4193219-1-keescook@chromium.org> X-Mailer: git-send-email 2.34.1 In-Reply-To: <20230817211114.never.208-kees@kernel.org> References: <20230817211114.never.208-kees@kernel.org> MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=2104; i=keescook@chromium.org; h=from:subject; bh=HsEe1uS2p7u7BP7jBH38t6GAsv3eC9u8U8u9k4LTzrU=; b=owEBbQKS/ZANAwAKAYly9N/cbcAmAcsmYgBk3o3xUjzj9KXDcTFQvsN8IUNrW4GzDUUcLTOTR F6R3fE9BVaJAjMEAAEKAB0WIQSlw/aPIp3WD3I+bhOJcvTf3G3AJgUCZN6N8QAKCRCJcvTf3G3A JnzYD/0Z4jrC3Qoel0vy3g8ZrUKOYnJtNXSA5nwtWIj/WJ95o2nAw5Wff1y7uP0tXHAQ5QzlFeK 20SmedYHn+kj1uvTJ9++OVMMtOrTDd6LcBKdByskoSipgJo+bpwPNcNsiMVC3vMU8SlQ1U3dPOZ BRpQyecFwffX+Su5Ma7m86dMjcI6/nXrm5EIm0fZAyPYhyEG1zyT/J/eAgbL0YKVISQNO9ibybT Eklf8pHUlVduSjjwLcmiZfLYsrv1PHzybiHx9wQO0XEoVXCO8Gxt4Q7ZD7mOcrkKjkG4hOtyDi5 wkLn3BSk6LLpTrX9MX4TkhPLtZPKl+tdHSvxrvcjN1GzrJRAcMrClNRfjaR6Ay2JfQ6Xn7UC4vp DCygVQsJkaeGeQ1r7fFH6M0xfeORZqtRnmaBxSDI6q0RXDVdu5xv7BQ714R0gsNkcXh9vS8Wko1 5I9TUIDwHmobFmBmY0mw0GxI8Ni9en3PAjKZ7OroncsXcBRzTcC+sryyIONTsRjY2gIfV+bqgjv O8VqOlRAFVmMs0qXGLRaVWEo1Lcv2fmD0MqqjHoOFSpfO6/OYGLTKLSqfC26N8w2zi8U0KRcmLP wgh+mcdIpLnFW1fg6WtwoCbOuvmLYIMlmN381VG18LaUKFGiYEwo7gdcx2Rh2edzb2NaZ6p7LSZ tvcl7/UTEgnKl2Q== X-Developer-Key: i=keescook@chromium.org; a=openpgp; fpr=A5C3F68F229DD60F723E6E138972F4DFDC6DC026 Precedence: bulk List-ID: X-Mailing-List: linux-hardening@vger.kernel.org Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Justin Stitt Reviewed-by: Gustavo A. R. Silva Reviewed-by: Jeff Johnson --- include/net/cfg80211.h | 2 +- net/wireless/nl80211.c | 3 +-- 2 files changed, 2 insertions(+), 3 deletions(-) diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index d6fa7c8767ad..eb73b5af5d04 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1282,7 +1282,7 @@ struct cfg80211_acl_data { int n_acl_entries; /* Keep it last */ - struct mac_address mac_addrs[]; + struct mac_address mac_addrs[] __counted_by(n_acl_entries); }; /** diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8bcf8e293308..80633e815311 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); if (!acl) return ERR_PTR(-ENOMEM); + acl->n_acl_entries = n_entries; nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); i++; } - - acl->n_acl_entries = n_entries; acl->acl_policy = acl_policy; return acl;