diff mbox series

[1/3] wifi: mwifiex: Fix tlv_buf_left calculation

Message ID 698dc480d939e3ae490140db5c2f36eb84093594.1692829410.git.gustavoars@kernel.org (mailing list archive)
State Superseded
Headers show
Series wifi: mwifiex: Fix tlv_buf_left calculation and replace one-element array | expand

Commit Message

Gustavo A. R. Silva Aug. 23, 2023, 10:30 p.m. UTC
In a TLV encoding scheme, the Length part represents the length after
the header containing the values for type and length. In this case,
`tlv_len` should be:

tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len

Notice that the `- 1` accounts for the one-element array `bitmap`, which
1-byte size is already included in `sizeof(*tlv_rxba)`.

So, if the above is correct, there is a double-counting of some members
in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
are calculated:

968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);

in specific, members:

drivers/net/wireless/marvell/mwifiex/fw.h:777
 777         u8 mac[ETH_ALEN];
 778         u8 tid;
 779         u8 reserved;
 780         __le16 seq_num;
 781         __le16 bitmap_len;

This is clearly wrong, and affects the subsequent decoding of data from
`event_buf` through `tlv_rxba`:

970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;

Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
in the calculation of `tlv_buf_left` and `tmp`.

This results in the following binary differences before/after changes:

| drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
| @@ -4698,11 +4698,11 @@
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
| -    1da7:      lea    -0x11(%rbx),%edx
| +    1da7:      lea    -0x4(%rbx),%edx
|      1daa:      movzwl %bp,%eax
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
|                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
| -    1dad:      lea    0x11(%r15,%rbp,1),%r15
| +    1dad:      lea    0x4(%r15,%rbp,1),%r15
|  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
|                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
|      1db2:      mov    %edx,%ebx

The above reflects the desired change: avoid counting 13 too bytes;
which is the total size of the double-counted members in
`struct mwifiex_ie_types_rxba_sync`:

$ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
struct mwifiex_ie_types_rxba_sync {
	struct mwifiex_ie_types_header header;           /*     0     4 */

     |-----------------------------------------------------------------------
     |  u8                         mac[6];               /*     4     6 */  |
     |	u8                         tid;                  /*    10     1 */  |
     |  u8                         reserved;             /*    11     1 */  |
     | 	__le16                     seq_num;              /*    12     2 */  |
     | 	__le16                     bitmap_len;           /*    14     2 */  |
     |  u8                         bitmap[1];            /*    16     1 */  |
     |----------------------------------------------------------------------|
								  | 13 bytes|
								  -----------

	/* size: 17, cachelines: 1, members: 7 */
	/* last cacheline: 17 bytes */
} __attribute__((__packed__));

Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
Cc: stable@vger.kernel.org
Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Justin Stitt Aug. 23, 2023, 10:37 p.m. UTC | #1
On Wed, Aug 23, 2023 at 3:30 PM Gustavo A. R. Silva
<gustavoars@kernel.org> wrote:
>
> In a TLV encoding scheme, the Length part represents the length after
> the header containing the values for type and length. In this case,
> `tlv_len` should be:
>
> tlv_len == (sizeof(*tlv_rxba) - 1) - sizeof(tlv_rxba->header) + tlv_bitmap_len
>
> Notice that the `- 1` accounts for the one-element array `bitmap`, which
> 1-byte size is already included in `sizeof(*tlv_rxba)`.
>
> So, if the above is correct, there is a double-counting of some members
> in `struct mwifiex_ie_types_rxba_sync`, when `tlv_buf_left` and `tmp`
> are calculated:
>
> 968                 tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> 969                 tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
>
> in specific, members:
>
> drivers/net/wireless/marvell/mwifiex/fw.h:777
>  777         u8 mac[ETH_ALEN];
>  778         u8 tid;
>  779         u8 reserved;
>  780         __le16 seq_num;
>  781         __le16 bitmap_len;
>
> This is clearly wrong, and affects the subsequent decoding of data from
> `event_buf` through `tlv_rxba`:
>
> 970                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
>
> Fix this by using `sizeof(tlv_rxba->header)` instead of `sizeof(*tlv_rxba)`
> in the calculation of `tlv_buf_left` and `tmp`.
>
> This results in the following binary differences before/after changes:
>
> | drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> | @@ -4698,11 +4698,11 @@
> |                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> | -    1da7:      lea    -0x11(%rbx),%edx
> | +    1da7:      lea    -0x4(%rbx),%edx
> |      1daa:      movzwl %bp,%eax
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:969
> |                 tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
> | -    1dad:      lea    0x11(%r15,%rbp,1),%r15
> | +    1dad:      lea    0x4(%r15,%rbp,1),%r15
> |  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:968
> |                 tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> |      1db2:      mov    %edx,%ebx
>
> The above reflects the desired change: avoid counting 13 too bytes;
> which is the total size of the double-counted members in
> `struct mwifiex_ie_types_rxba_sync`:
>
> $ pahole -C mwifiex_ie_types_rxba_sync drivers/net/wireless/marvell/mwifiex/11n_rxreorder.o
> struct mwifiex_ie_types_rxba_sync {
>         struct mwifiex_ie_types_header header;           /*     0     4 */
>
>      |-----------------------------------------------------------------------
>      |  u8                         mac[6];               /*     4     6 */  |
>      |  u8                         tid;                  /*    10     1 */  |
>      |  u8                         reserved;             /*    11     1 */  |
>      |  __le16                     seq_num;              /*    12     2 */  |
>      |  __le16                     bitmap_len;           /*    14     2 */  |
>      |  u8                         bitmap[1];            /*    16     1 */  |
>      |----------------------------------------------------------------------|
>                                                                   | 13 bytes|
>                                                                   -----------
>
>         /* size: 17, cachelines: 1, members: 7 */
>         /* last cacheline: 17 bytes */
> } __attribute__((__packed__));
>
> Fixes: 99ffe72cdae4 ("mwifiex: process rxba_sync event")
> Cc: stable@vger.kernel.org
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
Reviewed-by: Justin Stitt <justinstitt@google.com>

> ---
>  drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> index 391793a16adc..d1d3632a3ed7 100644
> --- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> +++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
> @@ -965,8 +965,8 @@ void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
>                         }
>                 }
>
> -               tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
> -               tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
> +               tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
> +               tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
>                 tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
>         }
>  }
> --
> 2.34.1
>
diff mbox series

Patch

diff --git a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
index 391793a16adc..d1d3632a3ed7 100644
--- a/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
+++ b/drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c
@@ -965,8 +965,8 @@  void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
 			}
 		}
 
-		tlv_buf_left -= (sizeof(*tlv_rxba) + tlv_len);
-		tmp = (u8 *)tlv_rxba + tlv_len + sizeof(*tlv_rxba);
+		tlv_buf_left -= (sizeof(tlv_rxba->header) + tlv_len);
+		tmp = (u8 *)tlv_rxba  + sizeof(tlv_rxba->header) + tlv_len;
 		tlv_rxba = (struct mwifiex_ie_types_rxba_sync *)tmp;
 	}
 }