mac80211: Use flex-array for radiotap header bitmap
authorKees Cook <keescook@chromium.org>
Fri, 6 Aug 2021 21:53:05 +0000 (14:53 -0700)
committerJohannes Berg <johannes.berg@intel.com>
Fri, 13 Aug 2021 07:58:25 +0000 (09:58 +0200)
commit8c89f7b3d3f2880c57b0bc96c72ccd98fe354399
tree071abf84b4bde5a46a6fecd9473cbaa3ce4e8fee
parent5cafd3784a738eab8bbfcda17e8571050794ef32
mac80211: Use flex-array for radiotap header bitmap

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields.

The it_present member of struct ieee80211_radiotap_header is treated as a
flexible array (multiple u32s can be conditionally present). In order for
memcpy() to reason (or really, not reason) about the size of operations
against this struct, use of bytes beyond it_present need to be treated
as part of the flexible array. Add a trailing flexible array and
initialize its initial index via pointer arithmetic.

Cc: Johannes Berg <johannes@sipsolutions.net>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: linux-wireless@vger.kernel.org
Cc: netdev@vger.kernel.org
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20210806215305.2875621-1-keescook@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
include/net/ieee80211_radiotap.h
net/mac80211/rx.c
net/wireless/radiotap.c