From: Kees Cook Date: Thu, 17 Aug 2023 21:15:23 +0000 (-0700) Subject: wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by X-Git-Tag: v6.6.7~2079^2~23^2~74 X-Git-Url: http://review.tizen.org/git/?a=commitdiff_plain;h=93ca82447c3eab149b5b2588ab8bd9aa2eacef7c;p=platform%2Fkernel%2Flinux-starfive.git wifi: cfg80211: Annotate struct cfg80211_acl_data with __counted_by Prepare for the coming implementation by GCC and Clang of the __counted_by attribute. Flexible array members annotated with __counted_by can have their accesses bounds-checked at run-time checking via CONFIG_UBSAN_BOUNDS (for array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family functions). As found with Coccinelle[1], add __counted_by for struct cfg80211_acl_data. Additionally, since the element count member must be set before accessing the annotated flexible array member, move its initialization earlier. [1] https://github.com/kees/kernel-tools/blob/trunk/coccinelle/examples/counted_by.cocci Cc: Johannes Berg Cc: "David S. Miller" Cc: Eric Dumazet Cc: Jakub Kicinski Cc: Paolo Abeni Cc: linux-wireless@vger.kernel.org Cc: netdev@vger.kernel.org Signed-off-by: Kees Cook Reviewed-by: Justin Stitt Reviewed-by: Gustavo A. R. Silva Reviewed-by: Jeff Johnson Link: https://lore.kernel.org/r/20230817211531.4193219-1-keescook@chromium.org Signed-off-by: Johannes Berg --- diff --git a/include/net/cfg80211.h b/include/net/cfg80211.h index d6fa7c8..eb73b5a 100644 --- a/include/net/cfg80211.h +++ b/include/net/cfg80211.h @@ -1282,7 +1282,7 @@ struct cfg80211_acl_data { int n_acl_entries; /* Keep it last */ - struct mac_address mac_addrs[]; + struct mac_address mac_addrs[] __counted_by(n_acl_entries); }; /** diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c index 8bcf8e2..80633e8 100644 --- a/net/wireless/nl80211.c +++ b/net/wireless/nl80211.c @@ -4889,13 +4889,12 @@ static struct cfg80211_acl_data *parse_acl_data(struct wiphy *wiphy, acl = kzalloc(struct_size(acl, mac_addrs, n_entries), GFP_KERNEL); if (!acl) return ERR_PTR(-ENOMEM); + acl->n_acl_entries = n_entries; nla_for_each_nested(attr, info->attrs[NL80211_ATTR_MAC_ADDRS], tmp) { memcpy(acl->mac_addrs[i].addr, nla_data(attr), ETH_ALEN); i++; } - - acl->n_acl_entries = n_entries; acl->acl_policy = acl_policy; return acl;