kernel_samsung_a53x/drivers/net
Alper Nebi Yasak fa21ee65e2 wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan()
[ Upstream commit d241a139c2e9f8a479f25c75ebd5391e6a448500 ]

Replace one-element array with a flexible-array member in `struct
mwifiex_ie_types_wildcard_ssid_params` to fix the following warning
on a MT8173 Chromebook (mt8173-elm-hana):

[  356.775250] ------------[ cut here ]------------
[  356.784543] memcpy: detected field-spanning write (size 6) of single field "wildcard_ssid_tlv->ssid" at drivers/net/wireless/marvell/mwifiex/scan.c:904 (size 1)
[  356.813403] WARNING: CPU: 3 PID: 742 at drivers/net/wireless/marvell/mwifiex/scan.c:904 mwifiex_scan_networks+0x4fc/0xf28 [mwifiex]

The "(size 6)" above is exactly the length of the SSID of the network
this device was connected to. The source of the warning looks like:

    ssid_len = user_scan_in->ssid_list[i].ssid_len;
    [...]
    memcpy(wildcard_ssid_tlv->ssid,
           user_scan_in->ssid_list[i].ssid, ssid_len);

There is a #define WILDCARD_SSID_TLV_MAX_SIZE that uses sizeof() on this
struct, but it already didn't account for the size of the one-element
array, so it doesn't need to be changed.

Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Signed-off-by: Alper Nebi Yasak <alpernebiyasak@gmail.com>
Acked-by: Brian Norris <briannorris@chromium.org>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://patch.msgid.link/20241007222301.24154-1-alpernebiyasak@gmail.com
Signed-off-by: Sasha Levin <sashal@kernel.org>
2024-12-17 13:24:05 +01:00
..
appletalk
arcnet
bonding Revert "net: bonding: correctly annotate RCU in bond_should_notify_peers()" 2024-11-24 00:23:56 +01:00
caif
can can: c_can: fix {rx,tx}_errors statistics 2024-11-30 02:33:22 +01:00
dropdump
dsa Revert "net: dsa: mv88e6xxx: Limit chip-wide frame size config to CPU ports" 2024-11-24 00:23:56 +01:00
ethernet net/mlx5e: kTLS, Fix incorrect page refcounting 2024-12-17 13:20:50 +01:00
fddi
fjes
hamradio
hippi
hyperv hv_netvsc: Fix VF namespace also in synthetic NIC NETDEV_REGISTER event 2024-11-23 23:22:01 +01:00
ieee802154 Revert "ieee802154: Fix build error" 2024-11-24 00:23:12 +01:00
ipa
ipvlan
mdio
netdevsim netdevsim: copy addresses for both in and out paths 2024-12-17 13:24:04 +01:00
pcs
phy net: phy: ti: take into account all possible interrupt sources 2024-11-30 02:33:27 +01:00
plip
ppp Revert "ppp: fix ppp_async_encode() illegal access" 2024-11-24 00:22:56 +01:00
slip Revert "slip: make slhc_remember() more robust against malicious packets" 2024-11-24 00:22:55 +01:00
team
usb net: usb: qmi_wwan: add Quectel RG650V 2024-12-17 13:23:58 +01:00
vmxnet3
vxlan
wan
wimax
wireguard
wireless wifi: mwifiex: Fix memcpy() field-spanning write warning in mwifiex_config_scan() 2024-12-17 13:24:05 +01:00
xen-netback Revert "net/xen-netback: prevent UAF in xenvif_flush_hash()" 2024-11-24 00:23:10 +01:00
bareudp.c Revert "bareudp: Fix device stats updates." 2024-11-24 00:23:41 +01:00
dummy.c
eql.c
geneve.c Revert "gro: remove rcu_read_lock/rcu_read_unlock from gro_receive handlers" 2024-11-24 00:23:41 +01:00
gtp.c Revert "gtp: fix a potential NULL pointer dereference" 2024-11-24 00:23:49 +01:00
ifb.c
Kconfig
LICENSE.SRC
loopback.c
macsec.c
macvlan.c
macvtap.c
Makefile
mdio.c
mii.c
net_failover.c
netconsole.c
nlmon.c
ntb_netdev.c
rionet.c
sb1000.c
Space.c
sungem_phy.c
tap.c
thunderbolt.c
tun.c
veth.c
virtio_net.c Revert "virtio_net: Fix napi_skb_cache_put warning" 2024-11-24 00:23:46 +01:00
vrf.c Revert "net: vrf: determine the dst using the original ifindex for multicast" 2024-11-24 00:22:54 +01:00
vsockmon.c
xen-netfront.c