cfg80211: fix callback type mismatches in wext-compat
authorSami Tolvanen <samitolvanen@google.com>
Tue, 17 Nov 2020 20:59:02 +0000 (12:59 -0800)
committerJohannes Berg <johannes.berg@intel.com>
Fri, 11 Dec 2020 11:50:27 +0000 (12:50 +0100)
Instead of casting callback functions to type iw_handler, which trips
indirect call checking with Clang's Control-Flow Integrity (CFI), add
stub functions with the correct function type for the callbacks.

Reported-by: Sedat Dilek <sedat.dilek@gmail.com>
Signed-off-by: Sami Tolvanen <samitolvanen@google.com>
Reviewed-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20201117205902.405316-1-samitolvanen@google.com
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
net/wireless/wext-compat.c

index b84a345b2653b63310175d51b758490531a3d92c..fd9ad74972fb0041b9aa912dbc7fd2df9d2b7da0 100644 (file)
@@ -1421,39 +1421,78 @@ static int cfg80211_wext_siwpmksa(struct net_device *dev,
        }
 }
 
+#define DEFINE_WEXT_COMPAT_STUB(func, type)                    \
+       static int __ ## func(struct net_device *dev,           \
+                             struct iw_request_info *info,     \
+                             union iwreq_data *wrqu,           \
+                             char *extra)                      \
+       {                                                       \
+               return func(dev, info, (type *)wrqu, extra);    \
+       }
+
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwname, char)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwfreq, struct iw_freq)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwfreq, struct iw_freq)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwmode, u32)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwmode, u32)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwrange, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwap, struct sockaddr)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwap, struct sockaddr)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwmlme, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwscan, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwessid, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwessid, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwrate, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwrate, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwrts, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwrts, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwfrag, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwfrag, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwretry, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwretry, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwencode, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwencode, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwpower, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwpower, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwgenie, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_giwauth, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwauth, struct iw_param)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwencodeext, struct iw_point)
+DEFINE_WEXT_COMPAT_STUB(cfg80211_wext_siwpmksa, struct iw_point)
+
 static const iw_handler cfg80211_handlers[] = {
-       [IW_IOCTL_IDX(SIOCGIWNAME)]     = (iw_handler) cfg80211_wext_giwname,
-       [IW_IOCTL_IDX(SIOCSIWFREQ)]     = (iw_handler) cfg80211_wext_siwfreq,
-       [IW_IOCTL_IDX(SIOCGIWFREQ)]     = (iw_handler) cfg80211_wext_giwfreq,
-       [IW_IOCTL_IDX(SIOCSIWMODE)]     = (iw_handler) cfg80211_wext_siwmode,
-       [IW_IOCTL_IDX(SIOCGIWMODE)]     = (iw_handler) cfg80211_wext_giwmode,
-       [IW_IOCTL_IDX(SIOCGIWRANGE)]    = (iw_handler) cfg80211_wext_giwrange,
-       [IW_IOCTL_IDX(SIOCSIWAP)]       = (iw_handler) cfg80211_wext_siwap,
-       [IW_IOCTL_IDX(SIOCGIWAP)]       = (iw_handler) cfg80211_wext_giwap,
-       [IW_IOCTL_IDX(SIOCSIWMLME)]     = (iw_handler) cfg80211_wext_siwmlme,
-       [IW_IOCTL_IDX(SIOCSIWSCAN)]     = (iw_handler) cfg80211_wext_siwscan,
-       [IW_IOCTL_IDX(SIOCGIWSCAN)]     = (iw_handler) cfg80211_wext_giwscan,
-       [IW_IOCTL_IDX(SIOCSIWESSID)]    = (iw_handler) cfg80211_wext_siwessid,
-       [IW_IOCTL_IDX(SIOCGIWESSID)]    = (iw_handler) cfg80211_wext_giwessid,
-       [IW_IOCTL_IDX(SIOCSIWRATE)]     = (iw_handler) cfg80211_wext_siwrate,
-       [IW_IOCTL_IDX(SIOCGIWRATE)]     = (iw_handler) cfg80211_wext_giwrate,
-       [IW_IOCTL_IDX(SIOCSIWRTS)]      = (iw_handler) cfg80211_wext_siwrts,
-       [IW_IOCTL_IDX(SIOCGIWRTS)]      = (iw_handler) cfg80211_wext_giwrts,
-       [IW_IOCTL_IDX(SIOCSIWFRAG)]     = (iw_handler) cfg80211_wext_siwfrag,
-       [IW_IOCTL_IDX(SIOCGIWFRAG)]     = (iw_handler) cfg80211_wext_giwfrag,
-       [IW_IOCTL_IDX(SIOCSIWTXPOW)]    = (iw_handler) cfg80211_wext_siwtxpower,
-       [IW_IOCTL_IDX(SIOCGIWTXPOW)]    = (iw_handler) cfg80211_wext_giwtxpower,
-       [IW_IOCTL_IDX(SIOCSIWRETRY)]    = (iw_handler) cfg80211_wext_siwretry,
-       [IW_IOCTL_IDX(SIOCGIWRETRY)]    = (iw_handler) cfg80211_wext_giwretry,
-       [IW_IOCTL_IDX(SIOCSIWENCODE)]   = (iw_handler) cfg80211_wext_siwencode,
-       [IW_IOCTL_IDX(SIOCGIWENCODE)]   = (iw_handler) cfg80211_wext_giwencode,
-       [IW_IOCTL_IDX(SIOCSIWPOWER)]    = (iw_handler) cfg80211_wext_siwpower,
-       [IW_IOCTL_IDX(SIOCGIWPOWER)]    = (iw_handler) cfg80211_wext_giwpower,
-       [IW_IOCTL_IDX(SIOCSIWGENIE)]    = (iw_handler) cfg80211_wext_siwgenie,
-       [IW_IOCTL_IDX(SIOCSIWAUTH)]     = (iw_handler) cfg80211_wext_siwauth,
-       [IW_IOCTL_IDX(SIOCGIWAUTH)]     = (iw_handler) cfg80211_wext_giwauth,
-       [IW_IOCTL_IDX(SIOCSIWENCODEEXT)]= (iw_handler) cfg80211_wext_siwencodeext,
-       [IW_IOCTL_IDX(SIOCSIWPMKSA)]    = (iw_handler) cfg80211_wext_siwpmksa,
+       [IW_IOCTL_IDX(SIOCGIWNAME)]     = __cfg80211_wext_giwname,
+       [IW_IOCTL_IDX(SIOCSIWFREQ)]     = __cfg80211_wext_siwfreq,
+       [IW_IOCTL_IDX(SIOCGIWFREQ)]     = __cfg80211_wext_giwfreq,
+       [IW_IOCTL_IDX(SIOCSIWMODE)]     = __cfg80211_wext_siwmode,
+       [IW_IOCTL_IDX(SIOCGIWMODE)]     = __cfg80211_wext_giwmode,
+       [IW_IOCTL_IDX(SIOCGIWRANGE)]    = __cfg80211_wext_giwrange,
+       [IW_IOCTL_IDX(SIOCSIWAP)]       = __cfg80211_wext_siwap,
+       [IW_IOCTL_IDX(SIOCGIWAP)]       = __cfg80211_wext_giwap,
+       [IW_IOCTL_IDX(SIOCSIWMLME)]     = __cfg80211_wext_siwmlme,
+       [IW_IOCTL_IDX(SIOCSIWSCAN)]     = cfg80211_wext_siwscan,
+       [IW_IOCTL_IDX(SIOCGIWSCAN)]     = __cfg80211_wext_giwscan,
+       [IW_IOCTL_IDX(SIOCSIWESSID)]    = __cfg80211_wext_siwessid,
+       [IW_IOCTL_IDX(SIOCGIWESSID)]    = __cfg80211_wext_giwessid,
+       [IW_IOCTL_IDX(SIOCSIWRATE)]     = __cfg80211_wext_siwrate,
+       [IW_IOCTL_IDX(SIOCGIWRATE)]     = __cfg80211_wext_giwrate,
+       [IW_IOCTL_IDX(SIOCSIWRTS)]      = __cfg80211_wext_siwrts,
+       [IW_IOCTL_IDX(SIOCGIWRTS)]      = __cfg80211_wext_giwrts,
+       [IW_IOCTL_IDX(SIOCSIWFRAG)]     = __cfg80211_wext_siwfrag,
+       [IW_IOCTL_IDX(SIOCGIWFRAG)]     = __cfg80211_wext_giwfrag,
+       [IW_IOCTL_IDX(SIOCSIWTXPOW)]    = cfg80211_wext_siwtxpower,
+       [IW_IOCTL_IDX(SIOCGIWTXPOW)]    = cfg80211_wext_giwtxpower,
+       [IW_IOCTL_IDX(SIOCSIWRETRY)]    = __cfg80211_wext_siwretry,
+       [IW_IOCTL_IDX(SIOCGIWRETRY)]    = __cfg80211_wext_giwretry,
+       [IW_IOCTL_IDX(SIOCSIWENCODE)]   = __cfg80211_wext_siwencode,
+       [IW_IOCTL_IDX(SIOCGIWENCODE)]   = __cfg80211_wext_giwencode,
+       [IW_IOCTL_IDX(SIOCSIWPOWER)]    = __cfg80211_wext_siwpower,
+       [IW_IOCTL_IDX(SIOCGIWPOWER)]    = __cfg80211_wext_giwpower,
+       [IW_IOCTL_IDX(SIOCSIWGENIE)]    = __cfg80211_wext_siwgenie,
+       [IW_IOCTL_IDX(SIOCSIWAUTH)]     = __cfg80211_wext_siwauth,
+       [IW_IOCTL_IDX(SIOCGIWAUTH)]     = __cfg80211_wext_giwauth,
+       [IW_IOCTL_IDX(SIOCSIWENCODEEXT)]= __cfg80211_wext_siwencodeext,
+       [IW_IOCTL_IDX(SIOCSIWPMKSA)]    = __cfg80211_wext_siwpmksa,
 };
 
 const struct iw_handler_def cfg80211_wext_handler = {