intersil: Use struct_group() for memcpy() region

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memcpy(), memmove(), and memset(), avoid
intentionally writing across neighboring fields.

Use struct_group() in struct hfa384x_tx_frame around members
frame_control, duration_id, addr1, addr2, addr3, and seq_ctrl, so they
can be referenced together. This will allow memcpy() and sizeof() to
more easily reason about sizes, improve readability, and avoid future
warnings about writing beyond the end of frame_control.

"pahole" shows no size nor member offset changes to struct
hfa384x_tx_frame. "objdump -d" shows no object code changes.

Signed-off-by: Kees Cook <keescook@chromium.org>
Signed-off-by: Kalle Valo <kvalo@codeaurora.org>
Link: https://lore.kernel.org/r/20211119004646.2347920-1-keescook@chromium.org

diff --git a/drivers/net/wireless/intersil/hostap/hostap_hw.c b/drivers/net/wireless/intersil/hostap/hostap_hw.c
index e459e7192ae9695f6e6ae6acbdea99f440825e60..b74f4cb5d6d3991a9165f6eefd670969bcee372a 100644 (file)
--- a/drivers/net/wireless/intersil/hostap/hostap_hw.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_hw.c
@@ -1815,8 +1815,9 @@ static int prism2_tx_80211(struct sk_buff *skb, struct net_device *dev)
        memset(&txdesc, 0, sizeof(txdesc));
 
        /* skb->data starts with txdesc->frame_control */
-       hdr_len = 24;
-       skb_copy_from_linear_data(skb, &txdesc.frame_control, hdr_len);
+       hdr_len = sizeof(txdesc.header);
+       BUILD_BUG_ON(hdr_len != 24);
+       skb_copy_from_linear_data(skb, &txdesc.header, hdr_len);
        if (ieee80211_is_data(txdesc.frame_control) &&
            ieee80211_has_a4(txdesc.frame_control) &&
            skb->len >= 30) {

diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
index dd2603d9b5d37de161d95af2f6eaf0e021cbc56f..c25cd21d18bd9f7273180984b28b0dc13221942a 100644 (file)
--- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h
+++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
@@ -115,12 +115,14 @@ struct hfa384x_tx_frame {
        __le16 tx_control; /* HFA384X_TX_CTRL_ flags */
 
        /* 802.11 */
-       __le16 frame_control; /* parts not used */
-       __le16 duration_id;
-       u8 addr1[ETH_ALEN];
-       u8 addr2[ETH_ALEN]; /* filled by firmware */
-       u8 addr3[ETH_ALEN];
-       __le16 seq_ctrl; /* filled by firmware */
+       struct_group(header,
+               __le16 frame_control; /* parts not used */
+               __le16 duration_id;
+               u8 addr1[ETH_ALEN];
+               u8 addr2[ETH_ALEN]; /* filled by firmware */
+               u8 addr3[ETH_ALEN];
+               __le16 seq_ctrl; /* filled by firmware */
+       );
        u8 addr4[ETH_ALEN];
        __le16 data_len;