[PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Georgi Valkov]

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Replace affected uses of sizeof(member) with sizeof(type).
- Replace unions containing one-element arrays with
  u8 flexible arrays, and document the stored parameter-set type.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
 drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
 drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
 .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
 3 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..ec3e3f806134 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
 
 struct mwifiex_ie_types_chan_band_list_param_set {
 	struct mwifiex_ie_types_header header;
-	struct chan_band_param_set chan_band_param[1];
+	struct chan_band_param_set chan_band_param[];
 } __packed;
 
 struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
 	struct mwifiex_ie_types_header header;
-	u8 tsf_data[1];
+	u8 tsf_data[];
 } __packed;
 
 struct mwifiex_cf_param_set {
@@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
 
 struct mwifiex_ie_types_ss_param_set {
 	struct mwifiex_ie_types_header header;
-	union {
-		struct mwifiex_cf_param_set cf_param_set[1];
-		struct mwifiex_ibss_param_set ibss_param_set[1];
-	} cf_ibss;
+	u8 cf_ibss[];	/* CF and IBSS param sets are stored here */
 } __packed;
 
 struct mwifiex_fh_param_set {
@@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
 
 struct mwifiex_ie_types_phy_param_set {
 	struct mwifiex_ie_types_header header;
-	union {
-		struct mwifiex_fh_param_set fh_param_set[1];
-		struct mwifiex_ds_param_set ds_param_set[1];
-	} fh_ds;
+	u8 fh_ds[];	/* FH and DS param sets are stored here */
 } __packed;
 
 struct mwifiex_ie_types_auth_type {
@@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
 	__le16 query_type;
 	__le16 oid;
 	__le16 buf_size;
-	u8 value[1];
+	u8 value[];
 } __packed;
 
 struct mwifiex_rate_scope {
@@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
 	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
 	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
 	 */
-	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
+	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
 				   here */
 } __packed;
 
@@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
 	struct mwifiex_ie_types_header header;
 	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
-	struct ieee80211_country_ie_triplet triplet[1];
+	struct ieee80211_country_ie_triplet triplet[];
 } __packed;
 
 struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a2c427e6af3f 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
 
 	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
 	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
-	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
-	memcpy(&phy_tlv->fh_ds.ds_param_set,
+	phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));
+	memcpy(phy_tlv->fh_ds,
 	       &bss_desc->phy_param_set.ds_param_set.current_chan,
-	       sizeof(phy_tlv->fh_ds.ds_param_set));
+	       sizeof(struct mwifiex_ds_param_set));
 	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
 
 	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
 	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
-	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+	ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
 	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
 
 	/* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
 		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
 	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
-				- 1 + S_DS_GEN);
+				+ S_DS_GEN);
 
 	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
 	if (cmd_action == HostCmd_ACT_GEN_GET) {
-- 
2.55.0

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Replace affected uses of sizeof(member) with sizeof(type).
> - Replace unions containing one-element arrays with
>   u8 flexible arrays, and document the stored parameter-set type.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Kees Cook]

On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Replace affected uses of sizeof(member) with sizeof(type).
> - Replace unions containing one-element arrays with
>   u8 flexible arrays, and document the stored parameter-set type.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> ---
>  drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
>  drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
>  .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
>  3 files changed, 12 insertions(+), 18 deletions(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
> index e9e896606912..ec3e3f806134 100644
> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
> @@ -823,7 +823,7 @@ struct chan_band_param_set {
>  
>  struct mwifiex_ie_types_chan_band_list_param_set {
>  	struct mwifiex_ie_types_header header;
> -	struct chan_band_param_set chan_band_param[1];
> +	struct chan_band_param_set chan_band_param[];
>  } __packed;
>  
>  struct mwifiex_ie_types_rates_param_set {
> @@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
>  #define TSF_DATA_SIZE            8
>  struct mwifiex_ie_types_tsf_timestamp {
>  	struct mwifiex_ie_types_header header;
> -	u8 tsf_data[1];
> +	u8 tsf_data[];
>  } __packed;
>  
>  struct mwifiex_cf_param_set {
> @@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
>  
>  struct mwifiex_ie_types_ss_param_set {
>  	struct mwifiex_ie_types_header header;
> -	union {
> -		struct mwifiex_cf_param_set cf_param_set[1];
> -		struct mwifiex_ibss_param_set ibss_param_set[1];
> -	} cf_ibss;
> +	u8 cf_ibss[];	/* CF and IBSS param sets are stored here */
>  } __packed;
>  
>  struct mwifiex_fh_param_set {
> @@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
>  
>  struct mwifiex_ie_types_phy_param_set {
>  	struct mwifiex_ie_types_header header;
> -	union {
> -		struct mwifiex_fh_param_set fh_param_set[1];
> -		struct mwifiex_ds_param_set ds_param_set[1];
> -	} fh_ds;
> +	u8 fh_ds[];	/* FH and DS param sets are stored here */
>  } __packed;

This (and below) can still be a union so you don't lose the type
information:

	union {
		DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
		DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
	} fh_ds;

>  
>  struct mwifiex_ie_types_auth_type {
> @@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
>  	__le16 query_type;
>  	__le16 oid;
>  	__le16 buf_size;
> -	u8 value[1];
> +	u8 value[];
>  } __packed;
>  
>  struct mwifiex_rate_scope {
> @@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
>  	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
>  	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
>  	 */
> -	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
> +	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
>  				   here */
>  } __packed;
>  
> @@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
>  struct mwifiex_ietypes_domain_param_set {
>  	struct mwifiex_ie_types_header header;
>  	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
> -	struct ieee80211_country_ie_triplet triplet[1];
> +	struct ieee80211_country_ie_triplet triplet[];
>  } __packed;
>  
>  struct host_cmd_ds_802_11d_domain_info {
> diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
> index 5a1a0287c1d5..a2c427e6af3f 100644
> --- a/drivers/net/wireless/marvell/mwifiex/join.c
> +++ b/drivers/net/wireless/marvell/mwifiex/join.c
> @@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
>  
>  	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
>  	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
> -	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
> -	memcpy(&phy_tlv->fh_ds.ds_param_set,
> +	phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));

And this would become (the "*" added to get the member size):

	phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));

etc.

> +	memcpy(phy_tlv->fh_ds,
>  	       &bss_desc->phy_param_set.ds_param_set.current_chan,
> -	       sizeof(phy_tlv->fh_ds.ds_param_set));
> +	       sizeof(struct mwifiex_ds_param_set));
>  	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
>  
>  	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
>  	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
> -	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
> +	ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
>  	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
>  
>  	/* Get the common rates supported between the driver and the BSS Desc */
> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> index 623ddde8c8e5..071f7cb305e1 100644
> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> @@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
>  		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
>  	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
>  	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
> -				- 1 + S_DS_GEN);
> +				+ S_DS_GEN);
>  
>  	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
>  	if (cmd_action == HostCmd_ACT_GEN_GET) {
> -- 
> 2.55.0
> 

-- 
Kees Cook

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

Thank you for your help!
Please backport to 6.18 and 6.12, which are used by OpenWrt.

v2:
- restore the unions and use DECLARE_FLEX_ARRAY
  for the flexible arrays inside
- restore use of sizeof(*member) instead of sizeof(struct)


From 654af1e2be5e0d2269a108f050dfbcbf1ad79262 Mon Sep 17 00:00:00 2001
From: Georgi Valkov <gvalkov@gmail.com>
Date: Thu, 16 Jul 2026 12:28:00 +0300
Subject: [PATCH v2] wifi: mwifiex: replace one-element arrays with flexible array
 members

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY for structs inside affected unions.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
 drivers/net/wireless/marvell/mwifiex/fw.h      | 18 +++++++++---------
 drivers/net/wireless/marvell/mwifiex/join.c    |  8 ++++----
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c |  2 +-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..93561116959a 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
   struct mwifiex_ie_types_chan_band_list_param_set {
  struct mwifiex_ie_types_header header;
- struct chan_band_param_set chan_band_param[1];
+ struct chan_band_param_set chan_band_param[];
 } __packed;
   struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
  struct mwifiex_ie_types_header header;
- u8 tsf_data[1];
+ u8 tsf_data[];
 } __packed;
   struct mwifiex_cf_param_set {
@@ -903,8 +903,8 @@ struct mwifiex_ibss_param_set {
 struct mwifiex_ie_types_ss_param_set {
  struct mwifiex_ie_types_header header;
  union {
- struct mwifiex_cf_param_set cf_param_set[1];
- struct mwifiex_ibss_param_set ibss_param_set[1];
+ DECLARE_FLEX_ARRAY(struct mwifiex_cf_param_set, cf_param_set);
+ DECLARE_FLEX_ARRAY(struct mwifiex_ibss_param_set, ibss_param_set);
  } cf_ibss;
 } __packed;
  @@ -922,8 +922,8 @@ struct mwifiex_ds_param_set {
 struct mwifiex_ie_types_phy_param_set {
  struct mwifiex_ie_types_header header;
  union {
- struct mwifiex_fh_param_set fh_param_set[1];
- struct mwifiex_ds_param_set ds_param_set[1];
+ DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
+ DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
  } fh_ds;
 } __packed;
  @@ -1383,7 +1383,7 @@ struct host_cmd_ds_802_11_snmp_mib {
  __le16 query_type;
  __le16 oid;
  __le16 buf_size;
- u8 value[1];
+ u8 value[];
 } __packed;
   struct mwifiex_rate_scope {
@@ -1551,7 +1551,7 @@ struct mwifiex_scan_cmd_config {
  *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
  *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
  */
- u8 tlv_buf[1]; /* SSID TLV(s) and ChanList TLVs are stored
+ u8 tlv_buf[]; /* SSID TLV(s) and ChanList TLVs are stored
    here */
 } __packed;
  @@ -1683,7 +1683,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
  struct mwifiex_ie_types_header header;
  u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
- struct ieee80211_country_ie_triplet triplet[1];
+ struct ieee80211_country_ie_triplet triplet[];
 } __packed;
   struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a83f4d081fe2 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
    phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
  phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
- phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
- memcpy(&phy_tlv->fh_ds.ds_param_set,
+ phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
+ memcpy(phy_tlv->fh_ds.ds_param_set,
        &bss_desc->phy_param_set.ds_param_set.current_chan,
-       sizeof(phy_tlv->fh_ds.ds_param_set));
+       sizeof(*phy_tlv->fh_ds.ds_param_set));
  pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
    ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
  ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
- ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+ ss_tlv->header.len = cpu_to_le16(sizeof(*ss_tlv->cf_ibss.cf_param_set));
  pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
    /* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
      "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
  cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
  cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
- - 1 + S_DS_GEN);
+ + S_DS_GEN);
    snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
  if (cmd_action == HostCmd_ACT_GEN_GET) {
--  2.55.0



> On 15 Jul 2026, at 7:35 PM, Kees Cook <kees@kernel.org> wrote:
> 
> On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
>> Replace deprecated one-element arrays with flexible array members.
>> CONFIG_FORTIFY_SOURCE reports the following warning when
>> one-element arrays are used as variable-length buffers:
>> 
>> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
>> memcpy: detected field-spanning write (size 84) of single field
>> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
>> 
>> Convert affected structs to use flexible array members.
>> - Preserve existing wire layouts.
>> - Replace affected uses of sizeof(member) with sizeof(type).
>> - Replace unions containing one-element arrays with
>>  u8 flexible arrays, and document the stored parameter-set type.
>> 
>> Tested-on: WRT3200ACM, OpenWrt
>> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
>> ---
>> drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
>> drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
>> .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
>> 3 files changed, 12 insertions(+), 18 deletions(-)
>> 
>> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
>> index e9e896606912..ec3e3f806134 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
>> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
>> @@ -823,7 +823,7 @@ struct chan_band_param_set {
>> 
>> struct mwifiex_ie_types_chan_band_list_param_set {
>> struct mwifiex_ie_types_header header;
>> - struct chan_band_param_set chan_band_param[1];
>> + struct chan_band_param_set chan_band_param[];
>> } __packed;
>> 
>> struct mwifiex_ie_types_rates_param_set {
>> @@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
>> #define TSF_DATA_SIZE            8
>> struct mwifiex_ie_types_tsf_timestamp {
>> struct mwifiex_ie_types_header header;
>> - u8 tsf_data[1];
>> + u8 tsf_data[];
>> } __packed;
>> 
>> struct mwifiex_cf_param_set {
>> @@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
>> 
>> struct mwifiex_ie_types_ss_param_set {
>> struct mwifiex_ie_types_header header;
>> - union {
>> - struct mwifiex_cf_param_set cf_param_set[1];
>> - struct mwifiex_ibss_param_set ibss_param_set[1];
>> - } cf_ibss;
>> + u8 cf_ibss[]; /* CF and IBSS param sets are stored here */
>> } __packed;
>> 
>> struct mwifiex_fh_param_set {
>> @@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
>> 
>> struct mwifiex_ie_types_phy_param_set {
>> struct mwifiex_ie_types_header header;
>> - union {
>> - struct mwifiex_fh_param_set fh_param_set[1];
>> - struct mwifiex_ds_param_set ds_param_set[1];
>> - } fh_ds;
>> + u8 fh_ds[]; /* FH and DS param sets are stored here */
>> } __packed;
> 
> This (and below) can still be a union so you don't lose the type
> information:
> 
> union {
> DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
> DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
> } fh_ds;
> 
>> 
>> struct mwifiex_ie_types_auth_type {
>> @@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
>> __le16 query_type;
>> __le16 oid;
>> __le16 buf_size;
>> - u8 value[1];
>> + u8 value[];
>> } __packed;
>> 
>> struct mwifiex_rate_scope {
>> @@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
>>  *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
>>  *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
>>  */
>> - u8 tlv_buf[1]; /* SSID TLV(s) and ChanList TLVs are stored
>> + u8 tlv_buf[]; /* SSID TLV(s) and ChanList TLVs are stored
>>    here */
>> } __packed;
>> 
>> @@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
>> struct mwifiex_ietypes_domain_param_set {
>> struct mwifiex_ie_types_header header;
>> u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
>> - struct ieee80211_country_ie_triplet triplet[1];
>> + struct ieee80211_country_ie_triplet triplet[];
>> } __packed;
>> 
>> struct host_cmd_ds_802_11d_domain_info {
>> diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
>> index 5a1a0287c1d5..a2c427e6af3f 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/join.c
>> +++ b/drivers/net/wireless/marvell/mwifiex/join.c
>> @@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
>> 
>> phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
>> phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
>> - phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
>> - memcpy(&phy_tlv->fh_ds.ds_param_set,
>> + phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));
> 
> And this would become (the "*" added to get the member size):
> 
> phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
> 
> etc.
> 
>> + memcpy(phy_tlv->fh_ds,
>>        &bss_desc->phy_param_set.ds_param_set.current_chan,
>> -        sizeof(phy_tlv->fh_ds.ds_param_set));
>> +        sizeof(struct mwifiex_ds_param_set));
>> pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
>> 
>> ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
>> ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
>> - ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
>> + ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
>> pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
>> 
>> /* Get the common rates supported between the driver and the BSS Desc */
>> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> index 623ddde8c8e5..071f7cb305e1 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> @@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
>>     "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
>> cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
>> cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
>> - - 1 + S_DS_GEN);
>> + + S_DS_GEN);
>> 
>> snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
>> if (cmd_action == HostCmd_ACT_GEN_GET) {
>> -- 
>> 2.55.0
>> 
> 
> -- 
> Kees Cook

[PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Georgi Valkov]

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY() for structs inside affected unions.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
Thank you for your help!
Please backport to 6.18 and 6.12, which are used by OpenWrt.

v3:
- resend, please ignore v2 (corrupted by mail client)

v2:
- restore the unions and use DECLARE_FLEX_ARRAY
  for the flexible arrays inside
- restore use of sizeof(*member) instead of sizeof(struct)

 drivers/net/wireless/marvell/mwifiex/fw.h      | 18 +++++++++---------
 drivers/net/wireless/marvell/mwifiex/join.c    |  8 ++++----
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c |  2 +-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..93561116959a 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
 
 struct mwifiex_ie_types_chan_band_list_param_set {
 	struct mwifiex_ie_types_header header;
-	struct chan_band_param_set chan_band_param[1];
+	struct chan_band_param_set chan_band_param[];
 } __packed;
 
 struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
 	struct mwifiex_ie_types_header header;
-	u8 tsf_data[1];
+	u8 tsf_data[];
 } __packed;
 
 struct mwifiex_cf_param_set {
@@ -903,8 +903,8 @@ struct mwifiex_ibss_param_set {
 struct mwifiex_ie_types_ss_param_set {
 	struct mwifiex_ie_types_header header;
 	union {
-		struct mwifiex_cf_param_set cf_param_set[1];
-		struct mwifiex_ibss_param_set ibss_param_set[1];
+		DECLARE_FLEX_ARRAY(struct mwifiex_cf_param_set, cf_param_set);
+		DECLARE_FLEX_ARRAY(struct mwifiex_ibss_param_set, ibss_param_set);
 	} cf_ibss;
 } __packed;
 
@@ -922,8 +922,8 @@ struct mwifiex_ds_param_set {
 struct mwifiex_ie_types_phy_param_set {
 	struct mwifiex_ie_types_header header;
 	union {
-		struct mwifiex_fh_param_set fh_param_set[1];
-		struct mwifiex_ds_param_set ds_param_set[1];
+		DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
+		DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
 	} fh_ds;
 } __packed;
 
@@ -1383,7 +1383,7 @@ struct host_cmd_ds_802_11_snmp_mib {
 	__le16 query_type;
 	__le16 oid;
 	__le16 buf_size;
-	u8 value[1];
+	u8 value[];
 } __packed;
 
 struct mwifiex_rate_scope {
@@ -1551,7 +1551,7 @@ struct mwifiex_scan_cmd_config {
 	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
 	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
 	 */
-	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
+	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
 				   here */
 } __packed;
 
@@ -1683,7 +1683,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
 	struct mwifiex_ie_types_header header;
 	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
-	struct ieee80211_country_ie_triplet triplet[1];
+	struct ieee80211_country_ie_triplet triplet[];
 } __packed;
 
 struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a83f4d081fe2 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
 
 	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
 	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
-	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
-	memcpy(&phy_tlv->fh_ds.ds_param_set,
+	phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
+	memcpy(phy_tlv->fh_ds.ds_param_set,
 	       &bss_desc->phy_param_set.ds_param_set.current_chan,
-	       sizeof(phy_tlv->fh_ds.ds_param_set));
+	       sizeof(*phy_tlv->fh_ds.ds_param_set));
 	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
 
 	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
 	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
-	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+	ss_tlv->header.len = cpu_to_le16(sizeof(*ss_tlv->cf_ibss.cf_param_set));
 	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
 
 	/* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
 		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
 	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
-				- 1 + S_DS_GEN);
+				+ S_DS_GEN);
 
 	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
 	if (cmd_action == HostCmd_ACT_GEN_GET) {
-- 
2.55.0

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Cc: stable@vger.kernel.org # 6.12+
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Dan Carpenter]

On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > Replace deprecated one-element arrays with flexible array members.
> > CONFIG_FORTIFY_SOURCE reports the following warning when
> > one-element arrays are used as variable-length buffers:
> > 
> > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > memcpy: detected field-spanning write (size 84) of single field
> > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > 
> > Convert affected structs to use flexible array members.
> > - Preserve existing wire layouts.
> > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > 
> > Tested-on: WRT3200ACM, OpenWrt
> > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> 
> Cc: stable@vger.kernel.org # 6.12+
> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
warnings are still remaining?

regards,
dan carpenter

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > Replace deprecated one-element arrays with flexible array members.
> > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > one-element arrays are used as variable-length buffers:
> > > 
> > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > memcpy: detected field-spanning write (size 84) of single field
> > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > 
> > > Convert affected structs to use flexible array members.
> > > - Preserve existing wire layouts.
> > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > 
> > > Tested-on: WRT3200ACM, OpenWrt
> > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > 
> > Cc: stable@vger.kernel.org # 6.12+
> > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> 
> Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> warnings are still remaining?

Yes, you are right, my mistake.

Johannes, please be sure to not have the stable tag in once you apply the
patch.

Francesco

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Dan Carpenter]

On Thu, Jul 16, 2026 at 08:32:46AM +0200, Francesco Dolcini wrote:
> On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> > On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > > Replace deprecated one-element arrays with flexible array members.
> > > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > > one-element arrays are used as variable-length buffers:
> > > > 
> > > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > > memcpy: detected field-spanning write (size 84) of single field
> > > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > > 
> > > > Convert affected structs to use flexible array members.
> > > > - Preserve existing wire layouts.
> > > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > > 
> > > > Tested-on: WRT3200ACM, OpenWrt
> > > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > > 
> > > Cc: stable@vger.kernel.org # 6.12+
> > > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> > 
> > Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> > warnings are still remaining?
> 
> Yes, you are right, my mistake.
> 
> Johannes, please be sure to not have the stable tag in once you apply the
> patch.

Wait...  No no.  It was a serious question.  I guess these warnings
are pretty annoying for a real user on WRT so it's fine to CC stable.
I just assumed these warnings were more common still.

regards,
dan carpenter

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

On Thu, 16 Jul 2026 at 09:55, Dan Carpenter <error27@gmail.com> wrote:
>
> On Thu, Jul 16, 2026 at 08:32:46AM +0200, Francesco Dolcini wrote:
> > On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> > > On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > > > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > > > Replace deprecated one-element arrays with flexible array members.
> > > > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > > > one-element arrays are used as variable-length buffers:
> > > > >
> > > > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > > > memcpy: detected field-spanning write (size 84) of single field
> > > > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > > >
> > > > > Convert affected structs to use flexible array members.
> > > > > - Preserve existing wire layouts.
> > > > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > > >
> > > > > Tested-on: WRT3200ACM, OpenWrt
> > > > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > > >
> > > > Cc: stable@vger.kernel.org # 6.12+
> > > > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> > >
> > > Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> > > warnings are still remaining?
> >
> > Yes, you are right, my mistake.
> >
> > Johannes, please be sure to not have the stable tag in once you apply the
> > patch.
>
> Wait...  No no.  It was a serious question.  I guess these warnings
> are pretty annoying for a real user on WRT so it's fine to CC stable.
> I just assumed these warnings were more common still.

When I first saw it, I thought it was a kernel panic.
There was an unrelated bug before the warning. My other PR fixes it:
wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware

But after fixing the freeze, the warning remained.
Next I thought it was a driver crash. To confirm, I added:
mwifiex_dbg(ERROR) right before and after memcpy(),
and printed all values in both source and destination:
- memcpy has copied all data to the destination
- execution is allowed to continue
- so it is just a scary warning

I wanted to ask both patches to be backported to stable, but
at the time I sent them, I did not know that I could insert
free text between the commit message and the patch.
I will reply to the other PR and ask them.

Full text of the warning fixed here:

[   90.484902] ------------[ cut here ]------------
[   90.489549] WARNING: CPU: 1 PID: 3059 at
backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
[   90.503877] memcpy: detected field-spanning write (size 84) of
single field "domain->triplet" at
backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
(size 3)
[   90.519602] Modules linked in: option cdc_mbim uvcvideo usb_wwan
rndis_host qmi_wwan nft_fib_inet nf_flow_table_inet ftdi_sio
ebtable_nat ebtable_filter ebtable_broute cdc_ncm cdc_ether xt_time
xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac
xt_limit xt_length xt_iprange xt_hl xt_fuzzy(O) xt_ecn xt_dscp
xt_conntrack xt_comment xt_TEE xt_TCPMSS xt_REDIRECT xt_MASQUERADE
xt_LOG xt_IPMARK(O) xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY
xt_DELUDE(O) xt_TARPIT(O) ipt_REJECT xt_tcpudp xt_CHAOS(O)
videobuf2_v4l2 uvc usbserial usbnet ums_usbat ums_sddr55 ums_sddr09
ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress
ums_alauda rfcomm nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet
nft_reject_bridge nft_reject nft_redir nft_quota nft_numgen nft_nat
nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_flow_offload
nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_compat nft_chain_nat
nf_tables nf_reject_ipv4 nf_log_syslog nf_flow_table nf_dup_ipv6
nf_dup_ipv4 nf_conntrack_bridge
[   90.519758]  mwifiex_sdio(O) mwifiex(O) libcrc32c iptable_nat
iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hidp ebtables
ebt_vlan ebt_stp ebt_snat ebt_redirect ebt_pkttype ebt_mark_m ebt_mark
ebt_limit ebt_ip6 ebt_ip ebt_dnat ebt_arpreply ebt_arp ebt_among
ebt_802_3 cdc_wdm cdc_acm btmrvl_sdio btmrvl bnep bluetooth
arptable_filter arpt_mangle arp_tables fuse ntfs3 videobuf2_vmalloc
videobuf2_memops videobuf2_common hid videodev mc evdev input_core
mwlwifi(O) mac80211(O) cfg80211(O) compat(O) cryptodev(O) xt_set
ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport
ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net
ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip
ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip
ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set
nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6
nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh
ip6t_frag ip6t_eui64 ip6t_ah ip6table_mangle ip6table_filter
ip6_tables
[   90.609354]  ip6t_REJECT x_tables nf_reject_ipv6 msdos tun nls_utf8
nls_iso8859_2 nls_iso8859_15 nls_iso8859_13 nls_iso8859_1 nls_cp866
nls_cp437 nls_cp1251 dma_shared_buffer ecdh_generic ecc crypto_user
algif_skcipher algif_rng algif_hash algif_aead af_alg sha512_generic
sha256_generic seqiv sha3_generic jitterentropy_rng drbg kpp hmac
ghash_arm_ce geniv rng cmac uas gpio_button_hotplug(O) vfat fat exfat
mii
[   90.736063] CPU: 1 UID: 101 PID: 3059 Comm: hostapd Tainted: G
     O       6.12.92 #0
[   90.736073] Tainted: [O]=OOT_MODULE
[   90.736074] Hardware name: Marvell Armada 380/385 (Device Tree)
[   90.736077] Call trace:
[   90.736082]  unwind_backtrace from show_stack+0x10/0x14
[   90.736094]  show_stack from dump_stack_lvl+0x50/0x64
[   90.736105]  dump_stack_lvl from __warn+0x7c/0xd4
[   90.736116]  __warn from warn_slowpath_fmt+0xf8/0x15c
[   90.736124]  warn_slowpath_fmt from
mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
[   90.736217]  mwifiex_sta_prepare_cmd [mwifiex] from
mwifiex_send_cmd+0x2f4/0x410 [mwifiex]
[   90.736286]  mwifiex_send_cmd [mwifiex] from
mwifiex_send_domain_info_cmd_fw+0x150/0x1b4 [mwifiex]
[   90.736351]  mwifiex_send_domain_info_cmd_fw [mwifiex] from
mwifiex_uap_set_channel+0x100/0x150 [mwifiex]
[   90.736416]  mwifiex_uap_set_channel [mwifiex] from
mwifiex_cfg80211_start_ap+0x12c/0x39c [mwifiex]
[   90.736480]  mwifiex_cfg80211_start_ap [mwifiex] from
nl80211_start_ap+0xa24/0x1048 [cfg80211]
[   90.736607]  nl80211_start_ap [cfg80211] from genl_rcv_msg+0x260/0x3a8
[   90.736670]  genl_rcv_msg from netlink_rcv_skb+0xb8/0x11c
[   90.736681]  netlink_rcv_skb from genl_rcv+0x28/0x34
[   90.736690]  genl_rcv from netlink_unicast+0x22c/0x330
[   90.736698]  netlink_unicast from netlink_sendmsg+0x198/0x3d0
[   90.736707]  netlink_sendmsg from ____sys_sendmsg+0x1cc/0x260
[   90.736717]  ____sys_sendmsg from ___sys_sendmsg+0x6c/0xa4
[   90.736723]  ___sys_sendmsg from __sys_sendmsg+0x5c/0x94
[   90.736732]  __sys_sendmsg from ret_fast_syscall+0x0/0x4c
[   90.736738] Exception stack(0xc4181fa8 to 0xc4181ff0)
[   90.736743] 1fa0:                   00000000 00000000 0000001f
bed78be0 00000000 00000000
[   90.736748] 1fc0: 00000000 00000000 b69d6b90 00000128 00000004
00000001 bed78c34 b69c1cd0
[   90.736751] 1fe0: bed78b90 bed78b80 b6f7a848 b6f79b6c
[   90.736754] ---[ end trace 0000000000000000 ]---

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

> On 16 Jul 2026, at 9:27 AM, Dan Carpenter <error27@gmail.com> wrote:
> 
> On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
>> On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
>>> Replace deprecated one-element arrays with flexible array members.
>>> CONFIG_FORTIFY_SOURCE reports the following warning when
>>> one-element arrays are used as variable-length buffers:
>>> 
>>> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
>>> memcpy: detected field-spanning write (size 84) of single field
>>> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
>>> 
>>> Convert affected structs to use flexible array members.
>>> - Preserve existing wire layouts.
>>> - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
>>> 
>>> Tested-on: WRT3200ACM, OpenWrt
>>> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
>> 
>> Cc: stable@vger.kernel.org # 6.12+
>> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> 
> Are we CCing stable for this sort of thing?

Yes, please add stable if possible.
I am new to this process and still learning the rules.


> How many FORTIFY_SOURCE
> warnings are still remaining?

So far I have observed only the warning on sta_cmd.c:1033.
I made the rest of the changes as preventative measures,
because they are flexible arrays used in the same way.

Georgi Valkov