[PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Gustavo A. R. Silva]

Prepare for the coming implementation by GCC and Clang of the __counted_by
attribute. Flexible array members annotated with __counted_by can have
their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
functions).

While there, use struct_size() helper, instead of the open-coded
version, to calculate the size for the allocation of the whole
flexible structure, including of course, the flexible-array member.

This code was found with the help of Coccinelle, and audited and
fixed manually.

Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
---
 drivers/net/wireless/intersil/hostap/hostap_download.c | 3 +--
 drivers/net/wireless/intersil/hostap/hostap_wlan.h     | 2 +-
 2 files changed, 2 insertions(+), 3 deletions(-)

diff --git a/drivers/net/wireless/intersil/hostap/hostap_download.c b/drivers/net/wireless/intersil/hostap/hostap_download.c
index 3672291ced5c..5e5bada28b5b 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_download.c
+++ b/drivers/net/wireless/intersil/hostap/hostap_download.c
@@ -732,8 +732,7 @@ static int prism2_download(local_info_t *local,
 		goto out;
 	}
 
-	dl = kzalloc(sizeof(*dl) + param->num_areas *
-		     sizeof(struct prism2_download_data_area), GFP_KERNEL);
+	dl = kzalloc(struct_size(dl, data, param->num_areas), GFP_KERNEL);
 	if (dl == NULL) {
 		ret = -ENOMEM;
 		goto out;
diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
index c25cd21d18bd..f71c0545c0be 100644
--- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h
+++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
@@ -617,7 +617,7 @@ struct prism2_download_data {
 		u32 addr; /* wlan card address */
 		u32 len;
 		u8 *data; /* allocated data */
-	} data[];
+	} data[] __counted_by(num_areas);
 };
 
 
-- 
2.34.1

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Kees Cook]

On Mon, Oct 09, 2023 at 01:41:18PM -0600, Gustavo A. R. Silva wrote:
> Prepare for the coming implementation by GCC and Clang of the __counted_by
> attribute. Flexible array members annotated with __counted_by can have
> their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
> array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> functions).
> 
> While there, use struct_size() helper, instead of the open-coded
> version, to calculate the size for the allocation of the whole
> flexible structure, including of course, the flexible-array member.
> 
> This code was found with the help of Coccinelle, and audited and
> fixed manually.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> ---
>  drivers/net/wireless/intersil/hostap/hostap_download.c | 3 +--
>  drivers/net/wireless/intersil/hostap/hostap_wlan.h     | 2 +-
>  2 files changed, 2 insertions(+), 3 deletions(-)
> 
> diff --git a/drivers/net/wireless/intersil/hostap/hostap_download.c b/drivers/net/wireless/intersil/hostap/hostap_download.c
> index 3672291ced5c..5e5bada28b5b 100644
> --- a/drivers/net/wireless/intersil/hostap/hostap_download.c
> +++ b/drivers/net/wireless/intersil/hostap/hostap_download.c
> @@ -732,8 +732,7 @@ static int prism2_download(local_info_t *local,
>  		goto out;
>  	}
>  
> -	dl = kzalloc(sizeof(*dl) + param->num_areas *
> -		     sizeof(struct prism2_download_data_area), GFP_KERNEL);
> +	dl = kzalloc(struct_size(dl, data, param->num_areas), GFP_KERNEL);
>  	if (dl == NULL) {
>  		ret = -ENOMEM;
>  		goto out;
> diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> index c25cd21d18bd..f71c0545c0be 100644
> --- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> +++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> @@ -617,7 +617,7 @@ struct prism2_download_data {
>  		u32 addr; /* wlan card address */
>  		u32 len;
>  		u8 *data; /* allocated data */
> -	} data[];
> +	} data[] __counted_by(num_areas);
>  };

Should this be considered a v2 of:
https://lore.kernel.org/linux-hardening/94848cc3-6f5c-46d7-8cc7-98a4f10865b3@embeddedor.com/

?

Yours is more complete since it includes the struct_size() change...

-- 
Kees Cook

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Gustavo A. R. Silva]

On 10/9/23 21:54, Kees Cook wrote:
> On Mon, Oct 09, 2023 at 01:41:18PM -0600, Gustavo A. R. Silva wrote:
>> Prepare for the coming implementation by GCC and Clang of the __counted_by
>> attribute. Flexible array members annotated with __counted_by can have
>> their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
>> array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
>> functions).
>>
>> While there, use struct_size() helper, instead of the open-coded
>> version, to calculate the size for the allocation of the whole
>> flexible structure, including of course, the flexible-array member.
>>
>> This code was found with the help of Coccinelle, and audited and
>> fixed manually.
>>
>> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>> ---
>>   drivers/net/wireless/intersil/hostap/hostap_download.c | 3 +--
>>   drivers/net/wireless/intersil/hostap/hostap_wlan.h     | 2 +-
>>   2 files changed, 2 insertions(+), 3 deletions(-)
>>
>> diff --git a/drivers/net/wireless/intersil/hostap/hostap_download.c b/drivers/net/wireless/intersil/hostap/hostap_download.c
>> index 3672291ced5c..5e5bada28b5b 100644
>> --- a/drivers/net/wireless/intersil/hostap/hostap_download.c
>> +++ b/drivers/net/wireless/intersil/hostap/hostap_download.c
>> @@ -732,8 +732,7 @@ static int prism2_download(local_info_t *local,
>>   		goto out;
>>   	}
>>   
>> -	dl = kzalloc(sizeof(*dl) + param->num_areas *
>> -		     sizeof(struct prism2_download_data_area), GFP_KERNEL);
>> +	dl = kzalloc(struct_size(dl, data, param->num_areas), GFP_KERNEL);
>>   	if (dl == NULL) {
>>   		ret = -ENOMEM;
>>   		goto out;
>> diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
>> index c25cd21d18bd..f71c0545c0be 100644
>> --- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h
>> +++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
>> @@ -617,7 +617,7 @@ struct prism2_download_data {
>>   		u32 addr; /* wlan card address */
>>   		u32 len;
>>   		u8 *data; /* allocated data */
>> -	} data[];
>> +	} data[] __counted_by(num_areas);
>>   };
> 
> Should this be considered a v2 of:
> https://lore.kernel.org/linux-hardening/94848cc3-6f5c-46d7-8cc7-98a4f10865b3@embeddedor.com/
> 
> ?

Oops... sorry, I forgot I had reviewed this patch of yours.

> 
> Yours is more complete since it includes the struct_size() change...
> 

Should I resend this explicitly marking it as a v2?

--
Gustavo

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Kees Cook]

On Mon, Oct 09, 2023 at 02:33:01PM -0600, Gustavo A. R. Silva wrote:
> 
> 
> On 10/9/23 21:54, Kees Cook wrote:
> > On Mon, Oct 09, 2023 at 01:41:18PM -0600, Gustavo A. R. Silva wrote:
> > > Prepare for the coming implementation by GCC and Clang of the __counted_by
> > > attribute. Flexible array members annotated with __counted_by can have
> > > their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
> > > array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> > > functions).
> > > 
> > > While there, use struct_size() helper, instead of the open-coded
> > > version, to calculate the size for the allocation of the whole
> > > flexible structure, including of course, the flexible-array member.
> > > 
> > > This code was found with the help of Coccinelle, and audited and
> > > fixed manually.
> > > 
> > > Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> > > ---
> > >   drivers/net/wireless/intersil/hostap/hostap_download.c | 3 +--
> > >   drivers/net/wireless/intersil/hostap/hostap_wlan.h     | 2 +-
> > >   2 files changed, 2 insertions(+), 3 deletions(-)
> > > 
> > > diff --git a/drivers/net/wireless/intersil/hostap/hostap_download.c b/drivers/net/wireless/intersil/hostap/hostap_download.c
> > > index 3672291ced5c..5e5bada28b5b 100644
> > > --- a/drivers/net/wireless/intersil/hostap/hostap_download.c
> > > +++ b/drivers/net/wireless/intersil/hostap/hostap_download.c
> > > @@ -732,8 +732,7 @@ static int prism2_download(local_info_t *local,
> > >   		goto out;
> > >   	}
> > > -	dl = kzalloc(sizeof(*dl) + param->num_areas *
> > > -		     sizeof(struct prism2_download_data_area), GFP_KERNEL);
> > > +	dl = kzalloc(struct_size(dl, data, param->num_areas), GFP_KERNEL);
> > >   	if (dl == NULL) {
> > >   		ret = -ENOMEM;
> > >   		goto out;
> > > diff --git a/drivers/net/wireless/intersil/hostap/hostap_wlan.h b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> > > index c25cd21d18bd..f71c0545c0be 100644
> > > --- a/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> > > +++ b/drivers/net/wireless/intersil/hostap/hostap_wlan.h
> > > @@ -617,7 +617,7 @@ struct prism2_download_data {
> > >   		u32 addr; /* wlan card address */
> > >   		u32 len;
> > >   		u8 *data; /* allocated data */
> > > -	} data[];
> > > +	} data[] __counted_by(num_areas);
> > >   };
> > 
> > Should this be considered a v2 of:
> > https://lore.kernel.org/linux-hardening/94848cc3-6f5c-46d7-8cc7-98a4f10865b3@embeddedor.com/
> > 
> > ?
> 
> Oops... sorry, I forgot I had reviewed this patch of yours.
> 
> > 
> > Yours is more complete since it includes the struct_size() change...
> > 
> 
> Should I resend this explicitly marking it as a v2?

I defer to Kalle -- your Subject is more accurate, so perhaps let's just
let this stand?

-- 
Kees Cook

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Kalle Valo]

Kees Cook <keescook@chromium.org> writes:

>> > Should this be considered a v2 of:
>> > https://lore.kernel.org/linux-hardening/94848cc3-6f5c-46d7-8cc7-98a4f10865b3@embeddedor.com/
>> > 
>> > ?
>> 
>> Oops... sorry, I forgot I had reviewed this patch of yours.
>> 
>> > 
>> > Yours is more complete since it includes the struct_size() change...
>> > 
>> 
>> Should I resend this explicitly marking it as a v2?
>
> I defer to Kalle -- your Subject is more accurate, so perhaps let's just
> let this stand?

No need to resend. I marked Kees' version as Superseded so that I don't
accidentally take the wrong version.

In the title "wifi:" is missing but I can add that during commit.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Gustavo A. R. Silva]

On 10/10/23 08:17, Kalle Valo wrote:

> 
> No need to resend. I marked Kees' version as Superseded so that I don't
> accidentally take the wrong version.
> 
> In the title "wifi:" is missing but I can add that during commit.
> 

Awesome. :)

Thanks, Kalle!
--
Gustavo

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Kees Cook]

On Mon, Oct 09, 2023 at 01:41:18PM -0600, Gustavo A. R. Silva wrote:
> Prepare for the coming implementation by GCC and Clang of the __counted_by
> attribute. Flexible array members annotated with __counted_by can have
> their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
> array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> functions).
> 
> While there, use struct_size() helper, instead of the open-coded
> version, to calculate the size for the allocation of the whole
> flexible structure, including of course, the flexible-array member.
> 
> This code was found with the help of Coccinelle, and audited and
> fixed manually.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>

I realize I didn't actually send my R-b for this thread, so here it is:

Reviewed-by: Kees Cook <keescook@chromium.org>

:)

-- 
Kees Cook

Re: [PATCH][next] hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Gustavo A. R. Silva]

> I realize I didn't actually send my R-b for this thread, so here it is:
> 
> Reviewed-by: Kees Cook <keescook@chromium.org>
> 
> :)
> 

Thanks! :)

--
Gustavo

Re: [next] wifi: hostap: Add __counted_by for struct prism2_download_data and use struct_size()

[Kalle Valo]

"Gustavo A. R. Silva" <gustavoars@kernel.org> wrote:

> Prepare for the coming implementation by GCC and Clang of the __counted_by
> attribute. Flexible array members annotated with __counted_by can have
> their accesses bounds-checked at run-time via CONFIG_UBSAN_BOUNDS (for
> array indexing) and CONFIG_FORTIFY_SOURCE (for strcpy/memcpy-family
> functions).
> 
> While there, use struct_size() helper, instead of the open-coded
> version, to calculate the size for the allocation of the whole
> flexible structure, including of course, the flexible-array member.
> 
> This code was found with the help of Coccinelle, and audited and
> fixed manually.
> 
> Signed-off-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> Reviewed-by: Kees Cook <keescook@chromium.org>

Patch applied to wireless-next.git, thanks.

5cf47dc14158 wifi: hostap: Add __counted_by for struct prism2_download_data and use struct_size()

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/ZSRXXvWMMkm7qqRW@work/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches