[PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Georgi Valkov]

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Replace affected uses of sizeof(member) with sizeof(type).
- Replace unions containing one-element arrays with
  u8 flexible arrays, and document the stored parameter-set type.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
 drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
 drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
 .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
 3 files changed, 12 insertions(+), 18 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..ec3e3f806134 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
 
 struct mwifiex_ie_types_chan_band_list_param_set {
 	struct mwifiex_ie_types_header header;
-	struct chan_band_param_set chan_band_param[1];
+	struct chan_band_param_set chan_band_param[];
 } __packed;
 
 struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
 	struct mwifiex_ie_types_header header;
-	u8 tsf_data[1];
+	u8 tsf_data[];
 } __packed;
 
 struct mwifiex_cf_param_set {
@@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
 
 struct mwifiex_ie_types_ss_param_set {
 	struct mwifiex_ie_types_header header;
-	union {
-		struct mwifiex_cf_param_set cf_param_set[1];
-		struct mwifiex_ibss_param_set ibss_param_set[1];
-	} cf_ibss;
+	u8 cf_ibss[];	/* CF and IBSS param sets are stored here */
 } __packed;
 
 struct mwifiex_fh_param_set {
@@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
 
 struct mwifiex_ie_types_phy_param_set {
 	struct mwifiex_ie_types_header header;
-	union {
-		struct mwifiex_fh_param_set fh_param_set[1];
-		struct mwifiex_ds_param_set ds_param_set[1];
-	} fh_ds;
+	u8 fh_ds[];	/* FH and DS param sets are stored here */
 } __packed;
 
 struct mwifiex_ie_types_auth_type {
@@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
 	__le16 query_type;
 	__le16 oid;
 	__le16 buf_size;
-	u8 value[1];
+	u8 value[];
 } __packed;
 
 struct mwifiex_rate_scope {
@@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
 	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
 	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
 	 */
-	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
+	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
 				   here */
 } __packed;
 
@@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
 	struct mwifiex_ie_types_header header;
 	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
-	struct ieee80211_country_ie_triplet triplet[1];
+	struct ieee80211_country_ie_triplet triplet[];
 } __packed;
 
 struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a2c427e6af3f 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
 
 	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
 	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
-	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
-	memcpy(&phy_tlv->fh_ds.ds_param_set,
+	phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));
+	memcpy(phy_tlv->fh_ds,
 	       &bss_desc->phy_param_set.ds_param_set.current_chan,
-	       sizeof(phy_tlv->fh_ds.ds_param_set));
+	       sizeof(struct mwifiex_ds_param_set));
 	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
 
 	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
 	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
-	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+	ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
 	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
 
 	/* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
 		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
 	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
-				- 1 + S_DS_GEN);
+				+ S_DS_GEN);
 
 	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
 	if (cmd_action == HostCmd_ACT_GEN_GET) {
-- 
2.55.0

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Replace affected uses of sizeof(member) with sizeof(type).
> - Replace unions containing one-element arrays with
>   u8 flexible arrays, and document the stored parameter-set type.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[Kees Cook]

On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Replace affected uses of sizeof(member) with sizeof(type).
> - Replace unions containing one-element arrays with
>   u8 flexible arrays, and document the stored parameter-set type.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> ---
>  drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
>  drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
>  .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
>  3 files changed, 12 insertions(+), 18 deletions(-)
> 
> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
> index e9e896606912..ec3e3f806134 100644
> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
> @@ -823,7 +823,7 @@ struct chan_band_param_set {
>  
>  struct mwifiex_ie_types_chan_band_list_param_set {
>  	struct mwifiex_ie_types_header header;
> -	struct chan_band_param_set chan_band_param[1];
> +	struct chan_band_param_set chan_band_param[];
>  } __packed;
>  
>  struct mwifiex_ie_types_rates_param_set {
> @@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
>  #define TSF_DATA_SIZE            8
>  struct mwifiex_ie_types_tsf_timestamp {
>  	struct mwifiex_ie_types_header header;
> -	u8 tsf_data[1];
> +	u8 tsf_data[];
>  } __packed;
>  
>  struct mwifiex_cf_param_set {
> @@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
>  
>  struct mwifiex_ie_types_ss_param_set {
>  	struct mwifiex_ie_types_header header;
> -	union {
> -		struct mwifiex_cf_param_set cf_param_set[1];
> -		struct mwifiex_ibss_param_set ibss_param_set[1];
> -	} cf_ibss;
> +	u8 cf_ibss[];	/* CF and IBSS param sets are stored here */
>  } __packed;
>  
>  struct mwifiex_fh_param_set {
> @@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
>  
>  struct mwifiex_ie_types_phy_param_set {
>  	struct mwifiex_ie_types_header header;
> -	union {
> -		struct mwifiex_fh_param_set fh_param_set[1];
> -		struct mwifiex_ds_param_set ds_param_set[1];
> -	} fh_ds;
> +	u8 fh_ds[];	/* FH and DS param sets are stored here */
>  } __packed;

This (and below) can still be a union so you don't lose the type
information:

	union {
		DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
		DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
	} fh_ds;

>  
>  struct mwifiex_ie_types_auth_type {
> @@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
>  	__le16 query_type;
>  	__le16 oid;
>  	__le16 buf_size;
> -	u8 value[1];
> +	u8 value[];
>  } __packed;
>  
>  struct mwifiex_rate_scope {
> @@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
>  	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
>  	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
>  	 */
> -	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
> +	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
>  				   here */
>  } __packed;
>  
> @@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
>  struct mwifiex_ietypes_domain_param_set {
>  	struct mwifiex_ie_types_header header;
>  	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
> -	struct ieee80211_country_ie_triplet triplet[1];
> +	struct ieee80211_country_ie_triplet triplet[];
>  } __packed;
>  
>  struct host_cmd_ds_802_11d_domain_info {
> diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
> index 5a1a0287c1d5..a2c427e6af3f 100644
> --- a/drivers/net/wireless/marvell/mwifiex/join.c
> +++ b/drivers/net/wireless/marvell/mwifiex/join.c
> @@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
>  
>  	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
>  	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
> -	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
> -	memcpy(&phy_tlv->fh_ds.ds_param_set,
> +	phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));

And this would become (the "*" added to get the member size):

	phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));

etc.

> +	memcpy(phy_tlv->fh_ds,
>  	       &bss_desc->phy_param_set.ds_param_set.current_chan,
> -	       sizeof(phy_tlv->fh_ds.ds_param_set));
> +	       sizeof(struct mwifiex_ds_param_set));
>  	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
>  
>  	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
>  	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
> -	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
> +	ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
>  	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
>  
>  	/* Get the common rates supported between the driver and the BSS Desc */
> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> index 623ddde8c8e5..071f7cb305e1 100644
> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
> @@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
>  		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
>  	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
>  	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
> -				- 1 + S_DS_GEN);
> +				+ S_DS_GEN);
>  
>  	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
>  	if (cmd_action == HostCmd_ACT_GEN_GET) {
> -- 
> 2.55.0
> 

-- 
Kees Cook

Re: [PATCH] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

Thank you for your help!
Please backport to 6.18 and 6.12, which are used by OpenWrt.

v2:
- restore the unions and use DECLARE_FLEX_ARRAY
  for the flexible arrays inside
- restore use of sizeof(*member) instead of sizeof(struct)


From 654af1e2be5e0d2269a108f050dfbcbf1ad79262 Mon Sep 17 00:00:00 2001
From: Georgi Valkov <gvalkov@gmail.com>
Date: Thu, 16 Jul 2026 12:28:00 +0300
Subject: [PATCH v2] wifi: mwifiex: replace one-element arrays with flexible array
 members

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY for structs inside affected unions.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
 drivers/net/wireless/marvell/mwifiex/fw.h      | 18 +++++++++---------
 drivers/net/wireless/marvell/mwifiex/join.c    |  8 ++++----
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c |  2 +-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..93561116959a 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
   struct mwifiex_ie_types_chan_band_list_param_set {
  struct mwifiex_ie_types_header header;
- struct chan_band_param_set chan_band_param[1];
+ struct chan_band_param_set chan_band_param[];
 } __packed;
   struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
  struct mwifiex_ie_types_header header;
- u8 tsf_data[1];
+ u8 tsf_data[];
 } __packed;
   struct mwifiex_cf_param_set {
@@ -903,8 +903,8 @@ struct mwifiex_ibss_param_set {
 struct mwifiex_ie_types_ss_param_set {
  struct mwifiex_ie_types_header header;
  union {
- struct mwifiex_cf_param_set cf_param_set[1];
- struct mwifiex_ibss_param_set ibss_param_set[1];
+ DECLARE_FLEX_ARRAY(struct mwifiex_cf_param_set, cf_param_set);
+ DECLARE_FLEX_ARRAY(struct mwifiex_ibss_param_set, ibss_param_set);
  } cf_ibss;
 } __packed;
  @@ -922,8 +922,8 @@ struct mwifiex_ds_param_set {
 struct mwifiex_ie_types_phy_param_set {
  struct mwifiex_ie_types_header header;
  union {
- struct mwifiex_fh_param_set fh_param_set[1];
- struct mwifiex_ds_param_set ds_param_set[1];
+ DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
+ DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
  } fh_ds;
 } __packed;
  @@ -1383,7 +1383,7 @@ struct host_cmd_ds_802_11_snmp_mib {
  __le16 query_type;
  __le16 oid;
  __le16 buf_size;
- u8 value[1];
+ u8 value[];
 } __packed;
   struct mwifiex_rate_scope {
@@ -1551,7 +1551,7 @@ struct mwifiex_scan_cmd_config {
  *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
  *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
  */
- u8 tlv_buf[1]; /* SSID TLV(s) and ChanList TLVs are stored
+ u8 tlv_buf[]; /* SSID TLV(s) and ChanList TLVs are stored
    here */
 } __packed;
  @@ -1683,7 +1683,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
  struct mwifiex_ie_types_header header;
  u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
- struct ieee80211_country_ie_triplet triplet[1];
+ struct ieee80211_country_ie_triplet triplet[];
 } __packed;
   struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a83f4d081fe2 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
    phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
  phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
- phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
- memcpy(&phy_tlv->fh_ds.ds_param_set,
+ phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
+ memcpy(phy_tlv->fh_ds.ds_param_set,
        &bss_desc->phy_param_set.ds_param_set.current_chan,
-       sizeof(phy_tlv->fh_ds.ds_param_set));
+       sizeof(*phy_tlv->fh_ds.ds_param_set));
  pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
    ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
  ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
- ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+ ss_tlv->header.len = cpu_to_le16(sizeof(*ss_tlv->cf_ibss.cf_param_set));
  pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
    /* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
      "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
  cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
  cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
- - 1 + S_DS_GEN);
+ + S_DS_GEN);
    snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
  if (cmd_action == HostCmd_ACT_GEN_GET) {
--  2.55.0



> On 15 Jul 2026, at 7:35 PM, Kees Cook <kees@kernel.org> wrote:
> 
> On Mon, Jul 13, 2026 at 01:23:34AM +0300, Georgi Valkov wrote:
>> Replace deprecated one-element arrays with flexible array members.
>> CONFIG_FORTIFY_SOURCE reports the following warning when
>> one-element arrays are used as variable-length buffers:
>> 
>> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
>> memcpy: detected field-spanning write (size 84) of single field
>> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
>> 
>> Convert affected structs to use flexible array members.
>> - Preserve existing wire layouts.
>> - Replace affected uses of sizeof(member) with sizeof(type).
>> - Replace unions containing one-element arrays with
>>  u8 flexible arrays, and document the stored parameter-set type.
>> 
>> Tested-on: WRT3200ACM, OpenWrt
>> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
>> ---
>> drivers/net/wireless/marvell/mwifiex/fw.h     | 20 +++++++------------
>> drivers/net/wireless/marvell/mwifiex/join.c   |  8 ++++----
>> .../net/wireless/marvell/mwifiex/sta_cmd.c    |  2 +-
>> 3 files changed, 12 insertions(+), 18 deletions(-)
>> 
>> diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
>> index e9e896606912..ec3e3f806134 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/fw.h
>> +++ b/drivers/net/wireless/marvell/mwifiex/fw.h
>> @@ -823,7 +823,7 @@ struct chan_band_param_set {
>> 
>> struct mwifiex_ie_types_chan_band_list_param_set {
>> struct mwifiex_ie_types_header header;
>> - struct chan_band_param_set chan_band_param[1];
>> + struct chan_band_param_set chan_band_param[];
>> } __packed;
>> 
>> struct mwifiex_ie_types_rates_param_set {
>> @@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
>> #define TSF_DATA_SIZE            8
>> struct mwifiex_ie_types_tsf_timestamp {
>> struct mwifiex_ie_types_header header;
>> - u8 tsf_data[1];
>> + u8 tsf_data[];
>> } __packed;
>> 
>> struct mwifiex_cf_param_set {
>> @@ -902,10 +902,7 @@ struct mwifiex_ibss_param_set {
>> 
>> struct mwifiex_ie_types_ss_param_set {
>> struct mwifiex_ie_types_header header;
>> - union {
>> - struct mwifiex_cf_param_set cf_param_set[1];
>> - struct mwifiex_ibss_param_set ibss_param_set[1];
>> - } cf_ibss;
>> + u8 cf_ibss[]; /* CF and IBSS param sets are stored here */
>> } __packed;
>> 
>> struct mwifiex_fh_param_set {
>> @@ -921,10 +918,7 @@ struct mwifiex_ds_param_set {
>> 
>> struct mwifiex_ie_types_phy_param_set {
>> struct mwifiex_ie_types_header header;
>> - union {
>> - struct mwifiex_fh_param_set fh_param_set[1];
>> - struct mwifiex_ds_param_set ds_param_set[1];
>> - } fh_ds;
>> + u8 fh_ds[]; /* FH and DS param sets are stored here */
>> } __packed;
> 
> This (and below) can still be a union so you don't lose the type
> information:
> 
> union {
> DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
> DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
> } fh_ds;
> 
>> 
>> struct mwifiex_ie_types_auth_type {
>> @@ -1383,7 +1377,7 @@ struct host_cmd_ds_802_11_snmp_mib {
>> __le16 query_type;
>> __le16 oid;
>> __le16 buf_size;
>> - u8 value[1];
>> + u8 value[];
>> } __packed;
>> 
>> struct mwifiex_rate_scope {
>> @@ -1551,7 +1545,7 @@ struct mwifiex_scan_cmd_config {
>>  *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
>>  *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
>>  */
>> - u8 tlv_buf[1]; /* SSID TLV(s) and ChanList TLVs are stored
>> + u8 tlv_buf[]; /* SSID TLV(s) and ChanList TLVs are stored
>>    here */
>> } __packed;
>> 
>> @@ -1683,7 +1677,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
>> struct mwifiex_ietypes_domain_param_set {
>> struct mwifiex_ie_types_header header;
>> u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
>> - struct ieee80211_country_ie_triplet triplet[1];
>> + struct ieee80211_country_ie_triplet triplet[];
>> } __packed;
>> 
>> struct host_cmd_ds_802_11d_domain_info {
>> diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
>> index 5a1a0287c1d5..a2c427e6af3f 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/join.c
>> +++ b/drivers/net/wireless/marvell/mwifiex/join.c
>> @@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
>> 
>> phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
>> phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
>> - phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
>> - memcpy(&phy_tlv->fh_ds.ds_param_set,
>> + phy_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_ds_param_set));
> 
> And this would become (the "*" added to get the member size):
> 
> phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
> 
> etc.
> 
>> + memcpy(phy_tlv->fh_ds,
>>        &bss_desc->phy_param_set.ds_param_set.current_chan,
>> -        sizeof(phy_tlv->fh_ds.ds_param_set));
>> +        sizeof(struct mwifiex_ds_param_set));
>> pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
>> 
>> ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
>> ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
>> - ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
>> + ss_tlv->header.len = cpu_to_le16(sizeof(struct mwifiex_cf_param_set));
>> pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
>> 
>> /* Get the common rates supported between the driver and the BSS Desc */
>> diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> index 623ddde8c8e5..071f7cb305e1 100644
>> --- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> +++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
>> @@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
>>     "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
>> cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
>> cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
>> - - 1 + S_DS_GEN);
>> + + S_DS_GEN);
>> 
>> snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
>> if (cmd_action == HostCmd_ACT_GEN_GET) {
>> -- 
>> 2.55.0
>> 
> 
> -- 
> Kees Cook

[PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Georgi Valkov]

Replace deprecated one-element arrays with flexible array members.
CONFIG_FORTIFY_SOURCE reports the following warning when
one-element arrays are used as variable-length buffers:

sta_cmd.c:1033 mwifiex_sta_prepare_cmd
memcpy: detected field-spanning write (size 84) of single field
"domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)

Convert affected structs to use flexible array members.
- Preserve existing wire layouts.
- Use DECLARE_FLEX_ARRAY() for structs inside affected unions.

Tested-on: WRT3200ACM, OpenWrt
Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
---
Thank you for your help!
Please backport to 6.18 and 6.12, which are used by OpenWrt.

v3:
- resend, please ignore v2 (corrupted by mail client)

v2:
- restore the unions and use DECLARE_FLEX_ARRAY
  for the flexible arrays inside
- restore use of sizeof(*member) instead of sizeof(struct)

 drivers/net/wireless/marvell/mwifiex/fw.h      | 18 +++++++++---------
 drivers/net/wireless/marvell/mwifiex/join.c    |  8 ++++----
 drivers/net/wireless/marvell/mwifiex/sta_cmd.c |  2 +-
 3 files changed, 14 insertions(+), 14 deletions(-)

diff --git a/drivers/net/wireless/marvell/mwifiex/fw.h b/drivers/net/wireless/marvell/mwifiex/fw.h
index e9e896606912..93561116959a 100644
--- a/drivers/net/wireless/marvell/mwifiex/fw.h
+++ b/drivers/net/wireless/marvell/mwifiex/fw.h
@@ -823,7 +823,7 @@ struct chan_band_param_set {
 
 struct mwifiex_ie_types_chan_band_list_param_set {
 	struct mwifiex_ie_types_header header;
-	struct chan_band_param_set chan_band_param[1];
+	struct chan_band_param_set chan_band_param[];
 } __packed;
 
 struct mwifiex_ie_types_rates_param_set {
@@ -886,7 +886,7 @@ struct mwifiex_ie_types_wildcard_ssid_params {
 #define TSF_DATA_SIZE            8
 struct mwifiex_ie_types_tsf_timestamp {
 	struct mwifiex_ie_types_header header;
-	u8 tsf_data[1];
+	u8 tsf_data[];
 } __packed;
 
 struct mwifiex_cf_param_set {
@@ -903,8 +903,8 @@ struct mwifiex_ibss_param_set {
 struct mwifiex_ie_types_ss_param_set {
 	struct mwifiex_ie_types_header header;
 	union {
-		struct mwifiex_cf_param_set cf_param_set[1];
-		struct mwifiex_ibss_param_set ibss_param_set[1];
+		DECLARE_FLEX_ARRAY(struct mwifiex_cf_param_set, cf_param_set);
+		DECLARE_FLEX_ARRAY(struct mwifiex_ibss_param_set, ibss_param_set);
 	} cf_ibss;
 } __packed;
 
@@ -922,8 +922,8 @@ struct mwifiex_ds_param_set {
 struct mwifiex_ie_types_phy_param_set {
 	struct mwifiex_ie_types_header header;
 	union {
-		struct mwifiex_fh_param_set fh_param_set[1];
-		struct mwifiex_ds_param_set ds_param_set[1];
+		DECLARE_FLEX_ARRAY(struct mwifiex_fh_param_set, fh_param_set);
+		DECLARE_FLEX_ARRAY(struct mwifiex_ds_param_set, ds_param_set);
 	} fh_ds;
 } __packed;
 
@@ -1383,7 +1383,7 @@ struct host_cmd_ds_802_11_snmp_mib {
 	__le16 query_type;
 	__le16 oid;
 	__le16 buf_size;
-	u8 value[1];
+	u8 value[];
 } __packed;
 
 struct mwifiex_rate_scope {
@@ -1551,7 +1551,7 @@ struct mwifiex_scan_cmd_config {
 	 *  TLV_TYPE_CHANLIST, mwifiex_ie_types_chan_list_param_set
 	 *  WLAN_EID_SSID, mwifiex_ie_types_ssid_param_set
 	 */
-	u8 tlv_buf[1];	/* SSID TLV(s) and ChanList TLVs are stored
+	u8 tlv_buf[];	/* SSID TLV(s) and ChanList TLVs are stored
 				   here */
 } __packed;
 
@@ -1683,7 +1683,7 @@ struct host_cmd_ds_802_11_bg_scan_query_rsp {
 struct mwifiex_ietypes_domain_param_set {
 	struct mwifiex_ie_types_header header;
 	u8 country_code[IEEE80211_COUNTRY_STRING_LEN];
-	struct ieee80211_country_ie_triplet triplet[1];
+	struct ieee80211_country_ie_triplet triplet[];
 } __packed;
 
 struct host_cmd_ds_802_11d_domain_info {
diff --git a/drivers/net/wireless/marvell/mwifiex/join.c b/drivers/net/wireless/marvell/mwifiex/join.c
index 5a1a0287c1d5..a83f4d081fe2 100644
--- a/drivers/net/wireless/marvell/mwifiex/join.c
+++ b/drivers/net/wireless/marvell/mwifiex/join.c
@@ -421,15 +421,15 @@ int mwifiex_cmd_802_11_associate(struct mwifiex_private *priv,
 
 	phy_tlv = (struct mwifiex_ie_types_phy_param_set *) pos;
 	phy_tlv->header.type = cpu_to_le16(WLAN_EID_DS_PARAMS);
-	phy_tlv->header.len = cpu_to_le16(sizeof(phy_tlv->fh_ds.ds_param_set));
-	memcpy(&phy_tlv->fh_ds.ds_param_set,
+	phy_tlv->header.len = cpu_to_le16(sizeof(*phy_tlv->fh_ds.ds_param_set));
+	memcpy(phy_tlv->fh_ds.ds_param_set,
 	       &bss_desc->phy_param_set.ds_param_set.current_chan,
-	       sizeof(phy_tlv->fh_ds.ds_param_set));
+	       sizeof(*phy_tlv->fh_ds.ds_param_set));
 	pos += sizeof(phy_tlv->header) + le16_to_cpu(phy_tlv->header.len);
 
 	ss_tlv = (struct mwifiex_ie_types_ss_param_set *) pos;
 	ss_tlv->header.type = cpu_to_le16(WLAN_EID_CF_PARAMS);
-	ss_tlv->header.len = cpu_to_le16(sizeof(ss_tlv->cf_ibss.cf_param_set));
+	ss_tlv->header.len = cpu_to_le16(sizeof(*ss_tlv->cf_ibss.cf_param_set));
 	pos += sizeof(ss_tlv->header) + le16_to_cpu(ss_tlv->header.len);
 
 	/* Get the common rates supported between the driver and the BSS Desc */
diff --git a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
index 623ddde8c8e5..071f7cb305e1 100644
--- a/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
+++ b/drivers/net/wireless/marvell/mwifiex/sta_cmd.c
@@ -108,7 +108,7 @@ static int mwifiex_cmd_802_11_snmp_mib(struct mwifiex_private *priv,
 		    "cmd: SNMP_CMD: cmd_oid = 0x%x\n", cmd_oid);
 	cmd->command = cpu_to_le16(HostCmd_CMD_802_11_SNMP_MIB);
 	cmd->size = cpu_to_le16(sizeof(struct host_cmd_ds_802_11_snmp_mib)
-				- 1 + S_DS_GEN);
+				+ S_DS_GEN);
 
 	snmp_mib->oid = cpu_to_le16((u16)cmd_oid);
 	if (cmd_action == HostCmd_ACT_GEN_GET) {
-- 
2.55.0

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> Replace deprecated one-element arrays with flexible array members.
> CONFIG_FORTIFY_SOURCE reports the following warning when
> one-element arrays are used as variable-length buffers:
> 
> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> memcpy: detected field-spanning write (size 84) of single field
> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> 
> Convert affected structs to use flexible array members.
> - Preserve existing wire layouts.
> - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> 
> Tested-on: WRT3200ACM, OpenWrt
> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>

Cc: stable@vger.kernel.org # 6.12+
Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Dan Carpenter]

On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > Replace deprecated one-element arrays with flexible array members.
> > CONFIG_FORTIFY_SOURCE reports the following warning when
> > one-element arrays are used as variable-length buffers:
> > 
> > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > memcpy: detected field-spanning write (size 84) of single field
> > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > 
> > Convert affected structs to use flexible array members.
> > - Preserve existing wire layouts.
> > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > 
> > Tested-on: WRT3200ACM, OpenWrt
> > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> 
> Cc: stable@vger.kernel.org # 6.12+
> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>

Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
warnings are still remaining?

regards,
dan carpenter

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Francesco Dolcini]

On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > Replace deprecated one-element arrays with flexible array members.
> > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > one-element arrays are used as variable-length buffers:
> > > 
> > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > memcpy: detected field-spanning write (size 84) of single field
> > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > 
> > > Convert affected structs to use flexible array members.
> > > - Preserve existing wire layouts.
> > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > 
> > > Tested-on: WRT3200ACM, OpenWrt
> > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > 
> > Cc: stable@vger.kernel.org # 6.12+
> > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> 
> Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> warnings are still remaining?

Yes, you are right, my mistake.

Johannes, please be sure to not have the stable tag in once you apply the
patch.

Francesco

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

> On 16 Jul 2026, at 9:27 AM, Dan Carpenter <error27@gmail.com> wrote:
> 
> On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
>> On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
>>> Replace deprecated one-element arrays with flexible array members.
>>> CONFIG_FORTIFY_SOURCE reports the following warning when
>>> one-element arrays are used as variable-length buffers:
>>> 
>>> sta_cmd.c:1033 mwifiex_sta_prepare_cmd
>>> memcpy: detected field-spanning write (size 84) of single field
>>> "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
>>> 
>>> Convert affected structs to use flexible array members.
>>> - Preserve existing wire layouts.
>>> - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
>>> 
>>> Tested-on: WRT3200ACM, OpenWrt
>>> Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
>> 
>> Cc: stable@vger.kernel.org # 6.12+
>> Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> 
> Are we CCing stable for this sort of thing?

Yes, please add stable if possible.
I am new to this process and still learning the rules.


> How many FORTIFY_SOURCE
> warnings are still remaining?

So far I have observed only the warning on sta_cmd.c:1033.
I made the rest of the changes as preventative measures,
because they are flexible arrays used in the same way.

Georgi Valkov

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Dan Carpenter]

On Thu, Jul 16, 2026 at 08:32:46AM +0200, Francesco Dolcini wrote:
> On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> > On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > > Replace deprecated one-element arrays with flexible array members.
> > > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > > one-element arrays are used as variable-length buffers:
> > > > 
> > > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > > memcpy: detected field-spanning write (size 84) of single field
> > > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > > 
> > > > Convert affected structs to use flexible array members.
> > > > - Preserve existing wire layouts.
> > > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > > 
> > > > Tested-on: WRT3200ACM, OpenWrt
> > > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > > 
> > > Cc: stable@vger.kernel.org # 6.12+
> > > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> > 
> > Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> > warnings are still remaining?
> 
> Yes, you are right, my mistake.
> 
> Johannes, please be sure to not have the stable tag in once you apply the
> patch.

Wait...  No no.  It was a serious question.  I guess these warnings
are pretty annoying for a real user on WRT so it's fine to CC stable.
I just assumed these warnings were more common still.

regards,
dan carpenter

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

On Thu, 16 Jul 2026 at 09:55, Dan Carpenter <error27@gmail.com> wrote:
>
> On Thu, Jul 16, 2026 at 08:32:46AM +0200, Francesco Dolcini wrote:
> > On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> > > On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > > > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > > > Replace deprecated one-element arrays with flexible array members.
> > > > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > > > one-element arrays are used as variable-length buffers:
> > > > >
> > > > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > > > memcpy: detected field-spanning write (size 84) of single field
> > > > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > > >
> > > > > Convert affected structs to use flexible array members.
> > > > > - Preserve existing wire layouts.
> > > > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > > >
> > > > > Tested-on: WRT3200ACM, OpenWrt
> > > > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > > >
> > > > Cc: stable@vger.kernel.org # 6.12+
> > > > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> > >
> > > Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> > > warnings are still remaining?
> >
> > Yes, you are right, my mistake.
> >
> > Johannes, please be sure to not have the stable tag in once you apply the
> > patch.
>
> Wait...  No no.  It was a serious question.  I guess these warnings
> are pretty annoying for a real user on WRT so it's fine to CC stable.
> I just assumed these warnings were more common still.

When I first saw it, I thought it was a kernel panic.
There was an unrelated bug before the warning. My other PR fixes it:
wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware

But after fixing the freeze, the warning remained.
Next I thought it was a driver crash. To confirm, I added:
mwifiex_dbg(ERROR) right before and after memcpy(),
and printed all values in both source and destination:
- memcpy has copied all data to the destination
- execution is allowed to continue
- so it is just a scary warning

I wanted to ask both patches to be backported to stable, but
at the time I sent them, I did not know that I could insert
free text between the commit message and the patch.
I will reply to the other PR and ask them.

Full text of the warning fixed here:

[   90.484902] ------------[ cut here ]------------
[   90.489549] WARNING: CPU: 1 PID: 3059 at
backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
[   90.503877] memcpy: detected field-spanning write (size 84) of
single field "domain->triplet" at
backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
(size 3)
[   90.519602] Modules linked in: option cdc_mbim uvcvideo usb_wwan
rndis_host qmi_wwan nft_fib_inet nf_flow_table_inet ftdi_sio
ebtable_nat ebtable_filter ebtable_broute cdc_ncm cdc_ether xt_time
xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac
xt_limit xt_length xt_iprange xt_hl xt_fuzzy(O) xt_ecn xt_dscp
xt_conntrack xt_comment xt_TEE xt_TCPMSS xt_REDIRECT xt_MASQUERADE
xt_LOG xt_IPMARK(O) xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY
xt_DELUDE(O) xt_TARPIT(O) ipt_REJECT xt_tcpudp xt_CHAOS(O)
videobuf2_v4l2 uvc usbserial usbnet ums_usbat ums_sddr55 ums_sddr09
ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress
ums_alauda rfcomm nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet
nft_reject_bridge nft_reject nft_redir nft_quota nft_numgen nft_nat
nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_flow_offload
nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_compat nft_chain_nat
nf_tables nf_reject_ipv4 nf_log_syslog nf_flow_table nf_dup_ipv6
nf_dup_ipv4 nf_conntrack_bridge
[   90.519758]  mwifiex_sdio(O) mwifiex(O) libcrc32c iptable_nat
iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hidp ebtables
ebt_vlan ebt_stp ebt_snat ebt_redirect ebt_pkttype ebt_mark_m ebt_mark
ebt_limit ebt_ip6 ebt_ip ebt_dnat ebt_arpreply ebt_arp ebt_among
ebt_802_3 cdc_wdm cdc_acm btmrvl_sdio btmrvl bnep bluetooth
arptable_filter arpt_mangle arp_tables fuse ntfs3 videobuf2_vmalloc
videobuf2_memops videobuf2_common hid videodev mc evdev input_core
mwlwifi(O) mac80211(O) cfg80211(O) compat(O) cryptodev(O) xt_set
ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport
ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net
ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip
ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip
ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set
nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6
nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh
ip6t_frag ip6t_eui64 ip6t_ah ip6table_mangle ip6table_filter
ip6_tables
[   90.609354]  ip6t_REJECT x_tables nf_reject_ipv6 msdos tun nls_utf8
nls_iso8859_2 nls_iso8859_15 nls_iso8859_13 nls_iso8859_1 nls_cp866
nls_cp437 nls_cp1251 dma_shared_buffer ecdh_generic ecc crypto_user
algif_skcipher algif_rng algif_hash algif_aead af_alg sha512_generic
sha256_generic seqiv sha3_generic jitterentropy_rng drbg kpp hmac
ghash_arm_ce geniv rng cmac uas gpio_button_hotplug(O) vfat fat exfat
mii
[   90.736063] CPU: 1 UID: 101 PID: 3059 Comm: hostapd Tainted: G
     O       6.12.92 #0
[   90.736073] Tainted: [O]=OOT_MODULE
[   90.736074] Hardware name: Marvell Armada 380/385 (Device Tree)
[   90.736077] Call trace:
[   90.736082]  unwind_backtrace from show_stack+0x10/0x14
[   90.736094]  show_stack from dump_stack_lvl+0x50/0x64
[   90.736105]  dump_stack_lvl from __warn+0x7c/0xd4
[   90.736116]  __warn from warn_slowpath_fmt+0xf8/0x15c
[   90.736124]  warn_slowpath_fmt from
mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
[   90.736217]  mwifiex_sta_prepare_cmd [mwifiex] from
mwifiex_send_cmd+0x2f4/0x410 [mwifiex]
[   90.736286]  mwifiex_send_cmd [mwifiex] from
mwifiex_send_domain_info_cmd_fw+0x150/0x1b4 [mwifiex]
[   90.736351]  mwifiex_send_domain_info_cmd_fw [mwifiex] from
mwifiex_uap_set_channel+0x100/0x150 [mwifiex]
[   90.736416]  mwifiex_uap_set_channel [mwifiex] from
mwifiex_cfg80211_start_ap+0x12c/0x39c [mwifiex]
[   90.736480]  mwifiex_cfg80211_start_ap [mwifiex] from
nl80211_start_ap+0xa24/0x1048 [cfg80211]
[   90.736607]  nl80211_start_ap [cfg80211] from genl_rcv_msg+0x260/0x3a8
[   90.736670]  genl_rcv_msg from netlink_rcv_skb+0xb8/0x11c
[   90.736681]  netlink_rcv_skb from genl_rcv+0x28/0x34
[   90.736690]  genl_rcv from netlink_unicast+0x22c/0x330
[   90.736698]  netlink_unicast from netlink_sendmsg+0x198/0x3d0
[   90.736707]  netlink_sendmsg from ____sys_sendmsg+0x1cc/0x260
[   90.736717]  ____sys_sendmsg from ___sys_sendmsg+0x6c/0xa4
[   90.736723]  ___sys_sendmsg from __sys_sendmsg+0x5c/0x94
[   90.736732]  __sys_sendmsg from ret_fast_syscall+0x0/0x4c
[   90.736738] Exception stack(0xc4181fa8 to 0xc4181ff0)
[   90.736743] 1fa0:                   00000000 00000000 0000001f
bed78be0 00000000 00000000
[   90.736748] 1fc0: 00000000 00000000 b69d6b90 00000128 00000004
00000001 bed78c34 b69c1cd0
[   90.736751] 1fe0: bed78b90 bed78b80 b6f7a848 b6f79b6c
[   90.736754] ---[ end trace 0000000000000000 ]---

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[George Valkov]

Any update on the progress? Do I need to do or change anything?

On Thu, 16 Jul 2026 at 11:09, George Valkov <gvalkov@gmail.com> wrote:
>
> On Thu, 16 Jul 2026 at 09:55, Dan Carpenter <error27@gmail.com> wrote:
> >
> > On Thu, Jul 16, 2026 at 08:32:46AM +0200, Francesco Dolcini wrote:
> > > On Thu, Jul 16, 2026 at 09:27:23AM +0300, Dan Carpenter wrote:
> > > > On Thu, Jul 16, 2026 at 08:16:38AM +0200, Francesco Dolcini wrote:
> > > > > On Thu, Jul 16, 2026 at 03:17:28AM +0300, Georgi Valkov wrote:
> > > > > > Replace deprecated one-element arrays with flexible array members.
> > > > > > CONFIG_FORTIFY_SOURCE reports the following warning when
> > > > > > one-element arrays are used as variable-length buffers:
> > > > > >
> > > > > > sta_cmd.c:1033 mwifiex_sta_prepare_cmd
> > > > > > memcpy: detected field-spanning write (size 84) of single field
> > > > > > "domain->triplet" at .../marvell/mwifiex/sta_cmd.c:1033 (size 3)
> > > > > >
> > > > > > Convert affected structs to use flexible array members.
> > > > > > - Preserve existing wire layouts.
> > > > > > - Use DECLARE_FLEX_ARRAY() for structs inside affected unions.
> > > > > >
> > > > > > Tested-on: WRT3200ACM, OpenWrt
> > > > > > Signed-off-by: Georgi Valkov <gvalkov@gmail.com>
> > > > >
> > > > > Cc: stable@vger.kernel.org # 6.12+
> > > > > Reviewed-by: Francesco Dolcini <francesco.dolcini@toradex.com>
> > > >
> > > > Are we CCing stable for this sort of thing?  How many FORTIFY_SOURCE
> > > > warnings are still remaining?
> > >
> > > Yes, you are right, my mistake.
> > >
> > > Johannes, please be sure to not have the stable tag in once you apply the
> > > patch.
> >
> > Wait...  No no.  It was a serious question.  I guess these warnings
> > are pretty annoying for a real user on WRT so it's fine to CC stable.
> > I just assumed these warnings were more common still.
>
> When I first saw it, I thought it was a kernel panic.
> There was an unrelated bug before the warning. My other PR fixes it:
> wifi: mwifiex: fix freeze for 60 seconds caused by request_firmware
>
> But after fixing the freeze, the warning remained.
> Next I thought it was a driver crash. To confirm, I added:
> mwifiex_dbg(ERROR) right before and after memcpy(),
> and printed all values in both source and destination:
> - memcpy has copied all data to the destination
> - execution is allowed to continue
> - so it is just a scary warning
>
> I wanted to ask both patches to be backported to stable, but
> at the time I sent them, I did not know that I could insert
> free text between the commit message and the patch.
> I will reply to the other PR and ask them.
>
> Full text of the warning fixed here:
>
> [   90.484902] ------------[ cut here ]------------
> [   90.489549] WARNING: CPU: 1 PID: 3059 at
> backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
> mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
> [   90.503877] memcpy: detected field-spanning write (size 84) of
> single field "domain->triplet" at
> backports-6.18.26/drivers/net/wireless/marvell/mwifiex/sta_cmd.c:1033
> (size 3)
> [   90.519602] Modules linked in: option cdc_mbim uvcvideo usb_wwan
> rndis_host qmi_wwan nft_fib_inet nf_flow_table_inet ftdi_sio
> ebtable_nat ebtable_filter ebtable_broute cdc_ncm cdc_ether xt_time
> xt_tcpmss xt_statistic xt_state xt_nat xt_multiport xt_mark xt_mac
> xt_limit xt_length xt_iprange xt_hl xt_fuzzy(O) xt_ecn xt_dscp
> xt_conntrack xt_comment xt_TEE xt_TCPMSS xt_REDIRECT xt_MASQUERADE
> xt_LOG xt_IPMARK(O) xt_HL xt_FLOWOFFLOAD xt_DSCP xt_CT xt_CLASSIFY
> xt_DELUDE(O) xt_TARPIT(O) ipt_REJECT xt_tcpudp xt_CHAOS(O)
> videobuf2_v4l2 uvc usbserial usbnet ums_usbat ums_sddr55 ums_sddr09
> ums_karma ums_jumpshot ums_isd200 ums_freecom ums_datafab ums_cypress
> ums_alauda rfcomm nft_reject_ipv6 nft_reject_ipv4 nft_reject_inet
> nft_reject_bridge nft_reject nft_redir nft_quota nft_numgen nft_nat
> nft_meta_bridge nft_masq nft_log nft_limit nft_hash nft_flow_offload
> nft_fib_ipv6 nft_fib_ipv4 nft_fib nft_ct nft_compat nft_chain_nat
> nf_tables nf_reject_ipv4 nf_log_syslog nf_flow_table nf_dup_ipv6
> nf_dup_ipv4 nf_conntrack_bridge
> [   90.519758]  mwifiex_sdio(O) mwifiex(O) libcrc32c iptable_nat
> iptable_mangle iptable_filter ipt_ECN ipheth ip_tables hidp ebtables
> ebt_vlan ebt_stp ebt_snat ebt_redirect ebt_pkttype ebt_mark_m ebt_mark
> ebt_limit ebt_ip6 ebt_ip ebt_dnat ebt_arpreply ebt_arp ebt_among
> ebt_802_3 cdc_wdm cdc_acm btmrvl_sdio btmrvl bnep bluetooth
> arptable_filter arpt_mangle arp_tables fuse ntfs3 videobuf2_vmalloc
> videobuf2_memops videobuf2_common hid videodev mc evdev input_core
> mwlwifi(O) mac80211(O) cfg80211(O) compat(O) cryptodev(O) xt_set
> ip_set_list_set ip_set_hash_netportnet ip_set_hash_netport
> ip_set_hash_netnet ip_set_hash_netiface ip_set_hash_net
> ip_set_hash_mac ip_set_hash_ipportnet ip_set_hash_ipportip
> ip_set_hash_ipport ip_set_hash_ipmark ip_set_hash_ipmac ip_set_hash_ip
> ip_set_bitmap_port ip_set_bitmap_ipmac ip_set_bitmap_ip ip_set
> nfnetlink ip6table_nat nf_nat nf_conntrack nf_defrag_ipv6
> nf_defrag_ipv4 ip6t_NPT ip6t_rt ip6t_mh ip6t_ipv6header ip6t_hbh
> ip6t_frag ip6t_eui64 ip6t_ah ip6table_mangle ip6table_filter
> ip6_tables
> [   90.609354]  ip6t_REJECT x_tables nf_reject_ipv6 msdos tun nls_utf8
> nls_iso8859_2 nls_iso8859_15 nls_iso8859_13 nls_iso8859_1 nls_cp866
> nls_cp437 nls_cp1251 dma_shared_buffer ecdh_generic ecc crypto_user
> algif_skcipher algif_rng algif_hash algif_aead af_alg sha512_generic
> sha256_generic seqiv sha3_generic jitterentropy_rng drbg kpp hmac
> ghash_arm_ce geniv rng cmac uas gpio_button_hotplug(O) vfat fat exfat
> mii
> [   90.736063] CPU: 1 UID: 101 PID: 3059 Comm: hostapd Tainted: G
>      O       6.12.92 #0
> [   90.736073] Tainted: [O]=OOT_MODULE
> [   90.736074] Hardware name: Marvell Armada 380/385 (Device Tree)
> [   90.736077] Call trace:
> [   90.736082]  unwind_backtrace from show_stack+0x10/0x14
> [   90.736094]  show_stack from dump_stack_lvl+0x50/0x64
> [   90.736105]  dump_stack_lvl from __warn+0x7c/0xd4
> [   90.736116]  __warn from warn_slowpath_fmt+0xf8/0x15c
> [   90.736124]  warn_slowpath_fmt from
> mwifiex_sta_prepare_cmd+0x1904/0x19b0 [mwifiex]
> [   90.736217]  mwifiex_sta_prepare_cmd [mwifiex] from
> mwifiex_send_cmd+0x2f4/0x410 [mwifiex]
> [   90.736286]  mwifiex_send_cmd [mwifiex] from
> mwifiex_send_domain_info_cmd_fw+0x150/0x1b4 [mwifiex]
> [   90.736351]  mwifiex_send_domain_info_cmd_fw [mwifiex] from
> mwifiex_uap_set_channel+0x100/0x150 [mwifiex]
> [   90.736416]  mwifiex_uap_set_channel [mwifiex] from
> mwifiex_cfg80211_start_ap+0x12c/0x39c [mwifiex]
> [   90.736480]  mwifiex_cfg80211_start_ap [mwifiex] from
> nl80211_start_ap+0xa24/0x1048 [cfg80211]
> [   90.736607]  nl80211_start_ap [cfg80211] from genl_rcv_msg+0x260/0x3a8
> [   90.736670]  genl_rcv_msg from netlink_rcv_skb+0xb8/0x11c
> [   90.736681]  netlink_rcv_skb from genl_rcv+0x28/0x34
> [   90.736690]  genl_rcv from netlink_unicast+0x22c/0x330
> [   90.736698]  netlink_unicast from netlink_sendmsg+0x198/0x3d0
> [   90.736707]  netlink_sendmsg from ____sys_sendmsg+0x1cc/0x260
> [   90.736717]  ____sys_sendmsg from ___sys_sendmsg+0x6c/0xa4
> [   90.736723]  ___sys_sendmsg from __sys_sendmsg+0x5c/0x94
> [   90.736732]  __sys_sendmsg from ret_fast_syscall+0x0/0x4c
> [   90.736738] Exception stack(0xc4181fa8 to 0xc4181ff0)
> [   90.736743] 1fa0:                   00000000 00000000 0000001f
> bed78be0 00000000 00000000
> [   90.736748] 1fc0: 00000000 00000000 b69d6b90 00000128 00000004
> 00000001 bed78c34 b69c1cd0
> [   90.736751] 1fe0: bed78b90 bed78b80 b6f7a848 b6f79b6c
> [   90.736754] ---[ end trace 0000000000000000 ]---

Re: [PATCH v3] wifi: mwifiex: replace one-element arrays with flexible array members

[Brian Norris]

On Mon, Jul 27, 2026 at 03:16:54PM +0300, George Valkov wrote:
> Any update on the progress? Do I need to do or change anything?

Your patch was merged for the next release on July 21. This process is
(unfortunately, IMO) silent in wireless land, but it is reflected in
Patchwork. You can see its status here:

https://patchwork.kernel.org/project/linux-wireless/patch/20260716001728.57799-1-gvalkov@gmail.com/

You can also see, for example, that v1 was marked "superseded":

https://patchwork.kernel.org/project/linux-wireless/patch/20260712222334.7134-1-gvalkov@gmail.com/

You didn't send v2 in the appropriate format, so it didn't get logged on
Patchwork.

Regards,
Brian