From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id B11C113A26F; Tue, 27 Feb 2024 14:09:16 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709042956; cv=none; b=Rh3nAnuvLhvpP1pnnEOPFHUD/+tKqbRczrLL+4lxK5XhwOL00W07iV6ipymzP0lNEdoqrhoeKRCnfftWDP1Qmd3CiTv7czOtUaXOI98bdWMxMwEg80rA5UCY7pbi0P8dtgqF09ASJAjAvWFtS8KPKols2biFwqFa2Q57ENNW4Jk= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1709042956; c=relaxed/simple; bh=tt5UnjcRr+xln9KhRL3f9FzSuIM4RUb/+ctUxpBEl90=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=OmSa0jo8smtURjx+yARbaHs1WQZmi4UVJ4KmtBJxdlstBDutbIpeThdCAYWLw3B+cZui2vTt43TFCjJHSjQLR9BY9YRWR+NuevC6gM1fkcfCDIIW8UwUfnIkTqv+2Hg7c2xYb98LD+/l9IY2ZV6QmAhWf1R4iB2lpH77Scx6el4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=fj9uZ4cZ; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="fj9uZ4cZ" Received: by smtp.kernel.org (Postfix) with ESMTPSA id E07E6C433C7; Tue, 27 Feb 2024 14:09:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1709042956; bh=tt5UnjcRr+xln9KhRL3f9FzSuIM4RUb/+ctUxpBEl90=; h=From:To:Cc:Subject:Date:In-Reply-To:References:From; b=fj9uZ4cZPuI08kB/LegnDbO8xe4UOYrnj/p/WR42f1s7wmBuUCCDKbJgOH8dkhAxX g41pnTh32/GIaf7LtvplVKZbVBNnbjhlFMoxHa2WhPSay/CWc/GOOnNgw8gM8tUasA kQkPTTUccAsvvlT9d2i5J+cAid2zhVjHtQIihypA= From: Greg Kroah-Hartman To: stable@vger.kernel.org Cc: Greg Kroah-Hartman , patches@lists.linux.dev, "Gustavo A. R. Silva" , Simon Horman , Johannes Berg , Sasha Levin Subject: [PATCH 5.15 180/245] wifi: wext-core: Fix -Wstringop-overflow warning in ioctl_standard_iw_point() Date: Tue, 27 Feb 2024 14:26:08 +0100 Message-ID: <20240227131621.058829126@linuxfoundation.org> X-Mailer: git-send-email 2.44.0 In-Reply-To: <20240227131615.098467438@linuxfoundation.org> References: <20240227131615.098467438@linuxfoundation.org> User-Agent: quilt/0.67 X-stable: review X-Patchwork-Hint: ignore Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit 5.15-stable review patch. If anyone has any objections, please let me know. ------------------ From: Gustavo A. R. Silva [ Upstream commit 71e7552c90db2a2767f5c17c7ec72296b0d92061 ] -Wstringop-overflow is legitimately warning us about extra_size pontentially being zero at some point, hence potenially ending up _allocating_ zero bytes of memory for extra pointer and then trying to access such object in a call to copy_from_user(). Fix this by adding a sanity check to ensure we never end up trying to allocate zero bytes of data for extra pointer, before continue executing the rest of the code in the function. Address the following -Wstringop-overflow warning seen when built m68k architecture with allyesconfig configuration: from net/wireless/wext-core.c:11: In function '_copy_from_user', inlined from 'copy_from_user' at include/linux/uaccess.h:183:7, inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:825:7: arch/m68k/include/asm/string.h:48:25: warning: '__builtin_memset' writing 1 or more bytes into a region of size 0 overflows the destination [-Wstringop-overflow=] 48 | #define memset(d, c, n) __builtin_memset(d, c, n) | ^~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/uaccess.h:153:17: note: in expansion of macro 'memset' 153 | memset(to + (n - res), 0, res); | ^~~~~~ In function 'kmalloc', inlined from 'kzalloc' at include/linux/slab.h:694:9, inlined from 'ioctl_standard_iw_point' at net/wireless/wext-core.c:819:10: include/linux/slab.h:577:16: note: at offset 1 into destination object of size 0 allocated by '__kmalloc' 577 | return __kmalloc(size, flags); | ^~~~~~~~~~~~~~~~~~~~~~ This help with the ongoing efforts to globally enable -Wstringop-overflow. Link: https://github.com/KSPP/linux/issues/315 Signed-off-by: Gustavo A. R. Silva Reviewed-by: Simon Horman Link: https://lore.kernel.org/r/ZItSlzvIpjdjNfd8@work Signed-off-by: Johannes Berg Signed-off-by: Sasha Levin --- net/wireless/wext-core.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/net/wireless/wext-core.c b/net/wireless/wext-core.c index fe8765c4075d3..8a4b85f96a13a 100644 --- a/net/wireless/wext-core.c +++ b/net/wireless/wext-core.c @@ -799,6 +799,12 @@ static int ioctl_standard_iw_point(struct iw_point *iwp, unsigned int cmd, } } + /* Sanity-check to ensure we never end up _allocating_ zero + * bytes of data for extra. + */ + if (extra_size <= 0) + return -EFAULT; + /* kzalloc() ensures NULL-termination for essid_compat. */ extra = kzalloc(extra_size, GFP_KERNEL); if (!extra) -- 2.43.0