OSDN Git Service

mac80211: Use memset_after() to clear tx status
authorKees Cook <keescook@chromium.org>
Thu, 18 Nov 2021 20:38:39 +0000 (12:38 -0800)
committerJohannes Berg <johannes.berg@intel.com>
Fri, 26 Nov 2021 10:54:03 +0000 (11:54 +0100)
commitfb5f6a0e8063b7a84d6d44ef353846ccd7708d2e
tree80855ee79eca1dbf02442ae112e37ce3b3924867
parenteb87d3e08992b2939d91b649630dfa11f4d2cd75
mac80211: Use memset_after() to clear tx status

In preparation for FORTIFY_SOURCE performing compile-time and run-time
field bounds checking for memset(), avoid intentionally writing across
neighboring fields.

Use memset_after() so memset() doesn't get confused about writing
beyond the destination member that is intended to be the starting point
of zeroing through the end of the struct.

Additionally fix the common helper, ieee80211_tx_info_clear_status(),
which was not clearing ack_signal, but the open-coded versions
did. Johannes Berg points out this bug was introduced by commit
e3e1a0bcb3f1 ("mac80211: reduce IEEE80211_TX_MAX_RATES") but was harmless.

Also drops the associated unneeded BUILD_BUG_ON()s, and adds a note to
carl9170 about usage.

Signed-off-by: Kees Cook <keescook@chromium.org>
Tested-by: Christian Lamparter <chunkeey@gmail.com> [both CARL9170+P54USB on real HW]
Link: https://lore.kernel.org/r/20211118203839.1289276-1-keescook@chromium.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
drivers/net/wireless/ath/carl9170/tx.c
drivers/net/wireless/intersil/p54/txrx.c
include/net/mac80211.h