• Kees Cook's avatar
    wifi: iwlwifi: calib: Refactor iwl_calib_result usage for clarity · 0d24201f
    Kees Cook authored
    In preparation for FORTIFY_SOURCE performing run-time destination buffer
    bounds checking for memcpy(), refactor the use of struct iwl_calib_result:
    
    - Have struct iwl_calib_result contain struct iwl_calib_cmd since
      functions expect to operate on the "data" flex array in "cmd", which
      follows the "hdr" member.
    - Switch argument passing around to use struct iwl_calib_cmd instead of
      struct iwl_calib_hdr to prepare functions to see the "data" member.
    - Change iwl_calib_set()'s "len" argument to a size_t since it is always
      unsigned and is normally receiving the output of sizeof().
    - Add an explicit length sanity check in iwl_calib_set().
    - Adjust the memcpy() to avoid copying across the now visible composite
      flex array structure.
    
    This avoids the future run-time warning:
    
      memcpy: detected field-spanning write (size 8) of single field "&res->hdr" (size 4)
    
    Cc: Luca Coelho <luciano.coelho@intel.com>
    Cc: Kalle Valo <kvalo@codeaurora.org>
    Cc: "David S. Miller" <davem@davemloft.net>
    Cc: Jakub Kicinski <kuba@kernel.org>
    Cc: Lee Jones <lee.jones@linaro.org>
    Cc: Johannes Berg <johannes.berg@intel.com>
    Cc: linux-wireless@vger.kernel.org
    Cc: netdev@vger.kernel.org
    Reported-by: default avatarAndy Lavr <andy.lavr@gmail.com>
    Signed-off-by: default avatarKees Cook <keescook@chromium.org>
    Signed-off-by: default avatarKalle Valo <kvalo@kernel.org>
    Link: https://lore.kernel.org/r/20220901204558.2256458-1-keescook@chromium.org
    0d24201f
ucode.c 11.1 KB