Re: [PATCH v2] wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

Hello everyone, On Tue, Oct 29, 2024 at 01:22:11PM +, Aleksei Vetrov wrote: > The channels array in the cfg80211_scan_request has a __counted_by > attribute attached to it, which points to the n_channels variable. This > attribute is used in bounds checking, and if it is not set before the > a

Re: [PATCH v2] wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

On Mon, Nov 04, 2024 at 09:10:15AM -0800, Jeff Johnson wrote: > It has not slipped through the cracks, it is being tracked in patchwork: > https://patchwork.kernel.org/project/linux-wireless/patch/20241029-nl80211_parse_sched_scan-bounds-checker-fix-v2-1-c804b7873...@google.com/ Today I learned of

Re: [PATCH 0/5] TQ-Systems TQMa62xx SoM and MBa62xx board

On Mon, 04 Nov 2024 10:47:23 +0100, Matthias Schiffer wrote: > This adds Device Trees for out AM62x-based SoM TQMa62xx and its > reference carrier board MBa62xx. > > Two of the patches are adapted from the TI vendor repo ti-linux-kernel to > add RemoteProc/RPMsg support for the R5F core. A simil

Re: [PATCH v2] wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

On 10/29/2024 6:22 AM, Aleksei Vetrov wrote: > The channels array in the cfg80211_scan_request has a __counted_by > attribute attached to it, which points to the n_channels variable. This > attribute is used in bounds checking, and if it is not set before the > array is filled, then the bounds sani

Re: [PATCH v2] wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

On 11/4/2024 8:10 AM, Aleksei Vetrov wrote: > Hello everyone, > > On Tue, Oct 29, 2024 at 01:22:11PM +, Aleksei Vetrov wrote: >> The channels array in the cfg80211_scan_request has a __counted_by >> attribute attached to it, which points to the n_channels variable. This >> attribute is used in

Re: [PATCH v2] wifi: nl80211: fix bounds checker error in nl80211_parse_sched_scan

On Mon, Nov 04, 2024 at 09:12:09AM -0800, Jeff Johnson wrote: > Reviewed-by: Jeff Johnson > > And it is exactly this kind of issue why I'm not accepting any __counted_by() > changes in ath.git without actually testing the code that is modified. However, I was really lucky that my setup used nl80

Re: [PATCH 1/5] dt-bindings: usb: dwc3: Allow connector in USB controller node

On Mon, Nov 04, 2024 at 10:47:24AM +0100, Matthias Schiffer wrote: > Allow specifying the connector directly in the USB controller node, as > supported by other USB controller bindings. > > Signed-off-by: Matthias Schiffer Acked-by: Conor Dooley signature.asc Description: PGP signature

[PATCH RFC 1/5] Revert "net: dev: Convert sa_data to flexible array in struct sockaddr"

This reverts commit b5f0de6df6dce8d641ef58ef7012f3304dffb9a1. Signed-off-by: Kees Cook --- include/linux/socket.h | 5 + net/core/dev.c | 2 +- net/core/dev_ioctl.c | 2 +- net/ipv4/arp.c | 2 +- net/packet/af_packet.c | 10 +- 5 files changed, 9 insertions(+),

[PATCH RFC 4/5] net: core: Convert inet_addr_is_any() to sockaddr_storage

All the callers of inet_addr_is_any() have a sockaddr_storage-backed sockaddr. Avoid casts and switch prototype to the actual object being used. Signed-off-by: Kees Cook --- drivers/nvme/target/rdma.c | 2 +- drivers/nvme/target/tcp.c | 2 +- drivers/target/iscsi/iscsi_target.

[PATCH RFC 0/5] sockaddr usage removal

(I removed the explicit CC list because it was huge...) Hi, This is strictly an RFC -- it's not a complete removal of sockaddr at all, but it explores what's involved. Some things are easy (e.g. the first 3 patches), and some is very involved (last patch). For the most part, the proto_ops::getna

[PATCH RFC 3/5] rtnetlink: do_setlink: Use sockaddr_storage

Instead of a heap allocation use a stack allocated sockaddr_storage to support arbitrary length addr_len value (but bounds check it against the maximum address length). Signed-off-by: Kees Cook --- net/core/rtnetlink.c | 12 1 file changed, 4 insertions(+), 8 deletions(-) diff --gi

[PATCH RFC 2/5] net: core: dev.c confirmed to use classic sockaddr

Add comments about the sockaddr arguments being actual classic "max 14 bytes in sa_data" sockaddr. Signed-off-by: Kees Cook --- net/core/dev.c | 5 - 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/net/core/dev.c b/net/core/dev.c index 582466a0176a..c95779cb42a6 100644 --- a/net

[PATCH RFC 5/5] net: Convert proto_ops::getname to sockaddr_storage

The proto_ops::getname callback was long ago backed by sockaddr_storage, but the replacement of it for sockaddr was never done. Plumb sockaddr_storage through all the getname callbacks and adjust prototypes and needed casts. Mostly casts to sockaddr are removed, though to avoid spilling this change

Re: [PATCH 2/5] dt-bindings: arm: ti: Add compatible for AM625-based TQMa62xx SOM family and carrier board

On Mon, Nov 04, 2024 at 10:47:25AM +0100, Matthias Schiffer wrote: > The TQMa62xx is a SoM family with a pluggable connector. The MBa62xx is > the matching reference/starterkit carrier board. Why all the wildcards? Why isn't there a compatible per device in the family? > > Signed-off-by: Matthia

[RESEND PATCH] ext4: Annotate struct fname with __counted_by()

Add the __counted_by compiler attribute to the flexible array member name to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and CONFIG_FORTIFY_SOURCE. Inline and use struct_size() to calculate the number of bytes to allocate for new_fn and remove the local variable len. Reviewed-by: Jan K

[PATCH 0/5] TQ-Systems TQMa62xx SoM and MBa62xx board

This adds Device Trees for out AM62x-based SoM TQMa62xx and its reference carrier board MBa62xx. Two of the patches are adapted from the TI vendor repo ti-linux-kernel to add RemoteProc/RPMsg support for the R5F core. A similar patch has been submitted for mainline by TI themselves for the closely

Re: [PATCH v2][next] jbd2: Avoid dozens of -Wflex-array-member-not-at-end warnings

On Fri 01-11-24 14:45:23, Gustavo A. R. Silva wrote: > -Wflex-array-member-not-at-end was introduced in GCC-14, and we > are getting ready to enable it, globally. > > Use the `DEFINE_RAW_FLEX()` helper for an on-stack definition of > a flexible structure (`struct shash_desc`) where the size of the

[PATCH 5/5] arm64: dts: ti: Add TQ-Systems TQMa62xx SoM and MBa62xx carrier board Device Trees

The TQMa62xx is a SoM family with a pluggable board connector based on the TI AM62x SoCs. Add DTS(I) for the AM625 (2x Cortex-A53) variant and its combination with our MBa62xx carrier board. Signed-off-by: Matthias Schiffer --- arch/arm64/boot/dts/ti/Makefile | 1 + .../boot/dts/

[PATCH 4/5] arm64: dts: ti: k3-am62-wakeup: Add R5F device node

From: Hari Nagalla AM62 SoCs have a single core R5F core in wakeup domain. This core is also used as a device manager for the SoC. Co-authored-by: Devarsh Thakkar Signed-off-by: Hari Nagalla [Matthias Schiffer: Updated to match latest submitted version v5 of "arm64: dts: k3-am62a-wakeup: Add R

[PATCH 3/5] arm64: dts: ti: k3-am62: Add DM R5 ranges in cbass

From: Devarsh Thakkar Add DM R5F ATCM and BTCM ranges in cbass_wakeup and cbass_main. Signed-off-by: Devarsh Thakkar Signed-off-by: Dhruva Gole Signed-off-by: Matthias Schiffer --- arch/arm64/boot/dts/ti/k3-am62.dtsi | 8 ++-- 1 file changed, 6 insertions(+), 2 deletions(-) diff --git a

[PATCH 1/5] dt-bindings: usb: dwc3: Allow connector in USB controller node

Allow specifying the connector directly in the USB controller node, as supported by other USB controller bindings. Signed-off-by: Matthias Schiffer --- Documentation/devicetree/bindings/usb/snps,dwc3.yaml | 6 ++ 1 file changed, 6 insertions(+) diff --git a/Documentation/devicetree/bindings

[PATCH 2/5] dt-bindings: arm: ti: Add compatible for AM625-based TQMa62xx SOM family and carrier board

The TQMa62xx is a SoM family with a pluggable connector. The MBa62xx is the matching reference/starterkit carrier board. Signed-off-by: Matthias Schiffer --- Documentation/devicetree/bindings/arm/ti/k3.yaml | 7 +++ 1 file changed, 7 insertions(+) diff --git a/Documentation/devicetree/bindi