From 0322e28220ba5464205911584f1fb4bcccedda66 Mon Sep 17 00:00:00 2001 From: Shelley Yang Date: Thu, 24 Apr 2025 22:20:33 -0500 Subject: [PATCH] brcmfmac: offload: p2p: fix kernel warning 1. offload: it happened when auth pkt rx for SAE fixed the kernel warning by unsafe_memcpy. ------------[ cut here ]------------ [16631.273380] memcpy: detected field-spanning write (size 104) of single field "&mgmt_frame->u" at /var/tmp/gitlab-runner/builds/y-R5mxtP/0/jenkinswlan/fmac/fmac-x86_64-release/fmac_build_scripts/v6.1.110-backports/drivers/net/wireless/infineon/inffmac/cfg80211.c:8395 (size 26) [16631.273391] WARNING: CPU: 9 PID: 136691 at /var/tmp/gitlab-runner/builds/y-R5mxtP/0/jenkinswlan/fmac/fmac-x86_64-release/fmac_build_scripts/v6.1.110-backports/drivers/net/wireless/infineon/inffmac/cfg80211.c:8395 inff_notify_auth_frame_rx+0x1b8/0x210 [inffmac] 2. p2p: it happened when receive action frame [120238.982996] ------------[ cut here ]------------ [120238.982999] memcpy: detected field-spanning write (size 115) of single field "&mgmt_frame->u" at /var/tmp/gitlab-runner/builds/y-R5mxtP/0/jenkinswlan/fmac/fmac-x86_64-release/fmac_build_scripts/v6.1.110-backports/drivers/net/wireless/infineon/inffmac/p2p.c:1514 (size 26) [120238.983010] WARNING: CPU: 9 PID: 185084 at /var/tmp/gitlab-runner/builds/y-R5mxtP/0/jenkinswlan/fmac/fmac-x86_64-release/fmac_build_scripts/v6.1.110-backports/drivers/net/wireless/infineon/inffmac/p2p.c:1514 inff_p2p_notify_action_frame_rx+0x343/0x3c0 [inffmac] Fixes SWLINUX-5168 Fixes SWLINUX-5187 Signed-off-by: Shelley Yang --- drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h | 5 +++++ drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c | 4 +++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h index 935291b..746d074 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/common.h @@ -28,6 +28,11 @@ #define SDIO_SDMODE_4BIT BIT(5) /* Set 4-bit Bus mode */ #endif /* !SDIO_IDLECLOCK_DIS */ +#ifndef unsafe_memcpy +#define unsafe_memcpy(dst, src, bytes, justification) \ + memcpy(dst, src, bytes) +#endif + /* Definitions for the module global and device specific settings are defined * here. Two structs are used for them. brcmf_mp_global_t and brcmf_mp_device. * The mp_global is instantiated once in a global struct and gets initialized diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c index 2cb0fb6..1ab6116 100644 --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/p2p.c @@ -18,6 +18,7 @@ #include "p2p.h" #include "cfg80211.h" #include "feature.h" +#include "common.h" /* parameters used for p2p escan */ #define P2PAPI_SCAN_NPROBES 1 @@ -1510,7 +1511,8 @@ int brcmf_p2p_notify_action_frame_rx(struct brcmf_if *ifp, ETH_ALEN); memcpy(mgmt_frame->sa, e->addr, ETH_ALEN); mgmt_frame->frame_control = cpu_to_le16(IEEE80211_STYPE_ACTION); - memcpy(mgmt_frame->u.body, frame, mgmt_frame_len); + unsafe_memcpy(&mgmt_frame->u, frame, mgmt_frame_len, + /* alloc enough buf*/); mgmt_frame_len += offsetof(struct ieee80211_mgmt, u.body); freq = ieee80211_channel_to_frequency(ch.control_ch_num, -- 2.25.1