github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-11-06 21:58:01 +01:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph

wifi: mac80211: tests: fix stack variable bug

Browse Source 
The code in mac80211 assumes that BSS entries are
allocated together with the struct ieee80211_bss
internal data, but the test didn't do that, which
with clang 23 resulted in a KASAN splat here. Fix
the code to properly have both structs.

Fix the allocation while at it, should be the ies
struct size, not the cbss.

Link: https://patch.msgid.link/20261013151329.b8135eb40430.I97a6cb689fbc19903c78e2f6dfe37bdc2117b605@changeid
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
This commit is contained in:
Johannes Berg 2026-10-13 15:13:29 +02:00
parent 313f802d6f
commit a919316bbb
1 changed files with 11 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

19
net/mac80211/tests/chan-mode.c
View File

@ -153,8 +153,11 @@ static void test_determine_chan_mode(struct kunit *test)
.mode = params->conn_mode,
.bw_limit = params->conn_bw_limit,
};
struct cfg80211_bss cbss = {
.channel = &t_sdata->band_5ghz.channels[0],
struct {
struct cfg80211_bss cbss;
struct ieee80211_bss internal;
} bss = {
.cbss.channel = &t_sdata->band_5ghz.channels[0],
};
unsigned long userspace_selectors[BITS_TO_LONGS(128)] = {};
u8 bss_ies[] = {
@ -229,18 +232,18 @@ static void test_determine_chan_mode(struct kunit *test)
if (params->userspace_selector)
set_bit(params->userspace_selector, userspace_selectors);
rcu_assign_pointer(cbss.ies,
rcu_assign_pointer(bss.cbss.ies,
kunit_kzalloc(test,
sizeof(cbss) + sizeof(bss_ies),
sizeof(*bss.cbss.ies) + sizeof(bss_ies),
GFP_KERNEL));
KUNIT_ASSERT_NOT_NULL(test, rcu_access_pointer(cbss.ies));
((struct cfg80211_bss_ies *)rcu_access_pointer(cbss.ies))->len = sizeof(bss_ies);
KUNIT_ASSERT_NOT_NULL(test, rcu_access_pointer(bss.cbss.ies));
((struct cfg80211_bss_ies *)rcu_access_pointer(bss.cbss.ies))->len = sizeof(bss_ies);
memcpy((void *)rcu_access_pointer(cbss.ies)->data, bss_ies,
memcpy((void *)rcu_access_pointer(bss.cbss.ies)->data, bss_ies,
sizeof(bss_ies));
rcu_read_lock();
elems = ieee80211_determine_chan_mode(t_sdata->sdata, &conn, &cbss,
elems = ieee80211_determine_chan_mode(t_sdata->sdata, &conn, &bss.cbss,
NULL, 0, &chanreq, &ap_chandef,
userspace_selectors);
rcu_read_unlock();