Fixes for 6.6

Signed-off-by: Sasha Levin <sashal@kernel.org>

diff --git a/queue-6.6/series b/queue-6.6/series
index 6d2bf29293fbaa8e0e2cfb8c9458ac340757d85a..e6818a2f19744405d27b0b809da23d3cf269f6c5 100644 (file)
--- a/queue-6.6/series
+++ b/queue-6.6/series
@@ -12,3 +12,4 @@ pinctrl-rockchip-fix-pinmux-reset-in-rockchip_pmx_se.patch
 mips-pci-lantiq-restore-reset-gpio-polarity.patch
 selftests-mptcp-print_test-out-of-verify_listener_ev.patch
 selftests-mptcp-userspace_pm-fixed-subtest-names.patch
+wifi-mac80211-use-flexible-array-in-struct-ieee80211.patch

diff --git a/queue-6.6/wifi-mac80211-use-flexible-array-in-struct-ieee80211.patch b/queue-6.6/wifi-mac80211-use-flexible-array-in-struct-ieee80211.patch
new file mode 100644 (file)
index 0000000..68977fb
--- /dev/null
+++ b/queue-6.6/wifi-mac80211-use-flexible-array-in-struct-ieee80211.patch
@@ -0,0 +1,68 @@
+From 3efa7f3afd74f2156259cf0f1d177fcf3b9bfa7c Mon Sep 17 00:00:00 2001
+From: Sasha Levin <sashal@kernel.org>
+Date: Thu, 31 Aug 2023 11:22:58 -0700
+Subject: wifi: mac80211: Use flexible array in struct ieee80211_tim_ie
+
+From: Jeff Johnson <quic_jjohnson@quicinc.com>
+
+[ Upstream commit 2ae5c9248e06dac2c2360be26b4e25f673238337 ]
+
+Currently struct ieee80211_tim_ie defines:
+       u8 virtual_map[1];
+
+Per the guidance in [1] change this to be a flexible array.
+
+Per the discussion in [2] wrap the virtual_map in a union with a u8
+item in order to preserve the existing expectation that the
+virtual_map must contain at least one octet (at least when used in a
+non-S1G PPDU). This means that no driver changes are required.
+
+[1] https://docs.kernel.org/process/deprecated.html#zero-length-and-one-element-arrays
+[2] https://lore.kernel.org/linux-wireless/202308301529.AC90A9EF98@keescook/
+
+Suggested-by: Kees Cook <keescook@chromium.org>
+Signed-off-by: Jeff Johnson <quic_jjohnson@quicinc.com>
+Reviewed-by: Kees Cook <keescook@chromium.org>
+Link: https://lore.kernel.org/r/20230831-ieee80211_tim_ie-v3-2-e10ff584ab5d@quicinc.com
+[add wifi prefix]
+Signed-off-by: Johannes Berg <johannes.berg@intel.com>
+Signed-off-by: Sasha Levin <sashal@kernel.org>
+---
+ include/linux/ieee80211.h | 13 ++++++++++---
+ 1 file changed, 10 insertions(+), 3 deletions(-)
+
+diff --git a/include/linux/ieee80211.h b/include/linux/ieee80211.h
+index aaaa5b90bfe25..5fbc08930941c 100644
+--- a/include/linux/ieee80211.h
++++ b/include/linux/ieee80211.h
+@@ -951,17 +951,24 @@ struct ieee80211_wide_bw_chansw_ie {
+  * @dtim_count: DTIM Count
+  * @dtim_period: DTIM Period
+  * @bitmap_ctrl: Bitmap Control
++ * @required_octet: "Syntatic sugar" to force the struct size to the
++ *                  minimum valid size when carried in a non-S1G PPDU
+  * @virtual_map: Partial Virtual Bitmap
+  *
+  * This structure represents the payload of the "TIM element" as
+- * described in IEEE Std 802.11-2020 section 9.4.2.5.
++ * described in IEEE Std 802.11-2020 section 9.4.2.5. Note that this
++ * definition is only applicable when the element is carried in a
++ * non-S1G PPDU. When the TIM is carried in an S1G PPDU, the Bitmap
++ * Control and Partial Virtual Bitmap may not be present.
+  */
+ struct ieee80211_tim_ie {
+       u8 dtim_count;
+       u8 dtim_period;
+       u8 bitmap_ctrl;
+-      /* variable size: 1 - 251 bytes */
+-      u8 virtual_map[1];
++      union {
++              u8 required_octet;
++              DECLARE_FLEX_ARRAY(u8, virtual_map);
++      };
+ } __packed;
+ 
+ /**
+-- 
+2.43.0
+