[PATCH 08/32] iwlwifi: mvm: Use mem_to_flex_dup() with struct ieee80211_key_conf

[Kees Cook]

As part of the work to perform bounds checking on all memcpy() uses,
replace the open-coded a deserialization of bytes out of memory into a
trailing flexible array by using a flex_array.h helper to perform the
allocation, bounds checking, and copying.

Cc: Luca Coelho <luciano.coe...@intel.com>
Cc: Kalle Valo <kv...@kernel.org>
Cc: "David S. Miller" <da...@davemloft.net>
Cc: Jakub Kicinski <k...@kernel.org>
Cc: Paolo Abeni <pab...@redhat.com>
Cc: Johannes Berg <johan...@sipsolutions.net>
Cc: Gregory Greenman <gregory.green...@intel.com>
Cc: Eric Dumazet <eduma...@google.com>
Cc: linux-wirel...@vger.kernel.org
Cc: net...@vger.kernel.org
Signed-off-by: Kees Cook <keesc...@chromium.org>
---
 drivers/net/wireless/intel/iwlwifi/mvm/sta.c | 8 ++------
 include/net/mac80211.h                       | 4 ++--
 2 files changed, 4 insertions(+), 8 deletions(-)

diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c 
b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
index 406f0a50a5bf..23cade528dcf 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/sta.c
@@ -4108,7 +4108,7 @@ int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct 
ieee80211_vif *vif,
        int ret;
        u16 queue;
        struct iwl_mvm_vif *mvmvif = iwl_mvm_vif_from_mac80211(vif);
-       struct ieee80211_key_conf *keyconf;
+       struct ieee80211_key_conf *keyconf = NULL;
 
        ret = iwl_mvm_allocate_int_sta(mvm, sta, 0,
                                       NL80211_IFTYPE_UNSPECIFIED,
@@ -4122,15 +4122,11 @@ int iwl_mvm_add_pasn_sta(struct iwl_mvm *mvm, struct 
ieee80211_vif *vif,
        if (ret)
                goto out;
 
-       keyconf = kzalloc(sizeof(*keyconf) + key_len, GFP_KERNEL);
-       if (!keyconf) {
+       if (mem_to_flex_dup(&keyconf, key, key_len, GFP_KERNEL)) {
                ret = -ENOBUFS;
                goto out;
        }
-
        keyconf->cipher = cipher;
-       memcpy(keyconf->key, key, key_len);
-       keyconf->keylen = key_len;
 
        ret = iwl_mvm_send_sta_key(mvm, sta->sta_id, keyconf, false,
                                   0, NULL, 0, 0, true);
diff --git a/include/net/mac80211.h b/include/net/mac80211.h
index 75880fc70700..4abe52963a96 100644
--- a/include/net/mac80211.h
+++ b/include/net/mac80211.h
@@ -1890,8 +1890,8 @@ struct ieee80211_key_conf {
        u8 hw_key_idx;
        s8 keyidx;
        u16 flags;
-       u8 keylen;
-       u8 key[];
+       DECLARE_FLEX_ARRAY_ELEMENTS_COUNT(u8, keylen);
+       DECLARE_FLEX_ARRAY_ELEMENTS(u8, key);
 };
 
 #define IEEE80211_MAX_PN_LEN   16
-- 
2.32.0