wifi: brcmfmac: Adjust n_channels usage for __counted_by

[PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Kees Cook 1 year, 11 months ago

After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
cfg80211_scan_request with __counted_by"), the compiler may enforce
dynamic array indexing of req->channels to stay below n_channels. As a
result, n_channels needs to be increased _before_ accessing the newly
added array index. Increment it first, then use "i" for the prior index.
Solves this warning in the coming GCC that has __counted_by support:

../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
n_channels' may be undefined [-Wsequence-point]
 3783 |                 req->channels[req->n_channels++] = chan;
      |                               ~~~~~~~~~~~~~~~^~

Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
Cc: Arend van Spriel <aspriel@gmail.com>
Cc: Franky Lin <franky.lin@broadcom.com>
Cc: Hante Meuleman <hante.meuleman@broadcom.com>
Cc: Kalle Valo <kvalo@kernel.org>
Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
Cc: Ian Lin <ian.lin@infineon.com>
Cc: Johannes Berg <johannes.berg@intel.com>
Cc: Wright Feng <wright.feng@cypress.com>
Cc: Hector Martin <marcan@marcan.st>
Cc: linux-wireless@vger.kernel.org
Cc: brcm80211-dev-list.pdl@broadcom.com
Signed-off-by: Kees Cook <keescook@chromium.org>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 133c5ea6429c..28d6a30cc010 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
 		if (req->channels[i] == chan)
 			break;
 	}
-	if (i == req->n_channels)
-		req->channels[req->n_channels++] = chan;
+	if (i == req->n_channels) {
+		req->n_channels++;
+		req->channels[i] = chan;
+	}
 
 	for (i = 0; i < req->n_ssids; i++) {
 		if (req->ssids[i].ssid_len == ssid_len &&
-- 
2.34.1

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Kalle Valo 1 year, 10 months ago

Kees Cook <keescook@chromium.org> wrote:

> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
> cfg80211_scan_request with __counted_by"), the compiler may enforce
> dynamic array indexing of req->channels to stay below n_channels. As a
> result, n_channels needs to be increased _before_ accessing the newly
> added array index. Increment it first, then use "i" for the prior index.
> Solves this warning in the coming GCC that has __counted_by support:
> 
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
> n_channels' may be undefined [-Wsequence-point]
>  3783 |                 req->channels[req->n_channels++] = chan;
>       |                               ~~~~~~~~~~~~~~~^~
> 
> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
> Cc: Arend van Spriel <aspriel@gmail.com>
> Cc: Franky Lin <franky.lin@broadcom.com>
> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
> Cc: Ian Lin <ian.lin@infineon.com>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Wright Feng <wright.feng@cypress.com>
> Cc: Hector Martin <marcan@marcan.st>
> Cc: linux-wireless@vger.kernel.org
> Cc: brcm80211-dev-list.pdl@broadcom.com
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Patch applied to wireless.git, thanks.

5bdda0048c8d wifi: brcmfmac: Adjust n_channels usage for __counted_by

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20240126223150.work.548-kees@kernel.org/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Kalle Valo 1 year, 10 months ago

Kees Cook <keescook@chromium.org> wrote:

> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
> cfg80211_scan_request with __counted_by"), the compiler may enforce
> dynamic array indexing of req->channels to stay below n_channels. As a
> result, n_channels needs to be increased _before_ accessing the newly
> added array index. Increment it first, then use "i" for the prior index.
> Solves this warning in the coming GCC that has __counted_by support:
> 
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
> n_channels' may be undefined [-Wsequence-point]
>  3783 |                 req->channels[req->n_channels++] = chan;
>       |                               ~~~~~~~~~~~~~~~^~
> 
> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
> Cc: Arend van Spriel <aspriel@gmail.com>
> Cc: Franky Lin <franky.lin@broadcom.com>
> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
> Cc: Ian Lin <ian.lin@infineon.com>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Wright Feng <wright.feng@cypress.com>
> Cc: Hector Martin <marcan@marcan.st>
> Cc: linux-wireless@vger.kernel.org
> Cc: brcm80211-dev-list.pdl@broadcom.com
> Signed-off-by: Kees Cook <keescook@chromium.org>
> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

I'm planning to queue this for wireless tree. Arend, ack?

-- 
https://patchwork.kernel.org/project/linux-wireless/patch/20240126223150.work.548-kees@kernel.org/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Arend Van Spriel 1 year, 10 months ago

On 2/1/2024 11:04 AM, Kalle Valo wrote:
> Kees Cook <keescook@chromium.org> wrote:
> 
>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>> cfg80211_scan_request with __counted_by"), the compiler may enforce
>> dynamic array indexing of req->channels to stay below n_channels. As a
>> result, n_channels needs to be increased _before_ accessing the newly
>> added array index. Increment it first, then use "i" for the prior index.
>> Solves this warning in the coming GCC that has __counted_by support:
>>
>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
>> n_channels' may be undefined [-Wsequence-point]
>>   3783 |                 req->channels[req->n_channels++] = chan;
>>        |                               ~~~~~~~~~~~~~~~^~
>>
>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
>> Cc: Arend van Spriel <aspriel@gmail.com>
>> Cc: Franky Lin <franky.lin@broadcom.com>
>> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
>> Cc: Kalle Valo <kvalo@kernel.org>
>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
>> Cc: Ian Lin <ian.lin@infineon.com>
>> Cc: Johannes Berg <johannes.berg@intel.com>
>> Cc: Wright Feng <wright.feng@cypress.com>
>> Cc: Hector Martin <marcan@marcan.st>
>> Cc: linux-wireless@vger.kernel.org
>> Cc: brcm80211-dev-list.pdl@broadcom.com
>> Signed-off-by: Kees Cook <keescook@chromium.org>
>> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
> 
> I'm planning to queue this for wireless tree. Arend, ack?

This slipped past my broadcom email. As the Fixes commit is in 6.7 I 
would say ACK.

Gr. AvS

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Arend Van Spriel 1 year, 10 months ago

On 2/2/2024 10:58 AM, Arend Van Spriel wrote:
> On 2/1/2024 11:04 AM, Kalle Valo wrote:
>> Kees Cook <keescook@chromium.org> wrote:
>>
>>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>>> cfg80211_scan_request with __counted_by"), the compiler may enforce
>>> dynamic array indexing of req->channels to stay below n_channels. As a
>>> result, n_channels needs to be increased _before_ accessing the newly
>>> added array index. Increment it first, then use "i" for the prior index.
>>> Solves this warning in the coming GCC that has __counted_by support:
>>>
>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In 
>>> function 'brcmf_internal_escan_add_info':
>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
>>> n_channels' may be undefined [-Wsequence-point]
>>>   3783 |                 req->channels[req->n_channels++] = chan;
>>>        |                               ~~~~~~~~~~~~~~~^~
>>>
>>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct 
>>> cfg80211_scan_request with __counted_by")
>>> Cc: Arend van Spriel <aspriel@gmail.com>
>>> Cc: Franky Lin <franky.lin@broadcom.com>
>>> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
>>> Cc: Kalle Valo <kvalo@kernel.org>
>>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
>>> Cc: Ian Lin <ian.lin@infineon.com>
>>> Cc: Johannes Berg <johannes.berg@intel.com>
>>> Cc: Wright Feng <wright.feng@cypress.com>
>>> Cc: Hector Martin <marcan@marcan.st>
>>> Cc: linux-wireless@vger.kernel.org
>>> Cc: brcm80211-dev-list.pdl@broadcom.com
>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>>
>> I'm planning to queue this for wireless tree. Arend, ack?
> 
> This slipped past my broadcom email. As the Fixes commit is in 6.7 I 
> would say ACK.

Cc: to stable?

Gr. AvS

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Kalle Valo 1 year, 10 months ago

Arend Van Spriel <aspriel@gmail.com> writes:

> On 2/2/2024 10:58 AM, Arend Van Spriel wrote:
>
>> On 2/1/2024 11:04 AM, Kalle Valo wrote:
>>> Kees Cook <keescook@chromium.org> wrote:
>>>
>>>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>>>> cfg80211_scan_request with __counted_by"), the compiler may enforce
>>>> dynamic array indexing of req->channels to stay below n_channels. As a
>>>> result, n_channels needs to be increased _before_ accessing the newly
>>>> added array index. Increment it first, then use "i" for the prior index.
>>>> Solves this warning in the coming GCC that has __counted_by support:
>>>>
>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In
>>>> function 'brcmf_internal_escan_add_info':
>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
>>>> n_channels' may be undefined [-Wsequence-point]
>>>>   3783 |                 req->channels[req->n_channels++] = chan;
>>>>        |                               ~~~~~~~~~~~~~~~^~
>>>>
>>>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>>>> cfg80211_scan_request with __counted_by")
>>>> Cc: Arend van Spriel <aspriel@gmail.com>
>>>> Cc: Franky Lin <franky.lin@broadcom.com>
>>>> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
>>>> Cc: Kalle Valo <kvalo@kernel.org>
>>>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
>>>> Cc: Ian Lin <ian.lin@infineon.com>
>>>> Cc: Johannes Berg <johannes.berg@intel.com>
>>>> Cc: Wright Feng <wright.feng@cypress.com>
>>>> Cc: Hector Martin <marcan@marcan.st>
>>>> Cc: linux-wireless@vger.kernel.org
>>>> Cc: brcm80211-dev-list.pdl@broadcom.com
>>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>>> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>>>
>>> I'm planning to queue this for wireless tree. Arend, ack?
>> This slipped past my broadcom email. As the Fixes commit is in 6.7 I
>> would say ACK.

Thanks.

> Cc: to stable?

Is commit e3eac9f32ec0 in stable releases? (I don't follow stable and
don't know what commits they take.) I propose that as we have Fixes tag
let's not add cc but instead let stable maintainers to decide.

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Arend Van Spriel 1 year, 10 months ago

On 2/2/2024 11:34 AM, Kalle Valo wrote:
> Arend Van Spriel <aspriel@gmail.com> writes:
> 
>> On 2/2/2024 10:58 AM, Arend Van Spriel wrote:
>>
>>> On 2/1/2024 11:04 AM, Kalle Valo wrote:
>>>> Kees Cook <keescook@chromium.org> wrote:
>>>>
>>>>> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>>>>> cfg80211_scan_request with __counted_by"), the compiler may enforce
>>>>> dynamic array indexing of req->channels to stay below n_channels. As a
>>>>> result, n_channels needs to be increased _before_ accessing the newly
>>>>> added array index. Increment it first, then use "i" for the prior index.
>>>>> Solves this warning in the coming GCC that has __counted_by support:
>>>>>
>>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In
>>>>> function 'brcmf_internal_escan_add_info':
>>>>> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
>>>>> n_channels' may be undefined [-Wsequence-point]
>>>>>    3783 |                 req->channels[req->n_channels++] = chan;
>>>>>         |                               ~~~~~~~~~~~~~~~^~
>>>>>
>>>>> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
>>>>> cfg80211_scan_request with __counted_by")
>>>>> Cc: Arend van Spriel <aspriel@gmail.com>
>>>>> Cc: Franky Lin <franky.lin@broadcom.com>
>>>>> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
>>>>> Cc: Kalle Valo <kvalo@kernel.org>
>>>>> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
>>>>> Cc: Ian Lin <ian.lin@infineon.com>
>>>>> Cc: Johannes Berg <johannes.berg@intel.com>
>>>>> Cc: Wright Feng <wright.feng@cypress.com>
>>>>> Cc: Hector Martin <marcan@marcan.st>
>>>>> Cc: linux-wireless@vger.kernel.org
>>>>> Cc: brcm80211-dev-list.pdl@broadcom.com
>>>>> Signed-off-by: Kees Cook <keescook@chromium.org>
>>>>> Reviewed-by: Hans de Goede <hdegoede@redhat.com>
>>>>> Reviewed-by: Linus Walleij <linus.walleij@linaro.org>
>>>>> Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>
>>>>
>>>> I'm planning to queue this for wireless tree. Arend, ack?
>>> This slipped past my broadcom email. As the Fixes commit is in 6.7 I
>>> would say ACK.
> 
> Thanks.
> 
>> Cc: to stable?
> 
> Is commit e3eac9f32ec0 in stable releases? (I don't follow stable and
> don't know what commits they take.) I propose that as we have Fixes tag
> let's not add cc but instead let stable maintainers to decide.

I confirmed the commit was in 6.7 and the latest released kernel is 
always handled by stable kernel team. kernel.org main page always shows 
the active stable/longterm releases. That said I have no problem with 
your proposal.

Gr. AvS

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Gustavo A. R. Silva 1 year, 11 months ago


On 1/26/24 16:31, Kees Cook wrote:
> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
> cfg80211_scan_request with __counted_by"), the compiler may enforce
> dynamic array indexing of req->channels to stay below n_channels. As a
> result, n_channels needs to be increased _before_ accessing the newly
> added array index. Increment it first, then use "i" for the prior index.
> Solves this warning in the coming GCC that has __counted_by support:
> 
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
> n_channels' may be undefined [-Wsequence-point]
>   3783 |                 req->channels[req->n_channels++] = chan;
>        |                               ~~~~~~~~~~~~~~~^~
> 
> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
> Cc: Arend van Spriel <aspriel@gmail.com>
> Cc: Franky Lin <franky.lin@broadcom.com>
> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
> Cc: Ian Lin <ian.lin@infineon.com>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Wright Feng <wright.feng@cypress.com>
> Cc: Hector Martin <marcan@marcan.st>
> Cc: linux-wireless@vger.kernel.org
> Cc: brcm80211-dev-list.pdl@broadcom.com
> Signed-off-by: Kees Cook <keescook@chromium.org>

Reviewed-by: Gustavo A. R. Silva <gustavoars@kernel.org>

Thanks!
-- 
Gustavo

> ---
>   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++--
>   1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index 133c5ea6429c..28d6a30cc010 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
>   		if (req->channels[i] == chan)
>   			break;
>   	}
> -	if (i == req->n_channels)
> -		req->channels[req->n_channels++] = chan;
> +	if (i == req->n_channels) {
> +		req->n_channels++;
> +		req->channels[i] = chan;
> +	}
>   
>   	for (i = 0; i < req->n_ssids; i++) {
>   		if (req->ssids[i].ssid_len == ssid_len &&

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Linus Walleij 1 year, 11 months ago

On Fri, Jan 26, 2024 at 11:31 PM Kees Cook <keescook@chromium.org> wrote:

> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
> cfg80211_scan_request with __counted_by"), the compiler may enforce
> dynamic array indexing of req->channels to stay below n_channels. As a
> result, n_channels needs to be increased _before_ accessing the newly
> added array index. Increment it first, then use "i" for the prior index.
> Solves this warning in the coming GCC that has __counted_by support:

Makes perfect sense.
Reviewed-by: Linus Walleij <linus.walleij@linaro.org>

Yours,
Linus Walleij

Re: [PATCH] wifi: brcmfmac: Adjust n_channels usage for __counted_by

Posted by Hans de Goede 1 year, 11 months ago

Hi,

On 1/26/24 23:31, Kees Cook wrote:
> After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct
> cfg80211_scan_request with __counted_by"), the compiler may enforce
> dynamic array indexing of req->channels to stay below n_channels. As a
> result, n_channels needs to be increased _before_ accessing the newly
> added array index. Increment it first, then use "i" for the prior index.
> Solves this warning in the coming GCC that has __counted_by support:
> 
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function 'brcmf_internal_escan_add_info':
> ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: warning: operation on 'req->
> n_channels' may be undefined [-Wsequence-point]
>  3783 |                 req->channels[req->n_channels++] = chan;
>       |                               ~~~~~~~~~~~~~~~^~
> 
> Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request with __counted_by")
> Cc: Arend van Spriel <aspriel@gmail.com>
> Cc: Franky Lin <franky.lin@broadcom.com>
> Cc: Hante Meuleman <hante.meuleman@broadcom.com>
> Cc: Kalle Valo <kvalo@kernel.org>
> Cc: Chi-hsien Lin <chi-hsien.lin@infineon.com>
> Cc: Ian Lin <ian.lin@infineon.com>
> Cc: Johannes Berg <johannes.berg@intel.com>
> Cc: Wright Feng <wright.feng@cypress.com>
> Cc: Hector Martin <marcan@marcan.st>
> Cc: linux-wireless@vger.kernel.org
> Cc: brcm80211-dev-list.pdl@broadcom.com
> Signed-off-by: Kees Cook <keescook@chromium.org>

Thanks, patch looks good to me:

Reviewed-by: Hans de Goede <hdegoede@redhat.com>

Regards,

Hans



> ---
>  drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++--
>  1 file changed, 4 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> index 133c5ea6429c..28d6a30cc010 100644
> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
> @@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct cfg80211_scan_request *req,
>  		if (req->channels[i] == chan)
>  			break;
>  	}
> -	if (i == req->n_channels)
> -		req->channels[req->n_channels++] = chan;
> +	if (i == req->n_channels) {
> +		req->n_channels++;
> +		req->channels[i] = chan;
> +	}
>  
>  	for (i = 0; i < req->n_ssids; i++) {
>  		if (req->ssids[i].ssid_len == ssid_len &&