| Message ID | 20221010160638.20152-1-kvalo@kernel.org (mailing list archive) |
|---|---|
| State | Accepted |
| Commit | abf93f369419249ca482a8911039fe1c75a94227 |
| Delegated to: | Kalle Valo |
| Headers | show |
| Series | [v6.1] wifi: ath11k: mac: fix reading 16 bytes from a region of size 0 warning | expand |
Kalle Valo <kvalo@kernel.org> writes: > From: Kalle Valo <quic_kvalo@quicinc.com> > > Linaro reported stringop-overread warnings in ath11k (this is one of many): > > drivers/net/wireless/ath/ath11k/mac.c:2238:29: error: 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size 0 [-Werror=stringop-overread] > > My further investigation showed that these warnings happen on GCC 11.3 but not > with GCC 12.2, and with only the kernel config Linaro provided: > > https://builds.tuxbuild.com/2F4W7nZHNx3T88RB0gaCZ9hBX6c/config > > I saw the same warnings both with arm64 and x86_64 builds but couldn't figure > out what exactly triggers the warnings, or why I didn't see them earlier. > Nobody else has reported this either. This is also why I can't provide a Fixes > tag as I don't know what's causing this. The function hasn't been touched for > a year. Thanks to Arnd I found out that KASAN caused this so I'll update the commit log in this regard.
Kalle Valo <kvalo@kernel.org> wrote: > From: Kalle Valo <quic_kvalo@quicinc.com> > > Linaro reported stringop-overread warnings in ath11k (this is one of many): > > drivers/net/wireless/ath/ath11k/mac.c:2238:29: error: 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size 0 [-Werror=stringop-overread] > > My further investigation showed that these warnings happen on GCC 11.3 but not > with GCC 12.2, and with only the kernel config Linaro provided: > > https://builds.tuxbuild.com/2F4W7nZHNx3T88RB0gaCZ9hBX6c/config > > I saw the same warnings both with arm64 and x86_64 builds and KASAN seems to be > the reason triggering these warnings with GCC 11. Nobody else has reported > this so this seems to be quite rare corner case. I don't know what specific > commit started emitting this warning so I can't provide a Fixes tag. The > function hasn't been touched for a year. > > I decided to workaround this by converting the pointer to a new array in stack, > and then copying the data to the new array. It's only 16 bytes anyway and this > is executed during association, so not in a hotpath. > > Tested-on: WCN6855 hw2.0 PCI WLAN.HSP.1.1-03125-QCAHSPSWPL_V1_V2_SILICONZ_LITE-3.6510.9 > > Reported-by: Linux Kernel Functional Testing <lkft@linaro.org> > Link: https://lore.kernel.org/all/CA+G9fYsZ_qypa=jHY_dJ=tqX4515+qrV9n2SWXVDHve826nF7Q@mail.gmail.com/ > Signed-off-by: Kalle Valo <quic_kvalo@quicinc.com> Patch applied to wireless.git, thanks. abf93f369419 wifi: ath11k: mac: fix reading 16 bytes from a region of size 0 warning
diff --git a/drivers/net/wireless/ath/ath11k/mac.c b/drivers/net/wireless/ath/ath11k/mac.c index 84d956ad4093..2d1e3fd9b526 100644 --- a/drivers/net/wireless/ath/ath11k/mac.c +++ b/drivers/net/wireless/ath/ath11k/mac.c @@ -2081,7 +2081,7 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, struct cfg80211_chan_def def; const struct ieee80211_sta_he_cap *he_cap = &sta->deflink.he_cap; enum nl80211_band band; - u16 *he_mcs_mask; + u16 he_mcs_mask[NL80211_HE_NSS_MAX]; u8 max_nss, he_mcs; u16 he_tx_mcs = 0, v = 0; int i, he_nss, nss_idx; @@ -2098,7 +2098,8 @@ static void ath11k_peer_assoc_h_he(struct ath11k *ar, return; band = def.chan->band; - he_mcs_mask = arvif->bitrate_mask.control[band].he_mcs; + memcpy(he_mcs_mask, arvif->bitrate_mask.control[band].he_mcs, + sizeof(he_mcs_mask)); if (ath11k_peer_assoc_h_he_masked(he_mcs_mask)) return;