Re: [tglx-devel:x86/apic 15/35] drivers/pci/controller/vmd.c:133:2: warning: 'memset' will always overflow; destination buffer has size 8, but size argument is 16

[Kees Cook <keescook@chromium.org>]

[-- Attachment #1: Type: text/plain, Size: 2635 bytes --]

On Thu, Oct 29, 2020 at 03:20:16AM +0800, kernel test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git x86/apic
> head:   32960489e2caa56bb259f8a8137b53576a2fa102
> commit: 176cfd8483128d01c05548162119c4b985f4f2ed [15/35] PCI: vmd: Use msi_msg shadow structs
> config: x86_64-randconfig-a003-20201028 (attached as .config)
> compiler: clang version 12.0.0 (https://github.com/llvm/llvm-project 50dfa19cc799ae7cddd39a95dbfce675a12672ad)
> reproduce (this is a W=1 build):
>         wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
>         chmod +x ~/bin/make.cross
>         # install x86_64 cross compiling tool for clang build
>         # apt-get install binutils-x86-64-linux-gnu
>         # https://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git/commit/?id=176cfd8483128d01c05548162119c4b985f4f2ed
>         git remote add tglx-devel https://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git
>         git fetch --no-tags tglx-devel x86/apic
>         git checkout 176cfd8483128d01c05548162119c4b985f4f2ed
>         # save the attached .config to linux build tree
>         COMPILER_INSTALL_PATH=$HOME/0day COMPILER=clang make.cross ARCH=x86_64 
> 
> If you fix the issue, kindly add following tag as appropriate
> Reported-by: kernel test robot <lkp@intel.com>
> 
> All warnings (new ones prefixed by >>):
> 
> >> drivers/pci/controller/vmd.c:133:2: warning: 'memset' will always overflow; destination buffer has size 8, but size argument is 16 [-Wfortify-source]
>            memset(&msg, 0, sizeof(*msg));
>            ^
>    1 warning generated.
> 
> vim +/memset +133 drivers/pci/controller/vmd.c
> 
>    118	
>    119	/*
>    120	 * Drivers managing a device in a VMD domain allocate their own IRQs as before,
>    121	 * but the MSI entry for the hardware it's driving will be programmed with a
>    122	 * destination ID for the VMD MSI-X table.  The VMD muxes interrupts in its
>    123	 * domain into one of its own, and the VMD driver de-muxes these for the
>    124	 * handlers sharing that VMD IRQ.  The vmd irq_domain provides the operations
>    125	 * and irq_chip to set this up.
>    126	 */
>    127	static void vmd_compose_msi_msg(struct irq_data *data, struct msi_msg *msg)
>    128	{
>    129		struct vmd_irq *vmdirq = data->chip_data;
>    130		struct vmd_irq_list *irq = vmdirq->irq;
>    131		struct vmd_dev *vmd = irq_data_get_irq_handler_data(data);
>    132	
>  > 133		memset(&msg, 0, sizeof(*msg));

Legit. That should be "msg" not &msg.

-- 
Kees Cook