drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:509 mt7921_mcu_tx_rate_report() warn: potential spectre issue 'wtbl_info->rate_info.rate'

drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:509 mt7921_mcu_tx_rate_report() warn: potential spectre issue 'wtbl_info->rate_info.rate'

[kernel test robot]

[-- Attachment #1: Type: text/plain, Size: 3887 bytes --]

CC: kbuild-all(a)lists.01.org
CC: linux-kernel(a)vger.kernel.org
TO: Sean Wang <sean.wang@mediatek.com>
CC: Felix Fietkau <nbd@nbd.name>
CC: Lorenzo Bianconi <lorenzo@kernel.org>
CC: Soul Huang <Soul.Huang@mediatek.com>

Hi Sean,

First bad commit (maybe != root cause):

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   8b83369ddcb3fb9cab5c1088987ce477565bb630
commit: 5c14a5f944b91371961548b1907802f74a4d2e5c mt76: mt7921: introduce mt7921e support
date:   4 weeks ago
:::::: branch date: 4 hours ago
:::::: commit date: 4 weeks ago
config: xtensa-randconfig-m031-20210227 (attached as .config)
compiler: xtensa-linux-gcc (GCC) 9.3.0

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:509 mt7921_mcu_tx_rate_report() warn: potential spectre issue 'wtbl_info->rate_info.rate' [r]

Old smatch warnings:
drivers/net/wireless/mediatek/mt76/mt7921/mcu.c:520 mt7921_mcu_tx_rate_report() error: potentially dereferencing uninitialized 'stats'.

vim +509 drivers/net/wireless/mediatek/mt76/mt7921/mcu.c

1c099ab44727c8e4 Sean Wang 2021-01-28  500  
1c099ab44727c8e4 Sean Wang 2021-01-28  501  static void
1c099ab44727c8e4 Sean Wang 2021-01-28  502  mt7921_mcu_tx_rate_report(struct mt7921_dev *dev, struct sk_buff *skb,
1c099ab44727c8e4 Sean Wang 2021-01-28  503  			  u16 wlan_idx)
1c099ab44727c8e4 Sean Wang 2021-01-28  504  {
1c099ab44727c8e4 Sean Wang 2021-01-28  505  	struct mt7921_mcu_wlan_info_event *wtbl_info =
1c099ab44727c8e4 Sean Wang 2021-01-28  506  		(struct mt7921_mcu_wlan_info_event *)(skb->data);
1c099ab44727c8e4 Sean Wang 2021-01-28  507  	struct rate_info rate = {};
1c099ab44727c8e4 Sean Wang 2021-01-28  508  	u8 curr_idx = wtbl_info->rate_info.rate_idx;
1c099ab44727c8e4 Sean Wang 2021-01-28 @509  	u16 curr = le16_to_cpu(wtbl_info->rate_info.rate[curr_idx]);
1c099ab44727c8e4 Sean Wang 2021-01-28  510  	struct mt7921_mcu_peer_cap peer = wtbl_info->peer_cap;
1c099ab44727c8e4 Sean Wang 2021-01-28  511  	struct mt76_phy *mphy = &dev->mphy;
1c099ab44727c8e4 Sean Wang 2021-01-28  512  	struct mt7921_sta_stats *stats;
1c099ab44727c8e4 Sean Wang 2021-01-28  513  	struct mt7921_sta *msta;
1c099ab44727c8e4 Sean Wang 2021-01-28  514  	struct mt76_wcid *wcid;
1c099ab44727c8e4 Sean Wang 2021-01-28  515  
1c099ab44727c8e4 Sean Wang 2021-01-28  516  	if (wlan_idx >= MT76_N_WCIDS)
1c099ab44727c8e4 Sean Wang 2021-01-28  517  		return;
1c099ab44727c8e4 Sean Wang 2021-01-28  518  	wcid = rcu_dereference(dev->mt76.wcid[wlan_idx]);
1c099ab44727c8e4 Sean Wang 2021-01-28  519  	if (!wcid) {
1c099ab44727c8e4 Sean Wang 2021-01-28  520  		stats->tx_rate = rate;
1c099ab44727c8e4 Sean Wang 2021-01-28  521  		return;
1c099ab44727c8e4 Sean Wang 2021-01-28  522  	}
1c099ab44727c8e4 Sean Wang 2021-01-28  523  
1c099ab44727c8e4 Sean Wang 2021-01-28  524  	msta = container_of(wcid, struct mt7921_sta, wcid);
1c099ab44727c8e4 Sean Wang 2021-01-28  525  	stats = &msta->stats;
1c099ab44727c8e4 Sean Wang 2021-01-28  526  
1c099ab44727c8e4 Sean Wang 2021-01-28  527  	/* current rate */
1c099ab44727c8e4 Sean Wang 2021-01-28  528  	mt7921_mcu_tx_rate_parse(mphy, &peer, &rate, curr);
1c099ab44727c8e4 Sean Wang 2021-01-28  529  	stats->tx_rate = rate;
1c099ab44727c8e4 Sean Wang 2021-01-28  530  }
1c099ab44727c8e4 Sean Wang 2021-01-28  531  

:::::: The code at line 509 was first introduced by commit
:::::: 1c099ab44727c8e42fe4de4d91b53cec3ef02860 mt76: mt7921: add MCU support

:::::: TO: Sean Wang <sean.wang@mediatek.com>
:::::: CC: Felix Fietkau <nbd@nbd.name>

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all(a)lists.01.org

[-- Attachment #2: config.gz --]
[-- Type: application/gzip, Size: 38360 bytes --]