Re: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len

[kernel test robot <lkp@intel.com>]

Hi Gustavo,

kernel test robot noticed the following build warnings:

[auto build test WARNING on linus/master]
[also build test WARNING on v6.5-rc7 next-20230823]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Gustavo-A-R-Silva/wifi-mwifiex-Fix-tlv_buf_left-calculation/20230824-063517
base:   linus/master
patch link:    https://lore.kernel.org/r/587423b0737108effe82aefed4407daca39e9a51.1692829410.git.gustavoars%40kernel.org
patch subject: [PATCH 3/3] wifi: mwifiex: Sanity check tlv_len and tlv_bitmap_len
config: m68k-allyesconfig (https://download.01.org/0day-ci/archive/20230824/202308240844.leyoOwdG-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 13.2.0
reproduce: (https://download.01.org/0day-ci/archive/20230824/202308240844.leyoOwdG-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202308240844.leyoOwdG-lkp@intel.com/

All warnings (new ones prefixed by >>):

   In file included from drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:12:
   drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c: In function 'mwifiex_11n_rxba_sync_event':
>> drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:926:37: warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
     926 |                                     "TLV size (%ld) overflows event_buf (%d)\n",
         |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     927 |                                     size_add(sizeof(tlv_rxba->header), tlv_len),
         |                                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |                                     |
         |                                     size_t {aka unsigned int}
   drivers/net/wireless/marvell/mwifiex/main.h:199:51: note: in definition of macro 'mwifiex_dbg'
     199 |         _mwifiex_dbg(adapter, MWIFIEX_DBG_##mask, fmt, ##__VA_ARGS__)
         |                                                   ^~~
   drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:926:50: note: format string is defined here
     926 |                                     "TLV size (%ld) overflows event_buf (%d)\n",
         |                                                ~~^
         |                                                  |
         |                                                  long int
         |                                                %d
   drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:942:37: warning: format '%ld' expects argument of type 'long int', but argument 4 has type 'size_t' {aka 'unsigned int'} [-Wformat=]
     942 |                                     "TLV size (%ld) overflows event_buf (%d)\n",
         |                                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     943 |                                     size_add(sizeof(*tlv_rxba), tlv_bitmap_len),
         |                                     ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         |                                     |
         |                                     size_t {aka unsigned int}
   drivers/net/wireless/marvell/mwifiex/main.h:199:51: note: in definition of macro 'mwifiex_dbg'
     199 |         _mwifiex_dbg(adapter, MWIFIEX_DBG_##mask, fmt, ##__VA_ARGS__)
         |                                                   ^~~
   drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c:942:50: note: format string is defined here
     942 |                                     "TLV size (%ld) overflows event_buf (%d)\n",
         |                                                ~~^
         |                                                  |
         |                                                  long int
         |                                                %d


vim +926 drivers/net/wireless/marvell/mwifiex/11n_rxreorder.c

   904	
   905	/* This function handles rxba_sync event
   906	 */
   907	void mwifiex_11n_rxba_sync_event(struct mwifiex_private *priv,
   908					 u8 *event_buf, u16 len)
   909	{
   910		struct mwifiex_ie_types_rxba_sync *tlv_rxba = (void *)event_buf;
   911		u16 tlv_type, tlv_len;
   912		struct mwifiex_rx_reorder_tbl *rx_reor_tbl_ptr;
   913		u8 i, j;
   914		u16 seq_num, tlv_seq_num, tlv_bitmap_len;
   915		int tlv_buf_left = len;
   916		int ret;
   917		u8 *tmp;
   918	
   919		mwifiex_dbg_dump(priv->adapter, EVT_D, "RXBA_SYNC event:",
   920				 event_buf, len);
   921		while (tlv_buf_left > sizeof(*tlv_rxba)) {
   922			tlv_type = le16_to_cpu(tlv_rxba->header.type);
   923			tlv_len  = le16_to_cpu(tlv_rxba->header.len);
   924			if (size_add(sizeof(tlv_rxba->header), tlv_len) > tlv_buf_left) {
   925				mwifiex_dbg(priv->adapter, WARN,
 > 926					    "TLV size (%ld) overflows event_buf (%d)\n",

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki