From: kernel test robot <lkp@intel.com>
To: oe-kbuild@lists.linux.dev
Cc: lkp@intel.com, Dan Carpenter <error27@gmail.com>
Subject: drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:553 mt7996_mcu_wed_rro_event() warn: potential spectre issue 'dev->mt76.wcid' [r] (local cap)
Date: Sun, 22 Dec 2024 18:27:25 +0800 [thread overview]
Message-ID: <202412221811.kAk2yte1-lkp@intel.com> (raw)
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Lorenzo Bianconi <lorenzo@kernel.org>
CC: Felix Fietkau <nbd@nbd.name>
CC: Sujuan Chen <sujuan.chen@mediatek.com>
CC: Bo Jiao <Bo.Jiao@mediatek.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 48f506ad0b683d3e7e794efa60c5785c4fdc86fa
commit: a5d028d668360db991e6da67cd48b9b4443198ed wifi: mt76: mt7996: add wed rro delete session garbage collector
date: 1 year, 1 month ago
:::::: branch date: 11 hours ago
:::::: commit date: 1 year, 1 month ago
config: x86_64-randconfig-161-20241215 (https://download.01.org/0day-ci/archive/20241222/202412221811.kAk2yte1-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202412221811.kAk2yte1-lkp@intel.com/
New smatch warnings:
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:553 mt7996_mcu_wed_rro_event() warn: potential spectre issue 'dev->mt76.wcid' [r] (local cap)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:560 mt7996_mcu_wed_rro_event() warn: potential spectre issue 'wcid->aggr' [r] (local cap)
Old smatch warnings:
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:347 mt7996_mcu_rx_radar_detected() warn: potential spectre issue 'dev->mt76.phys' [r] (local cap)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:349 mt7996_mcu_rx_radar_detected() warn: possible spectre second half. 'mphy'
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:429 mt7996_mcu_ie_countdown() warn: potential spectre issue 'dev->mt76.phys' [r] (local cap)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:436 mt7996_mcu_ie_countdown() warn: possible spectre second half. 'mphy'
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:441 mt7996_mcu_ie_countdown() warn: possible spectre second half. 'mphy'
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:2300 mt7996_mcu_beacon_mbss() warn: potential spectre issue 'sub_elem->data' [r] (local cap)
drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:2292 mt7996_mcu_beacon_mbss() warn: potential spectre issue 'elem->data' [r] (local cap)
vim +553 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c
98686cd21624c75 Shayne Chen 2022-11-22 528
a5d028d668360db Lorenzo Bianconi 2023-10-20 529 static void
a5d028d668360db Lorenzo Bianconi 2023-10-20 530 mt7996_mcu_wed_rro_event(struct mt7996_dev *dev, struct sk_buff *skb)
a5d028d668360db Lorenzo Bianconi 2023-10-20 531 {
a5d028d668360db Lorenzo Bianconi 2023-10-20 532 struct mt7996_mcu_wed_rro_event *event = (void *)skb->data;
a5d028d668360db Lorenzo Bianconi 2023-10-20 533
a5d028d668360db Lorenzo Bianconi 2023-10-20 534 if (!dev->has_rro)
a5d028d668360db Lorenzo Bianconi 2023-10-20 535 return;
a5d028d668360db Lorenzo Bianconi 2023-10-20 536
a5d028d668360db Lorenzo Bianconi 2023-10-20 537 skb_pull(skb, sizeof(struct mt7996_mcu_rxd) + 4);
a5d028d668360db Lorenzo Bianconi 2023-10-20 538
a5d028d668360db Lorenzo Bianconi 2023-10-20 539 switch (le16_to_cpu(event->tag)) {
a5d028d668360db Lorenzo Bianconi 2023-10-20 540 case UNI_WED_RRO_BA_SESSION_STATUS: {
a5d028d668360db Lorenzo Bianconi 2023-10-20 541 struct mt7996_mcu_wed_rro_ba_event *e;
a5d028d668360db Lorenzo Bianconi 2023-10-20 542
a5d028d668360db Lorenzo Bianconi 2023-10-20 543 while (skb->len >= sizeof(*e)) {
a5d028d668360db Lorenzo Bianconi 2023-10-20 544 struct mt76_rx_tid *tid;
a5d028d668360db Lorenzo Bianconi 2023-10-20 545 struct mt76_wcid *wcid;
a5d028d668360db Lorenzo Bianconi 2023-10-20 546 u16 idx;
a5d028d668360db Lorenzo Bianconi 2023-10-20 547
a5d028d668360db Lorenzo Bianconi 2023-10-20 548 e = (void *)skb->data;
a5d028d668360db Lorenzo Bianconi 2023-10-20 549 idx = le16_to_cpu(e->wlan_id);
a5d028d668360db Lorenzo Bianconi 2023-10-20 550 if (idx >= ARRAY_SIZE(dev->mt76.wcid))
a5d028d668360db Lorenzo Bianconi 2023-10-20 551 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 552
a5d028d668360db Lorenzo Bianconi 2023-10-20 @553 wcid = rcu_dereference(dev->mt76.wcid[idx]);
a5d028d668360db Lorenzo Bianconi 2023-10-20 554 if (!wcid || !wcid->sta)
a5d028d668360db Lorenzo Bianconi 2023-10-20 555 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 556
a5d028d668360db Lorenzo Bianconi 2023-10-20 557 if (e->tid >= ARRAY_SIZE(wcid->aggr))
a5d028d668360db Lorenzo Bianconi 2023-10-20 558 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 559
a5d028d668360db Lorenzo Bianconi 2023-10-20 @560 tid = rcu_dereference(wcid->aggr[e->tid]);
a5d028d668360db Lorenzo Bianconi 2023-10-20 561 if (!tid)
a5d028d668360db Lorenzo Bianconi 2023-10-20 562 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 563
a5d028d668360db Lorenzo Bianconi 2023-10-20 564 tid->id = le16_to_cpu(e->id);
a5d028d668360db Lorenzo Bianconi 2023-10-20 565 skb_pull(skb, sizeof(*e));
a5d028d668360db Lorenzo Bianconi 2023-10-20 566 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 567 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 568 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 569 case UNI_WED_RRO_BA_SESSION_DELETE: {
a5d028d668360db Lorenzo Bianconi 2023-10-20 570 struct mt7996_mcu_wed_rro_ba_delete_event *e;
a5d028d668360db Lorenzo Bianconi 2023-10-20 571
a5d028d668360db Lorenzo Bianconi 2023-10-20 572 while (skb->len >= sizeof(*e)) {
a5d028d668360db Lorenzo Bianconi 2023-10-20 573 struct mt7996_wed_rro_session_id *session;
a5d028d668360db Lorenzo Bianconi 2023-10-20 574
a5d028d668360db Lorenzo Bianconi 2023-10-20 575 e = (void *)skb->data;
a5d028d668360db Lorenzo Bianconi 2023-10-20 576 session = kzalloc(sizeof(*session), GFP_ATOMIC);
a5d028d668360db Lorenzo Bianconi 2023-10-20 577 if (!session)
a5d028d668360db Lorenzo Bianconi 2023-10-20 578 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 579
a5d028d668360db Lorenzo Bianconi 2023-10-20 580 session->id = le16_to_cpu(e->session_id);
a5d028d668360db Lorenzo Bianconi 2023-10-20 581
a5d028d668360db Lorenzo Bianconi 2023-10-20 582 spin_lock_bh(&dev->wed_rro.lock);
a5d028d668360db Lorenzo Bianconi 2023-10-20 583 list_add_tail(&session->list, &dev->wed_rro.poll_list);
a5d028d668360db Lorenzo Bianconi 2023-10-20 584 spin_unlock_bh(&dev->wed_rro.lock);
a5d028d668360db Lorenzo Bianconi 2023-10-20 585
a5d028d668360db Lorenzo Bianconi 2023-10-20 586 ieee80211_queue_work(mt76_hw(dev), &dev->wed_rro.work);
a5d028d668360db Lorenzo Bianconi 2023-10-20 587 skb_pull(skb, sizeof(*e));
a5d028d668360db Lorenzo Bianconi 2023-10-20 588 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 589 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 590 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 591 default:
a5d028d668360db Lorenzo Bianconi 2023-10-20 592 break;
a5d028d668360db Lorenzo Bianconi 2023-10-20 593 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 594 }
a5d028d668360db Lorenzo Bianconi 2023-10-20 595
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2024-12-22 10:27 UTC|newest]
Thread overview: 3+ messages / expand[flat|nested] mbox.gz Atom feed top
2024-12-22 10:27 kernel test robot [this message]
-- strict thread matches above, loose matches on Subject: below --
2024-12-20 17:42 drivers/net/wireless/mediatek/mt76/mt7996/mcu.c:553 mt7996_mcu_wed_rro_event() warn: potential spectre issue 'dev->mt76.wcid' [r] (local cap) kernel test robot
2024-11-04 22:00 kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202412221811.kAk2yte1-lkp@intel.com \
--to=lkp@intel.com \
--cc=error27@gmail.com \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.