* drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1153 iwl_mvm_fill_ppag_table() error: buffer overflow 'gain' 11 <= 21
@ 2026-08-21 21:16 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-08-21 21:16 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: Emmanuel Grumbach <emmanuel.grumbach@intel.com>
CC: Miri Korenblit <miriam.rachel.korenblit@intel.com>
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 818bebeb63dd6bf5f4e07e145f6cdbace520a34c
commit: 1a7d1830be843af332081833223f4be536c00e3b wifi: iwlwifi: bring iwl_fill_ppag_table to the iwlmvm
date: 5 months ago
:::::: branch date: 18 hours ago
:::::: commit date: 5 months ago
config: i386-randconfig-r073-20260821 (https://download.01.org/0day-ci/archive/20260822/202608220536.XZXJmRAK-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 1a7d1830be84 ("wifi: iwlwifi: bring iwl_fill_ppag_table to the iwlmvm")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202608220536.XZXJmRAK-lkp@intel.com/
New smatch warnings:
drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1153 iwl_mvm_fill_ppag_table() error: buffer overflow 'gain' 11 <= 21
Old smatch warnings:
drivers/net/wireless/intel/iwlwifi/mvm/fw.c:757 iwl_run_init_mvm_ucode() error: we previously assumed 'mvm->nvm_data' could be null (see line 742)
drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1155 iwl_mvm_fill_ppag_table() error: buffer overflow 'gain' 11 <= 21
vim +/gain +1153 drivers/net/wireless/intel/iwlwifi/mvm/fw.c
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1051
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1052 static int iwl_mvm_fill_ppag_table(struct iwl_fw_runtime *fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1053 union iwl_ppag_table_cmd *cmd,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1054 int *cmd_size)
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1055 {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1056 u8 cmd_ver;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1057 int i, j, num_sub_bands;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1058 s8 *gain;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1059 bool send_ppag_always;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1060
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1061 /* many firmware images for JF lie about this */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1062 if (CSR_HW_RFID_TYPE(fwrt->trans->info.hw_rf_id) ==
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1063 CSR_HW_RFID_TYPE(CSR_HW_RF_ID_TYPE_JF))
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1064 return -EOPNOTSUPP;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1065
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1066 if (!fw_has_capa(&fwrt->fw->ucode_capa, IWL_UCODE_TLV_CAPA_SET_PPAG)) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1067 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1068 "PPAG capability not supported by FW, command not sent.\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1069 return -EINVAL;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1070 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1071
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1072 cmd_ver = iwl_fw_lookup_cmd_ver(fwrt->fw,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1073 WIDE_ID(PHY_OPS_GROUP,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1074 PER_PLATFORM_ANT_GAIN_CMD), 1);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1075 /*
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1076 * Starting from ver 4, driver needs to send the PPAG CMD regardless
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1077 * if PPAG is enabled/disabled or valid/invalid.
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1078 */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1079 send_ppag_always = cmd_ver > 3;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1080
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1081 /* Don't send PPAG if it is disabled */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1082 if (!send_ppag_always && !fwrt->ppag_flags) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1083 IWL_DEBUG_RADIO(fwrt, "PPAG not enabled, command not sent.\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1084 return -EINVAL;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1085 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1086
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1087 IWL_DEBUG_RADIO(fwrt, "PPAG cmd ver is %d\n", cmd_ver);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1088 if (cmd_ver == 1) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1089 num_sub_bands = IWL_NUM_SUB_BANDS_V1;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1090 gain = cmd->v1.gain[0];
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1091 *cmd_size = sizeof(cmd->v1);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1092 cmd->v1.flags =
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1093 cpu_to_le32(fwrt->ppag_flags & IWL_PPAG_CMD_V1_MASK);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1094 if (fwrt->ppag_bios_rev >= 1) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1095 /* in this case FW supports revision 0 */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1096 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1097 "PPAG table rev is %d, send truncated table\n",
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1098 fwrt->ppag_bios_rev);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1099 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1100 } else if (cmd_ver == 5) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1101 num_sub_bands = IWL_NUM_SUB_BANDS_V2;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1102 gain = cmd->v5.gain[0];
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1103 *cmd_size = sizeof(cmd->v5);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1104 cmd->v5.flags =
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1105 cpu_to_le32(fwrt->ppag_flags & IWL_PPAG_CMD_V5_MASK);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1106 if (fwrt->ppag_bios_rev == 0) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1107 /* in this case FW supports revisions 1,2 or 3 */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1108 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1109 "PPAG table rev is 0, send padded table\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1110 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1111 } else if (cmd_ver == 7) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1112 num_sub_bands = IWL_NUM_SUB_BANDS_V2;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1113 gain = cmd->v7.gain[0];
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1114 *cmd_size = sizeof(cmd->v7);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1115 cmd->v7.ppag_config_info.hdr.table_source =
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1116 fwrt->ppag_bios_source;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1117 cmd->v7.ppag_config_info.hdr.table_revision =
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1118 fwrt->ppag_bios_rev;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1119 cmd->v7.ppag_config_info.value = cpu_to_le32(fwrt->ppag_flags);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1120 } else {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1121 IWL_DEBUG_RADIO(fwrt, "Unsupported PPAG command version\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1122 return -EINVAL;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1123 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1124
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1125 /* ppag mode */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1126 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1127 "PPAG MODE bits were read from bios: %d\n",
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1128 fwrt->ppag_flags);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1129
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1130 if (cmd_ver == 1 &&
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1131 !fw_has_capa(&fwrt->fw->ucode_capa,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1132 IWL_UCODE_TLV_CAPA_PPAG_CHINA_BIOS_SUPPORT)) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1133 cmd->v1.flags &= cpu_to_le32(IWL_PPAG_ETSI_MASK);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1134 IWL_DEBUG_RADIO(fwrt, "masking ppag China bit\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1135 } else {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1136 IWL_DEBUG_RADIO(fwrt, "isn't masking ppag China bit\n");
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1137 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1138
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1139 /* The 'flags' field is the same in v1 and v5 so we can just
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1140 * use v1 to access it.
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1141 */
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1142 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1143 "PPAG MODE bits going to be sent: %d\n",
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1144 (cmd_ver < 7) ? le32_to_cpu(cmd->v1.flags) :
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1145 le32_to_cpu(cmd->v7.ppag_config_info.value));
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1146
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1147 for (i = 0; i < IWL_NUM_CHAIN_LIMITS; i++) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1148 for (j = 0; j < num_sub_bands; j++) {
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1149 if (!send_ppag_always &&
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1150 !iwl_mvm_ppag_value_valid(fwrt, i, j))
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1151 return -EINVAL;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1152
1a7d1830be843af Emmanuel Grumbach 2026-03-19 @1153 gain[i * num_sub_bands + j] =
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1154 fwrt->ppag_chains[i].subbands[j];
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1155 IWL_DEBUG_RADIO(fwrt,
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1156 "PPAG table: chain[%d] band[%d]: gain = %d\n",
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1157 i, j, gain[i * num_sub_bands + j]);
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1158 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1159 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1160
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1161 return 0;
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1162 }
1a7d1830be843af Emmanuel Grumbach 2026-03-19 1163
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-08-21 21:17 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-08-21 21:16 drivers/net/wireless/intel/iwlwifi/mvm/fw.c:1153 iwl_mvm_fill_ppag_table() error: buffer overflow 'gain' 11 <= 21 kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.