From: Dan Carpenter <error27@gmail.com>
To: oe-kbuild@lists.linux.dev, Anthony Liu <anthony.liu@mediatek.com>
Cc: lkp@intel.com, oe-kbuild-all@lists.linux.dev,
Felix Fietkau <nbd@nbd.name>
Subject: [linux-next:master 13462/18293] drivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2488 mt7925_mcu_uni_add_beacon_offload() error: __builtin_memcpy() 'req.beacon_tlv.pkt' too small (510 vs 512)
Date: Mon, 19 Oct 2026 11:14:13 +0300 [thread overview]
Message-ID: <atXRVRc2T414bLiM@stanley.mountain> (raw)
tree: https://git.kernel.org/pub/scm/linux/kernel/git/next/linux-next.git master
head: 2efb7a11f1aa4d2dc285fe2680cca22cb9f72f64
commit: d4e5ca3483a0ce95ff8417e16d42af99f7a98da4 [13462/18293] wifi: mt76: mt7928: makes struct beacon_tlv 4-byte aligned.
config: m68k-randconfig-r2201-20261017 (https://download.01.org/0day-ci/archive/20261017/202610172141.mmRmGqow-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 12.5.0
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202610172141.mmRmGqow-lkp@intel.com/
New smatch warnings:
drivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2488 mt7925_mcu_uni_add_beacon_offload() error: __builtin_memcpy() 'req.beacon_tlv.pkt' too small (510 vs 512)
vim +2488 drivers/net/wireless/mediatek/mt76/mt7925/mcu.c
c948b5da6bbec7 Deren Wu 2023-09-18 2416 int
c948b5da6bbec7 Deren Wu 2023-09-18 2417 mt7925_mcu_uni_add_beacon_offload(struct mt792x_dev *dev,
c948b5da6bbec7 Deren Wu 2023-09-18 2418 struct ieee80211_hw *hw,
c948b5da6bbec7 Deren Wu 2023-09-18 2419 struct ieee80211_vif *vif,
c948b5da6bbec7 Deren Wu 2023-09-18 2420 bool enable)
c948b5da6bbec7 Deren Wu 2023-09-18 2421 {
c948b5da6bbec7 Deren Wu 2023-09-18 2422 struct mt792x_vif *mvif = (struct mt792x_vif *)vif->drv_priv;
c948b5da6bbec7 Deren Wu 2023-09-18 2423 struct ieee80211_mutable_offsets offs;
c948b5da6bbec7 Deren Wu 2023-09-18 2424 struct {
c948b5da6bbec7 Deren Wu 2023-09-18 2425 struct req_hdr {
c948b5da6bbec7 Deren Wu 2023-09-18 2426 u8 bss_idx;
c948b5da6bbec7 Deren Wu 2023-09-18 2427 u8 pad[3];
c948b5da6bbec7 Deren Wu 2023-09-18 2428 } __packed hdr;
c948b5da6bbec7 Deren Wu 2023-09-18 2429 struct bcn_content_tlv {
d4e5ca3483a0ce Anthony Liu 2026-10-05 2430 /* DW 0 */
c948b5da6bbec7 Deren Wu 2023-09-18 2431 __le16 tag;
c948b5da6bbec7 Deren Wu 2023-09-18 2432 __le16 len;
d4e5ca3483a0ce Anthony Liu 2026-10-05 2433 /* DW 1 */
c948b5da6bbec7 Deren Wu 2023-09-18 2434 __le16 tim_ie_pos;
c948b5da6bbec7 Deren Wu 2023-09-18 2435 __le16 csa_ie_pos;
d4e5ca3483a0ce Anthony Liu 2026-10-05 2436 /* DW 2 */
c948b5da6bbec7 Deren Wu 2023-09-18 2437 __le16 bcc_ie_pos;
c948b5da6bbec7 Deren Wu 2023-09-18 2438 /* 0: disable beacon offload
c948b5da6bbec7 Deren Wu 2023-09-18 2439 * 1: enable beacon offload
c948b5da6bbec7 Deren Wu 2023-09-18 2440 * 2: update probe respond offload
c948b5da6bbec7 Deren Wu 2023-09-18 2441 */
c948b5da6bbec7 Deren Wu 2023-09-18 2442 u8 enable;
c948b5da6bbec7 Deren Wu 2023-09-18 2443 /* 0: legacy format (TXD + payload)
c948b5da6bbec7 Deren Wu 2023-09-18 2444 * 1: only cap field IE
c948b5da6bbec7 Deren Wu 2023-09-18 2445 */
c948b5da6bbec7 Deren Wu 2023-09-18 2446 u8 type;
d4e5ca3483a0ce Anthony Liu 2026-10-05 2447 /* DW 3~130 */
c948b5da6bbec7 Deren Wu 2023-09-18 2448 __le16 pkt_len;
d4e5ca3483a0ce Anthony Liu 2026-10-05 2449 u8 pkt[510];
510 bytes.
c948b5da6bbec7 Deren Wu 2023-09-18 2450 } __packed beacon_tlv;
c948b5da6bbec7 Deren Wu 2023-09-18 2451 } req = {
c948b5da6bbec7 Deren Wu 2023-09-18 2452 .hdr = {
30e89baeb01fc7 Deren Wu 2024-06-12 2453 .bss_idx = mvif->bss_conf.mt76.idx,
c948b5da6bbec7 Deren Wu 2023-09-18 2454 },
c948b5da6bbec7 Deren Wu 2023-09-18 2455 .beacon_tlv = {
c948b5da6bbec7 Deren Wu 2023-09-18 2456 .tag = cpu_to_le16(UNI_BSS_INFO_BCN_CONTENT),
c948b5da6bbec7 Deren Wu 2023-09-18 2457 .len = cpu_to_le16(sizeof(struct bcn_content_tlv)),
c948b5da6bbec7 Deren Wu 2023-09-18 2458 .enable = enable,
c948b5da6bbec7 Deren Wu 2023-09-18 2459 .type = 1,
c948b5da6bbec7 Deren Wu 2023-09-18 2460 },
c948b5da6bbec7 Deren Wu 2023-09-18 2461 };
c948b5da6bbec7 Deren Wu 2023-09-18 2462 struct sk_buff *skb;
c948b5da6bbec7 Deren Wu 2023-09-18 2463 u8 cap_offs;
c948b5da6bbec7 Deren Wu 2023-09-18 2464
c948b5da6bbec7 Deren Wu 2023-09-18 2465 /* support enable/update process only
c948b5da6bbec7 Deren Wu 2023-09-18 2466 * disable flow would be handled in bss stop handler automatically
c948b5da6bbec7 Deren Wu 2023-09-18 2467 */
c948b5da6bbec7 Deren Wu 2023-09-18 2468 if (!enable)
c948b5da6bbec7 Deren Wu 2023-09-18 2469 return -EOPNOTSUPP;
c948b5da6bbec7 Deren Wu 2023-09-18 2470
c948b5da6bbec7 Deren Wu 2023-09-18 2471 skb = ieee80211_beacon_get_template(mt76_hw(dev), vif, &offs, 0);
c948b5da6bbec7 Deren Wu 2023-09-18 2472 if (!skb)
c948b5da6bbec7 Deren Wu 2023-09-18 2473 return -EINVAL;
c948b5da6bbec7 Deren Wu 2023-09-18 2474
c948b5da6bbec7 Deren Wu 2023-09-18 2475 cap_offs = offsetof(struct ieee80211_mgmt, u.beacon.capab_info);
c948b5da6bbec7 Deren Wu 2023-09-18 2476 if (!skb_pull(skb, cap_offs)) {
c948b5da6bbec7 Deren Wu 2023-09-18 2477 dev_err(dev->mt76.dev, "beacon format err\n");
c948b5da6bbec7 Deren Wu 2023-09-18 2478 dev_kfree_skb(skb);
c948b5da6bbec7 Deren Wu 2023-09-18 2479 return -EINVAL;
c948b5da6bbec7 Deren Wu 2023-09-18 2480 }
c948b5da6bbec7 Deren Wu 2023-09-18 2481
c948b5da6bbec7 Deren Wu 2023-09-18 2482 if (skb->len > 512) {
^^^
512 bytes
c948b5da6bbec7 Deren Wu 2023-09-18 2483 dev_err(dev->mt76.dev, "beacon size limit exceed\n");
c948b5da6bbec7 Deren Wu 2023-09-18 2484 dev_kfree_skb(skb);
c948b5da6bbec7 Deren Wu 2023-09-18 2485 return -EINVAL;
c948b5da6bbec7 Deren Wu 2023-09-18 2486 }
c948b5da6bbec7 Deren Wu 2023-09-18 2487
c948b5da6bbec7 Deren Wu 2023-09-18 @2488 memcpy(req.beacon_tlv.pkt, skb->data, skb->len);
2 byte overflow.
c948b5da6bbec7 Deren Wu 2023-09-18 2489 req.beacon_tlv.pkt_len = cpu_to_le16(skb->len);
c948b5da6bbec7 Deren Wu 2023-09-18 2490 offs.tim_offset -= cap_offs;
c948b5da6bbec7 Deren Wu 2023-09-18 2491 req.beacon_tlv.tim_ie_pos = cpu_to_le16(offs.tim_offset);
c948b5da6bbec7 Deren Wu 2023-09-18 2492
c948b5da6bbec7 Deren Wu 2023-09-18 2493 if (offs.cntdwn_counter_offs[0]) {
c948b5da6bbec7 Deren Wu 2023-09-18 2494 u16 csa_offs;
c948b5da6bbec7 Deren Wu 2023-09-18 2495
c948b5da6bbec7 Deren Wu 2023-09-18 2496 csa_offs = offs.cntdwn_counter_offs[0] - cap_offs - 4;
c948b5da6bbec7 Deren Wu 2023-09-18 2497 req.beacon_tlv.csa_ie_pos = cpu_to_le16(csa_offs);
c948b5da6bbec7 Deren Wu 2023-09-18 2498 }
c948b5da6bbec7 Deren Wu 2023-09-18 2499 dev_kfree_skb(skb);
c948b5da6bbec7 Deren Wu 2023-09-18 2500
c948b5da6bbec7 Deren Wu 2023-09-18 2501 return mt76_mcu_send_msg(&dev->mt76, MCU_UNI_CMD(BSS_INFO_UPDATE),
c948b5da6bbec7 Deren Wu 2023-09-18 2502 &req, sizeof(req), true);
c948b5da6bbec7 Deren Wu 2023-09-18 2503 }
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next reply other threads:[~2026-10-19 8:14 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-10-19 8:14 Dan Carpenter [this message]
-- strict thread matches above, loose matches on Subject: below --
2026-10-18 7:49 [linux-next:master 13462/18293] drivers/net/wireless/mediatek/mt76/mt7925/mcu.c:2488 mt7925_mcu_uni_add_beacon_offload() error: __builtin_memcpy() 'req.beacon_tlv.pkt' too small (510 vs 512) kernel test robot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=atXRVRc2T414bLiM@stanley.mountain \
--to=error27@gmail.com \
--cc=anthony.liu@mediatek.com \
--cc=lkp@intel.com \
--cc=nbd@nbd.name \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=oe-kbuild@lists.linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.