ATH10K Archive on lore.kernel.org
 help / color / mirror / Atom feed
* [ath6kl:pending-ath11k 198/205] drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)
@ 2019-06-18  6:53 kbuild test robot
  2019-06-18  6:59 ` John Crispin
  0 siblings, 1 reply; 3+ messages in thread
From: kbuild test robot @ 2019-06-18  6:53 UTC (permalink / raw)
  To: kbuild, John Crispin; +Cc: Kalle Valo, ath10k, kbuild-all, Dan Carpenter

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git pending-ath11k
head:   0f82fec5679664bb91d6c167fd1a146f113e4197
commit: cbdb3159fdf450b7b3999a06600aa0e1fb78383f [198/205] ath11k: set additional values inside wmi_peer_assoc_complete_cmd

If you fix the issue, kindly add following tag
Reported-by: kbuild test robot <lkp@intel.com>
Reported-by: Dan Carpenter <dan.carpenter@oracle.com>

New smatch warnings:
drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)

Old smatch warnings:
drivers/net/wireless/ath/ath11k/mac.c:1276 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.phy_cap_info' too small (11 vs 12)

# https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?id=cbdb3159fdf450b7b3999a06600aa0e1fb78383f
git remote add ath6kl https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
git remote update ath6kl
git checkout cbdb3159fdf450b7b3999a06600aa0e1fb78383f
vim +1274 drivers/net/wireless/ath/ath11k/mac.c

258bbf52 Kalle Valo   2019-02-05  1260  
258bbf52 Kalle Valo   2019-02-05  1261  static void ath11k_peer_assoc_h_he(struct ath11k *ar,
258bbf52 Kalle Valo   2019-02-05  1262  				   struct ieee80211_vif *vif,
258bbf52 Kalle Valo   2019-02-05  1263  				   struct ieee80211_sta *sta,
258bbf52 Kalle Valo   2019-02-05  1264  				   struct peer_assoc_params *arg)
258bbf52 Kalle Valo   2019-02-05  1265  {
17aca2d9 John Crispin 2019-06-03  1266  	const struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
3db59a23 Kalle Valo   2019-06-12  1267  	u16 v;
17aca2d9 John Crispin 2019-06-03  1268  
17aca2d9 John Crispin 2019-06-03  1269  	if (!he_cap->has_he)
17aca2d9 John Crispin 2019-06-03  1270  		return;
17aca2d9 John Crispin 2019-06-03  1271  
17aca2d9 John Crispin 2019-06-03  1272  	arg->he_flag = true;
17aca2d9 John Crispin 2019-06-03  1273  
17aca2d9 John Crispin 2019-06-03 @1274  	memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info,
17aca2d9 John Crispin 2019-06-03  1275  	       sizeof(arg->peer_he_cap_macinfo));

Smatch thinks these are different sizes...  I don't have a copy of
struct peer_assoc_params so I can't check.

17aca2d9 John Crispin 2019-06-03  1276  	memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info,
17aca2d9 John Crispin 2019-06-03  1277  	       sizeof(arg->peer_he_cap_phyinfo));
17aca2d9 John Crispin 2019-06-03  1278  	memcpy(&arg->peer_he_ops, &vif->bss_conf.he_operation,
17aca2d9 John Crispin 2019-06-03  1279  	       sizeof(arg->peer_he_ops));
cbdb3159 John Crispin 2019-06-17  1280  	arg->peer_he_cap_macinfo_internal = 0x0;
17aca2d9 John Crispin 2019-06-03  1281  
17aca2d9 John Crispin 2019-06-03  1282  	if (he_cap->he_cap_elem.phy_cap_info[6] &
17aca2d9 John Crispin 2019-06-03  1283  	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
17aca2d9 John Crispin 2019-06-03  1284  		int bit = 7;
17aca2d9 John Crispin 2019-06-03  1285  		int nss, ru;
17aca2d9 John Crispin 2019-06-03  1286  
17aca2d9 John Crispin 2019-06-03  1287  		arg->peer_ppet.numss_m1 = he_cap->ppe_thres[0] &
17aca2d9 John Crispin 2019-06-03  1288  					  IEEE80211_PPE_THRES_NSS_MASK;
17aca2d9 John Crispin 2019-06-03  1289  		arg->peer_ppet.ru_bit_mask =
17aca2d9 John Crispin 2019-06-03  1290  			(he_cap->ppe_thres[0] &
17aca2d9 John Crispin 2019-06-03  1291  			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
17aca2d9 John Crispin 2019-06-03  1292  			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
17aca2d9 John Crispin 2019-06-03  1293  
17aca2d9 John Crispin 2019-06-03  1294  		for (nss = 0; nss <= arg->peer_ppet.numss_m1; nss++) {
17aca2d9 John Crispin 2019-06-03  1295  			for (ru = 0; ru < 4; ru++) {
17aca2d9 John Crispin 2019-06-03  1296  				u32 val = 0;
17aca2d9 John Crispin 2019-06-03  1297  				int i;
17aca2d9 John Crispin 2019-06-03  1298  
17aca2d9 John Crispin 2019-06-03  1299  				if ((arg->peer_ppet.ru_bit_mask & BIT(ru)) == 0)
17aca2d9 John Crispin 2019-06-03  1300  					continue;
17aca2d9 John Crispin 2019-06-03  1301  				for (i = 0; i < 6; i++) {
17aca2d9 John Crispin 2019-06-03  1302  					val >>= 1;
17aca2d9 John Crispin 2019-06-03  1303  					val |= ((he_cap->ppe_thres[bit / 8] >>
17aca2d9 John Crispin 2019-06-03  1304  						 (bit % 8)) & 0x1) << 5;
17aca2d9 John Crispin 2019-06-03  1305  					bit++;
17aca2d9 John Crispin 2019-06-03  1306  				}
17aca2d9 John Crispin 2019-06-03  1307  				arg->peer_ppet.ppet16_ppet8_ru3_ru0[nss] |=
17aca2d9 John Crispin 2019-06-03  1308  								val << (ru * 6);
17aca2d9 John Crispin 2019-06-03  1309  			}
17aca2d9 John Crispin 2019-06-03  1310  		}
17aca2d9 John Crispin 2019-06-03  1311  	}
17aca2d9 John Crispin 2019-06-03  1312  
17aca2d9 John Crispin 2019-06-03  1313  	switch (sta->bandwidth) {
17aca2d9 John Crispin 2019-06-03  1314  	case IEEE80211_STA_RX_BW_160:
17aca2d9 John Crispin 2019-06-03  1315  		if (he_cap->he_cap_elem.phy_cap_info[0] &
17aca2d9 John Crispin 2019-06-03  1316  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
3db59a23 Kalle Valo   2019-06-12  1317  			v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80p80);
3db59a23 Kalle Valo   2019-06-12  1318  			arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80_80] = v;
3db59a23 Kalle Valo   2019-06-12  1319  
3db59a23 Kalle Valo   2019-06-12  1320  			v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80p80);
3db59a23 Kalle Valo   2019-06-12  1321  			arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80_80] = v;
3db59a23 Kalle Valo   2019-06-12  1322  
17aca2d9 John Crispin 2019-06-03  1323  			arg->peer_he_mcs_count++;
17aca2d9 John Crispin 2019-06-03  1324  		}
3db59a23 Kalle Valo   2019-06-12  1325  
3db59a23 Kalle Valo   2019-06-12  1326  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
3db59a23 Kalle Valo   2019-06-12  1327  		arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
3db59a23 Kalle Valo   2019-06-12  1328  
3db59a23 Kalle Valo   2019-06-12  1329  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_160);
3db59a23 Kalle Valo   2019-06-12  1330  		arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
3db59a23 Kalle Valo   2019-06-12  1331  
17aca2d9 John Crispin 2019-06-03  1332  		arg->peer_he_mcs_count++;
17aca2d9 John Crispin 2019-06-03  1333  		/* drop through */
17aca2d9 John Crispin 2019-06-03  1334  
17aca2d9 John Crispin 2019-06-03  1335  	default:
3db59a23 Kalle Valo   2019-06-12  1336  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
3db59a23 Kalle Valo   2019-06-12  1337  		arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
3db59a23 Kalle Valo   2019-06-12  1338  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
3db59a23 Kalle Valo   2019-06-12  1339  		arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
17aca2d9 John Crispin 2019-06-03  1340  		arg->peer_he_mcs_count++;
17aca2d9 John Crispin 2019-06-03  1341  		break;
17aca2d9 John Crispin 2019-06-03  1342  	}
258bbf52 Kalle Valo   2019-02-05  1343  }
258bbf52 Kalle Valo   2019-02-05  1344  

:::::: The code at line 1274 was first introduced by commit
:::::: 17aca2d9a969788a7f1e3e0c72b5485bf6a432a4 ath11k: add HE support

:::::: TO: John Crispin <john@phrozen.org>
:::::: CC: Kalle Valo <kvalo@codeaurora.org>

---
0-DAY kernel test infrastructure                Open Source Technology Center
https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [ath6kl:pending-ath11k 198/205] drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)
  2019-06-18  6:53 [ath6kl:pending-ath11k 198/205] drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8) kbuild test robot
@ 2019-06-18  6:59 ` John Crispin
  2019-06-18 11:47   ` Dan Carpenter
  0 siblings, 1 reply; 3+ messages in thread
From: John Crispin @ 2019-06-18  6:59 UTC (permalink / raw)
  To: kbuild test robot, kbuild; +Cc: Kalle Valo, ath10k, kbuild-all, Dan Carpenter


On 18/06/2019 08:53, kbuild test robot wrote:
> tree:   https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git pending-ath11k
> head:   0f82fec5679664bb91d6c167fd1a146f113e4197
> commit: cbdb3159fdf450b7b3999a06600aa0e1fb78383f [198/205] ath11k: set additional values inside wmi_peer_assoc_complete_cmd
>
> If you fix the issue, kindly add following tag
> Reported-by: kbuild test robot <lkp@intel.com>
> Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
>
> New smatch warnings:
> drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)
>
> Old smatch warnings:
> drivers/net/wireless/ath/ath11k/mac.c:1276 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.phy_cap_info' too small (11 vs 12)
>
> # https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?id=cbdb3159fdf450b7b3999a06600aa0e1fb78383f
> git remote add ath6kl https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
> git remote update ath6kl
> git checkout cbdb3159fdf450b7b3999a06600aa0e1fb78383f
> vim +1274 drivers/net/wireless/ath/ath11k/mac.c
>
> 258bbf52 Kalle Valo   2019-02-05  1260
> 258bbf52 Kalle Valo   2019-02-05  1261  static void ath11k_peer_assoc_h_he(struct ath11k *ar,
> 258bbf52 Kalle Valo   2019-02-05  1262  				   struct ieee80211_vif *vif,
> 258bbf52 Kalle Valo   2019-02-05  1263  				   struct ieee80211_sta *sta,
> 258bbf52 Kalle Valo   2019-02-05  1264  				   struct peer_assoc_params *arg)
> 258bbf52 Kalle Valo   2019-02-05  1265  {
> 17aca2d9 John Crispin 2019-06-03  1266  	const struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
> 3db59a23 Kalle Valo   2019-06-12  1267  	u16 v;
> 17aca2d9 John Crispin 2019-06-03  1268
> 17aca2d9 John Crispin 2019-06-03  1269  	if (!he_cap->has_he)
> 17aca2d9 John Crispin 2019-06-03  1270  		return;
> 17aca2d9 John Crispin 2019-06-03  1271
> 17aca2d9 John Crispin 2019-06-03  1272  	arg->he_flag = true;
> 17aca2d9 John Crispin 2019-06-03  1273
> 17aca2d9 John Crispin 2019-06-03 @1274  	memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info,
> 17aca2d9 John Crispin 2019-06-03  1275  	       sizeof(arg->peer_he_cap_macinfo));
>
> Smatch thinks these are different sizes...  I don't have a copy of
> struct peer_assoc_params so I can't check.

Hi,

its he_cap->he_cap_elem.mac_cap_info[6] and arg->peer_he_cap_macinfo[2] and we only copy the first 2 elements as the FW only cares for the first 2 bytes.

	John




>
> 17aca2d9 John Crispin 2019-06-03  1276  	memcpy(&arg->peer_he_cap_phyinfo, he_cap->he_cap_elem.phy_cap_info,
> 17aca2d9 John Crispin 2019-06-03  1277  	       sizeof(arg->peer_he_cap_phyinfo));
> 17aca2d9 John Crispin 2019-06-03  1278  	memcpy(&arg->peer_he_ops, &vif->bss_conf.he_operation,
> 17aca2d9 John Crispin 2019-06-03  1279  	       sizeof(arg->peer_he_ops));
> cbdb3159 John Crispin 2019-06-17  1280  	arg->peer_he_cap_macinfo_internal = 0x0;
> 17aca2d9 John Crispin 2019-06-03  1281
> 17aca2d9 John Crispin 2019-06-03  1282  	if (he_cap->he_cap_elem.phy_cap_info[6] &
> 17aca2d9 John Crispin 2019-06-03  1283  	    IEEE80211_HE_PHY_CAP6_PPE_THRESHOLD_PRESENT) {
> 17aca2d9 John Crispin 2019-06-03  1284  		int bit = 7;
> 17aca2d9 John Crispin 2019-06-03  1285  		int nss, ru;
> 17aca2d9 John Crispin 2019-06-03  1286
> 17aca2d9 John Crispin 2019-06-03  1287  		arg->peer_ppet.numss_m1 = he_cap->ppe_thres[0] &
> 17aca2d9 John Crispin 2019-06-03  1288  					  IEEE80211_PPE_THRES_NSS_MASK;
> 17aca2d9 John Crispin 2019-06-03  1289  		arg->peer_ppet.ru_bit_mask =
> 17aca2d9 John Crispin 2019-06-03  1290  			(he_cap->ppe_thres[0] &
> 17aca2d9 John Crispin 2019-06-03  1291  			 IEEE80211_PPE_THRES_RU_INDEX_BITMASK_MASK) >>
> 17aca2d9 John Crispin 2019-06-03  1292  			IEEE80211_PPE_THRES_RU_INDEX_BITMASK_POS;
> 17aca2d9 John Crispin 2019-06-03  1293
> 17aca2d9 John Crispin 2019-06-03  1294  		for (nss = 0; nss <= arg->peer_ppet.numss_m1; nss++) {
> 17aca2d9 John Crispin 2019-06-03  1295  			for (ru = 0; ru < 4; ru++) {
> 17aca2d9 John Crispin 2019-06-03  1296  				u32 val = 0;
> 17aca2d9 John Crispin 2019-06-03  1297  				int i;
> 17aca2d9 John Crispin 2019-06-03  1298
> 17aca2d9 John Crispin 2019-06-03  1299  				if ((arg->peer_ppet.ru_bit_mask & BIT(ru)) == 0)
> 17aca2d9 John Crispin 2019-06-03  1300  					continue;
> 17aca2d9 John Crispin 2019-06-03  1301  				for (i = 0; i < 6; i++) {
> 17aca2d9 John Crispin 2019-06-03  1302  					val >>= 1;
> 17aca2d9 John Crispin 2019-06-03  1303  					val |= ((he_cap->ppe_thres[bit / 8] >>
> 17aca2d9 John Crispin 2019-06-03  1304  						 (bit % 8)) & 0x1) << 5;
> 17aca2d9 John Crispin 2019-06-03  1305  					bit++;
> 17aca2d9 John Crispin 2019-06-03  1306  				}
> 17aca2d9 John Crispin 2019-06-03  1307  				arg->peer_ppet.ppet16_ppet8_ru3_ru0[nss] |=
> 17aca2d9 John Crispin 2019-06-03  1308  								val << (ru * 6);
> 17aca2d9 John Crispin 2019-06-03  1309  			}
> 17aca2d9 John Crispin 2019-06-03  1310  		}
> 17aca2d9 John Crispin 2019-06-03  1311  	}
> 17aca2d9 John Crispin 2019-06-03  1312
> 17aca2d9 John Crispin 2019-06-03  1313  	switch (sta->bandwidth) {
> 17aca2d9 John Crispin 2019-06-03  1314  	case IEEE80211_STA_RX_BW_160:
> 17aca2d9 John Crispin 2019-06-03  1315  		if (he_cap->he_cap_elem.phy_cap_info[0] &
> 17aca2d9 John Crispin 2019-06-03  1316  		    IEEE80211_HE_PHY_CAP0_CHANNEL_WIDTH_SET_80PLUS80_MHZ_IN_5G) {
> 3db59a23 Kalle Valo   2019-06-12  1317  			v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80p80);
> 3db59a23 Kalle Valo   2019-06-12  1318  			arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80_80] = v;
> 3db59a23 Kalle Valo   2019-06-12  1319
> 3db59a23 Kalle Valo   2019-06-12  1320  			v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80p80);
> 3db59a23 Kalle Valo   2019-06-12  1321  			arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80_80] = v;
> 3db59a23 Kalle Valo   2019-06-12  1322
> 17aca2d9 John Crispin 2019-06-03  1323  			arg->peer_he_mcs_count++;
> 17aca2d9 John Crispin 2019-06-03  1324  		}
> 3db59a23 Kalle Valo   2019-06-12  1325
> 3db59a23 Kalle Valo   2019-06-12  1326  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_160);
> 3db59a23 Kalle Valo   2019-06-12  1327  		arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
> 3db59a23 Kalle Valo   2019-06-12  1328
> 3db59a23 Kalle Valo   2019-06-12  1329  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_160);
> 3db59a23 Kalle Valo   2019-06-12  1330  		arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_160] = v;
> 3db59a23 Kalle Valo   2019-06-12  1331
> 17aca2d9 John Crispin 2019-06-03  1332  		arg->peer_he_mcs_count++;
> 17aca2d9 John Crispin 2019-06-03  1333  		/* drop through */
> 17aca2d9 John Crispin 2019-06-03  1334
> 17aca2d9 John Crispin 2019-06-03  1335  	default:
> 3db59a23 Kalle Valo   2019-06-12  1336  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.rx_mcs_80);
> 3db59a23 Kalle Valo   2019-06-12  1337  		arg->peer_he_rx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
> 3db59a23 Kalle Valo   2019-06-12  1338  		v = le16_to_cpu(he_cap->he_mcs_nss_supp.tx_mcs_80);
> 3db59a23 Kalle Valo   2019-06-12  1339  		arg->peer_he_tx_mcs_set[WMI_HECAP_TXRX_MCS_NSS_IDX_80] = v;
> 17aca2d9 John Crispin 2019-06-03  1340  		arg->peer_he_mcs_count++;
> 17aca2d9 John Crispin 2019-06-03  1341  		break;
> 17aca2d9 John Crispin 2019-06-03  1342  	}
> 258bbf52 Kalle Valo   2019-02-05  1343  }
> 258bbf52 Kalle Valo   2019-02-05  1344
>
> :::::: The code at line 1274 was first introduced by commit
> :::::: 17aca2d9a969788a7f1e3e0c72b5485bf6a432a4 ath11k: add HE support
>
> :::::: TO: John Crispin <john@phrozen.org>
> :::::: CC: Kalle Valo <kvalo@codeaurora.org>
>
> ---
> 0-DAY kernel test infrastructure                Open Source Technology Center
> https://lists.01.org/pipermail/kbuild-all                   Intel Corporation

_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

^ permalink raw reply	[flat|nested] 3+ messages in thread
* Re: [ath6kl:pending-ath11k 198/205] drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)
  2019-06-18  6:59 ` John Crispin
@ 2019-06-18 11:47   ` Dan Carpenter
  0 siblings, 0 replies; 3+ messages in thread
From: Dan Carpenter @ 2019-06-18 11:47 UTC (permalink / raw)
  To: John Crispin; +Cc: Kalle Valo, kbuild, kbuild test robot, ath10k, kbuild-all

On Tue, Jun 18, 2019 at 08:59:55AM +0200, John Crispin wrote:
> 
> On 18/06/2019 08:53, kbuild test robot wrote:
> > tree:   https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git pending-ath11k
> > head:   0f82fec5679664bb91d6c167fd1a146f113e4197
> > commit: cbdb3159fdf450b7b3999a06600aa0e1fb78383f [198/205] ath11k: set additional values inside wmi_peer_assoc_complete_cmd
> > 
> > If you fix the issue, kindly add following tag
> > Reported-by: kbuild test robot <lkp@intel.com>
> > Reported-by: Dan Carpenter <dan.carpenter@oracle.com>
> > 
> > New smatch warnings:
> > drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8)
> > 
> > Old smatch warnings:
> > drivers/net/wireless/ath/ath11k/mac.c:1276 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.phy_cap_info' too small (11 vs 12)
> > 
> > # https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git/commit/?id=cbdb3159fdf450b7b3999a06600aa0e1fb78383f
> > git remote add ath6kl https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/ath.git
> > git remote update ath6kl
> > git checkout cbdb3159fdf450b7b3999a06600aa0e1fb78383f
> > vim +1274 drivers/net/wireless/ath/ath11k/mac.c
> > 
> > 258bbf52 Kalle Valo   2019-02-05  1260
> > 258bbf52 Kalle Valo   2019-02-05  1261  static void ath11k_peer_assoc_h_he(struct ath11k *ar,
> > 258bbf52 Kalle Valo   2019-02-05  1262  				   struct ieee80211_vif *vif,
> > 258bbf52 Kalle Valo   2019-02-05  1263  				   struct ieee80211_sta *sta,
> > 258bbf52 Kalle Valo   2019-02-05  1264  				   struct peer_assoc_params *arg)
> > 258bbf52 Kalle Valo   2019-02-05  1265  {
> > 17aca2d9 John Crispin 2019-06-03  1266  	const struct ieee80211_sta_he_cap *he_cap = &sta->he_cap;
> > 3db59a23 Kalle Valo   2019-06-12  1267  	u16 v;
> > 17aca2d9 John Crispin 2019-06-03  1268
> > 17aca2d9 John Crispin 2019-06-03  1269  	if (!he_cap->has_he)
> > 17aca2d9 John Crispin 2019-06-03  1270  		return;
> > 17aca2d9 John Crispin 2019-06-03  1271
> > 17aca2d9 John Crispin 2019-06-03  1272  	arg->he_flag = true;
> > 17aca2d9 John Crispin 2019-06-03  1273
> > 17aca2d9 John Crispin 2019-06-03 @1274  	memcpy(&arg->peer_he_cap_macinfo, he_cap->he_cap_elem.mac_cap_info,
> > 17aca2d9 John Crispin 2019-06-03  1275  	       sizeof(arg->peer_he_cap_macinfo));
> > 
> > Smatch thinks these are different sizes...  I don't have a copy of
> > struct peer_assoc_params so I can't check.
> 
> Hi,
> 
> its he_cap->he_cap_elem.mac_cap_info[6] and arg->peer_he_cap_macinfo[2] and we only copy the first 2 elements as the FW only cares for the first 2 bytes.
> 

I did download the latest git.  The problem is that
he_cap->he_cap_elem.mac_cap_info[] is six bytes and arg->peer_he_cap_macinfo[]
is two u32s or eight bytes.  So we are reading beyond the end of the
array.

regards,
dan carpenter


_______________________________________________
ath10k mailing list
ath10k@lists.infradead.org
http://lists.infradead.org/mailman/listinfo/ath10k

^ permalink raw reply	[flat|nested] 3+ messages in thread
end of thread, other threads:[~2019-06-18 11:47 UTC | newest]

Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2019-06-18  6:53 [ath6kl:pending-ath11k 198/205] drivers/net/wireless/ath/ath11k/mac.c:1274 ath11k_peer_assoc_h_he() error: memcpy() 'he_cap->he_cap_elem.mac_cap_info' too small (6 vs 8) kbuild test robot
2019-06-18  6:59 ` John Crispin
2019-06-18 11:47   ` Dan Carpenter

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox