Re: [WARNING] memcpy: detected field-spanning write (size 1005) of single field "&out_cmd->cmd.payload" at drivers/net/wireless/intel/iwlegacy/common.c:3173 (size 320)

[Stanislaw Gruszka <stf_xl@wp.pl>]

Hi

On Fri, Apr 12, 2024 at 07:48:39PM +0200, Xose Vazquez Perez wrote:
> Hi,
> 
> In Fedora kernel 6.8.5-301.fc40.x86_64, dmesg shows:
> 
> [ device: 03:00.0 Network controller [0280]: Intel Corporation PRO/Wireless 4965 AG or AGN [Kedron] Network Connection [8086:4230] (rev 61) ]
> 
> Thanks.
> 
> [   53.407607] ------------[ cut here ]------------
> [   53.407622] memcpy: detected field-spanning write (size 1005) of single field "&out_cmd->cmd.payload" at drivers/net/wireless/intel/iwlegacy/common.c:3173 (size 320)
> [   53.407721] WARNING: CPU: 1 PID: 1632 at drivers/net/wireless/intel/iwlegacy/common.c:3173 il_enqueue_hcmd+0x477/0x560 [iwlegacy]

For CMD_SIZE_HUGE we have allocated 4k, so we do not do anything wrong.
Except maybe code is convoluted, since we use same structure for
huge and small il_device_cmd allocations.

But I'm thinking how to fix this fortify warning without refactoring and
some extra runtime cost ...   

Xose, could you test below patch? I did not tested it, but I think
it should make this particular warning gone and does not break
anything. But maybe it will trigger some others fortify warnings.

Regards
Stanislaw

diff --git a/drivers/net/wireless/intel/iwlegacy/common.c b/drivers/net/wireless/intel/iwlegacy/common.c
index 9d33a66a49b5..c4ccc5df6419 100644
--- a/drivers/net/wireless/intel/iwlegacy/common.c
+++ b/drivers/net/wireless/intel/iwlegacy/common.c
@@ -3170,7 +3170,7 @@ il_enqueue_hcmd(struct il_priv *il, struct il_host_cmd *cmd)
 		out_meta->callback = cmd->callback;
 
 	out_cmd->hdr.cmd = cmd->id;
-	memcpy(&out_cmd->cmd.payload, cmd->data, cmd->len);
+	memcpy(&out_cmd->hdr.data, cmd->data, cmd->len);
 
 	/* At this point, the out_cmd now has all of the incoming cmd
 	 * information */