Re: [PATCH] ipw2x00: Avoid field-overflowing memcpy()

From: kernel test robot
Date: Fri Aug 06 2021 - 22:37:28 EST

Hi Kees,

I love your patch! Perhaps something to improve:

[auto build test WARNING on wireless-drivers-next/master]
[also build test WARNING on wireless-drivers/master kees/for-next/pstore v5.14-rc4 next-20210806]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch]

url: https://github.com/0day-ci/linux/commits/Kees-Cook/ipw2x00-Avoid-field-overflowing-memcpy/20210807-041024
base: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-next.git master
config: ia64-allmodconfig (attached as .config)
compiler: ia64-linux-gcc (GCC) 10.3.0
reproduce (this is a W=1 build):
wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross
chmod +x ~/bin/make.cross
# https://github.com/0day-ci/linux/commit/8f3acfe1fbe7b1bad6ff871b98209bbbf6581992
git remote add linux-review https://github.com/0day-ci/linux
git fetch --no-tags linux-review Kees-Cook/ipw2x00-Avoid-field-overflowing-memcpy/20210807-041024
git checkout 8f3acfe1fbe7b1bad6ff871b98209bbbf6581992
# save the attached .config to linux build tree
COMPILER_INSTALL_PATH=$HOME/0day COMPILER=gcc-10.3.0 make.cross ARCH=ia64

If you fix the issue, kindly add following tag as appropriate
Reported-by: kernel test robot <lkp@xxxxxxxxx>

All warnings (new ones prefixed by >>):

In function 'libipw_read_qos_info_element',
inlined from 'libipw_parse_qos_info_param_IE' at drivers/net/wireless/intel/ipw2x00/libipw_rx.c:1025:7:
>> drivers/net/wireless/intel/ipw2x00/libipw_rx.c:973:2: warning: argument 2 null where non-null expected [-Wnonnull]
973 | memcpy(element_info, info_element, size);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
In file included from include/linux/string.h:20,
from include/linux/bitmap.h:10,
from include/linux/cpumask.h:12,
from include/linux/smp.h:13,
from include/linux/lockdep.h:14,
from include/linux/spinlock.h:59,
from include/linux/mmzone.h:8,
from include/linux/gfp.h:6,
from include/linux/mm.h:10,
from include/linux/bvec.h:14,
from include/linux/skbuff.h:17,
from include/linux/if_arp.h:22,
from drivers/net/wireless/intel/ipw2x00/libipw_rx.c:14:
drivers/net/wireless/intel/ipw2x00/libipw_rx.c: In function 'libipw_parse_qos_info_param_IE':
arch/ia64/include/asm/string.h:19:14: note: in a call to function 'memcpy' declared here
19 | extern void *memcpy (void *, const void *, __kernel_size_t);
| ^~~~~~


vim +973 drivers/net/wireless/intel/ipw2x00/libipw_rx.c

960
961 /*
962 * Parse a QoS information element
963 */
964 static int libipw_read_qos_info_element(
965 struct libipw_qos_information_element *element_info,
966 struct libipw_info_element *info_element)
967 {
968 size_t size = sizeof(struct libipw_qos_information_element) - 2;
969
970 if (!element_info || info_element || info_element->len != size - 2)
971 return -1;
972
> 973 memcpy(element_info, info_element, size);
974 return libipw_verify_qos_info(element_info, QOS_OUI_INFO_SUB_TYPE);
975 }
976
977 /*
978 * Write QoS parameters from the ac parameters.
979 */
980 static void libipw_qos_convert_ac_to_parameters(struct
981 libipw_qos_parameter_info
982 *param_elm, struct
983 libipw_qos_parameters
984 *qos_param)
985 {
986 int i;
987 struct libipw_qos_ac_parameter *ac_params;
988 u32 txop;
989 u8 cw_min;
990 u8 cw_max;
991
992 for (i = 0; i < QOS_QUEUE_NUM; i++) {
993 ac_params = &(param_elm->ac_params_record[i]);
994
995 qos_param->aifs[i] = (ac_params->aci_aifsn) & 0x0F;
996 qos_param->aifs[i] -= (qos_param->aifs[i] < 2) ? 0 : 2;
997
998 cw_min = ac_params->ecw_min_max & 0x0F;
999 qos_param->cw_min[i] = cpu_to_le16((1 << cw_min) - 1);
1000
1001 cw_max = (ac_params->ecw_min_max & 0xF0) >> 4;
1002 qos_param->cw_max[i] = cpu_to_le16((1 << cw_max) - 1);
1003
1004 qos_param->flag[i] =
1005 (ac_params->aci_aifsn & 0x10) ? 0x01 : 0x00;
1006
1007 txop = le16_to_cpu(ac_params->tx_op_limit) * 32;
1008 qos_param->tx_op_limit[i] = cpu_to_le16(txop);
1009 }
1010 }
1011
1012 /*
1013 * we have a generic data element which it may contain QoS information or
1014 * parameters element. check the information element length to decide
1015 * which type to read
1016 */
1017 static int libipw_parse_qos_info_param_IE(struct libipw_info_element
1018 *info_element,
1019 struct libipw_network *network)
1020 {
1021 int rc = 0;
1022 struct libipw_qos_parameters *qos_param = NULL;
1023 struct libipw_qos_information_element qos_info_element;
1024
> 1025 rc = libipw_read_qos_info_element(&qos_info_element, info_element);
1026
1027 if (rc == 0) {
1028 network->qos_data.param_count = qos_info_element.ac_info & 0x0F;
1029 network->flags |= NETWORK_HAS_QOS_INFORMATION;
1030 } else {
1031 struct libipw_qos_parameter_info param_element;
1032
1033 rc = libipw_read_qos_param_element(&param_element,
1034 info_element);
1035 if (rc == 0) {
1036 qos_param = &(network->qos_data.parameters);
1037 libipw_qos_convert_ac_to_parameters(&param_element,
1038 qos_param);
1039 network->flags |= NETWORK_HAS_QOS_PARAMETERS;
1040 network->qos_data.param_count =
1041 param_element.info_element.ac_info & 0x0F;
1042 }
1043 }
1044
1045 if (rc == 0) {
1046 LIBIPW_DEBUG_QOS("QoS is supported\n");
1047 network->qos_data.supported = 1;
1048 }
1049 return rc;
1050 }
1051

---
0-DAY CI Kernel Test Service, Intel Corporation
https://lists.01.org/hyperkitty/list/kbuild-all@xxxxxxxxxxxx

Attachment: .config.gz
Description: application/gzip