linux-kernel - drivers/accel/qaic/qaic_control.c:348:17: warning: array subscript 'struct wrapper_msg[0]' is partly outside array bounds of 'unsigned char[44]'

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date:   Wed, 20 Sep 2023 04:55:05 +0800
From:   kernel test robot <lkp@...el.com>
To:     Jeffrey Hugo <quic_jhugo@...cinc.com>
Cc:     oe-kbuild-all@...ts.linux.dev, linux-kernel@...r.kernel.org,
        Jacek Lawrynowicz <jacek.lawrynowicz@...ux.intel.com>,
        Carl Vanderlip <quic_carlv@...cinc.com>,
        Pranjal Ramajor Asha Kanojiya <quic_pkanojiy@...cinc.com>,
        Stanislaw Gruszka <stanislaw.gruszka@...ux.intel.com>
Subject: drivers/accel/qaic/qaic_control.c:348:17: warning: array subscript
 'struct wrapper_msg[0]' is partly outside array bounds of 'unsigned
 char[44]'

Hi Jeffrey,

First bad commit (maybe != root cause):

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   2cf0f715623872823a72e451243bbf555d10d032
commit: 759662e4f1f8cd6ea0ec466e10cf29fe7c1fec36 accel/qaic: Add qaic driver to the build system
date:   6 months ago
config: i386-randconfig-i015-20230718 (https://download.01.org/0day-ci/archive/20230920/202309200403.mGPrZFN4-lkp@intel.com/config)
compiler: gcc-12 (Debian 12.2.0-14) 12.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20230920/202309200403.mGPrZFN4-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202309200403.mGPrZFN4-lkp@intel.com/

All warnings (new ones prefixed by >>):

   In function 'add_wrapper',
       inlined from 'abort_dma_cont' at drivers/accel/qaic/qaic_control.c:1107:12,
       inlined from 'qaic_manage_msg_xfer' at drivers/accel/qaic/qaic_control.c:1165:9:
>> drivers/accel/qaic/qaic_control.c:348:17: warning: array subscript 'struct wrapper_msg[0]' is partly outside array bounds of 'unsigned char[44]' [-Warray-bounds]
     348 |         w->head = wrappers;
         |         ~~~~~~~~^~~~~~~~~~
   In file included from include/linux/fs.h:45,
                    from include/linux/huge_mm.h:8,
                    from include/linux/mm.h:855,
                    from include/linux/scatterlist.h:8,
                    from include/linux/dma-mapping.h:10,
                    from drivers/accel/qaic/qaic_control.c:10:
   In function 'kmalloc',
       inlined from 'kzalloc' at include/linux/slab.h:720:9,
       inlined from 'add_wrapper' at drivers/accel/qaic/qaic_control.c:342:26,
       inlined from 'abort_dma_cont' at drivers/accel/qaic/qaic_control.c:1107:12,
       inlined from 'qaic_manage_msg_xfer' at drivers/accel/qaic/qaic_control.c:1165:9:
   include/linux/slab.h:580:24: note: object of size 44 allocated by 'kmalloc_trace'
     580 |                 return kmalloc_trace(
         |                        ^~~~~~~~~~~~~~
     581 |                                 kmalloc_caches[kmalloc_type(flags)][index],
         |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     582 |                                 flags, size);
         |                                 ~~~~~~~~~~~~
   In function 'abort_dma_cont',
       inlined from 'qaic_manage_msg_xfer' at drivers/accel/qaic/qaic_control.c:1165:9:
   drivers/accel/qaic/qaic_control.c:1121:22: warning: array subscript 'struct wrapper_msg[0]' is partly outside array bounds of 'unsigned char[44]' [-Warray-bounds]
    1121 |         wrapper->len = size;
         |         ~~~~~~~~~~~~~^~~~~~
   In function 'kmalloc',
       inlined from 'kzalloc' at include/linux/slab.h:720:9,
       inlined from 'add_wrapper' at drivers/accel/qaic/qaic_control.c:342:26,
       inlined from 'abort_dma_cont' at drivers/accel/qaic/qaic_control.c:1107:12,
       inlined from 'qaic_manage_msg_xfer' at drivers/accel/qaic/qaic_control.c:1165:9:
   include/linux/slab.h:580:24: note: object of size 44 allocated by 'kmalloc_trace'
     580 |                 return kmalloc_trace(
         |                        ^~~~~~~~~~~~~~
     581 |                                 kmalloc_caches[kmalloc_type(flags)][index],
         |                                 ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
     582 |                                 flags, size);
         |                                 ~~~~~~~~~~~~


vim +348 drivers/accel/qaic/qaic_control.c

129776ac2e3823 Jeffrey Hugo 2023-03-27  339  
129776ac2e3823 Jeffrey Hugo 2023-03-27  340  static struct wrapper_msg *add_wrapper(struct wrapper_list *wrappers, u32 size)
129776ac2e3823 Jeffrey Hugo 2023-03-27  341  {
129776ac2e3823 Jeffrey Hugo 2023-03-27  342  	struct wrapper_msg *w = kzalloc(size, GFP_KERNEL);
129776ac2e3823 Jeffrey Hugo 2023-03-27  343  
129776ac2e3823 Jeffrey Hugo 2023-03-27  344  	if (!w)
129776ac2e3823 Jeffrey Hugo 2023-03-27  345  		return NULL;
129776ac2e3823 Jeffrey Hugo 2023-03-27  346  	list_add_tail(&w->list, &wrappers->list);
129776ac2e3823 Jeffrey Hugo 2023-03-27  347  	kref_init(&w->ref_count);
129776ac2e3823 Jeffrey Hugo 2023-03-27 @348  	w->head = wrappers;
129776ac2e3823 Jeffrey Hugo 2023-03-27  349  	return w;
129776ac2e3823 Jeffrey Hugo 2023-03-27  350  }
129776ac2e3823 Jeffrey Hugo 2023-03-27  351  

:::::: The code at line 348 was first introduced by commit
:::::: 129776ac2e38231fa9c02ce20e116c99de291666 accel/qaic: Add control path

:::::: TO: Jeffrey Hugo <quic_jhugo@...cinc.com>
:::::: CC: Jacek Lawrynowicz <jacek.lawrynowicz@...ux.intel.com>

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki