| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202411041346.VYUgLq9I-lkp@intel.com>
Date: Mon, 4 Nov 2024 13:18:08 +0800
From: kernel test robot <lkp@...el.com>
To: "Gustavo A. R. Silva" <gustavoars@...nel.org>
Cc: llvm@...ts.linux.dev, oe-kbuild-all@...ts.linux.dev,
"Gustavo A. R. Silva" <gustavo@...eddedor.com>,
LKML <linux-kernel@...r.kernel.org>
Subject: [gustavoars:testing/wfamnae-next20241028-sa-with-flex 26/26]
net/ncsi/ncsi-rsp.c:649:2: warning: 'memcpy' will always overflow;
destination buffer has size 0, but size argument is 6
tree: https://git.kernel.org/pub/scm/linux/kernel/git/gustavoars/linux.git testing/wfamnae-next20241028-sa-with-flex
head: 0e7c24c783de39e1f965e8c23e96a7de29dfbfca
commit: 0e7c24c783de39e1f965e8c23e96a7de29dfbfca [26/26] uapi: socket: Introduce struct sockaddr_legacy
config: x86_64-allyesconfig (https://download.01.org/0day-ci/archive/20241104/202411041346.VYUgLq9I-lkp@intel.com/config)
compiler: clang version 19.1.3 (https://github.com/llvm/llvm-project ab51eccf88f5321e7c60591c5546b254b6afab99)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20241104/202411041346.VYUgLq9I-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202411041346.VYUgLq9I-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from net/ncsi/ncsi-rsp.c:9:
In file included from include/linux/netdevice.h:38:
In file included from include/net/net_namespace.h:43:
In file included from include/linux/skbuff.h:17:
In file included from include/linux/bvec.h:10:
In file included from include/linux/highmem.h:8:
In file included from include/linux/cacheflush.h:5:
In file included from arch/x86/include/asm/cacheflush.h:5:
In file included from include/linux/mm.h:2225:
include/linux/vmstat.h:504:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
504 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
505 | item];
| ~~~~
include/linux/vmstat.h:511:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
511 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
512 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:518:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
518 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
include/linux/vmstat.h:524:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
524 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
525 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
>> net/ncsi/ncsi-rsp.c:649:2: warning: 'memcpy' will always overflow; destination buffer has size 0, but size argument is 6 [-Wfortify-source]
649 | memcpy(saddr.sa_data, &rsp->data[mac_addr_off], ETH_ALEN);
| ^
include/linux/fortify-string.h:678:26: note: expanded from macro 'memcpy'
678 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^
include/linux/fortify-string.h:633:2: note: expanded from macro '__fortify_memcpy_chk'
633 | __underlying_##op(p, q, __fortify_size); \
| ^
<scratch space>:23:1: note: expanded from here
23 | __underlying_memcpy
| ^
include/linux/fortify-string.h:114:29: note: expanded from macro '__underlying_memcpy'
114 | #define __underlying_memcpy __builtin_memcpy
| ^
net/ncsi/ncsi-rsp.c:1119:3: warning: 'memcpy' will always overflow; destination buffer has size 0, but size argument is 6 [-Wfortify-source]
1119 | memcpy(saddr.sa_data, &rsp->addresses[i], ETH_ALEN);
| ^
include/linux/fortify-string.h:678:26: note: expanded from macro 'memcpy'
678 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^
include/linux/fortify-string.h:633:2: note: expanded from macro '__fortify_memcpy_chk'
633 | __underlying_##op(p, q, __fortify_size); \
| ^
<scratch space>:120:1: note: expanded from here
120 | __underlying_memcpy
| ^
include/linux/fortify-string.h:114:29: note: expanded from macro '__underlying_memcpy'
114 | #define __underlying_memcpy __builtin_memcpy
| ^
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
571 | __write_overflow_field(p_size_field, size);
| ^
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
10 warnings generated.
--
In file included from drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c:53:
In file included from include/linux/if_vlan.h:10:
In file included from include/linux/netdevice.h:38:
In file included from include/net/net_namespace.h:43:
In file included from include/linux/skbuff.h:17:
In file included from include/linux/bvec.h:10:
In file included from include/linux/highmem.h:8:
In file included from include/linux/cacheflush.h:5:
In file included from arch/x86/include/asm/cacheflush.h:5:
In file included from include/linux/mm.h:2225:
include/linux/vmstat.h:504:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
504 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
505 | item];
| ~~~~
include/linux/vmstat.h:511:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
511 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
512 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:518:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
518 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
include/linux/vmstat.h:524:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
524 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
525 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
>> drivers/infiniband/ulp/opa_vnic/opa_vnic_netdev.c:148:3: warning: 'memcpy' will always overflow; destination buffer has size 0, but size argument is 6 [-Wfortify-source]
148 | memcpy(saddr.sa_data, info->vport.base_mac_addr,
| ^
include/linux/fortify-string.h:678:26: note: expanded from macro 'memcpy'
678 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^
include/linux/fortify-string.h:633:2: note: expanded from macro '__fortify_memcpy_chk'
633 | __underlying_##op(p, q, __fortify_size); \
| ^
<scratch space>:34:1: note: expanded from here
34 | __underlying_memcpy
| ^
include/linux/fortify-string.h:114:29: note: expanded from macro '__underlying_memcpy'
114 | #define __underlying_memcpy __builtin_memcpy
| ^
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
571 | __write_overflow_field(p_size_field, size);
| ^
6 warnings generated.
--
In file included from drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:12:
In file included from include/linux/of_mdio.h:12:
In file included from include/linux/phy.h:16:
In file included from include/linux/ethtool.h:18:
In file included from include/linux/if_ether.h:19:
In file included from include/linux/skbuff.h:17:
In file included from include/linux/bvec.h:10:
In file included from include/linux/highmem.h:8:
In file included from include/linux/cacheflush.h:5:
In file included from arch/x86/include/asm/cacheflush.h:5:
In file included from include/linux/mm.h:2225:
include/linux/vmstat.h:504:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
504 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
505 | item];
| ~~~~
include/linux/vmstat.h:511:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
511 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
512 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
include/linux/vmstat.h:518:36: warning: arithmetic between different enumeration types ('enum node_stat_item' and 'enum lru_list') [-Wenum-enum-conversion]
518 | return node_stat_name(NR_LRU_BASE + lru) + 3; // skip "nr_"
| ~~~~~~~~~~~ ^ ~~~
include/linux/vmstat.h:524:43: warning: arithmetic between different enumeration types ('enum zone_stat_item' and 'enum numa_stat_item') [-Wenum-enum-conversion]
524 | return vmstat_text[NR_VM_ZONE_STAT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~ ^
525 | NR_VM_NUMA_EVENT_ITEMS +
| ~~~~~~~~~~~~~~~~~~~~~~
>> drivers/net/ethernet/freescale/dpaa/dpaa_eth.c:442:2: warning: 'memcpy' will always overflow; destination buffer has size 0, but size argument is 6 [-Wfortify-source]
442 | memcpy(old_addr.sa_data, net_dev->dev_addr, ETH_ALEN);
| ^
include/linux/fortify-string.h:678:26: note: expanded from macro 'memcpy'
678 | #define memcpy(p, q, s) __fortify_memcpy_chk(p, q, s, \
| ^
include/linux/fortify-string.h:633:2: note: expanded from macro '__fortify_memcpy_chk'
633 | __underlying_##op(p, q, __fortify_size); \
| ^
<scratch space>:219:1: note: expanded from here
219 | __underlying_memcpy
| ^
include/linux/fortify-string.h:114:29: note: expanded from macro '__underlying_memcpy'
114 | #define __underlying_memcpy __builtin_memcpy
| ^
include/linux/fortify-string.h:571:4: warning: call to '__write_overflow_field' declared with 'warning' attribute: detected write beyond size of field (1st parameter); maybe use struct_group()? [-Wattribute-warning]
571 | __write_overflow_field(p_size_field, size);
| ^
6 warnings generated.
vim +/memcpy +649 net/ncsi/ncsi-rsp.c
138635cc27c973 Gavin Shan 2016-07-19 626
74b449b98dccdf Ivan Mikhaylov 2023-06-07 627 /* Response handler for Get Mac Address command */
74b449b98dccdf Ivan Mikhaylov 2023-06-07 628 static int ncsi_rsp_handler_oem_gma(struct ncsi_request *nr, int mfr_id)
16e8c4ca21a238 Vijay Khemka 2018-11-26 629 {
16e8c4ca21a238 Vijay Khemka 2018-11-26 630 struct ncsi_dev_priv *ndp = nr->ndp;
16e8c4ca21a238 Vijay Khemka 2018-11-26 631 struct net_device *ndev = ndp->ndev.dev;
16e8c4ca21a238 Vijay Khemka 2018-11-26 632 struct ncsi_rsp_oem_pkt *rsp;
16e8c4ca21a238 Vijay Khemka 2018-11-26 633 struct sockaddr saddr;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 634 u32 mac_addr_off = 0;
16e8c4ca21a238 Vijay Khemka 2018-11-26 635 int ret = 0;
16e8c4ca21a238 Vijay Khemka 2018-11-26 636
16e8c4ca21a238 Vijay Khemka 2018-11-26 637 /* Get the response header */
16e8c4ca21a238 Vijay Khemka 2018-11-26 638 rsp = (struct ncsi_rsp_oem_pkt *)skb_network_header(nr->rsp);
16e8c4ca21a238 Vijay Khemka 2018-11-26 639
16e8c4ca21a238 Vijay Khemka 2018-11-26 640 saddr.sa_family = ndev->type;
16e8c4ca21a238 Vijay Khemka 2018-11-26 641 ndev->priv_flags |= IFF_LIVE_ADDR_CHANGE;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 642 if (mfr_id == NCSI_OEM_MFR_BCM_ID)
74b449b98dccdf Ivan Mikhaylov 2023-06-07 643 mac_addr_off = BCM_MAC_ADDR_OFFSET;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 644 else if (mfr_id == NCSI_OEM_MFR_MLX_ID)
74b449b98dccdf Ivan Mikhaylov 2023-06-07 645 mac_addr_off = MLX_MAC_ADDR_OFFSET;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 646 else if (mfr_id == NCSI_OEM_MFR_INTEL_ID)
74b449b98dccdf Ivan Mikhaylov 2023-06-07 647 mac_addr_off = INTEL_MAC_ADDR_OFFSET;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 648
74b449b98dccdf Ivan Mikhaylov 2023-06-07 @649 memcpy(saddr.sa_data, &rsp->data[mac_addr_off], ETH_ALEN);
74b449b98dccdf Ivan Mikhaylov 2023-06-07 650 if (mfr_id == NCSI_OEM_MFR_BCM_ID || mfr_id == NCSI_OEM_MFR_INTEL_ID)
74b449b98dccdf Ivan Mikhaylov 2023-06-07 651 eth_addr_inc((u8 *)saddr.sa_data);
74b449b98dccdf Ivan Mikhaylov 2023-06-07 652 if (!is_valid_ether_addr((const u8 *)saddr.sa_data))
74b449b98dccdf Ivan Mikhaylov 2023-06-07 653 return -ENXIO;
74b449b98dccdf Ivan Mikhaylov 2023-06-07 654
9e860947d8d7a1 Vijay Khemka 2019-12-27 655 /* Set the flag for GMA command which should only be called once */
9e860947d8d7a1 Vijay Khemka 2019-12-27 656 ndp->gma_flag = 1;
9e860947d8d7a1 Vijay Khemka 2019-12-27 657
790071347a0a1a Ivan Mikhaylov 2023-06-07 658 rtnl_lock();
790071347a0a1a Ivan Mikhaylov 2023-06-07 659 ret = dev_set_mac_address(ndev, &saddr, NULL);
790071347a0a1a Ivan Mikhaylov 2023-06-07 660 rtnl_unlock();
16e8c4ca21a238 Vijay Khemka 2018-11-26 661 if (ret < 0)
16e8c4ca21a238 Vijay Khemka 2018-11-26 662 netdev_warn(ndev, "NCSI: 'Writing mac address to device failed\n");
16e8c4ca21a238 Vijay Khemka 2018-11-26 663
16e8c4ca21a238 Vijay Khemka 2018-11-26 664 return ret;
16e8c4ca21a238 Vijay Khemka 2018-11-26 665 }
16e8c4ca21a238 Vijay Khemka 2018-11-26 666
:::::: The code at line 649 was first introduced by commit
:::::: 74b449b98dccdf24288d562f9d207fa066da793d net/ncsi: make one oem_gma function for all mfr id
:::::: TO: Ivan Mikhaylov <fr0st61te@...il.com>
:::::: CC: David S. Miller <davem@...emloft.net>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists