netdev - Re: drivers/net/wireless/ath/ath11k/mac.c:2238:29: warning: 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size 0

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date:   Mon, 10 Oct 2022 19:54:29 +0300
From:   Kalle Valo <kvalo@...nel.org>
To:     Naresh Kamboju <naresh.kamboju@...aro.org>,
        Arnd Bergmann <arnd@...db.de>
Cc:     Netdev <netdev@...r.kernel.org>,
        open list <linux-kernel@...r.kernel.org>,
        linux-wireless@...r.kernel.org,
        "David S. Miller" <davem@...emloft.net>,
        Eric Dumazet <edumazet@...gle.com>,
        Jakub Kicinski <kuba@...nel.org>,
        Paolo Abeni <pabeni@...hat.com>, ath11k@...ts.infradead.org,
        regressions@...ts.linux.dev, lkft-triage@...ts.linaro.org
Subject: Re: drivers/net/wireless/ath/ath11k/mac.c:2238:29: warning: 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size 0

+ arnd

Naresh Kamboju <naresh.kamboju@...aro.org> writes:

> Following build warnings noticed while building arm64 on Linux next-20220921
>
> Reported-by: Linux Kernel Functional Testing <lkft@...aro.org>
>
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2238:29: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2238 |                         v = ath11k_peer_assoc_h_he_limit(v,
> he_mcs_mask);
>       |                             ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2238:29: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2251:21: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2251 |                 v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
>       |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2251:21: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2264 |                 v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
>       |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2264 |                 v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
>       |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2264 |                 v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
>       |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2264:21: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
> In function 'ath11k_peer_assoc_h_he',
>     inlined from 'ath11k_peer_assoc_prepare' at
> drivers/net/wireless/ath/ath11k/mac.c:2662:2:
> drivers/net/wireless/ath/ath11k/mac.c:2251:21: warning:
> 'ath11k_peer_assoc_h_he_limit' reading 16 bytes from a region of size
> 0 [-Wstringop-overread]
>  2251 |                 v = ath11k_peer_assoc_h_he_limit(v, he_mcs_mask);
>       |                     ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
> drivers/net/wireless/ath/ath11k/mac.c: In function 'ath11k_peer_assoc_prepare':
> drivers/net/wireless/ath/ath11k/mac.c:2251:21: note: referencing
> argument 2 of type 'const u16 *' {aka 'const short unsigned int *'}
> drivers/net/wireless/ath/ath11k/mac.c:2019:12: note: in a call to
> function 'ath11k_peer_assoc_h_he_limit'
>  2019 | static u16 ath11k_peer_assoc_h_he_limit(u16 tx_mcs_set,
>       |            ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
>
> Build log: https://builds.tuxbuild.com/2F4W7nZHNx3T88RB0gaCZ9hBX6c/

Thanks, I was able to reproduce it now and submitted a patch:

https://patchwork.kernel.org/project/linux-wireless/patch/20221010160638.20152-1-kvalo@kernel.org/

But it's strange that nobody else (myself included) didn't see this
earlier. Nor later for that matter, this is the only report I got about
this. Arnd, any ideas what could cause this only to happen on GCC 11?

-- 
https://patchwork.kernel.org/project/linux-wireless/list/

https://wireless.wiki.kernel.org/en/developers/documentation/submittingpatches