[kbuild-all] Re: [PATCH] libertas: Fix two buffer overflows at parsing bss descriptor

Hi, Thank you for the patch! Perhaps something to improve: [auto build test WARNING on wireless-drivers-next/master] [also build test WARNING on v5.4-rc8 next-20191122] [if your patch is applied to the wrong git tree, please drop us a note to help improve the system. BTW, we also suggest to use '--base' option to specify the base tree in git format-patch, please see https://stackoverflow.com/a/37406982] url: https://github.com/0day-ci/linux/commits/huangwenabc-gmail-com/libertas-F... base: https://git.kernel.org/pub/scm/linux/kernel/git/kvalo/wireless-drivers-ne... master config: sh-allmodconfig (attached as .config) compiler: sh4-linux-gcc (GCC) 7.4.0 reproduce: wget https://raw.githubusercontent.com/intel/lkp-tests/master/sbin/make.cross -O ~/bin/make.cross chmod +x ~/bin/make.cross # save the attached .config to linux build tree GCC_VERSION=7.4.0 make.cross ARCH=sh If you fix the issue, kindly add following tag Reported-by: kbuild test robot <lkp(a)intel.com&gt; All warnings (new ones prefixed by >>): drivers/net/wireless/marvell/libertas/cfg.c: In function 'lbs_ibss_join_existing': u8 *rates = cmd.bss.rates; ^~ vim +1788 drivers/net/wireless/marvell/libertas/cfg.c e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1715 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1716 static int lbs_ibss_join_existing(struct lbs_private *priv, e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1717 struct cfg80211_ibss_params *params, e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1718 struct cfg80211_bss *bss) e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1719 { 9caf03640279e6 drivers/net/wireless/libertas/cfg.c Johannes Berg 2012-11-29 1720 const u8 *rates_eid; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1721 struct cmd_ds_802_11_ad_hoc_join cmd; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1722 u8 preamble = RADIO_PREAMBLE_SHORT; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1723 int ret = 0; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1724 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1725 /* TODO: set preamble based on scan result */ e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1726 ret = lbs_set_radio(priv, preamble, 1); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1727 if (ret) e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1728 goto out; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1729 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1730 /* e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1731 * Example CMD_802_11_AD_HOC_JOIN command: e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1732 * e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1733 * command 2c 00 CMD_802_11_AD_HOC_JOIN e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1734 * size 65 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1735 * sequence xx xx e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1736 * result 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1737 * bssid 02 27 27 97 2f 96 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1738 * ssid 49 42 53 53 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1739 * 00 00 00 00 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1740 * 00 00 00 00 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1741 * 00 00 00 00 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1742 * type 02 CMD_BSS_TYPE_IBSS e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1743 * beacon period 64 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1744 * dtim period 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1745 * timestamp 00 00 00 00 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1746 * localtime 00 00 00 00 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1747 * IE DS 03 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1748 * IE DS len 01 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1749 * IE DS channel 01 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1750 * reserveed 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1751 * IE IBSS 06 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1752 * IE IBSS len 02 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1753 * IE IBSS atim 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1754 * reserved 00 00 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1755 * capability 02 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1756 * rates 82 84 8b 96 0c 12 18 24 30 48 60 6c 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1757 * fail timeout ff 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1758 * probe delay 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1759 */ e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1760 memset(&cmd, 0, sizeof(cmd)); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1761 cmd.hdr.size = cpu_to_le16(sizeof(cmd)); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1762 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1763 memcpy(cmd.bss.bssid, bss->bssid, ETH_ALEN); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1764 memcpy(cmd.bss.ssid, params->ssid, params->ssid_len); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1765 cmd.bss.type = CMD_BSS_TYPE_IBSS; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1766 cmd.bss.beaconperiod = cpu_to_le16(params->beacon_interval); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1767 cmd.bss.ds.header.id = WLAN_EID_DS_PARAMS; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1768 cmd.bss.ds.header.len = 1; 683b6d3b31a519 drivers/net/wireless/libertas/cfg.c Johannes Berg 2012-11-08 1769 cmd.bss.ds.channel = params->chandef.chan->hw_value; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1770 cmd.bss.ibss.header.id = WLAN_EID_IBSS_PARAMS; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1771 cmd.bss.ibss.header.len = 2; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1772 cmd.bss.ibss.atimwindow = 0; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1773 cmd.bss.capability = cpu_to_le16(bss->capability & CAPINFO_MASK); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1774 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1775 /* set rates to the intersection of our rates and the rates in the e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1776 bss */ 9caf03640279e6 drivers/net/wireless/libertas/cfg.c Johannes Berg 2012-11-29 1777 rcu_read_lock(); 9caf03640279e6 drivers/net/wireless/libertas/cfg.c Johannes Berg 2012-11-29 1778 rates_eid = ieee80211_bss_get_ie(bss, WLAN_EID_SUPP_RATES); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1779 if (!rates_eid) { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1780 lbs_add_rates(cmd.bss.rates); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1781 } else { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1782 int hw, i; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1783 u8 rates_max = rates_eid[1]; bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c Wen Huang 2019-11-22 1784 if (rates_max > MAX_RATES) { bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c Wen Huang 2019-11-22 1785 lbs_deb_join("invalid rates"); bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c Wen Huang 2019-11-22 1786 goto out; bb7da3c8c1a225 drivers/net/wireless/marvell/libertas/cfg.c Wen Huang 2019-11-22 1787 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 @1788 u8 *rates = cmd.bss.rates; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1789 for (hw = 0; hw < ARRAY_SIZE(lbs_rates); hw++) { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1790 u8 hw_rate = lbs_rates[hw].bitrate / 5; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1791 for (i = 0; i < rates_max; i++) { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1792 if (hw_rate == (rates_eid[i+2] & 0x7f)) { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1793 u8 rate = rates_eid[i+2]; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1794 if (rate == 0x02 || rate == 0x04 || e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1795 rate == 0x0b || rate == 0x16) e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1796 rate |= 0x80; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1797 *rates++ = rate; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1798 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1799 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1800 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1801 } 9caf03640279e6 drivers/net/wireless/libertas/cfg.c Johannes Berg 2012-11-29 1802 rcu_read_unlock(); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1803 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1804 /* Only v8 and below support setting this */ e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1805 if (MRVL_FW_MAJOR_REV(priv->fwrelease) <= 8) { e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1806 cmd.failtimeout = cpu_to_le16(MRVDRV_ASSOCIATION_TIME_OUT); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1807 cmd.probedelay = cpu_to_le16(CMD_SCAN_PROBE_DELAY_TIME); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1808 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1809 ret = lbs_cmd_with_response(priv, CMD_802_11_AD_HOC_JOIN, &cmd); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1810 if (ret) e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1811 goto out; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1812 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1813 /* e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1814 * This is a sample response to CMD_802_11_AD_HOC_JOIN: e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1815 * e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1816 * response 2c 80 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1817 * size 09 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1818 * sequence xx xx e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1819 * result 00 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1820 * reserved 00 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1821 */ e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1822 lbs_join_post(priv, params, bss->bssid, bss->capability); e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1823 e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1824 out: e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1825 return ret; e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1826 } e86dc1ca467644 drivers/net/wireless/libertas/cfg.c Kiran Divekar 2010-06-14 1827 :::::: The code at line 1788 was first introduced by commit :::::: e86dc1ca4676445d9f0dfe35104efe0eb8a2f566 Libertas: cfg80211 support :::::: TO: Kiran Divekar <dkiran(a)marvell.com&gt; :::::: CC: John W. Linville <linville(a)tuxdriver.com&gt; --- 0-DAY kernel test infrastructure Open Source Technology Center https://lists.01.org/hyperkitty/list/kbuild-all@lists.01.org Intel Corporation