Commit 6fb5d25a authored by Kees Cook's avatar Kees Cook Committed by Greg Kroah-Hartman
Browse files

staging: r8188eu: Drop get_recvframe_data() 



When building with -Warray-bounds, the following warning is emitted:

In file included from ./include/linux/string.h:253,
                 from ./arch/x86/include/asm/page_32.h:22,
                 from ./arch/x86/include/asm/page.h:14,
                 from ./arch/x86/include/asm/thread_info.h:12,
                 from ./include/linux/thread_info.h:60,
                 from ./arch/x86/include/asm/preempt.h:7,
                 from ./include/linux/preempt.h:78,
                 from ./include/linux/rcupdate.h:27,
                 from ./include/linux/rculist.h:11,
                 from ./include/linux/sched/signal.h:5,
                 from ./drivers/staging/rtl8723bs/include/drv_types.h:17,
                 from drivers/staging/rtl8723bs/core/rtw_recv.c:7:
In function 'memcpy',
    inlined from 'wlanhdr_to_ethhdr' at drivers/staging/rtl8723bs/core/rtw_recv.c:1554:2:
./include/linux/fortify-string.h:41:33: warning: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Warray-bounds]
   41 | #define __underlying_memcpy     __builtin_memcpy
      |                                 ^

This is because the compiler sees it is possible for "ptr" to be a NULL
value, and concludes that it has zero size and attempts to copy to it
would overflow. Instead, remove the get_recvframe_data() entirely, as
it's not possible for this to ever be NULL.

Additionally add missing NULL checks after recvframe_pull() (which are
present in the rtl8712 driver).

Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Phillip Potter <phil@philpotter.co.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Michael Straube <straube.linux@gmail.com>
Cc: Fabio Aiuto <fabioaiuto83@gmail.com>
Cc: linux-staging@lists.linux.dev
Reviewed-by: default avatarHans de Goede <hdegoede@redhat.com>
Signed-off-by: default avatarKees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220118193327.2822099-2-keescook@chromium.org


Signed-off-by: default avatarGreg Kroah-Hartman <gregkh@linuxfoundation.org>
parent 71b83313

drivers/staging/r8188eu/core/rtw_recv.c

+5 −1
Original line number Diff line number Diff line
@@ -1185,7 +1185,7 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) 
	struct adapter			*adapter = precvframe->adapter;

	struct mlme_priv	*pmlmepriv = &adapter->mlmepriv;



	u8	*ptr = get_recvframe_data(precvframe); /*  point to frame_ctrl field */

	u8	*ptr = precvframe->rx_data; /*  point to frame_ctrl field */

	struct rx_pkt_attrib *pattrib = &precvframe->attrib;



	if (pattrib->encrypt)
@@ -1220,10 +1220,14 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe) 
		eth_type = 0x8712;

		/*  append rx status for mp test packets */

		ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24);

		if (!ptr)

			return _FAIL;

		memcpy(ptr, get_rxmem(precvframe), 24);

		ptr += 24;

	} else {

		ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));

		if (!ptr)

			return _FAIL;

	}



	memcpy(ptr, pattrib->dst, ETH_ALEN);

drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c

+1 −3
Original line number Diff line number Diff line
@@ -128,7 +128,7 @@ void update_recvframe_phyinfo_88e(struct recv_frame *precvframe, struct phy_stat 
	struct rx_pkt_attrib *pattrib = &precvframe->attrib;

	struct hal_data_8188e *pHalData = &padapter->haldata;

	struct phy_info *pPHYInfo  = &pattrib->phy_info;

	u8 *wlanhdr;

	u8 *wlanhdr = precvframe->rx_data;

	struct odm_per_pkt_info	pkt_info;

	u8 *sa = NULL;

	struct sta_priv *pstapriv;
@@ -138,8 +138,6 @@ void update_recvframe_phyinfo_88e(struct recv_frame *precvframe, struct phy_stat 
	pkt_info.bPacketToSelf = false;

	pkt_info.bPacketBeacon = false;



	wlanhdr = get_recvframe_data(precvframe);



	pkt_info.bPacketMatchBSSID = ((!IsFrameTypeCtrl(wlanhdr)) &&

		!pattrib->icv_err && !pattrib->crc_err &&

		!memcmp(get_hdr_bssid(wlanhdr),

drivers/staging/r8188eu/include/rtw_recv.h

+0 −9
Original line number Diff line number Diff line
@@ -296,15 +296,6 @@ static inline u8 *get_rx_status(struct recv_frame *precvframe) 
	return get_rxmem(precvframe);

}



static inline u8 *get_recvframe_data(struct recv_frame *precvframe)

{

	/* always return rx_data */

	if (precvframe == NULL)

		return NULL;



	return precvframe->rx_data;

}



static inline u8 *recvframe_push(struct recv_frame *precvframe, int sz)

{

	/*  append data before rx_data */