Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Date:   Mon, 30 May 2022 11:05:57 +0300
From:   Dan Carpenter <dan.carpenter@oracle.com>
To:     Larry Finger <Larry.Finger@lwfinger.net>
Cc:     gregkh@linuxfoundation.org, phil@philpotter.co.uk,
        linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org
Subject: Re: [PATCH v2 2/2] staging: r8188eu: Fix undersized array in
 rtw_xmit.c
Message-ID: <20220530080556.GM2146@kadam>
References: <20220529004711.27545-1-Larry.Finger@lwfinger.net>
 <20220529004711.27545-3-Larry.Finger@lwfinger.net>
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
Content-Transfer-Encoding: 8bit
In-Reply-To: <20220529004711.27545-3-Larry.Finger@lwfinger.net>
User-Agent: Mutt/1.9.4 (2018-02-28)
MIME-Version: 1.0
X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1
X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?dmxsU2g4S2NYclh1QlBqYUF2Y1JIeVRPckZaSHlaTTVaS3lNZHNOMjNtU2ow?=
 =?utf-8?B?K2wzZG5oOWVmMGEvbTI2MHRiMU9zR1E5TUI5a3dHTDd5dHFPOWhKdE9YSHRU?=
 =?utf-8?B?L2E1TjdDdlB4ZVI3cU1qMlFIalB3Mkp4cEdnbFhWejREcjVYQm9ZVWRFVHQ1?=
 =?utf-8?B?L3hCeFg2MXhTKzhjRzBKdGxnZUpjbnhWNllhN3JEbXIzUW0wamd1SkRPMWJ0?=
 =?utf-8?B?eEFjUXlHNEFkSmJKRGhPVXRPYjlJTDdOZUMycS9ZdTgzZTViN0JoZEpvYnYy?=
 =?utf-8?B?M2VmNVFxbDBrK2ZaRkhUZFZ4OTNCK1RBN1pOZm1OZ1BNVjRvZ2t2Nk4rSXhC?=
 =?utf-8?B?ZVNxZGNLeVBwNXQ3cjNMSHM1L05MajlyTXljb2oxL3RFUklweGdqd0JUT1d3?=
 =?utf-8?B?MXd1OGlsRDk3cjliUCsvY05Xb3Q3dDk1WGhKUXZnZmFBb0c3bHRmVjhyRXJY?=
 =?utf-8?B?NVNIRjRzZUw1aWtzYU1UZ0dkaDdIMjJQMitQMUdVbEdwRWlXTHdwM2RmdzlZ?=
 =?utf-8?B?emtrcWJWRVJELzRnR1lLeDYrekM1aFNTbGdoTHV2dkpTSkEyL0M5RG9MenQw?=
 =?utf-8?B?K3lVOW5WMzZnMkgvR3RhQmxwWmNYK2hISTlUM2ltL1dsQ1kwRmRHZTJNTjJR?=
 =?utf-8?B?TUVaS0tnMjJQZksvY0srb2tXeWFWTk4zbWh2cXdWakxzOExJMkpjVEIvS2JI?=
 =?utf-8?B?QU5ienBIeUpiS2ZZWFR1ZzRTb1ZHNWg3ZUpsMHY4dUJSTmZMTHY0TitZZnFn?=
 =?utf-8?B?R3k3bzY3aFpxb0hycW5EWGJPNjkvd3hYZGZKVXpnOStWRnZ4b0p3cTdRMTBj?=
 =?utf-8?B?KzdjSnYvMHNCTkJZckM2T1JiVjVFbjF2VzZvMXFlZ280TmtKSkNkWGdtSEhB?=
 =?utf-8?B?Yy9HZlYzcEsxamRSdUJzZUhOVVRQZ3lrWFkxdkxBQUtuT3V5L1FoK1FpRytU?=
 =?utf-8?B?cW1kbTRvcytPcVV4aG5XYU1NTFFpOHFmMGZoWnJSN0RvQTRVaWkvSHdRa2Fa?=
 =?utf-8?B?dEtrd2E0S3d6cVRqeGxPRGF0SnZROXIzYWtHM1J0c09IYWdZQm8xclVIQUVo?=
 =?utf-8?B?WmVmVXQ4bW1zSGU4REVURkRqWnUzZUlSd2xHQ2RRNGw1ZDhDUUtGVVY4ejd6?=
 =?utf-8?B?SHFZREZZYldLak55NHd2dUI0UmRaeDlVb3gxbmNWbzJZZ2Q0L2JQekVRNjl3?=
 =?utf-8?B?VElYRlBxTVNsN2NLUUtPTnpKV2E3WUQybjFEOGxnNjd4Wlpyb04rV0hPQ2Yz?=
 =?utf-8?B?Wmw2TE5Nem5yaEV4NTk3ZEFEYVNEY1pQMGZMa1RscnVxTDFLNlovTjNaWk5r?=
 =?utf-8?B?OGNGUUtSTjAvWjhnb2RUVjZPRFFvcEIyZ1hjQ0VyOHdqdmQwQjRBWkRjV3Ur?=
 =?utf-8?B?amZIaExaYWRWbmV0V2xYQnN2em5welVwY2NSWTlrcVowN01EeFlYNG9QSS94?=
 =?utf-8?B?L2R1YkZSZURzaW5jY0M5MUNJMklpVFVwYkpHdklFTmQ3K1BYN3gyRExOVjlK?=
 =?utf-8?B?bjhNd3RkeW9KN1BFZHllclp2bVJjd1ZrdllkNGk0UG16Mk45a0FyS1ZTenNU?=
 =?utf-8?B?QVFzd1QvN2ZsV2NzVWdzYVhxWWpQaE1FT3l4ckZyWWRDeFlmWXdPQmQrYkoz?=
 =?utf-8?B?QytsZkhPanBObnB0ZXphaWliYi9zOFhmeWN5Y3NRdFY1VXptaEZaVlZFRXIx?=
 =?utf-8?B?SGh0UU1sbE1FaFVHRis4VnNtM240bTQ1Z3M1YmxxZFVVclAxRnA1bkQrQ3JH?=
 =?utf-8?B?eDlxdENxcldxUDFSRnk1T3FjeDJoZzdDWnlEZkc0YXBTc2NiY3ZMMlB6Z2FH?=
 =?utf-8?B?MVRRaVd2TWd5OXBPa0t5ekdlVjdSeForUHc3L0l4UHJUZk02U0hBc3lySHl0?=
 =?utf-8?B?NVBtTG9wZUR0aGp0TXIvcVVhZ0VsM3lCSTBvdkZKdWsvN292eVZyS0xHYjJO?=
 =?utf-8?B?Q3ZoL3lSSXlHQXQvdzVVdGEyY0t5RnZXNGdkUlp2bjQ0RlNraitWUW54VXQ1?=
 =?utf-8?B?Vk15M0NvU1krQUFPTk5lOE80dG9SZUdUMVBpL01DVjRQUy9OUjdvOXJXMjF6?=
 =?utf-8?B?RVlBSnB4c1VrTkZXeUkwN2drQVJxZGxaZW1BYWRGeW52M1h0NUdZdFd6UDd6?=
 =?utf-8?B?b0FpWEVBM3hYS0wvTklYcVJBL1dsWWxiRlJwNXVFWndvYXJtMHdqaStTbXBN?=
 =?utf-8?B?L21kMy9SZ29Va0JkakpHSFVTRjByM3VrUnR4L0dEcE1wTHFYOHBVb215ZjY1?=
 =?utf-8?B?cDMzdC9MaVI4MnBPWURJa3YzTStWSmpBRDlQaE5EQmIxMVR1cXFnbjJjZE9N?=
 =?utf-8?B?M2NzUEV0aFNXQjJ4eGRwWU0yY1NDNlIyOC9LYVZpNSs0T1F6ajJEYkc5OHZo?=
 =?utf-8?Q?XknBJ2v1iu0HfGjA=3D?=
X-OriginatorOrg: oracle.com
X-MS-Exchange-CrossTenant-Network-Message-Id: 845795a4-c33a-4e08-09ee-08da421340cc
X-MS-Exchange-CrossTenant-AuthSource: MWHPR1001MB2365.namprd10.prod.outlook.com
X-MS-Exchange-CrossTenant-AuthAs: Internal
X-MS-Exchange-CrossTenant-OriginalArrivalTime: 30 May 2022 08:06:08.9021
 (UTC)
X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted
X-MS-Exchange-CrossTenant-Id: 4e2c6054-71cb-48f1-bd6c-3a9705aca71b
X-MS-Exchange-CrossTenant-MailboxType: HOSTED
X-MS-Exchange-CrossTenant-UserPrincipalName: O12oXsMV2oJzDXX0VduyG/n7cFqyu576Kqxaxf+oT6h7gUMXCHSA9X4LxoBWsL17NFQwKES+NZWqTw5VLP6dvIutuwe3oqRnB5qY18jkomU=
X-MS-Exchange-Transport-CrossTenantHeadersStamped: SJ0PR10MB5536
X-Proofpoint-Virus-Version: vendor=fsecure engine=2.50.10434:6.0.486,18.0.874
 definitions=2022-05-30_02:2022-05-27,2022-05-30 signatures=0
X-Proofpoint-Spam-Details: rule=notspam policy=default score=0 mlxlogscore=999 mlxscore=0
 suspectscore=0 spamscore=0 phishscore=0 malwarescore=0 bulkscore=0
 adultscore=0 classifier=spam adjust=0 reason=mlx scancount=1
 engine=8.12.0-2204290000 definitions=main-2205300042
X-Proofpoint-GUID: FOJTrO_QOlmXo0T0M-Dd6UvB-8MUqqay
X-Proofpoint-ORIG-GUID: FOJTrO_QOlmXo0T0M-Dd6UvB-8MUqqay
X-Spam-Status: No, score=-2.8 required=5.0 tests=BAYES_00,DKIM_SIGNED,
        DKIM_VALID,DKIM_VALID_AU,DKIM_VALID_EF,RCVD_IN_DNSWL_LOW,
        RCVD_IN_MSPIKE_H2,SPF_HELO_NONE,SPF_NONE,T_SCC_BODY_TEXT_LINE
        autolearn=ham autolearn_force=no version=3.4.6
X-Spam-Checker-Version: SpamAssassin 3.4.6 (2021-04-09) on
        lindbergh.monkeyblade.net
Precedence: bulk
List-ID: <linux-kernel.vger.kernel.org>
X-Mailing-List: linux-kernel@vger.kernel.org

On Sat, May 28, 2022 at 07:47:11PM -0500, Larry Finger wrote:
> Compiling with -warray-bounds yields the following warning:
> 
> drivers/staging/r8188eu/core/rtw_xmit.c: In function ‘rtw_alloc_hwxmits’:
> drivers/staging/r8188eu/core/rtw_xmit.c:1493:24: warning: array subscript 4 is outside array bounds of ‘void[64]’ [-Warray-bounds]
>  1493 |                 hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
>       |                 ~~~~~~~^~~

This patch is not correct.  The hwxmits[4] is nonsense dead code.  It
has an extra element and the other four element are in the wrong order.
If we applied this patch then we would have to update rtw_get_sta_pending()
to re-order the *(ac) = 2; assignments to match the format.  And to set
*ac = 4 on one path.

The correct fix is to just delete the dead code.

regards,
dan carpenter

diff --git a/drivers/staging/r8188eu/core/rtw_xmit.c b/drivers/staging/r8188eu/core/rtw_xmit.c
index 3d8e9dea7651..2a93e7fa1142 100644
--- a/drivers/staging/r8188eu/core/rtw_xmit.c
+++ b/drivers/staging/r8188eu/core/rtw_xmit.c
@@ -1483,19 +1483,10 @@ int rtw_alloc_hwxmits(struct adapter *padapter)
 
 	hwxmits = pxmitpriv->hwxmits;
 
-	if (pxmitpriv->hwxmit_entry == 5) {
-		hwxmits[0] .sta_queue = &pxmitpriv->bm_pending;
-		hwxmits[1] .sta_queue = &pxmitpriv->vo_pending;
-		hwxmits[2] .sta_queue = &pxmitpriv->vi_pending;
-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
-		hwxmits[4] .sta_queue = &pxmitpriv->be_pending;
-	} else if (pxmitpriv->hwxmit_entry == 4) {
-		hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
-		hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
-		hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
-		hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
-	} else {
-	}
+	hwxmits[0] .sta_queue = &pxmitpriv->vo_pending;
+	hwxmits[1] .sta_queue = &pxmitpriv->vi_pending;
+	hwxmits[2] .sta_queue = &pxmitpriv->be_pending;
+	hwxmits[3] .sta_queue = &pxmitpriv->bk_pending;
 
 	return 0;
 }