Received-SPF: pass (google.com: domain of linux-kernel-owner@vger.kernel.org designates 2620:137:e000::1:20 as permitted sender) client-ip=2620:137:e000::1:20;
Message-ID: <3bb839fe-1dfd-57f5-a5b0-be5adac57a4c@gmail.com>
Date:   Fri, 23 Jun 2023 19:15:18 +0200
MIME-Version: 1.0
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101
 Thunderbird/102.12.0
Subject: Re: [PATCH 1/2] carl9170: re-fix fortified-memset warning
Content-Language: en-US
To:     Arnd Bergmann <arnd@arndb.de>, Arnd Bergmann <arnd@kernel.org>,
        Kalle Valo <kvalo@kernel.org>,
        Kees Cook <keescook@chromium.org>,
        Johannes Berg <johannes.berg@intel.com>,
        Shiji Yang <yangshiji66@outlook.com>,
        Nick Kossifidis <mickflemm@gmail.com>,
        Jiri Slaby <jirislaby@kernel.org>,
        Christian Marangi <ansuelsmth@gmail.com>
Cc:     linux-wireless@vger.kernel.org, linux-kernel@vger.kernel.org
References: <20230623152443.2296825-1-arnd@kernel.org>
 <7c4622e7-d7a8-ae5d-e381-f726cb511228@gmail.com>
 <24986b5e-5cd1-4cd5-aff3-b5eab2c0fdde@app.fastmail.com>
From:   Christian Lamparter <chunkeey@gmail.com>
In-Reply-To: <24986b5e-5cd1-4cd5-aff3-b5eab2c0fdde@app.fastmail.com>
Content-Type: text/plain; charset=UTF-8; format=flowed
Content-Transfer-Encoding: 7bit
Precedence: bulk

On 6/23/23 18:05, Arnd Bergmann wrote:
> On Fri, Jun 23, 2023, at 17:38, Christian Lamparter wrote:
>> On 6/23/23 17:23, Arnd Bergmann wrote:
>>
>> Wait! I want to point out this funny thing is happening in ath too!
>>
>> https://lore.kernel.org/linux-wireless/TYAP286MB03154F9AAFD4C35BEEDE4A99BC4CA@TYAP286MB0315.JPNP286.PROD.OUTLOOK.COM/T/#mf1b8919a000fe661803c17073f48b3c410888541
>>
>> And that patch got NACK by Jiri Slaby because like me he suspects that
>> this is a compiler bug.
> 
> FWIW, that is one I don't see with clang-17 or gcc-13. The one I'm addressing
> here is the only thing I see in ath wireless with the default set of
> warning options, though this driver does have a couple of others that
> are unrelated, when you enable the source data check in memcpy() by
> building with W=1.
> 
>   In file included from  drivers/net/wireless/ath/ath9k/xmit.c:17:
> In file included from  include/linux/dma-mapping.h:7:
> In file included from include/linux/string.h:254:
> /home/arnd/arm-soc/include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
>                          __read_overflow2_field(q_size_field, size);
>                          ^
> include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
> 2 errors generated.
> /home/arnd/arm-soc/include/linux/fortify-string.h:592:4: error: call to '__read_overflow2_field' declared with 'warning' attribute: detected read beyond size of field (2nd parameter); maybe use struct_group()? [-Werror,-Wattribute-warning]
>                          __read_overflow2_field(q_size_field, size);
> 
>> so, what's going wrong with fortified there?
> 
> Kees might have a better answer to that, my best guess is that
> the one I'm addressing stems from the confusion between different
> union members.
> 
> Doing the randconfig builds with the latest compilers, carl9170 is the
> only one I see with fortified-string warnings, and there are a few
> dozen other drivers that I see with W=1, including one that affects
> all wireless drivers.

Hm, question here (to Jiri as well). Do you think that a workaround patch
for these sort-of-obvious-but-compiler-bug-but-failed-to-make-a-simple-reproducer
would be OK to get NACKed? In my case, I fiddled around with it and replaced the
the cc_ani memset in the following way:

|        memset(&common->cc_survey, 0, sizeof(common->cc_survey));
|-       memset(&common->cc_ani, 0, sizeof(common->cc_ani));
|+       common->cc_ani.cycles = common->cc_ani.rx_busy = common->cc_ani.rx_frame = common->cc_ani.tx_frame = 0;

(Note here: cc_survey and cc_ani are of the same struct ath_cycle_counters!
and they are right next to each other! Even better: reordering the memset
in the code does not help. Reordering it in the ath_common does!)

This is less intrusive since it only replaces one line... but I'm afraid it
too will get flagged for the same reason... Maybe can someone give Shiji Yang,
or me, if he has lost interest, some guidance on how this can be addressed?

Best Regards,
Christian