Received-SPF: pass (google.com: domain of linux-kernel+bounces-105547-linux.lists.archive=gmail.com@vger.kernel.org designates 139.178.88.99 as permitted sender) client-ip=139.178.88.99;
Feedback-ID: i56a14606:Fastmail
User-Agent: Cyrus-JMAP/3.11.0-alpha0-300-gdee1775a43-fm-20240315.001-gdee1775a
Precedence: bulk
MIME-Version: 1.0
Message-Id: <5716d138-ace0-4621-ab34-118610255207@app.fastmail.com>
In-Reply-To: <6c772d15-d249-4175-93f4-ca523006129b@gmail.com>
References: <6dc14151-e71e-4118-826d-3ca5c8ee907f@gmail.com>
 <fba3951f-00b7-41af-8ef4-1e7c86e0cb48@moroto.mountain>
 <6c772d15-d249-4175-93f4-ca523006129b@gmail.com>
Date: Sun, 17 Mar 2024 21:20:34 +0100
From: "Arnd Bergmann" <arnd@arndb.de>
To: "Philipp Hortmann" <philipp.g.hortmann@gmail.com>,
 "Dan Carpenter" <dan.carpenter@linaro.org>, "Lee Jones" <lee@kernel.org>
Cc: "Greg Kroah-Hartman" <gregkh@linuxfoundation.org>,
 linux-staging@lists.linux.dev, linux-kernel@vger.kernel.org,
 "Larry Finger" <Larry.Finger@lwfinger.net>,
 "Johannes Berg" <johannes@sipsolutions.net>, "Kalle Valo" <kvalo@kernel.org>
Subject: Re: [RFC] staging: wlan-ng: Driver broken since kernel 5.15
Content-Type: text/plain;charset=utf-8
Content-Transfer-Encoding: quoted-printable

On Sun, Mar 17, 2024, at 21:07, Philipp Hortmann wrote:
> On 3/11/24 08:04, Dan Carpenter wrote:
>> On Sat, Mar 09, 2024 at 11:09:24PM +0100, Philipp Hortmann wrote:
> You are right with the statement that it is this commit.
> commit ea82ff749587807fa48e3277c977ff3cec266f25 (HEAD)
> Author: Lee Jones <lee.jones@linaro.org>
> Date:   Wed Apr 14 19:10:39 2021 +0100
>
>      staging: wlan-ng: cfg80211: Move large struct onto the heap
>
>      Fixes the following W=3D1 kernel build warning(s):
>
>       drivers/staging/wlan-ng/cfg80211.c: In function =E2=80=98prism2_=
scan=E2=80=99:
>       drivers/staging/wlan-ng/cfg80211.c:388:1: warning: the frame siz=
e=20
> of 1296 bytes is larger than 1024 bytes [-Wframe-larger-than=3D]
>
> But It is not depending on the line you pointed to.

Right, the kzalloc() already clears the data, so the memset
is not needed.

> I need another week to look into this.

I'm fairly sure this fixes the bug, the problem here was that
the cast to (u8 *) hides the incorrect conversion:

diff --git a/drivers/staging/wlan-ng/cfg80211.c b/drivers/staging/wlan-n=
g/cfg80211.c
index 471bb310176f..9d6a2dd35ba9 100644
--- a/drivers/staging/wlan-ng/cfg80211.c
+++ b/drivers/staging/wlan-ng/cfg80211.c
@@ -350,7 +350,7 @@ static int prism2_scan(struct wiphy *wiphy,
 		msg2->msgcode =3D DIDMSG_DOT11REQ_SCAN_RESULTS;
 		msg2->bssindex.data =3D i;
=20
-		result =3D p80211req_dorequest(wlandev, (u8 *)&msg2);
+		result =3D p80211req_dorequest(wlandev, (u8 *)msg2);
 		if ((result !=3D 0) ||
 		    (msg2->resultcode.data !=3D P80211ENUM_resultcode_success)) {
 			break;

     Arnd