Received-SPF: pass (google.com: domain of linux-wireless-owner@vger.kernel.org designates 2620:137:e000::3:2 as permitted sender) client-ip=2620:137:e000::3:2;
Date:   Wed, 13 Sep 2023 11:17:47 +0200
From:   Juerg Haefliger <juerg.haefliger@canonical.com>
To:     Kalle Valo <kvalo@kernel.org>
Cc:     aspriel@gmail.com, franky.lin@broadcom.com,
        hante.meuleman@broadcom.com, linux-wireless@vger.kernel.org,
        brcm80211-dev-list.pdl@broadcom.com,
        SHA-cyfmac-dev-list@infineon.com, linux-kernel@vger.kernel.org,
        linus.walleij@linaro.org, marcan@marcan.st, keescook@chromium.org,
        gustavoars@kernel.org, hdegoede@redhat.com,
        ryohei.kondo@cypress.com
Subject: Re: [PATCH] wifi: brcmfmac: Replace 1-element arrays with flexible
 arrays
Message-ID: <20230913111747.35839fd8@gollum>
In-Reply-To: <87msxqlaao.fsf@kernel.org>
References: <20230913065421.12615-1-juerg.haefliger@canonical.com>
        <87msxqlaao.fsf@kernel.org>
Organization: Canonical Ltd
MIME-Version: 1.0
Content-Type: multipart/signed; boundary="Sig_/Cu_SgLCiae9uFjwQIJE6=+Z";
 protocol="application/pgp-signature"; micalg=pgp-sha512
Precedence: bulk

--Sig_/Cu_SgLCiae9uFjwQIJE6=+Z
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: quoted-printable

On Wed, 13 Sep 2023 11:58:07 +0300
Kalle Valo <kvalo@kernel.org> wrote:

> Juerg Haefliger <juerg.haefliger@canonical.com> writes:
>=20
> > Since commit 2d47c6956ab3 ("ubsan: Tighten UBSAN_BOUNDS on GCC"),
> > UBSAN_BOUNDS no longer pretends 1-element arrays are unbounded. Walking
> > 'element' and 'channel_list' will trigger warnings, so make them proper
> > flexible arrays.
> >
> > False positive warnings were:
> >
> >   UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brc=
m80211/brcmfmac/cfg80211.c:6984:20
> >   index 1 is out of range for type '__le32 [1]'
> >
> >   UBSAN: array-index-out-of-bounds in drivers/net/wireless/broadcom/brc=
m80211/brcmfmac/cfg80211.c:1126:27
> >   index 1 is out of range for type '__le16 [1]'
> >
> > for these lines of code:
> >
> >   6884  ch.chspec =3D (u16)le32_to_cpu(list->element[i]);
> >
> >   1126  params_le->channel_list[i] =3D cpu_to_le16(chanspec);
> >
> > Signed-off-by: Juerg Haefliger <juerg.haefliger@canonical.com> =20
>=20
> Should this be queued for v6.6?

I would think so. It's a problem since 6.5. Which reminds me that I should
have added:

Cc: stable@vger.kernel.org # 6.5+

...Juerg


--Sig_/Cu_SgLCiae9uFjwQIJE6=+Z
Content-Type: application/pgp-signature
Content-Description: OpenPGP digital signature

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEhZfU96IuprviLdeLD9OLCQumQrcFAmUBfjsACgkQD9OLCQum
Qrcu2g//VfE5J5Fsa8NX7kn7uJX0G9v1OLJIRJ/A9HYWNJ9CWWp0coKnWy0rdrWm
kJYut2/zOC/sjvKaXLIfSIRvmpL/4jl6/9Uesacah+7bfBszcYbNGStwa5sGx1zf
ntzc9RM0vRoYZYHfYyEootuzqQZ9ZSr2OZkCBnHe1KnAKz1NkoUOag+l6l76HMI+
XjtpXC5EHOmGCyWebWBUOv3SQl8g81bKKu+DwtW2zsKYpuJcYcQv9Y0GZgl0Bu6u
rrKXTGyZpyrQ4H9lqI0LP1GAwpbuinYgW0Xft6MUkVgQUS3qDhOBJCa1Nfb5xS0v
wMNH8KNZNT4vREH3LKOlRP/SdtP4lPH4udoONveHfGLXt+VXlgq02jRr/Jxj6ICM
dkIpY54ND8+I+psaH5Oi8s3qhcSzY8xuwJeZzQRh+wh7X8h8aj67N9hv6tQZkDEe
3WQmb3slanRnMGSgJhCkp3M1IrR38nNBgQe6nb9UagiWXW6l1kar5sQ+uQkPAgZz
Z3AE0rQt0SV2EHfyWGkwUSSTVKAP7mSb3jsVr+3UExOTLnNq1GsPr+dJ8oG3baHL
UDe3xw2TrXv+cSOUKuWqef3/C6xeqM7Jjz2fyYwKP+hjr5smf5QMzfdGif4Nv9x5
cmID/ABkY+GOGkFNE+68Qr+DOy/3CglizPfsB7ESqVdJFgLa1rU=
=Yn1Y
-----END PGP SIGNATURE-----

--Sig_/Cu_SgLCiae9uFjwQIJE6=+Z--