Received-SPF: pass (google.com: domain of linux-wireless+bounces-176-linux.lists.archive=gmail.com@vger.kernel.org designates 2604:1380:45e3:2400::1 as permitted sender) client-ip=2604:1380:45e3:2400::1;
Message-ID: <fc1dbe4a-a810-445c-9398-60a5e55990a2@quicinc.com>
Date: Tue, 28 Nov 2023 13:01:20 -0800
Precedence: bulk
MIME-Version: 1.0
User-Agent: Mozilla Thunderbird
Subject: Re: [RFC PATCH] wifi: cfg80211: fix CQM for non-range use
Content-Language: en-US
To: Johannes Berg <johannes@sipsolutions.net>,
        Michael Walle
	<mwalle@kernel.org>, Kees Cook <keescook@chromium.org>
CC: <lkp@intel.com>, <oe-kbuild-all@lists.linux.dev>,
        <linux-wireless@vger.kernel.org>, Max Schulze <max.schulze@online.de>
References: <202311090752.hWcJWAHL-lkp@intel.com>
 <202311090752.hWcJWAHL-lkp@intel.com>
 <1c37d99f722f891a50c540853e54d4e36bdf0157.camel@sipsolutions.net>
From: Jeff Johnson <quic_jjohnson@quicinc.com>
In-Reply-To: <1c37d99f722f891a50c540853e54d4e36bdf0157.camel@sipsolutions.net>
Content-Type: text/plain; charset="UTF-8"
Content-Transfer-Encoding: 7bit

On 11/28/2023 10:23 AM, Johannes Berg wrote:
> On Tue, 2023-11-28 at 15:44 +0100, Michael Walle wrote:
>> Hi,
>>
>>> net/wireless/nl80211.c: In function 'nl80211_set_cqm_rssi.isra':
>>> net/wireless/nl80211.c:12892:17: warning: 'memcpy' specified bound
>>> 18446744073709551615 exceeds maximum object size 9223372036854775807
>>> [-Wstringop-overflow=]
>>
>> FWIW, I'm getting the same error with the current next (next-20231128).
>>
> 
> I actually forgot about that, but does anyone actually know what this is
> trying to tell me?
> 
> The code seems to be
> 
>         if (n_thresholds) {
>                 cqm_config = kzalloc(struct_size(cqm_config, rssi_thresholds,
>                                                  n_thresholds),
>                                      GFP_KERNEL);
>                 if (!cqm_config)
>                         return -ENOMEM;
> 
>                 cqm_config->rssi_hyst = hysteresis;
>                 cqm_config->n_rssi_thresholds = n_thresholds;
>                 memcpy(cqm_config->rssi_thresholds, thresholds,
>                        flex_array_size(cqm_config, rssi_thresholds,
>                                        n_thresholds));
> 
> 
> Or does it just want to say n_thresholds shouldn't be a signed variable?

+Kees for flex array education :)