Hi Wen, kernel test robot noticed the following build warnings: url: https://github.com/intel-lab-lkp/linux/commits/Wen-Gong/wifi-mac80211-avoid-buffer-overflow-by-adding-clear-data-of-VHT-Tx-power-envelope/20230721-140122 base: b21fe5be53eb873c02e7479372726c8aeed171e3 patch link: https://lore.kernel.org/r/20230721055851.20525-1-quic_wgong%40quicinc.com patch subject: [PATCH] wifi: mac80211: avoid buffer overflow by adding clear data of VHT Tx power envelope config: i386-randconfig-m021-20230723 (https://download.01.org/0day-ci/archive/20230725/202307251807.z04UOfqH-lkp@xxxxxxxxx/config) compiler: gcc-12 (Debian 12.2.0-14) 12.2.0 reproduce: (https://download.01.org/0day-ci/archive/20230725/202307251807.z04UOfqH-lkp@xxxxxxxxx/reproduce) If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot <lkp@xxxxxxxxx> | Reported-by: Dan Carpenter <dan.carpenter@xxxxxxxxxx> | Closes: https://lore.kernel.org/r/202307251807.z04UOfqH-lkp@xxxxxxxxx/ New smatch warnings: net/mac80211/mlme.c:4818 ieee80211_prep_channel() error: we previously assumed 'link' could be null (see line 4792) net/mac80211/mlme.c:4890 ieee80211_prep_channel() warn: variable dereferenced before check 'link' (see line 4818) Old smatch warnings: net/mac80211/mlme.c:7073 ieee80211_setup_assoc_link() warn: variable dereferenced before check 'elem' (see line 7071) vim +/link +4818 net/mac80211/mlme.c 7781f0d81c7a7e6 net/mac80211/mlme.c Johannes Berg 2022-07-12 4789 if (!(*conn_flags & IEEE80211_CONN_DISABLE_HE)) { 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4790 he_oper = elems->he_operation; d524215f6cad245 net/mac80211/mlme.c Felix Fietkau 2010-01-08 4791 7781f0d81c7a7e6 net/mac80211/mlme.c Johannes Berg 2022-07-12 @4792 if (link && is_6ghz) { Check for NULL 4df17235d03fd79 net/mac80211/mlme.c Wen Gong 2023-07-21 4793 struct ieee80211_bss_conf *bss_conf = link->conf;; a607268a0d5532d net/mac80211/ieee80211_sta.c Bruno Randolf 2008-02-18 4794 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4795 if (elems->pwr_constr_elem) 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4796 bss_conf->pwr_reduction = *elems->pwr_constr_elem; 66e67e418908442 net/mac80211/mlme.c Johannes Berg 2012-01-20 4797 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4798 BUILD_BUG_ON(ARRAY_SIZE(bss_conf->tx_pwr_env) != 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4799 ARRAY_SIZE(elems->tx_pwr_env)); 66e67e418908442 net/mac80211/mlme.c Johannes Berg 2012-01-20 4800 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4801 for (i = 0; i < elems->tx_pwr_env_num; i++) { 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4802 if (elems->tx_pwr_env_len[i] > 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4803 sizeof(bss_conf->tx_pwr_env[j])) 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4804 continue; 1d00ce807efaa0e net/mac80211/mlme.c Thomas Pedersen 2020-09-21 4805 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4806 memcpy(&bss_conf->tx_pwr_env[j], elems->tx_pwr_env[i], 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4807 elems->tx_pwr_env_len[i]); 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4808 j++; 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4809 } 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4810 } 66e67e418908442 net/mac80211/mlme.c Johannes Berg 2012-01-20 4811 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4812 if (!ieee80211_verify_peer_he_mcs_support(sdata, ies, he_oper) || 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4813 !ieee80211_verify_sta_he_mcs_support(sdata, sband, he_oper)) 7781f0d81c7a7e6 net/mac80211/mlme.c Johannes Berg 2022-07-12 4814 *conn_flags |= IEEE80211_CONN_DISABLE_HE | 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4815 IEEE80211_CONN_DISABLE_EHT; 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4816 } 1d00ce807efaa0e net/mac80211/mlme.c Thomas Pedersen 2020-09-21 4817 4df17235d03fd79 net/mac80211/mlme.c Wen Gong 2023-07-21 @4818 link->conf->tx_pwr_env_num = j; ^^^^^^^^^^ Unchecked dereference 4df17235d03fd79 net/mac80211/mlme.c Wen Gong 2023-07-21 4819 66e67e418908442 net/mac80211/mlme.c Johannes Berg 2012-01-20 4820 /* 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4821 * EHT requires HE to be supported as well. Specifically for 6 GHz 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4822 * channels, the operation channel information can only be deduced from 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4823 * both the 6 GHz operation information (from the HE operation IE) and 61513162aa2d6c1 net/mac80211/mlme.c Johannes Berg 2022-07-12 4824 * EHT operation. 66e67e418908442 net/mac80211/mlme.c Johannes Berg 2012-01-20 4825 */ 7781f0d81c7a7e6 net/mac80211/mlme.c Johannes Berg 2022-07-12 4826 if (!(*conn_flags & [ snip ] 1ad22fb5bb53ce6 net/mac80211/mlme.c Tosoni 2018-03-14 4879 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4880 *conn_flags |= 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4881 ieee80211_determine_chantype(sdata, link, *conn_flags, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4882 sband, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4883 cbss->channel, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4884 bss->vht_cap_info, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4885 ht_oper, vht_oper, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4886 he_oper, eht_oper, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4887 s1g_oper, 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4888 &chandef, false); 78ac51f81532c1e net/mac80211/mlme.c Sara Sharon 2019-01-16 4889 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 @4890 if (link) More checks for NULL 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4891 link->needed_rx_chains = 6911458dc4283a7 net/mac80211/mlme.c Johannes Berg 2022-07-12 4892 min(ieee80211_max_rx_chains(link, cbss), -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki
