From 1fc2375e90643093fc966a116cef0dfcb75a571a Mon Sep 17 00:00:00 2001 From: Greg Kroah-Hartman Date: Mon, 5 Jun 2023 19:07:39 +0200 Subject: [PATCH] 5.15-stable patches added patches: ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch --- ...oup-to-avoid-size-mismatched-casting.patch | 98 +++++++++++++++++++ queue-5.15/series | 1 + 2 files changed, 99 insertions(+) create mode 100644 queue-5.15/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch diff --git a/queue-5.15/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch b/queue-5.15/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch new file mode 100644 index 00000000000..d7eae3f3316 --- /dev/null +++ b/queue-5.15/ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch @@ -0,0 +1,98 @@ +From e3128a9d482cff9cc2a826adec5e1f7acb922b8f Mon Sep 17 00:00:00 2001 +From: Kees Cook +Date: Wed, 8 Dec 2021 10:44:00 +0200 +Subject: ath6kl: Use struct_group() to avoid size-mismatched casting + +From: Kees Cook + +commit e3128a9d482cff9cc2a826adec5e1f7acb922b8f upstream. + +In builds with -Warray-bounds, casts from smaller objects to larger +objects will produce warnings. These can be overly conservative, but since +-Warray-bounds has been finding legitimate bugs, it is desirable to turn +it on globally. Instead of casting a u32 to a larger object, redefine +the u32 portion of the header to a separate struct that can be used for +both u32 operations and the distinct header fields. Silences this warning: + +drivers/net/wireless/ath/ath6kl/htc_mbox.c: In function 'htc_wait_for_ctrl_msg': +drivers/net/wireless/ath/ath6kl/htc_mbox.c:2275:20: error: array subscript 'struct htc_frame_hdr[0]' is partly outside array bounds of 'u32[1]' {aka 'unsigned int[1]'} [-Werror=array-bounds] + 2275 | if (htc_hdr->eid != ENDPOINT_0) + | ^~ +drivers/net/wireless/ath/ath6kl/htc_mbox.c:2264:13: note: while referencing 'look_ahead' + 2264 | u32 look_ahead; + | ^~~~~~~~~~ + +This change results in no executable instruction differences. + +Signed-off-by: Kees Cook +Signed-off-by: Kalle Valo +Link: https://lore.kernel.org/r/20211207063538.2767954-1-keescook@chromium.org +Signed-off-by: Greg Kroah-Hartman +--- + drivers/net/wireless/ath/ath6kl/htc.h | 15 +++++++++++---- + drivers/net/wireless/ath/ath6kl/htc_mbox.c | 15 ++++++--------- + 2 files changed, 17 insertions(+), 13 deletions(-) + +--- a/drivers/net/wireless/ath/ath6kl/htc.h ++++ b/drivers/net/wireless/ath/ath6kl/htc.h +@@ -153,12 +153,19 @@ + * implementations. + */ + struct htc_frame_hdr { +- u8 eid; +- u8 flags; ++ struct_group_tagged(htc_frame_look_ahead, header, ++ union { ++ struct { ++ u8 eid; ++ u8 flags; + +- /* length of data (including trailer) that follows the header */ +- __le16 payld_len; ++ /* length of data (including trailer) that follows the header */ ++ __le16 payld_len; + ++ }; ++ u32 word; ++ }; ++ ); + /* end of 4-byte lookahead */ + + u8 ctrl[2]; +--- a/drivers/net/wireless/ath/ath6kl/htc_mbox.c ++++ b/drivers/net/wireless/ath/ath6kl/htc_mbox.c +@@ -2260,19 +2260,16 @@ int ath6kl_htc_rxmsg_pending_handler(str + static struct htc_packet *htc_wait_for_ctrl_msg(struct htc_target *target) + { + struct htc_packet *packet = NULL; +- struct htc_frame_hdr *htc_hdr; +- u32 look_ahead; ++ struct htc_frame_look_ahead look_ahead; + +- if (ath6kl_hif_poll_mboxmsg_rx(target->dev, &look_ahead, ++ if (ath6kl_hif_poll_mboxmsg_rx(target->dev, &look_ahead.word, + HTC_TARGET_RESPONSE_TIMEOUT)) + return NULL; + + ath6kl_dbg(ATH6KL_DBG_HTC, +- "htc rx wait ctrl look_ahead 0x%X\n", look_ahead); ++ "htc rx wait ctrl look_ahead 0x%X\n", look_ahead.word); + +- htc_hdr = (struct htc_frame_hdr *)&look_ahead; +- +- if (htc_hdr->eid != ENDPOINT_0) ++ if (look_ahead.eid != ENDPOINT_0) + return NULL; + + packet = htc_get_control_buf(target, false); +@@ -2281,8 +2278,8 @@ static struct htc_packet *htc_wait_for_c + return NULL; + + packet->info.rx.rx_flags = 0; +- packet->info.rx.exp_hdr = look_ahead; +- packet->act_len = le16_to_cpu(htc_hdr->payld_len) + HTC_HDR_LENGTH; ++ packet->info.rx.exp_hdr = look_ahead.word; ++ packet->act_len = le16_to_cpu(look_ahead.payld_len) + HTC_HDR_LENGTH; + + if (packet->act_len > packet->buf_len) + goto fail_ctrl_rx; diff --git a/queue-5.15/series b/queue-5.15/series index c0c4daa6029..5c9994a6f09 100644 --- a/queue-5.15/series +++ b/queue-5.15/series @@ -119,3 +119,4 @@ drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-vangogh.patch drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-yellow-carp.patch drm-amd-pm-reverse-mclk-and-fclk-clocks-levels-for-renoir.patch x86-boot-wrap-literal-addresses-in-absolute_pointer.patch +ath6kl-use-struct_group-to-avoid-size-mismatched-casting.patch -- 2.47.3