staging: rtl8723bs: Avoid memset() in aes_cipher() and aes_decipher()

commit a55bc4ffc06d8c965a7d6f0a01ed0ed41380df28 upstream.

After commit 6f110a5e4f99 ("Disable SLUB_TINY for build testing"), which
causes CONFIG_KASAN to be enabled in allmodconfig again, arm64
allmodconfig builds with older versions of clang (15 through 17) show an
instance of -Wframe-larger-than (which breaks the build with
CONFIG_WERROR=y):

  drivers/staging/rtl8723bs/core/rtw_security.c:1287:5: error: stack frame size (2208) exceeds limit (2048) in 'rtw_aes_decrypt' [-Werror,-Wframe-larger-than]
   1287 | u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
        |     ^

This comes from aes_decipher() being inlined in rtw_aes_decrypt().
Running the same build with CONFIG_FRAME_WARN=128 shows aes_cipher()
also uses a decent amount of stack, just under the limit of 2048:

  drivers/staging/rtl8723bs/core/rtw_security.c:864:19: warning: stack frame size (1952) exceeds limit (128) in 'aes_cipher' [-Wframe-larger-than]
    864 | static signed int aes_cipher(u8 *key, uint      hdrlen,
        |                   ^

-Rpass-analysis=stack-frame-layout only shows one large structure on the
stack, which is the ctx variable inlined from aes128k128d(). A good
number of the other variables come from the additional checks of
fortified string routines, which are present in memset(), which both
aes_cipher() and aes_decipher() use to initialize some temporary
buffers. In this case, since the size is known at compile time, these
additional checks should not result in any code generation changes but
allmodconfig has several sanitizers enabled, which may make it harder
for the compiler to eliminate the compile time checks and the variables
that come about from them.

The memset() calls are just initializing these buffers to zero, so use
'= {}' instead, which is used all over the kernel and does the exact
same thing as memset() without the fortify checks, which drops the stack
usage of these functions by a few hundred kilobytes.

  drivers/staging/rtl8723bs/core/rtw_security.c:864:19: warning: stack frame size (1584) exceeds limit (128) in 'aes_cipher' [-Wframe-larger-than]
    864 | static signed int aes_cipher(u8 *key, uint      hdrlen,
        |                   ^
  drivers/staging/rtl8723bs/core/rtw_security.c:1271:5: warning: stack frame size (1456) exceeds limit (128) in 'rtw_aes_decrypt' [-Wframe-larger-than]
   1271 | u32 rtw_aes_decrypt(struct adapter *padapter, u8 *precvframe)
        |     ^

Cc: stable@vger.kernel.org
Fixes: 554c0a3abf21 ("staging: Add rtl8723bs sdio wifi driver")
Signed-off-by: Nathan Chancellor <nathan@kernel.org>
Reviewed-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://lore.kernel.org/r/20250609-rtl8723bs-fix-clang-arm64-wflt-v1-1-e2accba43def@kernel.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/rtl8723bs/core/rtw_security.c b/drivers/staging/rtl8723bs/core/rtw_security.c
index ac731415f73327af51fac472f99d26fc13d70bb1..904beca2c02db8fee0b00777e8a5cb4bbe5200e7 100644 (file)
--- a/drivers/staging/rtl8723bs/core/rtw_security.c
+++ b/drivers/staging/rtl8723bs/core/rtw_security.c
@@ -869,29 +869,21 @@ static signed int aes_cipher(u8 *key, uint        hdrlen,
                num_blocks, payload_index;
 
        u8 pn_vector[6];
-       u8 mic_iv[16];
-       u8 mic_header1[16];
-       u8 mic_header2[16];
-       u8 ctr_preload[16];
+       u8 mic_iv[16] = {};
+       u8 mic_header1[16] = {};
+       u8 mic_header2[16] = {};
+       u8 ctr_preload[16] = {};
 
        /* Intermediate Buffers */
-       u8 chain_buffer[16];
-       u8 aes_out[16];
-       u8 padded_buffer[16];
+       u8 chain_buffer[16] = {};
+       u8 aes_out[16] = {};
+       u8 padded_buffer[16] = {};
        u8 mic[8];
        uint    frtype  = GetFrameType(pframe);
        uint    frsubtype  = GetFrameSubType(pframe);
 
        frsubtype = frsubtype>>4;
 
-       memset((void *)mic_iv, 0, 16);
-       memset((void *)mic_header1, 0, 16);
-       memset((void *)mic_header2, 0, 16);
-       memset((void *)ctr_preload, 0, 16);
-       memset((void *)chain_buffer, 0, 16);
-       memset((void *)aes_out, 0, 16);
-       memset((void *)padded_buffer, 0, 16);
-
        if ((hdrlen == WLAN_HDR_A3_LEN) || (hdrlen ==  WLAN_HDR_A3_QOS_LEN))
                a4_exists = 0;
        else
@@ -1081,15 +1073,15 @@ static signed int aes_decipher(u8 *key, uint    hdrlen,
                        num_blocks, payload_index;
        signed int res = _SUCCESS;
        u8 pn_vector[6];
-       u8 mic_iv[16];
-       u8 mic_header1[16];
-       u8 mic_header2[16];
-       u8 ctr_preload[16];
+       u8 mic_iv[16] = {};
+       u8 mic_header1[16] = {};
+       u8 mic_header2[16] = {};
+       u8 ctr_preload[16] = {};
 
                /* Intermediate Buffers */
-       u8 chain_buffer[16];
-       u8 aes_out[16];
-       u8 padded_buffer[16];
+       u8 chain_buffer[16] = {};
+       u8 aes_out[16] = {};
+       u8 padded_buffer[16] = {};
        u8 mic[8];
 
        uint frtype  = GetFrameType(pframe);
@@ -1097,14 +1089,6 @@ static signed int aes_decipher(u8 *key, uint     hdrlen,
 
        frsubtype = frsubtype>>4;
 
-       memset((void *)mic_iv, 0, 16);
-       memset((void *)mic_header1, 0, 16);
-       memset((void *)mic_header2, 0, 16);
-       memset((void *)ctr_preload, 0, 16);
-       memset((void *)chain_buffer, 0, 16);
-       memset((void *)aes_out, 0, 16);
-       memset((void *)padded_buffer, 0, 16);
-
        /* start to decrypt the payload */
 
        num_blocks = (plen-8) / 16; /* plen including LLC, payload_length and mic) */