staging: r8188eu: Drop get_recvframe_data()

When building with -Warray-bounds, the following warning is emitted:

In file included from ./include/linux/string.h:253,
                 from ./arch/x86/include/asm/page_32.h:22,
                 from ./arch/x86/include/asm/page.h:14,
                 from ./arch/x86/include/asm/thread_info.h:12,
                 from ./include/linux/thread_info.h:60,
                 from ./arch/x86/include/asm/preempt.h:7,
                 from ./include/linux/preempt.h:78,
                 from ./include/linux/rcupdate.h:27,
                 from ./include/linux/rculist.h:11,
                 from ./include/linux/sched/signal.h:5,
                 from ./drivers/staging/rtl8723bs/include/drv_types.h:17,
                 from drivers/staging/rtl8723bs/core/rtw_recv.c:7:
In function 'memcpy',
    inlined from 'wlanhdr_to_ethhdr' at drivers/staging/rtl8723bs/core/rtw_recv.c:1554:2:
./include/linux/fortify-string.h:41:33: warning: '__builtin_memcpy' offset [0, 5] is out of the bounds [0, 0] [-Warray-bounds]
   41 | #define __underlying_memcpy     __builtin_memcpy
      |                                 ^

This is because the compiler sees it is possible for "ptr" to be a NULL
value, and concludes that it has zero size and attempts to copy to it
would overflow. Instead, remove the get_recvframe_data() entirely, as
it's not possible for this to ever be NULL.

Additionally add missing NULL checks after recvframe_pull() (which are
present in the rtl8712 driver).

Cc: Larry Finger <Larry.Finger@lwfinger.net>
Cc: Phillip Potter <phil@philpotter.co.uk>
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
Cc: Michael Straube <straube.linux@gmail.com>
Cc: Fabio Aiuto <fabioaiuto83@gmail.com>
Cc: linux-staging@lists.linux.dev
Reviewed-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Kees Cook <keescook@chromium.org>
Link: https://lore.kernel.org/r/20220118193327.2822099-2-keescook@chromium.org
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

diff --git a/drivers/staging/r8188eu/core/rtw_recv.c b/drivers/staging/r8188eu/core/rtw_recv.c
index 5438a73..acc0dd8 100644 (file)
--- a/drivers/staging/r8188eu/core/rtw_recv.c
+++ b/drivers/staging/r8188eu/core/rtw_recv.c
@@ -1185,7 +1185,7 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
        struct adapter                  *adapter = precvframe->adapter;
        struct mlme_priv        *pmlmepriv = &adapter->mlmepriv;
 
-       u8      *ptr = get_recvframe_data(precvframe); /*  point to frame_ctrl field */
+       u8      *ptr = precvframe->rx_data; /*  point to frame_ctrl field */
        struct rx_pkt_attrib *pattrib = &precvframe->attrib;
 
        if (pattrib->encrypt)
@@ -1220,10 +1220,14 @@ static int wlanhdr_to_ethhdr(struct recv_frame *precvframe)
                eth_type = 0x8712;
                /*  append rx status for mp test packets */
                ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + 2) - 24);
+               if (!ptr)
+                       return _FAIL;
                memcpy(ptr, get_rxmem(precvframe), 24);
                ptr += 24;
        } else {
                ptr = recvframe_pull(precvframe, (rmv_len - sizeof(struct ethhdr) + (bsnaphdr ? 2 : 0)));
+               if (!ptr)
+                       return _FAIL;
        }
 
        memcpy(ptr, pattrib->dst, ETH_ALEN);

diff --git a/drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c b/drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c
index 90d4261..bf93ff3 100644 (file)
--- a/drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c
+++ b/drivers/staging/r8188eu/hal/rtl8188e_rxdesc.c
@@ -128,7 +128,7 @@ void update_recvframe_phyinfo_88e(struct recv_frame *precvframe, struct phy_stat
        struct rx_pkt_attrib *pattrib = &precvframe->attrib;
        struct hal_data_8188e *pHalData = &padapter->haldata;
        struct phy_info *pPHYInfo  = &pattrib->phy_info;
-       u8 *wlanhdr;
+       u8 *wlanhdr = precvframe->rx_data;
        struct odm_per_pkt_info pkt_info;
        u8 *sa = NULL;
        struct sta_priv *pstapriv;
@@ -138,8 +138,6 @@ void update_recvframe_phyinfo_88e(struct recv_frame *precvframe, struct phy_stat
        pkt_info.bPacketToSelf = false;
        pkt_info.bPacketBeacon = false;
 
-       wlanhdr = get_recvframe_data(precvframe);
-
        pkt_info.bPacketMatchBSSID = ((!IsFrameTypeCtrl(wlanhdr)) &&
                !pattrib->icv_err && !pattrib->crc_err &&
                !memcmp(get_hdr_bssid(wlanhdr),

diff --git a/drivers/staging/r8188eu/include/rtw_recv.h b/drivers/staging/r8188eu/include/rtw_recv.h
index b43a468..920f332 100644 (file)
--- a/drivers/staging/r8188eu/include/rtw_recv.h
+++ b/drivers/staging/r8188eu/include/rtw_recv.h
@@ -296,15 +296,6 @@ static inline u8 *get_rx_status(struct recv_frame *precvframe)
        return get_rxmem(precvframe);
 }
 
-static inline u8 *get_recvframe_data(struct recv_frame *precvframe)
-{
-       /* always return rx_data */
-       if (precvframe == NULL)
-               return NULL;
-
-       return precvframe->rx_data;
-}
-
 static inline u8 *recvframe_push(struct recv_frame *precvframe, int sz)
 {
        /*  append data before rx_data */