Splat from net/wireless/wext-core.c

Splat from net/wireless/wext-core.c

[Larry Finger]

Hi,

With a recent pull from kernel mainline, I am getting a log splat shown below:

[   29.369446] ------------[ cut here ]------------
[   29.369447] memcpy: detected field-spanning write (size 16) of single field 
"&compat_event->pointer" at net/wireless/wext-core.c:623 (size 4)
[   29.369465] WARNING: CPU: 0 PID: 38 at net/wireless/wext-core.c:623 
wireless_send_event+0x502/0x530
[   29.369472] Modules linked in: rfcomm(E) rpcsec_gss_krb5(E) auth_rpcgss(E) 
nfsv4(E) dns_resolver(E) nfs(E) lockd(E) grace(E) sunrpc(E) fscache(E) netfs(E) 
af_packet(E) cmac(E) algif_hash(E) algif_skcipher(E) af_alg(E) vboxnetadp(OE) 
vboxnetflt(OE) bnep(E) btusb(E) btrtl(E) btbcm(E) btintel(E) btmtk(E) 
vboxdrv(OE) bluetooth(E) qrtr(E) ecdh_generic(E) dmi_sysfs(E) intel_rapl_msr(E) 
intel_rapl_common(E) x86_pkg_temp_thermal(E) intel_powerclamp(E) coretemp(E) 
rtw_8852be(OE) rtw_8852b(OE) rtw89pci(OE) iTCO_wdt(E) kvm_intel(E) 
snd_hda_codec_realtek(E) iwlmvm(E) nls_iso8859_1(E) snd_hda_codec_generic(E) 
intel_pmc_bxt(E) spi_intel_platform(E) rtw89core(OE) nls_cp437(E) 
iTCO_vendor_support(E) spi_intel(E) ledtrig_audio(E) snd_hda_codec_hdmi(E) 
mei_pxp(E) mei_hdcp(E) vfat(E) kvm(E) snd_hda_intel(E) fat(E) irqbypass(E) 
snd_intel_dspcfg(E) mac80211(E) snd_hda_codec(E) pcspkr(E) joydev(E) wmi_bmof(E) 
iwlwifi(E) snd_hwdep(E) lpc_ich(E) snd_hda_core(E) libarc4(E) snd_pcm(E)
[   29.369535]  snd_timer(E) toshiba_acpi(E) cfg80211(E) mei_me(E) snd(E) 
sparse_keymap(E) e1000e(E) soundcore(E) mei(E) tiny_power_button(E) 
industrialio(E) toshiba_bluetooth(E) thermal(E) tpm_infineon(E) ac(E) battery(E) 
button(E) fuse(E) configfs(E) ext4(E) mbcache(E) jbd2(E) crct10dif_pclmul(E) 
crc32_pclmul(E) crc32c_intel(E) polyval_clmulni(E) polyval_generic(E) 
rtsx_pci_sdmmc(E) ghash_clmulni_intel(E) sha512_ssse3(E) mmc_core(E) i915(E) 
i2c_algo_bit(E) drm_buddy(E) drm_display_helper(E) drm_kms_helper(E) 
syscopyarea(E) sysfillrect(E) aesni_intel(E) sr_mod(E) sysimgblt(E) 
fb_sys_fops(E) crypto_simd(E) cec(E) xhci_pci(E) xhci_pci_renesas(E) cryptd(E) 
ehci_pci(E) xhci_hcd(E) ehci_hcd(E) ttm(E) serio_raw(E) cdrom(E) rtsx_pci(E) 
usbcore(E) drm(E) video(E) wmi(E) sg(E) dm_multipath(E) dm_mod(E) 
scsi_dh_rdac(E) scsi_dh_emc(E) scsi_dh_alua(E) msr(E)
[   29.369590] Unloaded tainted modules: ie31200_edac(E):1 pcc_cpufreq(E):8 
acpi_cpufreq(E):12
[   29.369596] CPU: 0 PID: 38 Comm: kworker/u16:1 Tainted: G           OE 
6.1.0-rc0-10164-g19f210eed144-dirty #4 a79f5d234c3d905ad563fd7aed3f9e7c19b19791
[   29.369600] Hardware name: TOSHIBA TECRA A50-A/TECRA A50-A, BIOS Version 4.50 
   09/29/2014
[   29.369602] Workqueue: phy0 ieee80211_iface_work [mac80211]
[   29.369658] RIP: 0010:wireless_send_event+0x502/0x530
[   29.369663] Code: 5f fd ff ff b9 04 00 00 00 48 89 ee 48 89 04 24 48 c7 c2 10 
ec f3 a4 48 c7 c7 c0 b1 e3 a4 c6 05 ed 3f 0e 01 01 e8 4c 8b 07 00 <0f> 0b 48 8b 
04 24 e9 2e fd ff ff e8 7e 3e 0d 00 e8 79 3e 0d 00 e8
[   29.369665] RSP: 0018:ffff9c11001b7790 EFLAGS: 00010286
[   29.369667] RAX: 0000000000000000 RBX: ffff8a70457a3d00 RCX: 0000000000000027
[   29.369669] RDX: ffff8a72632224c8 RSI: 0000000000000001 RDI: ffff8a72632224c0
[   29.369670] RBP: 0000000000000010 R08: 0000000000000000 R09: ffff9c11001b7638
[   29.369672] R10: 0000000000000003 R11: ffff8a726f546fa8 R12: ffffffffa4c45b3c
[   29.369673] R13: ffff8a70cb0fd000 R14: 0000000000000014 R15: ffff8a70457a3600
[   29.369675] FS:  0000000000000000(0000) GS:ffff8a7263200000(0000) 
knlGS:0000000000000000
[   29.369676] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[   29.369678] CR2: 00007fb53d769000 CR3: 0000000163248002 CR4: 00000000001706f0
[   29.369679] Call Trace:
[   29.369681]  <TASK>
[   29.369683]  __cfg80211_connect_result+0x36f/0x650 [cfg80211 
ef292c04261807d50b3dee8f7093c79c21ebd85d]
[   29.369744]  ? cfg80211_rx_assoc_resp+0x1db/0x290 [cfg80211 
ef292c04261807d50b3dee8f7093c79c21ebd85d]
[   29.369787]  cfg80211_rx_assoc_resp+0x1db/0x290 [cfg80211 
ef292c04261807d50b3dee8f7093c79c21ebd85d]
[   29.369830]  ieee80211_rx_mgmt_assoc_resp.cold+0x268/0x191c [mac80211 
b16c34b0c18b27e169c0d6c5932cee86c8e5f900]
[   29.369889]  ieee80211_sta_rx_queued_mgmt+0x2d6/0x820 [mac80211 
b16c34b0c18b27e169c0d6c5932cee86c8e5f900]
[   29.369940]  ? __update_idle_core+0x68/0xc0
[   29.369944]  ? __switch_to_asm+0x3a/0x60
[   29.369948]  ? finish_task_switch.isra.0+0x90/0x2c0
[   29.369951]  ieee80211_iface_work+0x315/0x430 [mac80211 
b16c34b0c18b27e169c0d6c5932cee86c8e5f900]
[   29.369994]  process_one_work+0x202/0x3c0
[   29.369997]  worker_thread+0x4a/0x3b0
[   29.369999]  ? process_one_work+0x3c0/0x3c0
[   29.370000]  kthread+0xd7/0x100
[   29.370004]  ? kthread_complete_and_exit+0x20/0x20
[   29.370007]  ret_from_fork+0x1f/0x30
[   29.370010]  </TASK>
[   29.370011] ---[ end trace 0000000000000000 ]---

Thanks,

Larry

Re: Splat from net/wireless/wext-core.c

[Johannes Berg]

On Fri, 2022-10-14 at 11:49 -0500, Larry Finger wrote:
> Hi,
> 
> With a recent pull from kernel mainline, I am getting a log splat shown below:
> 
> [   29.369446] ------------[ cut here ]------------
> [   29.369447] memcpy: detected field-spanning write (size 16) of single field 
> "&compat_event->pointer" at net/wireless/wext-core.c:623 (size 4)


Yeah fixed by commit e3e6e1d16a4c ("wifi: wext: use flex array
destination for memcpy()") I think?

johannes

Re: Splat from net/wireless/wext-core.c

[Larry Finger]

On 10/14/22 11:57, Johannes Berg wrote:
> On Fri, 2022-10-14 at 11:49 -0500, Larry Finger wrote:
>> Hi,
>>
>> With a recent pull from kernel mainline, I am getting a log splat shown below:
>>
>> [   29.369446] ------------[ cut here ]------------
>> [   29.369447] memcpy: detected field-spanning write (size 16) of single field
>> "&compat_event->pointer" at net/wireless/wext-core.c:623 (size 4)
> 
> 
> Yeah fixed by commit e3e6e1d16a4c ("wifi: wext: use flex array
> destination for memcpy()") I think?

Johannes,

Sorry for the noise. That commit was merged when I did a new pull on mainline. 
My log is clean now.

Larry

Re: Splat from net/wireless/wext-core.c

[Johannes Berg]

On Fri, 2022-10-14 at 15:16 -0500, Larry Finger wrote:
> On 10/14/22 11:57, Johannes Berg wrote:
> > On Fri, 2022-10-14 at 11:49 -0500, Larry Finger wrote:
> > > Hi,
> > > 
> > > With a recent pull from kernel mainline, I am getting a log splat shown below:
> > > 
> > > [   29.369446] ------------[ cut here ]------------
> > > [   29.369447] memcpy: detected field-spanning write (size 16) of single field
> > > "&compat_event->pointer" at net/wireless/wext-core.c:623 (size 4)
> > 
> > 
> > Yeah fixed by commit e3e6e1d16a4c ("wifi: wext: use flex array
> > destination for memcpy()") I think?
> 
> Sorry for the noise. That commit was merged when I did a new pull on mainline. 

No worries!

> My log is clean now.
> 

Good to hear, I haven't built a kernel in the right way so far to see
this :)

johannes