]> www.infradead.org Git - users/jedix/linux-maple.git/commit
wifi: iwlwifi: mld: Work around Clang loop unrolling bug
authorKees Cook <kees@kernel.org>
Mon, 21 Apr 2025 20:41:57 +0000 (13:41 -0700)
committerKees Cook <kees@kernel.org>
Tue, 27 May 2025 19:26:00 +0000 (12:26 -0700)
commit368556dd234dc4a506a35a0c99c0eee2ab475c77
tree3fcdefa26250115b1ece4c807f06f4bd4774ffc4
parentf0cd6012c40da99b45f8f63052b97ec89d5f307b
wifi: iwlwifi: mld: Work around Clang loop unrolling bug

The nested loop in iwl_mld_send_proto_offload() confuses Clang into
thinking there could be a final loop iteration past the end of the
"nsc" array (which is only 4 entries). The FORTIFY checking in memcmp()
(via ipv6_addr_cmp()) notices this (due to the available bytes in the
out-of-bounds position of &nsc[4] being 0), and errors out, failing
the build. For some reason (likely due to architectural loop unrolling
configurations), this is only exposed on ARM builds currently. Due to
Clang's lack of inline tracking[1], the warning is not very helpful:

include/linux/fortify-string.h:719:4: error: call to '__read_overflow' declared with 'error' attribute: detected read beyond size of object (1st parameter)
  719 |                         __read_overflow();
      |                         ^
1 error generated.

But this was tracked down to iwl_mld_send_proto_offload()'s
ipv6_addr_cmp() call.

An upstream Clang bug has been filed[2] to track this. For now fix the
build by explicitly bounding the inner loop by "n_nsc", which is what
"c" is already limited to.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://github.com/ClangBuiltLinux/linux/issues/2076
Link: https://github.com/llvm/llvm-project/pull/73552
Link: https://github.com/llvm/llvm-project/issues/136603
Link: https://lore.kernel.org/r/20250421204153.work.935-kees@kernel.org
Signed-off-by: Kees Cook <kees@kernel.org>
drivers/net/wireless/intel/iwlwifi/mld/d3.c