From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mail-wm1-f41.google.com (mail-wm1-f41.google.com [209.85.128.41]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 00ED43B8D54 for ; Mon, 8 Dec 2025 00:05:24 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=209.85.128.41 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765152326; cv=none; b=Q840JTjKYIb62N9HZeoKHrXUIbVxpunWPUMsYHMy4nmzlAPmDC2zHCHIcVMunHLVhlB+t6+DR2lr/WELVSrExpstXGHmT1cF55UnprplR1A2xrydUUK2YQJjJ3gOTv6scT9f6n3zJ5hTM6w2vnWNjZN5RUJ2X/6chU5oUgr45hc= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1765152326; c=relaxed/simple; bh=kF1RpIs85tnz0Mum9qzIvXTUhZPttSkvcmreMhDe0bc=; h=Message-ID:Date:MIME-Version:Subject:To:Cc:References:From: In-Reply-To:Content-Type; b=MVjQRDhQexU5z8Uha1KEqhVeYQQdMnkJ3dR7zaqPHwT0xud5wyurcpdVIESBwv3Vny+C4m339QhrmU+sjsuaaCoIEPLiL88g0/9H9Jrw0Xsi8MpT9Mhc2helOwuCrYnG+5KUstTuft0ioOdMFyWE8YooivYB1RuPk5iwr3sdt2k= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com; spf=pass smtp.mailfrom=gmail.com; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b=L7d7XWsA; arc=none smtp.client-ip=209.85.128.41 Authentication-Results: smtp.subspace.kernel.org; dmarc=pass (p=none dis=none) header.from=gmail.com Authentication-Results: smtp.subspace.kernel.org; spf=pass smtp.mailfrom=gmail.com Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=gmail.com header.i=@gmail.com header.b="L7d7XWsA" Received: by mail-wm1-f41.google.com with SMTP id 5b1f17b1804b1-47798ded6fcso28664015e9.1 for ; Sun, 07 Dec 2025 16:05:24 -0800 (PST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1765152323; x=1765757123; darn=vger.kernel.org; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :from:to:cc:subject:date:message-id:reply-to; bh=crGWNTCrIJBXutZfz1g08zhcxUbU3pl9o/ZTSXj4LR4=; b=L7d7XWsAJu+QYNfNMEd4db7PJe786XwKJanzJq4zwHPXDhp2Atetpf8+xp9vX3E6r5 JW4I2oNmQx4VmsVFyNzT8fOTEoiJ0EAlzPk6iPv0RsCVigghduvHsB1KhPOU2Rttw/gR nGpJiCcojGRBIvOL7oElyMrtamNdhpmYTXWAj9PFMxF+8sDbnwOFM2rt/O25i5vKbfvV PAlY/ExztpdHx3MjrUqA1TFZhQtarE2CDeCmAALt9pe4rWvfEVHE8lSbERiSQZ/waSzH Gro232B8Hi84PO353U5C0Gmae90FmmvNbvqP8Bztl3Z91c91BDfJvV/y044jZZpMTB9/ +d6Q== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1765152323; x=1765757123; h=content-transfer-encoding:in-reply-to:from:content-language :references:cc:to:subject:user-agent:mime-version:date:message-id :x-gm-gg:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=crGWNTCrIJBXutZfz1g08zhcxUbU3pl9o/ZTSXj4LR4=; b=f/bJywqu+Ee1FoN92dYgQS18uJRnonmhXp5ZaKHR5jtnqyLQWjdUbX/bG5Vu4t+/aZ n24DEQ8lD+FrHAgMBEpcSTuCly9zkJEcL4PO5zZZT/3OujWElcO8Di5dEW2p9t9cWEdm Qn/Y4IabDisuhuL2+MAg0fZvH3PAaxnVilWr9e7SW49s0y02lW+r2ZVAMFZS5C0IRVIG zYgGQR47nEJpbBM01ZFN8V7Odn4y+3qJNsElIFS+IFbXR1qAIBJWi07CR136hiNFTUCw ZhKfg7prScaqrng1blGfHJiwecUPIkjH56XI6duYULZ7+VHikzEaK7h7C7/Hsi/QqyzE jYTA== X-Forwarded-Encrypted: i=1; AJvYcCUD7pwsXAm//yJAraTgzRuMVv1tNjsdvwb3vAIlhHsItlb9V+5Tqb4GBJ7ENHRXwd41T5m7QCRZrOSutnI=@vger.kernel.org X-Gm-Message-State: AOJu0YyAJF3u1Jr9fIpFZEfuaXjNRIfaFf7E9ldDnaD60qSScMJ9jne0 sknrospo0GmAn1UO4b3DwtWrmdGezHW6aFP5fRkE8LvhY030SKli+iBq X-Gm-Gg: ASbGncsAQcRRZzoGpZ4Rk38Evued/1OEY1hzBFa+pGgO2oUvH697PLCY3WhfodPpP6h ZF3+mNIoFqreyWTjOgAPVzj/jGJTHEShSzr/2LfyZRA69J81JeWmzrvoJZ/HX+piVRunJqLSeWB k7XY6DQfoiF7FQxjx/A8bndt4aqCfpsxx8n5i9/aF3wYARVsNQXxGJbr0jl1ehP+EPUIaTusTGq j1bGd3JOoDDKGjjVeauPFwOHbCeYYLNnXC+xdxDLalktDyPyc+8vW5W8FQmUNqzlmVukPbLoVIb tPv3xVf5x6bhuPrX/uiIG6tgCmehov4t31h0ikwtA/DNCbBax7pQN0nQcxz2HDivxxhwOSbM8a9 dp74VTFaVub1t/ZWU2x/3GnjpcLjQD9xrk30hQPNWhLa3r14nUBd4gpycn8c0VwS5nQSL1buDhD UuRei/86+cuOMxopqL7OF+ X-Google-Smtp-Source: AGHT+IElnljE3VByHdqZRQQCN5eSGajqd6Tvz9JHksaJP8BhX7orlEgII4Jmd3VFk5TSm0OmokF2mg== X-Received: by 2002:a05:600c:529b:b0:479:3a88:de5d with SMTP id 5b1f17b1804b1-4793a88deb1mr59110375e9.36.1765152323202; Sun, 07 Dec 2025 16:05:23 -0800 (PST) Received: from [192.168.1.50] ([79.119.240.187]) by smtp.gmail.com with ESMTPSA id 5b1f17b1804b1-479308cd87csm225552475e9.0.2025.12.07.16.05.20 (version=TLS1_3 cipher=TLS_AES_128_GCM_SHA256 bits=128/128); Sun, 07 Dec 2025 16:05:22 -0800 (PST) Message-ID: Date: Mon, 8 Dec 2025 02:05:19 +0200 Precedence: bulk X-Mailing-List: linux-kernel@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH][next] wifi: rtl8xxxu: Avoid -Wflex-array-member-not-at-end warnings To: Michal Pecio Cc: Ping-Ke Shih , Zenm Chen , "gustavo@embeddedor.com" , "Jes.Sorensen@gmail.com" , "gustavoars@kernel.org" , "linux-hardening@vger.kernel.org" , "linux-kernel@vger.kernel.org" , "linux-wireless@vger.kernel.org" , linux-usb@vger.kernel.org References: <20251121111132.4435-1-zenmchen@gmail.com> <475b4336-eed0-4fae-848f-aae26f109606@gmail.com> <44c9c325-14a8-4391-adce-4bbe8c68b446@gmail.com> <20251207001608.1f6940bf.michal.pecio@gmail.com> Content-Language: en-US From: Bitterblue Smith In-Reply-To: <20251207001608.1f6940bf.michal.pecio@gmail.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit On 07/12/2025 01:16, Michal Pecio wrote: > Hi, > >>>> I got something. In my case everything seemed fine until I >>>> unplugged the wifi adapter. And then the system still worked for a >>>> few minutes before it froze. > > Sounds like memory corruption. > >>> Zenm and I tested below changes which can also reproduce the >>> symptom, so I wonder driver might assume urb is the first member of >>> struct, but unfortunately I can't find that. > > That's what it seems to be doing, because it uses usb_init_urb() > on urbs embedded in some struct and then usb_free_urb(). > > If you look what usb_free_urb() does, it decrements refcount and > attempts to free urb. But here urb is a member of a larger struct, > so I guess the whole struct is freed (and this was either intentional > or a bug that didn't happen to blow up yet). > > Now a bogus address is being passed to kfree() and things go boom. > Or at least that's my first guess after spending a few minutes. > But that's the direction I would be looking at. > > Regards, > Michal Ahhh, I see it now, thank you.