* Re: [PATCH v3] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d
2025-11-18 15:05 [PATCH v3] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d Ranganath V N
@ 2025-11-19 9:09 ` Johannes Berg
2025-11-19 14:49 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: Johannes Berg @ 2025-11-19 9:09 UTC (permalink / raw)
To: Ranganath V N, dave.taht, linville
Cc: linux-wireless, linux-kernel, skhan, david.hunter.linux, khalid,
syzbot+878ddc3962f792e9af59
On Tue, 2025-11-18 at 20:35 +0530, Ranganath V N wrote:
>
> switch (skb->protocol) {
> case htons(ETH_P_IP):
> + struct iphdr iph, *ip;
> +
> + ip = skb_header_pointer(skb, sizeof(struct ethhdr),
> + sizeof(*ip), &iph);
> + if (!ip)
> + return 0;
> +
> dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
If you pull it out that way, seems you should also _use_ it?
johannes
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [PATCH v3] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d
2025-11-18 15:05 [PATCH v3] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d Ranganath V N
2025-11-19 9:09 ` Johannes Berg
@ 2025-11-19 14:49 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2025-11-19 14:49 UTC (permalink / raw)
To: Ranganath V N, johannes, dave.taht, linville
Cc: oe-kbuild-all, linux-wireless, linux-kernel, skhan,
david.hunter.linux, khalid, Ranganath V N,
syzbot+878ddc3962f792e9af59
Hi Ranganath,
kernel test robot noticed the following build errors:
[auto build test ERROR on wireless-next/main]
[also build test ERROR on wireless/main linus/master v6.18-rc6 next-20251119]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ranganath-V-N/wifi-cfg80211-Fix-uninitialized-header-access-in-cfg80211_classify8021d/20251118-231316
base: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link: https://lore.kernel.org/r/20251118150524.7973-1-vnranganath.20%40gmail.com
patch subject: [PATCH v3] wifi: cfg80211: Fix uninitialized header access in cfg80211_classify8021d
config: arm64-randconfig-r132-20251119 (https://download.01.org/0day-ci/archive/20251119/202511192205.7ZRQgwZI-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251119/202511192205.7ZRQgwZI-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202511192205.7ZRQgwZI-lkp@intel.com/
All errors (new ones prefixed by >>):
net/wireless/util.c: In function 'cfg80211_classify8021d':
>> net/wireless/util.c:966:3: error: a label can only be part of a statement and a declaration is not a statement
struct iphdr iph, *ip;
^~~~~~
net/wireless/util.c:976:3: error: a label can only be part of a statement and a declaration is not a statement
struct ipv6hdr ip6h, *ip6;
^~~~~~
vim +966 net/wireless/util.c
936
937 /* Given a data frame determine the 802.1p/1d tag to use. */
938 unsigned int cfg80211_classify8021d(struct sk_buff *skb,
939 struct cfg80211_qos_map *qos_map)
940 {
941 unsigned int dscp;
942 unsigned char vlan_priority;
943 unsigned int ret;
944
945 /* skb->priority values from 256->263 are magic values to
946 * directly indicate a specific 802.1d priority. This is used
947 * to allow 802.1d priority to be passed directly in from VLAN
948 * tags, etc.
949 */
950 if (skb->priority >= 256 && skb->priority <= 263) {
951 ret = skb->priority - 256;
952 goto out;
953 }
954
955 if (skb_vlan_tag_present(skb)) {
956 vlan_priority = (skb_vlan_tag_get(skb) & VLAN_PRIO_MASK)
957 >> VLAN_PRIO_SHIFT;
958 if (vlan_priority > 0) {
959 ret = vlan_priority;
960 goto out;
961 }
962 }
963
964 switch (skb->protocol) {
965 case htons(ETH_P_IP):
> 966 struct iphdr iph, *ip;
967
968 ip = skb_header_pointer(skb, sizeof(struct ethhdr),
969 sizeof(*ip), &iph);
970 if (!ip)
971 return 0;
972
973 dscp = ipv4_get_dsfield(ip_hdr(skb)) & 0xfc;
974 break;
975 case htons(ETH_P_IPV6):
976 struct ipv6hdr ip6h, *ip6;
977
978 ip6 = skb_header_pointer(skb, sizeof(struct ethhdr),
979 sizeof(*ip6), &ip6h);
980 if (!ip6)
981 return 0;
982
983 dscp = ipv6_get_dsfield(ipv6_hdr(skb)) & 0xfc;
984 break;
985 case htons(ETH_P_MPLS_UC):
986 case htons(ETH_P_MPLS_MC): {
987 struct mpls_label mpls_tmp, *mpls;
988
989 mpls = skb_header_pointer(skb, sizeof(struct ethhdr),
990 sizeof(*mpls), &mpls_tmp);
991 if (!mpls)
992 return 0;
993
994 ret = (ntohl(mpls->entry) & MPLS_LS_TC_MASK)
995 >> MPLS_LS_TC_SHIFT;
996 goto out;
997 }
998 case htons(ETH_P_80221):
999 /* 802.21 is always network control traffic */
1000 return 7;
1001 default:
1002 return 0;
1003 }
1004
1005 if (qos_map) {
1006 unsigned int i, tmp_dscp = dscp >> 2;
1007
1008 for (i = 0; i < qos_map->num_des; i++) {
1009 if (tmp_dscp == qos_map->dscp_exception[i].dscp) {
1010 ret = qos_map->dscp_exception[i].up;
1011 goto out;
1012 }
1013 }
1014
1015 for (i = 0; i < 8; i++) {
1016 if (tmp_dscp >= qos_map->up[i].low &&
1017 tmp_dscp <= qos_map->up[i].high) {
1018 ret = i;
1019 goto out;
1020 }
1021 }
1022 }
1023
1024 /* The default mapping as defined Section 2.3 in RFC8325: The three
1025 * Most Significant Bits (MSBs) of the DSCP are used as the
1026 * corresponding L2 markings.
1027 */
1028 ret = dscp >> 5;
1029
1030 /* Handle specific DSCP values for which the default mapping (as
1031 * described above) doesn't adhere to the intended usage of the DSCP
1032 * value. See section 4 in RFC8325. Specifically, for the following
1033 * Diffserv Service Classes no update is needed:
1034 * - Standard: DF
1035 * - Low Priority Data: CS1
1036 * - Multimedia Conferencing: AF41, AF42, AF43
1037 * - Network Control Traffic: CS7
1038 * - Real-Time Interactive: CS4
1039 * - Signaling: CS5
1040 */
1041 switch (dscp >> 2) {
1042 case 10:
1043 case 12:
1044 case 14:
1045 /* High throughput data: AF11, AF12, AF13 */
1046 ret = 0;
1047 break;
1048 case 16:
1049 /* Operations, Administration, and Maintenance and Provisioning:
1050 * CS2
1051 */
1052 ret = 0;
1053 break;
1054 case 18:
1055 case 20:
1056 case 22:
1057 /* Low latency data: AF21, AF22, AF23 */
1058 ret = 3;
1059 break;
1060 case 24:
1061 /* Broadcasting video: CS3 */
1062 ret = 4;
1063 break;
1064 case 26:
1065 case 28:
1066 case 30:
1067 /* Multimedia Streaming: AF31, AF32, AF33 */
1068 ret = 4;
1069 break;
1070 case 44:
1071 /* Voice Admit: VA */
1072 ret = 6;
1073 break;
1074 case 46:
1075 /* Telephony traffic: EF */
1076 ret = 6;
1077 break;
1078 case 48:
1079 /* Network Control Traffic: CS6 */
1080 ret = 7;
1081 break;
1082 }
1083 out:
1084 return array_index_nospec(ret, IEEE80211_NUM_TIDS);
1085 }
1086 EXPORT_SYMBOL(cfg80211_classify8021d);
1087
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread