Hi, On 1/26/24 23:31, Kees Cook wrote: > After commit e3eac9f32ec0 ("wifi: cfg80211: Annotate struct > cfg80211_scan_request with __counted_by"), the compiler may enforce > dynamic array indexing of req->channels to stay below n_channels. As a > result, n_channels needs to be increased _before_ accessing the newly > added array index. Increment it first, then use "i" for the prior index. > Solves this warning in the coming GCC that has __counted_by support: > > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c: In function > 'brcmf_internal_escan_add_info': > ../drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:3783:46: > warning: operation on 'req-> > n_channels' may be undefined [-Wsequence-point] > 3783 | req->channels[req->n_channels++] = chan; > | ~~~~~~~~~~~~~~~^~ > > Fixes: e3eac9f32ec0 ("wifi: cfg80211: Annotate struct cfg80211_scan_request > with __counted_by") > Cc: Arend van Spriel <aspr...@gmail.com> > Cc: Franky Lin <franky....@broadcom.com> > Cc: Hante Meuleman <hante.meule...@broadcom.com> > Cc: Kalle Valo <kv...@kernel.org> > Cc: Chi-hsien Lin <chi-hsien....@infineon.com> > Cc: Ian Lin <ian....@infineon.com> > Cc: Johannes Berg <johannes.b...@intel.com> > Cc: Wright Feng <wright.f...@cypress.com> > Cc: Hector Martin <mar...@marcan.st> > Cc: linux-wirel...@vger.kernel.org > Cc: brcm80211-dev-list....@broadcom.com > Signed-off-by: Kees Cook <keesc...@chromium.org>
Thanks, patch looks good to me: Reviewed-by: Hans de Goede <hdego...@redhat.com> Regards, Hans > --- > drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 6 ++++-- > 1 file changed, 4 insertions(+), 2 deletions(-) > > diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > index 133c5ea6429c..28d6a30cc010 100644 > --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c > @@ -3779,8 +3779,10 @@ static int brcmf_internal_escan_add_info(struct > cfg80211_scan_request *req, > if (req->channels[i] == chan) > break; > } > - if (i == req->n_channels) > - req->channels[req->n_channels++] = chan; > + if (i == req->n_channels) { > + req->n_channels++; > + req->channels[i] = chan; > + } > > for (i = 0; i < req->n_ssids; i++) { > if (req->ssids[i].ssid_len == ssid_len &&