tree: https://gitee.com/openeuler/kernel.git openEuler-1.0-LTS head: e9eac2f8ec0d6e36fe87c658851c3c77f990b098 commit: 7ad207616673722d5cf52c18d9464e0d3184ffc9 [22145/22156] arp: Prevent overflow in arp_req_get(). config: x86_64-rhel-8.3-rust (https://download.01.org/0day-ci/archive/20240419/202404192145.IFJnkcXo-lkp@i...) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18) reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20240419/202404192145.IFJnkcXo-lkp@i...)

If you fix the issue in a separate patch/commit (i.e. not just a new version of the same patch/commit), kindly add following tags | Reported-by: kernel test robot lkp@intel.com | Closes: https://lore.kernel.org/oe-kbuild-all/202404192145.IFJnkcXo-lkp@intel.com/

All warnings (new ones prefixed by >>):

...

net/ipv4/arp.c:1106:5: warning: comparison of distinct pointer types ('typeof (dev->addr_len) *' (aka 'unsigned char *') and 'typeof (sizeof (r->arp_ha.sa_data)) *' (aka 'unsigned long *')) [-Wcompare-distinct-pointer-types]

1106 | min(dev->addr_len, sizeof(r->arp_ha.sa_data))); | ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:884:19: note: expanded from macro 'min' 884 | #define min(x, y) __careful_cmp(x, y, <) | ^~~~~~~~~~~~~~~~~~~~~~ include/linux/kernel.h:875:24: note: expanded from macro '__careful_cmp' 875 | __builtin_choose_expr(__safe_cmp(x, y), \ | ^~~~~~~~~~~~~~~~ include/linux/kernel.h:865:4: note: expanded from macro '__safe_cmp' 865 | (__typecheck(x, y) && __no_side_effects(x, y)) | ^~~~~~~~~~~~~~~~~ include/linux/kernel.h:851:29: note: expanded from macro '__typecheck' 851 | (!!(sizeof((typeof(x) *)1 == (typeof(y) *)1))) | ~~~~~~~~~~~~~~ ^ ~~~~~~~~~~~~~~ 1 warning generated.

vim +1106 net/ipv4/arp.c

1090 1091 /* 1092 * Get an ARP cache entry. 1093 */ 1094 1095 static int arp_req_get(struct arpreq *r, struct net_device *dev) 1096 { 1097 __be32 ip = ((struct sockaddr_in *) &r->arp_pa)->sin_addr.s_addr; 1098 struct neighbour *neigh; 1099 int err = -ENXIO; 1100 1101 neigh = neigh_lookup(&arp_tbl, &ip, dev); 1102 if (neigh) { 1103 if (!(neigh->nud_state & NUD_NOARP)) { 1104 read_lock_bh(&neigh->lock); 1105 memcpy(r->arp_ha.sa_data, neigh->ha,

1106 min(dev->addr_len, sizeof(r->arp_ha.sa_data)));

1107 r->arp_flags = arp_state_to_flags(neigh); 1108 read_unlock_bh(&neigh->lock); 1109 r->arp_ha.sa_family = dev->type; 1110 strlcpy(r->arp_dev, dev->name, sizeof(r->arp_dev)); 1111 err = 0; 1112 } 1113 neigh_release(neigh); 1114 } 1115 return err; 1116 } 1117