Re: [PATCH wireless-next v2] wifi: brcmfmac: fix EXTSAE WPA3 connection failure due to AUTH TX failure

Hi Gokul,

kernel test robot noticed the following build warnings:

[auto build test WARNING on wireless-next/main]
[also build test WARNING on wireless/main linus/master v6.16-rc4 next-20250704]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Gokul-Sivakumar/wifi-brcmfmac-fix-EXTSAE-WPA3-connection-failure-due-to-AUTH-TX-failure/20250703-215456
base:   https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next.git main
patch link:    https://lore.kernel.org/r/20250703135307.7433-1-gokulkumar.sivakumar%40infineon.com
patch subject: [PATCH wireless-next v2] wifi: brcmfmac: fix EXTSAE WPA3 connection failure due to AUTH TX failure
config: sh-randconfig-r121-20250704 (https://download.01.org/0day-ci/archive/20250706/[email protected]/config)
compiler: sh4-linux-gcc (GCC) 15.1.0
reproduce: (https://download.01.org/0day-ci/archive/20250706/[email protected]/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <[email protected]>
| Closes: https://lore.kernel.org/oe-kbuild-all/[email protected]/

sparse warnings: (new ones prefixed by >>)
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5620:52: sparse: sparse: incorrect type in assignment (different base types) @@     expected restricted __le32 [usertype] channel @@     got signed int [addressable] [usertype] hw_ch @@
   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5620:52: sparse:     expected restricted __le32 [usertype] channel
   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c:5620:52: sparse:     got signed int [addressable] [usertype] hw_ch
--
>> drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:156:44: sparse: sparse: incorrect type in assignment (different base types) @@     expected restricted __le16 [usertype] channel @@     got signed int [addressable] [usertype] hw_ch @@
   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:156:44: sparse:     expected restricted __le16 [usertype] channel
   drivers/net/wireless/broadcom/brcm80211/brcmfmac/cyw/core.c:156:44: sparse:     got signed int [addressable] [usertype] hw_ch

vim +5620 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c

  5528	
  5529	
  5530	int
  5531	brcmf_cfg80211_mgmt_tx(struct wiphy *wiphy, struct wireless_dev *wdev,
  5532			       struct cfg80211_mgmt_tx_params *params, u64 *cookie)
  5533	{
  5534		struct brcmf_cfg80211_info *cfg = wiphy_to_cfg(wiphy);
  5535		struct ieee80211_channel *chan = params->chan;
  5536		struct brcmf_pub *drvr = cfg->pub;
  5537		const u8 *buf = params->buf;
  5538		size_t len = params->len;
  5539		const struct ieee80211_mgmt *mgmt;
  5540		struct brcmf_cfg80211_vif *vif;
  5541		s32 err = 0;
  5542		s32 ie_offset;
  5543		s32 ie_len;
  5544		struct brcmf_fil_action_frame_le *action_frame;
  5545		struct brcmf_fil_af_params_le *af_params;
  5546		bool ack;
  5547		s32 ch, hw_ch;
  5548	
  5549		brcmf_dbg(TRACE, "Enter\n");
  5550	
  5551		*cookie = 0;
  5552	
  5553		mgmt = (const struct ieee80211_mgmt *)buf;
  5554	
  5555		if (!ieee80211_is_mgmt(mgmt->frame_control)) {
  5556			bphy_err(drvr, "Driver only allows MGMT packet type\n");
  5557			return -EPERM;
  5558		}
  5559	
  5560		vif = container_of(wdev, struct brcmf_cfg80211_vif, wdev);
  5561	
  5562		if (ieee80211_is_probe_resp(mgmt->frame_control)) {
  5563			/* Right now the only reason to get a probe response */
  5564			/* is for p2p listen response or for p2p GO from     */
  5565			/* wpa_supplicant. Unfortunately the probe is send   */
  5566			/* on primary ndev, while dongle wants it on the p2p */
  5567			/* vif. Since this is only reason for a probe        */
  5568			/* response to be sent, the vif is taken from cfg.   */
  5569			/* If ever desired to send proberesp for non p2p     */
  5570			/* response then data should be checked for          */
  5571			/* "DIRECT-". Note in future supplicant will take    */
  5572			/* dedicated p2p wdev to do this and then this 'hack'*/
  5573			/* is not needed anymore.                            */
  5574			ie_offset =  DOT11_MGMT_HDR_LEN +
  5575				     DOT11_BCN_PRB_FIXED_LEN;
  5576			ie_len = len - ie_offset;
  5577			if (vif == cfg->p2p.bss_idx[P2PAPI_BSSCFG_PRIMARY].vif)
  5578				vif = cfg->p2p.bss_idx[P2PAPI_BSSCFG_DEVICE].vif;
  5579			err = brcmf_vif_set_mgmt_ie(vif,
  5580						    BRCMF_VNDR_IE_PRBRSP_FLAG,
  5581						    &buf[ie_offset],
  5582						    ie_len);
  5583			cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, true,
  5584						GFP_KERNEL);
  5585		} else if (ieee80211_is_action(mgmt->frame_control)) {
  5586			if (len > BRCMF_FIL_ACTION_FRAME_SIZE + DOT11_MGMT_HDR_LEN) {
  5587				bphy_err(drvr, "invalid action frame length\n");
  5588				err = -EINVAL;
  5589				goto exit;
  5590			}
  5591			af_params = kzalloc(sizeof(*af_params), GFP_KERNEL);
  5592			if (af_params == NULL) {
  5593				bphy_err(drvr, "unable to allocate frame\n");
  5594				err = -ENOMEM;
  5595				goto exit;
  5596			}
  5597			action_frame = &af_params->action_frame;
  5598			/* Add the packet Id */
  5599			action_frame->packet_id = cpu_to_le32(*cookie);
  5600			/* Add BSSID */
  5601			memcpy(&action_frame->da[0], &mgmt->da[0], ETH_ALEN);
  5602			memcpy(&af_params->bssid[0], &mgmt->bssid[0], ETH_ALEN);
  5603			/* Add the length exepted for 802.11 header  */
  5604			action_frame->len = cpu_to_le16(len - DOT11_MGMT_HDR_LEN);
  5605			/* Add the channel. Use the one specified as parameter if any or
  5606			 * the current one (got from the firmware) otherwise
  5607			 */
  5608			if (chan) {
  5609				ch = ieee80211_frequency_to_channel(chan->center_freq);
  5610				af_params->channel = cpu_to_le32(ch);
  5611			} else {
  5612				err = brcmf_fil_cmd_int_get(vif->ifp,
  5613							    BRCMF_C_GET_CHANNEL,
  5614							    &hw_ch);
  5615				if (err) {
  5616					bphy_err(drvr,
  5617						 "unable to get current hw channel\n");
  5618					goto free;
  5619				} else {
> 5620					af_params->channel = hw_ch;
  5621				}
  5622			}
  5623	
  5624			af_params->dwell_time = cpu_to_le32(params->wait);
  5625			memcpy(action_frame->data, &buf[DOT11_MGMT_HDR_LEN],
  5626			       le16_to_cpu(action_frame->len));
  5627	
  5628			brcmf_dbg(TRACE, "Action frame, cookie=%lld, len=%d, channel=%d\n",
  5629				  *cookie, le16_to_cpu(action_frame->len),
  5630				  le32_to_cpu(af_params->channel));
  5631	
  5632			ack = brcmf_p2p_send_action_frame(cfg, cfg_to_ndev(cfg),
  5633							  af_params);
  5634	
  5635			cfg80211_mgmt_tx_status(wdev, *cookie, buf, len, ack,
  5636						GFP_KERNEL);
  5637	free:
  5638			kfree(af_params);
  5639		} else {
  5640			brcmf_dbg(TRACE, "Unhandled, fc=%04x!!\n", mgmt->frame_control);
  5641			brcmf_dbg_hex_dump(true, buf, len, "payload, len=%zu\n", len);
  5642		}
  5643	
  5644	exit:
  5645		return err;
  5646	}
  5647	BRCMF_EXPORT_SYMBOL_GPL(brcmf_cfg80211_mgmt_tx);
  5648	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki