* drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max
@ 2026-07-25 14:35 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-07-25 14:35 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: "Thomas Weißschuh" <thomas.weissschuh@linutronix.de>
CC: Shuah Khan <skhan@linuxfoundation.org>
CC: Johannes Berg <johannes@sipsolutions.net>
CC: David Gow <davidgow@google.com>
Hi Thomas,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 48a5a7ab8d6ab7090564339e039c421f315de912
commit: 031cdd3bc3f369553933c1b0f4cb18000162c8ff kunit: Enable PCI on UML without triggering WARN()
date: 10 months ago
:::::: branch date: 2 days ago
:::::: commit date: 10 months ago
config: um-randconfig-r073-20260725 (https://download.01.org/0day-ci/archive/20260725/202607252243.pfaeplGg-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607252243.pfaeplGg-lkp@intel.com/
smatch warnings:
drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max
drivers/gpu/drm/nouveau/nouveau_backlight.c:349 nouveau_backlight_init() warn: missing error code 'ret'
vim +2461 drivers/net/ethernet/emulex/benet/be_main.c
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2427
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2428 /* Process the RX completion indicated by rxcp when GRO is enabled */
4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han 2013-08-05 2429 static void be_rx_compl_process_gro(struct be_rx_obj *rxo,
4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han 2013-08-05 2430 struct napi_struct *napi,
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2431 struct be_rx_compl_info *rxcp)
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2432 {
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2433 struct be_adapter *adapter = rxo->adapter;
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2434 struct be_rx_page_info *page_info;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2435 struct sk_buff *skb = NULL;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2436 u16 remaining, curr_frag_len;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2437 u16 i, j;
3968fa1e5889618 drivers/net/benet/be_main.c Ajit Khaparde 2011-02-20 2438
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2439 skb = napi_get_frags(napi);
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2440 if (!skb) {
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2441 be_rx_compl_discard(rxo, rxcp);
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2442 return;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2443 }
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2444
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2445 remaining = rxcp->pkt_size;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2446 for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
0b0ef1d027008f0 drivers/net/ethernet/emulex/benet/be_main.c Suresh Reddy 2014-01-15 2447 page_info = get_rx_page_info(rxo);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2448
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2449 curr_frag_len = min(remaining, rx_frag_size);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2450
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2451 /* Coalesce all frags from the same physical page in one slot */
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2452 if (i == 0 || page_info->page_offset == 0) {
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2453 /* First frag or Fresh page */
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2454 j++;
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2455 skb_frag_fill_page_desc(&skb_shinfo(skb)->frags[j],
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2456 page_info->page,
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2457 page_info->page_offset,
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2458 curr_frag_len);
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2459 } else {
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2460 put_page(page_info->page);
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 @2461 skb_frag_size_add(&skb_shinfo(skb)->frags[j],
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2462 curr_frag_len);
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2463 }
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2464
bdb28a97f46b530 drivers/net/ethernet/emulex/benet/be_main.c Eric Dumazet 2011-10-13 2465 skb->truesize += rx_frag_size;
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2466 remaining -= curr_frag_len;
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2467 memset(page_info, 0, sizeof(*page_info));
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2468 }
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2469 BUG_ON(j > MAX_SKB_FRAGS);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2470
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2471 skb_shinfo(skb)->nr_frags = j + 1;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2472 skb->len = rxcp->pkt_size;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2473 skb->data_len = rxcp->pkt_size;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2474 skb->ip_summed = CHECKSUM_UNNECESSARY;
aaa6daec586cd39 drivers/net/ethernet/emulex/benet/be_main.c Somnath Kotur 2012-05-02 2475 skb_record_rx_queue(skb, rxo - &adapter->rx_obj[0]);
4b97291429bf59c drivers/net/benet/be_main.c Ajit Khaparde 2011-04-06 2476 if (adapter->netdev->features & NETIF_F_RXHASH)
d2464c8c547333e drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert 2013-12-17 2477 skb_set_hash(skb, rxcp->rss_hash, PKT_HASH_TYPE_L3);
c9c47142f6bf468 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2014-03-27 2478
b6c0e89dd3a1b22 drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert 2014-08-27 2479 skb->csum_level = rxcp->tunneled;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2480
343e43c02850a3a drivers/net/ethernet/emulex/benet/be_main.c Jiri Pirko 2011-08-25 2481 if (rxcp->vlanf)
86a9bad3ab6b6f8 drivers/net/ethernet/emulex/benet/be_main.c Patrick McHardy 2013-04-19 2482 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rxcp->vlan_tag);
4c5102f94c175d8 drivers/net/benet/be_main.c Ajit Khaparde 2011-07-12 2483
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2484 napi_gro_frags(napi);
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2485 }
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2486
:::::: The code at line 2461 was first introduced by commit
:::::: b51f4113ebb02011f0ca86abc3134b28d2071b6a net: introduce and use skb_frag_fill_page_desc()
:::::: TO: Yunsheng Lin <linyunsheng@huawei.com>
:::::: CC: David S. Miller <davem@davemloft.net>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-25 14:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-25 14:35 drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max kernel test robot
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.