Re: [PATCH] net: fec: reject oversized fragments before bounce-buffer memcpy

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] net: fec: undefined label 'release' causes build failure
--

commit 6a879b984d90eaab6d6db0210d5b4b63b7aaceff
Author: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

net: fec: reject oversized fragments before bounce-buffer memcpy

This commit adds bounds checks before copying transmit data into the per-ring
bounce buffer to prevent memory corruption when fragment sizes exceed the
buffer capacity.

> diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
> index 794ec427b0ee6..861498448fe36 100644
> --- a/drivers/net/ethernet/freescale/fec_main.c
> +++ b/drivers/net/ethernet/freescale/fec_main.c
[ ... ]
> @@ -634,6 +636,8 @@ static int fec_enet_txq_submit_skb(struct fec_enet_priv_tx_q *txq,
>  	index = fec_enet_get_bd_index(bdp, &txq->bd);
>  	if (((unsigned long) bufaddr) & fep->tx_align ||
>  		fep->quirks & FEC_QUIRK_SWAP_FRAME) {
> +		if (buflen > FEC_ENET_TX_FRSIZE)
> +			goto release;

[Severity: Low]
Does this code introduce a build failure? The label release appears to be
undefined in fec_enet_txq_submit_skb(), which causes compilation to fail
with an undefined label error.

>  		memcpy(txq->tx_bounce[index], skb->data, buflen);
>  		bufaddr = txq->tx_bounce[index];
>

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923141154.2415545-1-qwe.aldo@gmail.com?part=1