Re: [PATCH net v2] net: fec: reject oversized fragments before bounce-buffer memcpy

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [Low] net: fec: build failure due to undefined label release
--

commit 07a88506b223c9e67d1b8c1a1dfa027140cd954a
Author: Aldo Ariel Panzardo <qwe.aldo@gmail.com>

net: fec: reject oversized fragments before bounce-buffer memcpy

This patch adds length checks before bounce-buffer copies in
fec_enet_txq_submit_frag_skb() and fec_enet_txq_submit_skb(). It aims to
prevent buffer overflows by jumping to the error path when the data exceeds
the bounce buffer capacity.

> diff --git a/drivers/net/ethernet/freescale/fec_main.c b/drivers/net/ethernet/freescale/fec_main.c
> index 794ec427b0ee6..861498448fe36 100644
> --- a/drivers/net/ethernet/freescale/fec_main.c
> +++ b/drivers/net/ethernet/freescale/fec_main.c
[ ... ]
> @@ -634,6 +636,8 @@ static int fec_enet_txq_submit_skb(struct fec_enet_priv_tx_q *txq,
>  	index = fec_enet_get_bd_index(bdp, &txq->bd);
>  	if (((unsigned long) bufaddr) & fep->tx_align ||
>  		fep->quirks & FEC_QUIRK_SWAP_FRAME) {
> +		if (buflen > FEC_ENET_TX_FRSIZE)
> +			goto release;

[Severity: Low]
Does the label 'release' exist in fec_enet_txq_submit_skb()? It looks like
this might cause a build failure due to an undefined label.

Additionally, if a release path is added, would we also need to ensure the
skb is freed (for example, via dev_kfree_skb_any) to avoid a memory leak?

>  		memcpy(txq->tx_bounce[index], skb->data, buflen);
>  		bufaddr = txq->tx_bounce[index];

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260923203738.1583735-1-qwe.aldo@gmail.com?part=1