From: Dan Carpenter <dan.carpenter@oracle.com>
To: kernel-janitors@vger.kernel.org
Subject: [bug report] [ETH]: Make eth_type_trans set skb->dev like the other *_type_trans
Date: Wed, 02 May 2018 12:41:39 +0000 [thread overview]
Message-ID: <20180502124139.GA24433@mwanda> (raw)
Hi Santosh. This one is very old...
The patch 4c13eb6657fe: "[ETH]: Make eth_type_trans set skb->dev like
the other *_type_trans" from Apr 25, 2007, leads to the following
static checker warning:
drivers/net/ethernet/chelsio/cxgb3/sge.c:2087 rx_eth()
error: buffer overflow 'adap->port' 2 <= 15 user_rl='0-15'
drivers/net/ethernet/chelsio/cxgb3/sge.c
2068 /**
2069 * rx_eth - process an ingress ethernet packet
2070 * @adap: the adapter
2071 * @rq: the response queue that received the packet
2072 * @skb: the packet
2073 * @pad: amount of padding at the start of the buffer
2074 *
2075 * Process an ingress ethernet pakcet and deliver it to the stack.
2076 * The padding is 2 if the packet was delivered in an Rx buffer and 0
2077 * if it was immediate data in a response.
2078 */
2079 static void rx_eth(struct adapter *adap, struct sge_rspq *rq,
2080 struct sk_buff *skb, int pad, int lro)
2081 {
2082 struct cpl_rx_pkt *p = (struct cpl_rx_pkt *)(skb->data + pad);
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
Smatch always distruts skb->data.
2083 struct sge_qset *qs = rspq_to_qset(rq);
2084 struct port_info *pi;
2085
2086 skb_pull(skb, sizeof(*p) + pad);
2087 skb->protocol = eth_type_trans(skb, adap->port[p->iff]);
^^^^^^
How do we know this doesn't is within bounds?
2088 pi = netdev_priv(skb->dev);
2089 if ((skb->dev->features & NETIF_F_RXCSUM) && p->csum_valid &&
2090 p->csum = htons(0xffff) && !p->fragment) {
2091 qs->port_stats[SGE_PSTAT_RX_CSUM_GOOD]++;
2092 skb->ip_summed = CHECKSUM_UNNECESSARY;
2093 } else
2094 skb_checksum_none_assert(skb);
2095 skb_record_rx_queue(skb, qs - &adap->sge.qs[pi->first_qset]);
2096
2097 if (p->vlan_valid) {
2098 qs->port_stats[SGE_PSTAT_VLANEX]++;
2099 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), ntohs(p->vlan));
2100 }
regards,
dan carpenter
reply other threads:[~2018-05-02 12:41 UTC|newest]
Thread overview: [no followups] expand[flat|nested] mbox.gz Atom feed
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20180502124139.GA24433@mwanda \
--to=dan.carpenter@oracle.com \
--cc=kernel-janitors@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox