Re: [PATCH net] xsk: avoid data corruption on cq descriptor number

[kernel test robot <lkp@intel.com>]

Hi Fernando,

kernel test robot noticed the following build warnings:

[auto build test WARNING on net/main]

url:    https://github.com/intel-lab-lkp/linux/commits/Fernando-Fernandez-Mancera/xsk-avoid-data-corruption-on-cq-descriptor-number/20251021-231144
base:   net/main
patch link:    https://lore.kernel.org/r/20251021150656.6704-1-fmancera%40suse.de
patch subject: [PATCH net] xsk: avoid data corruption on cq descriptor number
config: x86_64-buildonly-randconfig-001-20251022 (https://download.01.org/0day-ci/archive/20251022/202510221337.KR7g9eX0-lkp@intel.com/config)
compiler: clang version 20.1.8 (https://github.com/llvm/llvm-project 87f0227cb60147a26a1eeb4fb06e3b505e9c7261)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251022/202510221337.KR7g9eX0-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202510221337.KR7g9eX0-lkp@intel.com/

All warnings (new ones prefixed by >>):

>> net/xdp/xsk.c:815:17: warning: variable 'page' is uninitialized when used here [-Wuninitialized]
     815 |                                 __free_page(page);
         |                                             ^~~~
   include/linux/gfp.h:385:41: note: expanded from macro '__free_page'
     385 | #define __free_page(page) __free_pages((page), 0)
         |                                         ^~~~
   net/xdp/xsk.c:780:19: note: initialize the variable 'page' to silence this warning
     780 |         struct page *page;
         |                          ^
         |                           = NULL
   1 warning generated.


vim +/page +815 net/xdp/xsk.c

   774	
   775	static struct sk_buff *xsk_build_skb(struct xdp_sock *xs,
   776					     struct xdp_desc *desc)
   777	{
   778		struct net_device *dev = xs->dev;
   779		struct sk_buff *skb = xs->skb;
   780		struct page *page;
   781		int err;
   782	
   783		if (dev->priv_flags & IFF_TX_SKB_NO_LINEAR) {
   784			skb = xsk_build_skb_zerocopy(xs, desc);
   785			if (IS_ERR(skb)) {
   786				err = PTR_ERR(skb);
   787				skb = NULL;
   788				goto free_err;
   789			}
   790		} else {
   791			u32 hr, tr, len;
   792			void *buffer;
   793	
   794			buffer = xsk_buff_raw_get_data(xs->pool, desc->addr);
   795			len = desc->len;
   796	
   797			if (!skb) {
   798				struct xsk_addr_node *head_addr;
   799	
   800				hr = max(NET_SKB_PAD, L1_CACHE_ALIGN(dev->needed_headroom));
   801				tr = dev->needed_tailroom;
   802				skb = sock_alloc_send_skb(&xs->sk, hr + len + tr, 1, &err);
   803				if (unlikely(!skb))
   804					goto free_err;
   805	
   806				skb_reserve(skb, hr);
   807				skb_put(skb, len);
   808	
   809				err = skb_store_bits(skb, 0, buffer, len);
   810				if (unlikely(err))
   811					goto free_err;
   812	
   813				head_addr = kmem_cache_zalloc(xsk_tx_generic_cache, GFP_KERNEL);
   814				if (!head_addr) {
 > 815					__free_page(page);
   816					err = -ENOMEM;
   817					goto free_err;
   818				}
   819				xsk_skb_init_misc(skb, xs, head_addr, desc->addr);
   820				if (desc->options & XDP_TX_METADATA) {
   821					err = xsk_skb_metadata(skb, buffer, desc,
   822							       xs->pool, hr);
   823					if (unlikely(err))
   824						goto free_err;
   825				}
   826			} else {
   827				int nr_frags = skb_shinfo(skb)->nr_frags;
   828				struct xsk_addr_node *xsk_addr;
   829				u8 *vaddr;
   830	
   831				if (unlikely(nr_frags == (MAX_SKB_FRAGS - 1) && xp_mb_desc(desc))) {
   832					err = -EOVERFLOW;
   833					goto free_err;
   834				}
   835	
   836				page = alloc_page(xs->sk.sk_allocation);
   837				if (unlikely(!page)) {
   838					err = -EAGAIN;
   839					goto free_err;
   840				}
   841	
   842				xsk_addr = kmem_cache_zalloc(xsk_tx_generic_cache, GFP_KERNEL);
   843				if (!xsk_addr) {
   844					__free_page(page);
   845					err = -ENOMEM;
   846					goto free_err;
   847				}
   848	
   849				vaddr = kmap_local_page(page);
   850				memcpy(vaddr, buffer, len);
   851				kunmap_local(vaddr);
   852	
   853				skb_add_rx_frag(skb, nr_frags, page, 0, len, PAGE_SIZE);
   854				refcount_add(PAGE_SIZE, &xs->sk.sk_wmem_alloc);
   855	
   856				xsk_addr->addr = desc->addr;
   857				list_add_tail(&xsk_addr->addr_node, &XSK_TX_HEAD(skb)->addr_node);
   858			}
   859		}
   860	
   861		xsk_inc_num_desc(skb);
   862	
   863		return skb;
   864	
   865	free_err:
   866		if (skb && !skb_shinfo(skb)->nr_frags)
   867			kfree_skb(skb);
   868	
   869		if (err == -EOVERFLOW) {
   870			/* Drop the packet */
   871			xsk_inc_num_desc(xs->skb);
   872			xsk_drop_skb(xs->skb);
   873			xskq_cons_release(xs->tx);
   874		} else {
   875			/* Let application retry */
   876			xsk_cq_cancel_locked(xs->pool, 1);
   877		}
   878	
   879		return ERR_PTR(err);
   880	}
   881	

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki