From: kernel test robot <lkp@intel.com>
To: Ilya Krutskih <devsec@tpz.ru>, Andrew Lunn <andrew+netdev@lunn.ch>
Cc: oe-kbuild-all@lists.linux.dev, Ilya Krutskih <devsec@tpz.ru>,
Eric Dumazet <edumazet@google.com>,
Jakub Kicinski <kuba@kernel.org>, Paolo Abeni <pabeni@redhat.com>,
Thomas Gleixner <tglx@linutronix.de>,
Ingo Molnar <mingo@kernel.org>,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
lvc-project@linuxtesting.org, stable@vger.kernel.org
Subject: Re: [PATCH v2] net: fealnx: fix possible 'card_idx' integer overflow in
Date: Fri, 12 Dec 2025 19:30:04 +0800 [thread overview]
Message-ID: <202512121907.n3Bzh2zF-lkp@intel.com> (raw)
In-Reply-To: <20251211173035.852756-1-devsec@tpz.ru>
Hi Ilya,
kernel test robot noticed the following build warnings:
[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v6.18 next-20251212]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Ilya-Krutskih/net-fealnx-fix-possible-card_idx-integer-overflow-in/20251212-013335
base: net-next/main
patch link: https://lore.kernel.org/r/20251211173035.852756-1-devsec%40tpz.ru
patch subject: [PATCH v2] net: fealnx: fix possible 'card_idx' integer overflow in
config: alpha-allyesconfig (https://download.01.org/0day-ci/archive/20251212/202512121907.n3Bzh2zF-lkp@intel.com/config)
compiler: alpha-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20251212/202512121907.n3Bzh2zF-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202512121907.n3Bzh2zF-lkp@intel.com/
All warnings (new ones prefixed by >>):
drivers/net/ethernet/fealnx.c: In function 'fealnx_init_one':
>> drivers/net/ethernet/fealnx.c:496:35: warning: '%d' directive writing between 1 and 11 bytes into a region of size 6 [-Wformat-overflow=]
496 | sprintf(boardname, "fealnx%d", card_idx);
| ^~
drivers/net/ethernet/fealnx.c:496:28: note: directive argument in the range [-2147483647, 2147483647]
496 | sprintf(boardname, "fealnx%d", card_idx);
| ^~~~~~~~~~
drivers/net/ethernet/fealnx.c:496:9: note: 'sprintf' output between 8 and 18 bytes into a destination of size 12
496 | sprintf(boardname, "fealnx%d", card_idx);
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
vim +496 drivers/net/ethernet/fealnx.c
8f14820801042c Jakub Kicinski 2023-03-07 491
8626fa3323cd34 Ilya Krutskih 2025-12-11 492 if (card_idx == INT_MAX)
8626fa3323cd34 Ilya Krutskih 2025-12-11 493 return -EINVAL;
8626fa3323cd34 Ilya Krutskih 2025-12-11 494 else
8f14820801042c Jakub Kicinski 2023-03-07 495 card_idx++;
8f14820801042c Jakub Kicinski 2023-03-07 @496 sprintf(boardname, "fealnx%d", card_idx);
8f14820801042c Jakub Kicinski 2023-03-07 497
8f14820801042c Jakub Kicinski 2023-03-07 498 option = card_idx < MAX_UNITS ? options[card_idx] : 0;
8f14820801042c Jakub Kicinski 2023-03-07 499
8f14820801042c Jakub Kicinski 2023-03-07 500 i = pci_enable_device(pdev);
8f14820801042c Jakub Kicinski 2023-03-07 501 if (i) return i;
8f14820801042c Jakub Kicinski 2023-03-07 502 pci_set_master(pdev);
8f14820801042c Jakub Kicinski 2023-03-07 503
8f14820801042c Jakub Kicinski 2023-03-07 504 len = pci_resource_len(pdev, bar);
8f14820801042c Jakub Kicinski 2023-03-07 505 if (len < MIN_REGION_SIZE) {
8f14820801042c Jakub Kicinski 2023-03-07 506 dev_err(&pdev->dev,
8f14820801042c Jakub Kicinski 2023-03-07 507 "region size %ld too small, aborting\n", len);
8f14820801042c Jakub Kicinski 2023-03-07 508 return -ENODEV;
8f14820801042c Jakub Kicinski 2023-03-07 509 }
8f14820801042c Jakub Kicinski 2023-03-07 510
8f14820801042c Jakub Kicinski 2023-03-07 511 i = pci_request_regions(pdev, boardname);
8f14820801042c Jakub Kicinski 2023-03-07 512 if (i)
8f14820801042c Jakub Kicinski 2023-03-07 513 return i;
8f14820801042c Jakub Kicinski 2023-03-07 514
8f14820801042c Jakub Kicinski 2023-03-07 515 irq = pdev->irq;
8f14820801042c Jakub Kicinski 2023-03-07 516
8f14820801042c Jakub Kicinski 2023-03-07 517 ioaddr = pci_iomap(pdev, bar, len);
8f14820801042c Jakub Kicinski 2023-03-07 518 if (!ioaddr) {
8f14820801042c Jakub Kicinski 2023-03-07 519 err = -ENOMEM;
8f14820801042c Jakub Kicinski 2023-03-07 520 goto err_out_res;
8f14820801042c Jakub Kicinski 2023-03-07 521 }
8f14820801042c Jakub Kicinski 2023-03-07 522
8f14820801042c Jakub Kicinski 2023-03-07 523 dev = alloc_etherdev(sizeof(struct netdev_private));
8f14820801042c Jakub Kicinski 2023-03-07 524 if (!dev) {
8f14820801042c Jakub Kicinski 2023-03-07 525 err = -ENOMEM;
8f14820801042c Jakub Kicinski 2023-03-07 526 goto err_out_unmap;
8f14820801042c Jakub Kicinski 2023-03-07 527 }
8f14820801042c Jakub Kicinski 2023-03-07 528 SET_NETDEV_DEV(dev, &pdev->dev);
8f14820801042c Jakub Kicinski 2023-03-07 529
8f14820801042c Jakub Kicinski 2023-03-07 530 /* read ethernet id */
8f14820801042c Jakub Kicinski 2023-03-07 531 for (i = 0; i < 6; ++i)
8f14820801042c Jakub Kicinski 2023-03-07 532 addr[i] = ioread8(ioaddr + PAR0 + i);
8f14820801042c Jakub Kicinski 2023-03-07 533 eth_hw_addr_set(dev, addr);
8f14820801042c Jakub Kicinski 2023-03-07 534
8f14820801042c Jakub Kicinski 2023-03-07 535 /* Reset the chip to erase previous misconfiguration. */
8f14820801042c Jakub Kicinski 2023-03-07 536 iowrite32(0x00000001, ioaddr + BCR);
8f14820801042c Jakub Kicinski 2023-03-07 537
8f14820801042c Jakub Kicinski 2023-03-07 538 /* Make certain the descriptor lists are aligned. */
8f14820801042c Jakub Kicinski 2023-03-07 539 np = netdev_priv(dev);
8f14820801042c Jakub Kicinski 2023-03-07 540 np->mem = ioaddr;
8f14820801042c Jakub Kicinski 2023-03-07 541 spin_lock_init(&np->lock);
8f14820801042c Jakub Kicinski 2023-03-07 542 np->pci_dev = pdev;
8f14820801042c Jakub Kicinski 2023-03-07 543 np->flags = skel_netdrv_tbl[chip_id].flags;
8f14820801042c Jakub Kicinski 2023-03-07 544 pci_set_drvdata(pdev, dev);
8f14820801042c Jakub Kicinski 2023-03-07 545 np->mii.dev = dev;
8f14820801042c Jakub Kicinski 2023-03-07 546 np->mii.mdio_read = mdio_read;
8f14820801042c Jakub Kicinski 2023-03-07 547 np->mii.mdio_write = mdio_write;
8f14820801042c Jakub Kicinski 2023-03-07 548 np->mii.phy_id_mask = 0x1f;
8f14820801042c Jakub Kicinski 2023-03-07 549 np->mii.reg_num_mask = 0x1f;
8f14820801042c Jakub Kicinski 2023-03-07 550
8f14820801042c Jakub Kicinski 2023-03-07 551 ring_space = dma_alloc_coherent(&pdev->dev, RX_TOTAL_SIZE, &ring_dma,
8f14820801042c Jakub Kicinski 2023-03-07 552 GFP_KERNEL);
8f14820801042c Jakub Kicinski 2023-03-07 553 if (!ring_space) {
8f14820801042c Jakub Kicinski 2023-03-07 554 err = -ENOMEM;
8f14820801042c Jakub Kicinski 2023-03-07 555 goto err_out_free_dev;
8f14820801042c Jakub Kicinski 2023-03-07 556 }
8f14820801042c Jakub Kicinski 2023-03-07 557 np->rx_ring = ring_space;
8f14820801042c Jakub Kicinski 2023-03-07 558 np->rx_ring_dma = ring_dma;
8f14820801042c Jakub Kicinski 2023-03-07 559
8f14820801042c Jakub Kicinski 2023-03-07 560 ring_space = dma_alloc_coherent(&pdev->dev, TX_TOTAL_SIZE, &ring_dma,
8f14820801042c Jakub Kicinski 2023-03-07 561 GFP_KERNEL);
8f14820801042c Jakub Kicinski 2023-03-07 562 if (!ring_space) {
8f14820801042c Jakub Kicinski 2023-03-07 563 err = -ENOMEM;
8f14820801042c Jakub Kicinski 2023-03-07 564 goto err_out_free_rx;
8f14820801042c Jakub Kicinski 2023-03-07 565 }
8f14820801042c Jakub Kicinski 2023-03-07 566 np->tx_ring = ring_space;
8f14820801042c Jakub Kicinski 2023-03-07 567 np->tx_ring_dma = ring_dma;
8f14820801042c Jakub Kicinski 2023-03-07 568
8f14820801042c Jakub Kicinski 2023-03-07 569 /* find the connected MII xcvrs */
8f14820801042c Jakub Kicinski 2023-03-07 570 if (np->flags == HAS_MII_XCVR) {
8f14820801042c Jakub Kicinski 2023-03-07 571 int phy, phy_idx = 0;
8f14820801042c Jakub Kicinski 2023-03-07 572
8f14820801042c Jakub Kicinski 2023-03-07 573 for (phy = 1; phy < 32 && phy_idx < ARRAY_SIZE(np->phys);
8f14820801042c Jakub Kicinski 2023-03-07 574 phy++) {
8f14820801042c Jakub Kicinski 2023-03-07 575 int mii_status = mdio_read(dev, phy, 1);
8f14820801042c Jakub Kicinski 2023-03-07 576
8f14820801042c Jakub Kicinski 2023-03-07 577 if (mii_status != 0xffff && mii_status != 0x0000) {
8f14820801042c Jakub Kicinski 2023-03-07 578 np->phys[phy_idx++] = phy;
8f14820801042c Jakub Kicinski 2023-03-07 579 dev_info(&pdev->dev,
8f14820801042c Jakub Kicinski 2023-03-07 580 "MII PHY found at address %d, status "
8f14820801042c Jakub Kicinski 2023-03-07 581 "0x%4.4x.\n", phy, mii_status);
8f14820801042c Jakub Kicinski 2023-03-07 582 /* get phy type */
8f14820801042c Jakub Kicinski 2023-03-07 583 {
8f14820801042c Jakub Kicinski 2023-03-07 584 unsigned int data;
8f14820801042c Jakub Kicinski 2023-03-07 585
8f14820801042c Jakub Kicinski 2023-03-07 586 data = mdio_read(dev, np->phys[0], 2);
8f14820801042c Jakub Kicinski 2023-03-07 587 if (data == SeeqPHYID0)
8f14820801042c Jakub Kicinski 2023-03-07 588 np->PHYType = SeeqPHY;
8f14820801042c Jakub Kicinski 2023-03-07 589 else if (data == AhdocPHYID0)
8f14820801042c Jakub Kicinski 2023-03-07 590 np->PHYType = AhdocPHY;
8f14820801042c Jakub Kicinski 2023-03-07 591 else if (data == MarvellPHYID0)
8f14820801042c Jakub Kicinski 2023-03-07 592 np->PHYType = MarvellPHY;
8f14820801042c Jakub Kicinski 2023-03-07 593 else if (data == MysonPHYID0)
8f14820801042c Jakub Kicinski 2023-03-07 594 np->PHYType = Myson981;
8f14820801042c Jakub Kicinski 2023-03-07 595 else if (data == LevelOnePHYID0)
8f14820801042c Jakub Kicinski 2023-03-07 596 np->PHYType = LevelOnePHY;
8f14820801042c Jakub Kicinski 2023-03-07 597 else
8f14820801042c Jakub Kicinski 2023-03-07 598 np->PHYType = OtherPHY;
8f14820801042c Jakub Kicinski 2023-03-07 599 }
8f14820801042c Jakub Kicinski 2023-03-07 600 }
8f14820801042c Jakub Kicinski 2023-03-07 601 }
8f14820801042c Jakub Kicinski 2023-03-07 602
8f14820801042c Jakub Kicinski 2023-03-07 603 np->mii_cnt = phy_idx;
8f14820801042c Jakub Kicinski 2023-03-07 604 if (phy_idx == 0)
8f14820801042c Jakub Kicinski 2023-03-07 605 dev_warn(&pdev->dev,
8f14820801042c Jakub Kicinski 2023-03-07 606 "MII PHY not found -- this device may "
8f14820801042c Jakub Kicinski 2023-03-07 607 "not operate correctly.\n");
8f14820801042c Jakub Kicinski 2023-03-07 608 } else {
8f14820801042c Jakub Kicinski 2023-03-07 609 np->phys[0] = 32;
8f14820801042c Jakub Kicinski 2023-03-07 610 /* 89/6/23 add, (begin) */
8f14820801042c Jakub Kicinski 2023-03-07 611 /* get phy type */
8f14820801042c Jakub Kicinski 2023-03-07 612 if (ioread32(ioaddr + PHYIDENTIFIER) == MysonPHYID)
8f14820801042c Jakub Kicinski 2023-03-07 613 np->PHYType = MysonPHY;
8f14820801042c Jakub Kicinski 2023-03-07 614 else
8f14820801042c Jakub Kicinski 2023-03-07 615 np->PHYType = OtherPHY;
8f14820801042c Jakub Kicinski 2023-03-07 616 }
8f14820801042c Jakub Kicinski 2023-03-07 617 np->mii.phy_id = np->phys[0];
8f14820801042c Jakub Kicinski 2023-03-07 618
8f14820801042c Jakub Kicinski 2023-03-07 619 if (dev->mem_start)
8f14820801042c Jakub Kicinski 2023-03-07 620 option = dev->mem_start;
8f14820801042c Jakub Kicinski 2023-03-07 621
8f14820801042c Jakub Kicinski 2023-03-07 622 /* The lower four bits are the media type. */
8f14820801042c Jakub Kicinski 2023-03-07 623 if (option > 0) {
8f14820801042c Jakub Kicinski 2023-03-07 624 if (option & 0x200)
8f14820801042c Jakub Kicinski 2023-03-07 625 np->mii.full_duplex = 1;
8f14820801042c Jakub Kicinski 2023-03-07 626 np->default_port = option & 15;
8f14820801042c Jakub Kicinski 2023-03-07 627 }
8f14820801042c Jakub Kicinski 2023-03-07 628
8f14820801042c Jakub Kicinski 2023-03-07 629 if (card_idx < MAX_UNITS && full_duplex[card_idx] > 0)
8f14820801042c Jakub Kicinski 2023-03-07 630 np->mii.full_duplex = full_duplex[card_idx];
8f14820801042c Jakub Kicinski 2023-03-07 631
8f14820801042c Jakub Kicinski 2023-03-07 632 if (np->mii.full_duplex) {
8f14820801042c Jakub Kicinski 2023-03-07 633 dev_info(&pdev->dev, "Media type forced to Full Duplex.\n");
8f14820801042c Jakub Kicinski 2023-03-07 634 /* 89/6/13 add, (begin) */
8f14820801042c Jakub Kicinski 2023-03-07 635 // if (np->PHYType==MarvellPHY)
8f14820801042c Jakub Kicinski 2023-03-07 636 if ((np->PHYType == MarvellPHY) || (np->PHYType == LevelOnePHY)) {
8f14820801042c Jakub Kicinski 2023-03-07 637 unsigned int data;
8f14820801042c Jakub Kicinski 2023-03-07 638
8f14820801042c Jakub Kicinski 2023-03-07 639 data = mdio_read(dev, np->phys[0], 9);
8f14820801042c Jakub Kicinski 2023-03-07 640 data = (data & 0xfcff) | 0x0200;
8f14820801042c Jakub Kicinski 2023-03-07 641 mdio_write(dev, np->phys[0], 9, data);
8f14820801042c Jakub Kicinski 2023-03-07 642 }
8f14820801042c Jakub Kicinski 2023-03-07 643 /* 89/6/13 add, (end) */
8f14820801042c Jakub Kicinski 2023-03-07 644 if (np->flags == HAS_MII_XCVR)
8f14820801042c Jakub Kicinski 2023-03-07 645 mdio_write(dev, np->phys[0], MII_ADVERTISE, ADVERTISE_FULL);
8f14820801042c Jakub Kicinski 2023-03-07 646 else
8f14820801042c Jakub Kicinski 2023-03-07 647 iowrite32(ADVERTISE_FULL, ioaddr + ANARANLPAR);
8f14820801042c Jakub Kicinski 2023-03-07 648 np->mii.force_media = 1;
8f14820801042c Jakub Kicinski 2023-03-07 649 }
8f14820801042c Jakub Kicinski 2023-03-07 650
8f14820801042c Jakub Kicinski 2023-03-07 651 dev->netdev_ops = &netdev_ops;
8f14820801042c Jakub Kicinski 2023-03-07 652 dev->ethtool_ops = &netdev_ethtool_ops;
8f14820801042c Jakub Kicinski 2023-03-07 653 dev->watchdog_timeo = TX_TIMEOUT;
8f14820801042c Jakub Kicinski 2023-03-07 654
8f14820801042c Jakub Kicinski 2023-03-07 655 err = register_netdev(dev);
8f14820801042c Jakub Kicinski 2023-03-07 656 if (err)
8f14820801042c Jakub Kicinski 2023-03-07 657 goto err_out_free_tx;
8f14820801042c Jakub Kicinski 2023-03-07 658
8f14820801042c Jakub Kicinski 2023-03-07 659 printk(KERN_INFO "%s: %s at %p, %pM, IRQ %d.\n",
8f14820801042c Jakub Kicinski 2023-03-07 660 dev->name, skel_netdrv_tbl[chip_id].chip_name, ioaddr,
8f14820801042c Jakub Kicinski 2023-03-07 661 dev->dev_addr, irq);
8f14820801042c Jakub Kicinski 2023-03-07 662
8f14820801042c Jakub Kicinski 2023-03-07 663 return 0;
8f14820801042c Jakub Kicinski 2023-03-07 664
8f14820801042c Jakub Kicinski 2023-03-07 665 err_out_free_tx:
8f14820801042c Jakub Kicinski 2023-03-07 666 dma_free_coherent(&pdev->dev, TX_TOTAL_SIZE, np->tx_ring,
8f14820801042c Jakub Kicinski 2023-03-07 667 np->tx_ring_dma);
8f14820801042c Jakub Kicinski 2023-03-07 668 err_out_free_rx:
8f14820801042c Jakub Kicinski 2023-03-07 669 dma_free_coherent(&pdev->dev, RX_TOTAL_SIZE, np->rx_ring,
8f14820801042c Jakub Kicinski 2023-03-07 670 np->rx_ring_dma);
8f14820801042c Jakub Kicinski 2023-03-07 671 err_out_free_dev:
8f14820801042c Jakub Kicinski 2023-03-07 672 free_netdev(dev);
8f14820801042c Jakub Kicinski 2023-03-07 673 err_out_unmap:
8f14820801042c Jakub Kicinski 2023-03-07 674 pci_iounmap(pdev, ioaddr);
8f14820801042c Jakub Kicinski 2023-03-07 675 err_out_res:
8f14820801042c Jakub Kicinski 2023-03-07 676 pci_release_regions(pdev);
8f14820801042c Jakub Kicinski 2023-03-07 677 return err;
8f14820801042c Jakub Kicinski 2023-03-07 678 }
8f14820801042c Jakub Kicinski 2023-03-07 679
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
next prev parent reply other threads:[~2025-12-12 11:30 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-11 17:30 [PATCH v2] net: fealnx: fix possible 'card_idx' integer overflow in Ilya Krutskih
2025-12-12 9:45 ` Simon Horman
2025-12-12 11:30 ` kernel test robot [this message]
2025-12-12 14:46 ` Simon Horman
2025-12-12 17:36 ` David Laight
2025-12-13 0:21 ` Francois Romieu
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=202512121907.n3Bzh2zF-lkp@intel.com \
--to=lkp@intel.com \
--cc=andrew+netdev@lunn.ch \
--cc=devsec@tpz.ru \
--cc=edumazet@google.com \
--cc=kuba@kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=lvc-project@linuxtesting.org \
--cc=mingo@kernel.org \
--cc=netdev@vger.kernel.org \
--cc=oe-kbuild-all@lists.linux.dev \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
--cc=tglx@linutronix.de \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).