* drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max
@ 2026-07-25 14:35 kernel test robot
0 siblings, 0 replies; only message in thread
From: kernel test robot @ 2026-07-25 14:35 UTC (permalink / raw)
To: oe-kbuild; +Cc: lkp, Dan Carpenter
BCC: lkp@intel.com
CC: oe-kbuild-all@lists.linux.dev
CC: linux-kernel@vger.kernel.org
TO: "Thomas Weißschuh" <thomas.weissschuh@linutronix.de>
CC: Shuah Khan <skhan@linuxfoundation.org>
CC: Johannes Berg <johannes@sipsolutions.net>
CC: David Gow <davidgow@google.com>
Hi Thomas,
First bad commit (maybe != root cause):
tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head: 48a5a7ab8d6ab7090564339e039c421f315de912
commit: 031cdd3bc3f369553933c1b0f4cb18000162c8ff kunit: Enable PCI on UML without triggering WARN()
date: 10 months ago
:::::: branch date: 2 days ago
:::::: commit date: 10 months ago
config: um-randconfig-r073-20260725 (https://download.01.org/0day-ci/archive/20260725/202607252243.pfaeplGg-lkp@intel.com/config)
compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 6009708b4367171ccdbf4b5905cb6a803753fe18)
smatch: v0.5.0-9187-g5189e3fb
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Fixes: 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()")
| Reported-by: kernel test robot <lkp@intel.com>
| Reported-by: Dan Carpenter <error27@gmail.com>
| Closes: https://lore.kernel.org/r/202607252243.pfaeplGg-lkp@intel.com/
smatch warnings:
drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max
drivers/gpu/drm/nouveau/nouveau_backlight.c:349 nouveau_backlight_init() warn: missing error code 'ret'
vim +2461 drivers/net/ethernet/emulex/benet/be_main.c
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2427
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2428 /* Process the RX completion indicated by rxcp when GRO is enabled */
4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han 2013-08-05 2429 static void be_rx_compl_process_gro(struct be_rx_obj *rxo,
4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han 2013-08-05 2430 struct napi_struct *napi,
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2431 struct be_rx_compl_info *rxcp)
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2432 {
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2433 struct be_adapter *adapter = rxo->adapter;
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2434 struct be_rx_page_info *page_info;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2435 struct sk_buff *skb = NULL;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2436 u16 remaining, curr_frag_len;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2437 u16 i, j;
3968fa1e5889618 drivers/net/benet/be_main.c Ajit Khaparde 2011-02-20 2438
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2439 skb = napi_get_frags(napi);
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2440 if (!skb) {
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2441 be_rx_compl_discard(rxo, rxcp);
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2442 return;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2443 }
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2444
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2445 remaining = rxcp->pkt_size;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2446 for (i = 0, j = -1; i < rxcp->num_rcvd; i++) {
0b0ef1d027008f0 drivers/net/ethernet/emulex/benet/be_main.c Suresh Reddy 2014-01-15 2447 page_info = get_rx_page_info(rxo);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2448
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2449 curr_frag_len = min(remaining, rx_frag_size);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2450
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2451 /* Coalesce all frags from the same physical page in one slot */
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2452 if (i == 0 || page_info->page_offset == 0) {
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2453 /* First frag or Fresh page */
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2454 j++;
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2455 skb_frag_fill_page_desc(&skb_shinfo(skb)->frags[j],
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2456 page_info->page,
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2457 page_info->page_offset,
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2458 curr_frag_len);
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2459 } else {
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2460 put_page(page_info->page);
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 @2461 skb_frag_size_add(&skb_shinfo(skb)->frags[j],
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2462 curr_frag_len);
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2463 }
b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin 2023-05-11 2464
bdb28a97f46b530 drivers/net/ethernet/emulex/benet/be_main.c Eric Dumazet 2011-10-13 2465 skb->truesize += rx_frag_size;
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2466 remaining -= curr_frag_len;
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2467 memset(page_info, 0, sizeof(*page_info));
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2468 }
bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde 2009-06-26 2469 BUG_ON(j > MAX_SKB_FRAGS);
6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla 2009-03-11 2470
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2471 skb_shinfo(skb)->nr_frags = j + 1;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2472 skb->len = rxcp->pkt_size;
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2473 skb->data_len = rxcp->pkt_size;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2474 skb->ip_summed = CHECKSUM_UNNECESSARY;
aaa6daec586cd39 drivers/net/ethernet/emulex/benet/be_main.c Somnath Kotur 2012-05-02 2475 skb_record_rx_queue(skb, rxo - &adapter->rx_obj[0]);
4b97291429bf59c drivers/net/benet/be_main.c Ajit Khaparde 2011-04-06 2476 if (adapter->netdev->features & NETIF_F_RXHASH)
d2464c8c547333e drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert 2013-12-17 2477 skb_set_hash(skb, rxcp->rss_hash, PKT_HASH_TYPE_L3);
c9c47142f6bf468 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2014-03-27 2478
b6c0e89dd3a1b22 drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert 2014-08-27 2479 skb->csum_level = rxcp->tunneled;
5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde 2009-07-21 2480
343e43c02850a3a drivers/net/ethernet/emulex/benet/be_main.c Jiri Pirko 2011-08-25 2481 if (rxcp->vlanf)
86a9bad3ab6b6f8 drivers/net/ethernet/emulex/benet/be_main.c Patrick McHardy 2013-04-19 2482 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rxcp->vlan_tag);
4c5102f94c175d8 drivers/net/benet/be_main.c Ajit Khaparde 2011-07-12 2483
10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla 2012-02-09 2484 napi_gro_frags(napi);
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2485 }
2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla 2011-03-11 2486
:::::: The code at line 2461 was first introduced by commit
:::::: b51f4113ebb02011f0ca86abc3134b28d2071b6a net: introduce and use skb_frag_fill_page_desc()
:::::: TO: Yunsheng Lin <linyunsheng@huawei.com>
:::::: CC: David S. Miller <davem@davemloft.net>
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2026-07-25 14:36 UTC | newest]
Thread overview: (only message) (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2026-07-25 14:35 drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).