drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <= u16max
kernel test robot <[email protected]> Sat, 25 Jul 2026 22:35:43 +0800
| Newsgroups | dev.linux.lists.oe-kbuild |
|---|---|
| Message-ID | <[email protected]> |
BCC: [email protected] CC: [email protected] CC: [email protected] TO: "Thomas Wei=C3=9Fschuh" <[email protected]> CC: Shuah Khan <[email protected]> CC: Johannes Berg <[email protected]> CC: David Gow <[email protected]> Hi Thomas, First bad commit (maybe !=3D root cause): tree: https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git = master head: 48a5a7ab8d6ab7090564339e039c421f315de912 commit: 031cdd3bc3f369553933c1b0f4cb18000162c8ff kunit: Enable PCI on UML w= ithout triggering WARN() date: 10 months ago :::::: branch date: 2 days ago :::::: commit date: 10 months ago config: um-randconfig-r073-20260725 (https://download.01.org/0day-ci/archiv= e/20260725/[email protected]/config) compiler: clang version 17.0.6 (https://github.com/llvm/llvm-project 600970= 8b4367171ccdbf4b5905cb6a803753fe18) smatch: v0.5.0-9187-g5189e3fb If you fix the issue in a separate patch/commit (i.e. not just a new versio= n of the same patch/commit), kindly add following tags | Fixes: 031cdd3bc3f3 ("kunit: Enable PCI on UML without triggering WARN()") | Reported-by: kernel test robot <[email protected]> | Reported-by: Dan Carpenter <[email protected]> | Closes: https://lore.kernel.org/r/[email protected]/ smatch warnings: drivers/net/ethernet/emulex/benet/be_main.c:2461 be_rx_compl_process_gro() = error: buffer overflow '((skb_end_pointer(skb)))->frags' 17 <=3D u16max drivers/gpu/drm/nouveau/nouveau_backlight.c:349 nouveau_backlight_init() wa= rn: missing error code 'ret' vim +2461 drivers/net/ethernet/emulex/benet/be_main.c 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2427 =20 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2428 /* Process the RX completion indicated by rxcp when GRO = is enabled */ 4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han = 2013-08-05 2429 static void be_rx_compl_process_gro(struct be_rx_obj *rx= o, 4188e7df44bf316 drivers/net/ethernet/emulex/benet/be_main.c Jingoo Han = 2013-08-05 2430 struct napi_struct *napi, 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2431 struct be_rx_compl_info *rxcp) 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2432 { 10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla = 2012-02-09 2433 struct be_adapter *adapter =3D rxo->adapter; 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2434 struct be_rx_page_info *page_info; 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2435 struct sk_buff *skb =3D NULL; 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2436 u16 remaining, curr_frag_len; 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2437 u16 i, j; 3968fa1e5889618 drivers/net/benet/be_main.c Ajit Khaparde = 2011-02-20 2438 =20 10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla = 2012-02-09 2439 skb =3D napi_get_frags(napi); 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2440 if (!skb) { 10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla = 2012-02-09 2441 be_rx_compl_discard(rxo, rxcp); 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2442 return; 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2443 } 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2444 =20 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2445 remaining =3D rxcp->pkt_size; 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2446 for (i =3D 0, j =3D -1; i < rxcp->num_rcvd; i++) { 0b0ef1d027008f0 drivers/net/ethernet/emulex/benet/be_main.c Suresh Reddy = 2014-01-15 2447 page_info =3D get_rx_page_info(rxo); 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2448 =20 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2449 curr_frag_len =3D min(remaining, rx_frag_size); 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2450 =20 bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2451 /* Coalesce all frags from the same physical page in o= ne slot */ bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2452 if (i =3D=3D 0 || page_info->page_offset =3D=3D 0) { bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2453 /* First frag or Fresh page */ bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2454 j++; b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2455 skb_frag_fill_page_desc(&skb_shinfo(skb)->frags[j], b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2456 page_info->page, b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2457 page_info->page_offset, b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2458 curr_frag_len); bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2459 } else { bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2460 put_page(page_info->page); b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 @2461 skb_frag_size_add(&skb_shinfo(skb)->frags[j], b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2462 curr_frag_len); bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2463 } b51f4113ebb0201 drivers/net/ethernet/emulex/benet/be_main.c Yunsheng Lin = 2023-05-11 2464 =20 bdb28a97f46b530 drivers/net/ethernet/emulex/benet/be_main.c Eric Dumazet = 2011-10-13 2465 skb->truesize +=3D rx_frag_size; bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2466 remaining -=3D curr_frag_len; 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2467 memset(page_info, 0, sizeof(*page_info)); 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2468 } bd46cb6cf118671 drivers/net/benet/be_main.c Ajit Khaparde = 2009-06-26 2469 BUG_ON(j > MAX_SKB_FRAGS); 6b7c5b947c671a9 drivers/net/benet/be_main.c Sathya Perla = 2009-03-11 2470 =20 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2471 skb_shinfo(skb)->nr_frags =3D j + 1; 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2472 skb->len =3D rxcp->pkt_size; 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2473 skb->data_len =3D rxcp->pkt_size; 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2474 skb->ip_summed =3D CHECKSUM_UNNECESSARY; aaa6daec586cd39 drivers/net/ethernet/emulex/benet/be_main.c Somnath Kotur = 2012-05-02 2475 skb_record_rx_queue(skb, rxo - &adapter->rx_obj[0]); 4b97291429bf59c drivers/net/benet/be_main.c Ajit Khaparde = 2011-04-06 2476 if (adapter->netdev->features & NETIF_F_RXHASH) d2464c8c547333e drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert = 2013-12-17 2477 skb_set_hash(skb, rxcp->rss_hash, PKT_HASH_TYPE_L3); c9c47142f6bf468 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla = 2014-03-27 2478 =20 b6c0e89dd3a1b22 drivers/net/ethernet/emulex/benet/be_main.c Tom Herbert = 2014-08-27 2479 skb->csum_level =3D rxcp->tunneled; 5be93b9a865344c drivers/net/benet/be_main.c Ajit Khaparde = 2009-07-21 2480 =20 343e43c02850a3a drivers/net/ethernet/emulex/benet/be_main.c Jiri Pirko = 2011-08-25 2481 if (rxcp->vlanf) 86a9bad3ab6b6f8 drivers/net/ethernet/emulex/benet/be_main.c Patrick McHardy= 2013-04-19 2482 __vlan_hwaccel_put_tag(skb, htons(ETH_P_8021Q), rxcp->= vlan_tag); 4c5102f94c175d8 drivers/net/benet/be_main.c Ajit Khaparde = 2011-07-12 2483 =20 10ef9ab4329edd0 drivers/net/ethernet/emulex/benet/be_main.c Sathya Perla = 2012-02-09 2484 napi_gro_frags(napi); 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2485 } 2e588f84f254cca drivers/net/benet/be_main.c Sathya Perla = 2011-03-11 2486 =20 :::::: The code at line 2461 was first introduced by commit :::::: b51f4113ebb02011f0ca86abc3134b28d2071b6a net: introduce and use skb_= frag_fill_page_desc() :::::: TO: Yunsheng Lin <[email protected]> :::::: CC: David S. Miller <[email protected]> -- 0-DAY CI Kernel Test Service https://github.com/intel/lkp-tests/wiki