Re: [PATCH v2] net: usb: lan78xx: Limit packet length to skb->len

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Hi Szymon,

Thank you for the patch! Perhaps something to improve:

[auto build test WARNING on net-next/main]
[also build test WARNING on net/main linus/master v6.3-rc2 next-20230317]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]

url:    https://github.com/intel-lab-lkp/linux/commits/Szymon-Heidrich/net-usb-lan78xx-Limit-packet-length-to-skb-len/20230318-013659
patch link:    https://lore.kernel.org/r/20230317173606.91426-1-szymon.heidrich%40gmail.com
patch subject: [PATCH v2] net: usb: lan78xx: Limit packet length to skb->len
config: i386-randconfig-a005 (https://download.01.org/0day-ci/archive/20230318/202303181127.Phif6jvW-lkp@xxxxxxxxx/config)
compiler: gcc-11 (Debian 11.3.0-8) 11.3.0
reproduce (this is a W=1 build):
        # https://github.com/intel-lab-lkp/linux/commit/17c060ef752f4a1366ed7d8e62ba5f64f654eced
        git remote add linux-review https://github.com/intel-lab-lkp/linux
        git fetch --no-tags linux-review Szymon-Heidrich/net-usb-lan78xx-Limit-packet-length-to-skb-len/20230318-013659
        git checkout 17c060ef752f4a1366ed7d8e62ba5f64f654eced
        # save the config file
        mkdir build_dir && cp config build_dir/.config
        make W=1 O=build_dir ARCH=i386 olddefconfig
        make W=1 O=build_dir ARCH=i386 SHELL=/bin/bash drivers/net/usb/

If you fix the issue, kindly add following tag where applicable
| Reported-by: kernel test robot <lkp@xxxxxxxxx>
| Link: https://lore.kernel.org/oe-kbuild-all/202303181127.Phif6jvW-lkp@xxxxxxxxx/

All warnings (new ones prefixed by >>):

   drivers/net/usb/lan78xx.c: In function 'lan78xx_rx':
>> drivers/net/usb/lan78xx.c:3603:25: warning: ISO C90 forbids mixed declarations and code [-Wdeclaration-after-statement]
    3603 |                         struct sk_buff *skb2;
         |                         ^~~~~~


vim +3603 drivers/net/usb/lan78xx.c

55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3552  
ec4c7e12396b1a John Efstathiades         2021-11-18  3553  static int lan78xx_rx(struct lan78xx_net *dev, struct sk_buff *skb,
ec4c7e12396b1a John Efstathiades         2021-11-18  3554  		      int budget, int *work_done)
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3555  {
0dd87266c1337d John Efstathiades         2021-11-18  3556  	if (skb->len < RX_SKB_MIN_LEN)
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3557  		return 0;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3558  
ec4c7e12396b1a John Efstathiades         2021-11-18  3559  	/* Extract frames from the URB buffer and pass each one to
ec4c7e12396b1a John Efstathiades         2021-11-18  3560  	 * the stack in a new NAPI SKB.
ec4c7e12396b1a John Efstathiades         2021-11-18  3561  	 */
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3562  	while (skb->len > 0) {
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3563  		u32 rx_cmd_a, rx_cmd_b, align_count, size;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3564  		u16 rx_cmd_c;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3565  		unsigned char *packet;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3566  
bb448f8a60ea93 Chuhong Yuan              2019-07-19  3567  		rx_cmd_a = get_unaligned_le32(skb->data);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3568  		skb_pull(skb, sizeof(rx_cmd_a));
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3569  
bb448f8a60ea93 Chuhong Yuan              2019-07-19  3570  		rx_cmd_b = get_unaligned_le32(skb->data);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3571  		skb_pull(skb, sizeof(rx_cmd_b));
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3572  
bb448f8a60ea93 Chuhong Yuan              2019-07-19  3573  		rx_cmd_c = get_unaligned_le16(skb->data);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3574  		skb_pull(skb, sizeof(rx_cmd_c));
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3575  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3576  		packet = skb->data;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3577  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3578  		/* get the packet length */
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3579  		size = (rx_cmd_a & RX_CMD_A_LEN_MASK_);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3580  		align_count = (4 - ((size + RXW_PADDING) % 4)) % 4;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3581  
17c060ef752f4a Szymon Heidrich           2023-03-17  3582  		if (unlikely(size > skb->len)) {
17c060ef752f4a Szymon Heidrich           2023-03-17  3583  			netif_dbg(dev, rx_err, dev->net,
17c060ef752f4a Szymon Heidrich           2023-03-17  3584  				  "size err rx_cmd_a=0x%08x\n",
17c060ef752f4a Szymon Heidrich           2023-03-17  3585  				  rx_cmd_a);
17c060ef752f4a Szymon Heidrich           2023-03-17  3586  			return 0;
17c060ef752f4a Szymon Heidrich           2023-03-17  3587  		}
17c060ef752f4a Szymon Heidrich           2023-03-17  3588  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3589  		if (unlikely(rx_cmd_a & RX_CMD_A_RED_)) {
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3590  			netif_dbg(dev, rx_err, dev->net,
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3591  				  "Error rx_cmd_a=0x%08x", rx_cmd_a);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3592  		} else {
17c060ef752f4a Szymon Heidrich           2023-03-17  3593  			u32 frame_len;
17c060ef752f4a Szymon Heidrich           2023-03-17  3594  
17c060ef752f4a Szymon Heidrich           2023-03-17  3595  			if (unlikely(size < ETH_FCS_LEN)) {
17c060ef752f4a Szymon Heidrich           2023-03-17  3596  				netif_dbg(dev, rx_err, dev->net,
17c060ef752f4a Szymon Heidrich           2023-03-17  3597  					  "size err rx_cmd_a=0x%08x\n",
17c060ef752f4a Szymon Heidrich           2023-03-17  3598  					  rx_cmd_a);
17c060ef752f4a Szymon Heidrich           2023-03-17  3599  				return 0;
17c060ef752f4a Szymon Heidrich           2023-03-17  3600  			}
17c060ef752f4a Szymon Heidrich           2023-03-17  3601  
17c060ef752f4a Szymon Heidrich           2023-03-17  3602  			frame_len = size - ETH_FCS_LEN;
ec4c7e12396b1a John Efstathiades         2021-11-18 @3603  			struct sk_buff *skb2;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3604  
ec4c7e12396b1a John Efstathiades         2021-11-18  3605  			skb2 = napi_alloc_skb(&dev->napi, frame_len);
ec4c7e12396b1a John Efstathiades         2021-11-18  3606  			if (!skb2)
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3607  				return 0;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3608  
ec4c7e12396b1a John Efstathiades         2021-11-18  3609  			memcpy(skb2->data, packet, frame_len);
ec4c7e12396b1a John Efstathiades         2021-11-18  3610  
ec4c7e12396b1a John Efstathiades         2021-11-18  3611  			skb_put(skb2, frame_len);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3612  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3613  			lan78xx_rx_csum_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
ec21ecf0aad279 Dave Stevenson            2018-06-25  3614  			lan78xx_rx_vlan_offload(dev, skb2, rx_cmd_a, rx_cmd_b);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3615  
ec4c7e12396b1a John Efstathiades         2021-11-18  3616  			/* Processing of the URB buffer must complete once
ec4c7e12396b1a John Efstathiades         2021-11-18  3617  			 * it has started. If the NAPI work budget is exhausted
ec4c7e12396b1a John Efstathiades         2021-11-18  3618  			 * while frames remain they are added to the overflow
ec4c7e12396b1a John Efstathiades         2021-11-18  3619  			 * queue for delivery in the next NAPI polling cycle.
ec4c7e12396b1a John Efstathiades         2021-11-18  3620  			 */
ec4c7e12396b1a John Efstathiades         2021-11-18  3621  			if (*work_done < budget) {
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3622  				lan78xx_skb_return(dev, skb2);
ec4c7e12396b1a John Efstathiades         2021-11-18  3623  				++(*work_done);
ec4c7e12396b1a John Efstathiades         2021-11-18  3624  			} else {
ec4c7e12396b1a John Efstathiades         2021-11-18  3625  				skb_queue_tail(&dev->rxq_overflow, skb2);
ec4c7e12396b1a John Efstathiades         2021-11-18  3626  			}
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3627  		}
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3628  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3629  		skb_pull(skb, size);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3630  
ec4c7e12396b1a John Efstathiades         2021-11-18  3631  		/* skip padding bytes before the next frame starts */
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3632  		if (skb->len)
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3633  			skb_pull(skb, align_count);
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3634  	}
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3635  
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3636  	return 1;
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3637  }
55d7de9de6c30a Woojung.Huh@xxxxxxxxxxxxx 2015-07-30  3638  

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests



[Index of Archives]     [Linux Media]     [Linux Input]     [Linux Audio Users]     [Yosemite News]     [Linux Kernel]     [Linux SCSI]     [Old Linux USB Devel Archive]

  Powered by Linux