| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202509271623.I36w4Uqo-lkp@intel.com>
Date: Sat, 27 Sep 2025 17:08:33 +0800
From: kernel test robot <lkp@...el.com>
To: Bobby Eshleman <bobbyeshleman@...il.com>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Simon Horman <horms@...nel.org>,
Kuniyuki Iwashima <kuniyu@...gle.com>,
Willem de Bruijn <willemb@...gle.com>,
Neal Cardwell <ncardwell@...gle.com>,
David Ahern <dsahern@...nel.org>
Cc: oe-kbuild-all@...ts.linux.dev, netdev@...r.kernel.org,
linux-kernel@...r.kernel.org, Stanislav Fomichev <sdf@...ichev.me>,
Mina Almasry <almasrymina@...gle.com>,
Bobby Eshleman <bobbyeshleman@...a.com>
Subject: Re: [PATCH net-next v4 2/2] net: devmem: use niov array for token
management
Hi Bobby,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 203e3beb73e53584ca90bc2a6d8240b9b12b9bcf]
url: https://github.com/intel-lab-lkp/linux/commits/Bobby-Eshleman/net-devmem-rename-tx_vec-to-vec-in-dmabuf-binding/20250927-003521
base: 203e3beb73e53584ca90bc2a6d8240b9b12b9bcf
patch link: https://lore.kernel.org/r/20250926-scratch-bobbyeshleman-devmem-tcp-token-upstream-v4-2-39156563c3ea%40meta.com
patch subject: [PATCH net-next v4 2/2] net: devmem: use niov array for token management
config: x86_64-buildonly-randconfig-005-20250927 (https://download.01.org/0day-ci/archive/20250927/202509271623.I36w4Uqo-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250927/202509271623.I36w4Uqo-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202509271623.I36w4Uqo-lkp@intel.com/
All warnings (new ones prefixed by >>):
net/ipv4/tcp.c: In function 'tcp_recvmsg_dmabuf':
>> net/ipv4/tcp.c:2473:32: warning: unused variable 'len' [-Wunused-variable]
2473 | size_t len;
| ^~~
>> net/ipv4/tcp.c:2472:32: warning: unused variable 'size' [-Wunused-variable]
2472 | size_t size;
| ^~~~
vim +/len +2473 net/ipv4/tcp.c
2409
2410 /* On error, returns the -errno. On success, returns number of bytes sent to the
2411 * user. May not consume all of @remaining_len.
2412 */
2413 static int tcp_recvmsg_dmabuf(struct sock *sk, const struct sk_buff *skb,
2414 unsigned int offset, struct msghdr *msg,
2415 int remaining_len)
2416 {
2417 struct dmabuf_cmsg dmabuf_cmsg = { 0 };
2418 unsigned int start;
2419 int i, copy, n;
2420 int sent = 0;
2421 int err = 0;
2422
2423 do {
2424 start = skb_headlen(skb);
2425
2426 if (skb_frags_readable(skb)) {
2427 err = -ENODEV;
2428 goto out;
2429 }
2430
2431 /* Copy header. */
2432 copy = start - offset;
2433 if (copy > 0) {
2434 copy = min(copy, remaining_len);
2435
2436 n = copy_to_iter(skb->data + offset, copy,
2437 &msg->msg_iter);
2438 if (n != copy) {
2439 err = -EFAULT;
2440 goto out;
2441 }
2442
2443 offset += copy;
2444 remaining_len -= copy;
2445
2446 /* First a dmabuf_cmsg for # bytes copied to user
2447 * buffer.
2448 */
2449 memset(&dmabuf_cmsg, 0, sizeof(dmabuf_cmsg));
2450 dmabuf_cmsg.frag_size = copy;
2451 err = put_cmsg_notrunc(msg, SOL_SOCKET,
2452 SO_DEVMEM_LINEAR,
2453 sizeof(dmabuf_cmsg),
2454 &dmabuf_cmsg);
2455 if (err)
2456 goto out;
2457
2458 sent += copy;
2459
2460 if (remaining_len == 0)
2461 goto out;
2462 }
2463
2464 /* after that, send information of dmabuf pages through a
2465 * sequence of cmsg
2466 */
2467 for (i = 0; i < skb_shinfo(skb)->nr_frags; i++) {
2468 skb_frag_t *frag = &skb_shinfo(skb)->frags[i];
2469 struct net_devmem_dmabuf_binding *binding;
2470 struct net_iov *niov;
2471 u64 frag_offset;
> 2472 size_t size;
> 2473 size_t len;
2474 u32 token;
2475 int end;
2476
2477 /* !skb_frags_readable() should indicate that ALL the
2478 * frags in this skb are dmabuf net_iovs. We're checking
2479 * for that flag above, but also check individual frags
2480 * here. If the tcp stack is not setting
2481 * skb_frags_readable() correctly, we still don't want
2482 * to crash here.
2483 */
2484 if (!skb_frag_net_iov(frag)) {
2485 net_err_ratelimited("Found non-dmabuf skb with net_iov");
2486 err = -ENODEV;
2487 goto out;
2488 }
2489
2490 niov = skb_frag_net_iov(frag);
2491 if (!net_is_devmem_iov(niov)) {
2492 err = -ENODEV;
2493 goto out;
2494 }
2495
2496 end = start + skb_frag_size(frag);
2497 copy = end - offset;
2498
2499 if (copy > 0) {
2500 copy = min(copy, remaining_len);
2501
2502 frag_offset = net_iov_virtual_addr(niov) +
2503 skb_frag_off(frag) + offset -
2504 start;
2505 dmabuf_cmsg.frag_offset = frag_offset;
2506 dmabuf_cmsg.frag_size = copy;
2507
2508 binding = net_devmem_iov_binding(niov);
2509
2510 if (!sk->sk_devmem_binding)
2511 sk->sk_devmem_binding = binding;
2512
2513 if (sk->sk_devmem_binding != binding) {
2514 err = -EFAULT;
2515 goto out;
2516 }
2517
2518 token = net_iov_virtual_addr(niov) >> PAGE_SHIFT;
2519 dmabuf_cmsg.frag_token = token;
2520
2521 /* Will perform the exchange later */
2522 dmabuf_cmsg.dmabuf_id = net_devmem_iov_binding_id(niov);
2523
2524 offset += copy;
2525 remaining_len -= copy;
2526
2527 err = put_cmsg_notrunc(msg, SOL_SOCKET,
2528 SO_DEVMEM_DMABUF,
2529 sizeof(dmabuf_cmsg),
2530 &dmabuf_cmsg);
2531 if (err)
2532 goto out;
2533
2534 if (atomic_inc_return(&niov->uref) == 1)
2535 atomic_long_inc(&niov->pp_ref_count);
2536
2537 sent += copy;
2538
2539 if (remaining_len == 0)
2540 goto out;
2541 }
2542 start = end;
2543 }
2544
2545 if (!remaining_len)
2546 goto out;
2547
2548 /* if remaining_len is not satisfied yet, we need to go to the
2549 * next frag in the frag_list to satisfy remaining_len.
2550 */
2551 skb = skb_shinfo(skb)->frag_list ?: skb->next;
2552
2553 offset = offset - start;
2554 } while (skb);
2555
2556 if (remaining_len) {
2557 err = -EFAULT;
2558 goto out;
2559 }
2560
2561 out:
2562 if (!sent)
2563 sent = err;
2564
2565 return sent;
2566 }
2567
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists