| lists.openwall.net | lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC | |
|
Open Source and information security mailing list archives
| ||
|
Message-ID: <202506262133.SOMnmRa5-lkp@intel.com>
Date: Thu, 26 Jun 2025 22:17:00 +0800
From: kernel test robot <lkp@...el.com>
To: Jeremy Kerr <jk@...econstruct.com.au>,
Matt Johnston <matt@...econstruct.com.au>,
"David S. Miller" <davem@...emloft.net>,
Eric Dumazet <edumazet@...gle.com>,
Jakub Kicinski <kuba@...nel.org>, Paolo Abeni <pabeni@...hat.com>,
Simon Horman <horms@...nel.org>
Cc: oe-kbuild-all@...ts.linux.dev, netdev@...r.kernel.org
Subject: Re: [PATCH net-next v3 02/14] net: mctp: test: make cloned_frag
buffers more appropriately-sized
Hi Jeremy,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 0097c4195b1d0ca57d15979626c769c74747b5a0]
url: https://github.com/intel-lab-lkp/linux/commits/Jeremy-Kerr/net-mctp-don-t-use-source-cb-data-when-forwarding-ensure-pkt_type-is-set/20250625-154020
base: 0097c4195b1d0ca57d15979626c769c74747b5a0
patch link: https://lore.kernel.org/r/20250625-dev-forwarding-v3-2-2061bd3013b3%40codeconstruct.com.au
patch subject: [PATCH net-next v3 02/14] net: mctp: test: make cloned_frag buffers more appropriately-sized
config: microblaze-allyesconfig (https://download.01.org/0day-ci/archive/20250626/202506262133.SOMnmRa5-lkp@intel.com/config)
compiler: microblaze-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250626/202506262133.SOMnmRa5-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@...el.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202506262133.SOMnmRa5-lkp@intel.com/
All warnings (new ones prefixed by >>):
In file included from net/mctp/route.c:1549:
net/mctp/test/route-test.c: In function 'mctp_test_route_input_cloned_frag':
>> net/mctp/test/route-test.c:937:12: warning: argument to variable-length array is too large [-Wvla-larger-than=]
937 | u8 compare[data_len * ARRAY_SIZE(hdrs)];
| ^~~~~~~
net/mctp/test/route-test.c:937:12: note: limit is 1 bytes, but argument is 15
net/mctp/test/route-test.c:938:12: warning: argument to variable-length array is too large [-Wvla-larger-than=]
938 | u8 flat[data_len * ARRAY_SIZE(hdrs)];
| ^~~~
net/mctp/test/route-test.c:938:12: note: limit is 1 bytes, but argument is 15
vim +937 net/mctp/test/route-test.c
923
924 /* Input route to socket, using a fragmented message created from clones.
925 */
926 static void mctp_test_route_input_cloned_frag(struct kunit *test)
927 {
928 /* 5 packet fragments, forming 2 complete messages */
929 const struct mctp_hdr hdrs[5] = {
930 RX_FRAG(FL_S, 0),
931 RX_FRAG(0, 1),
932 RX_FRAG(FL_E, 2),
933 RX_FRAG(FL_S, 0),
934 RX_FRAG(FL_E, 1),
935 };
936 const size_t data_len = 3; /* arbitrary */
> 937 u8 compare[data_len * ARRAY_SIZE(hdrs)];
938 u8 flat[data_len * ARRAY_SIZE(hdrs)];
939 struct mctp_test_route *rt;
940 struct mctp_test_dev *dev;
941 struct sk_buff *skb[5];
942 struct sk_buff *rx_skb;
943 struct socket *sock;
944 size_t total;
945 void *p;
946 int rc;
947
948 total = data_len + sizeof(struct mctp_hdr);
949
950 __mctp_route_test_init(test, &dev, &rt, &sock, MCTP_NET_ANY);
951
952 /* Create a single skb initially with concatenated packets */
953 skb[0] = mctp_test_create_skb(&hdrs[0], 5 * total);
954 mctp_test_skb_set_dev(skb[0], dev);
955 memset(skb[0]->data, 0 * 0x11, skb[0]->len);
956 memcpy(skb[0]->data, &hdrs[0], sizeof(struct mctp_hdr));
957
958 /* Extract and populate packets */
959 for (int i = 1; i < 5; i++) {
960 skb[i] = skb_clone(skb[i - 1], GFP_ATOMIC);
961 KUNIT_ASSERT_TRUE(test, skb[i]);
962 p = skb_pull(skb[i], total);
963 KUNIT_ASSERT_TRUE(test, p);
964 skb_reset_network_header(skb[i]);
965 memcpy(skb[i]->data, &hdrs[i], sizeof(struct mctp_hdr));
966 memset(&skb[i]->data[sizeof(struct mctp_hdr)], i * 0x11, data_len);
967 }
968 for (int i = 0; i < 5; i++)
969 skb_trim(skb[i], total);
970
971 /* SOM packets have a type byte to match the socket */
972 skb[0]->data[4] = 0;
973 skb[3]->data[4] = 0;
974
975 skb_dump("pkt1 ", skb[0], false);
976 skb_dump("pkt2 ", skb[1], false);
977 skb_dump("pkt3 ", skb[2], false);
978 skb_dump("pkt4 ", skb[3], false);
979 skb_dump("pkt5 ", skb[4], false);
980
981 for (int i = 0; i < 5; i++) {
982 KUNIT_EXPECT_EQ(test, refcount_read(&skb[i]->users), 1);
983 /* Take a reference so we can check refcounts at the end */
984 skb_get(skb[i]);
985 }
986
987 /* Feed the fragments into MCTP core */
988 for (int i = 0; i < 5; i++) {
989 rc = mctp_route_input(&rt->rt, skb[i]);
990 KUNIT_EXPECT_EQ(test, rc, 0);
991 }
992
993 /* Receive first reassembled message */
994 rx_skb = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
995 KUNIT_EXPECT_EQ(test, rc, 0);
996 KUNIT_EXPECT_EQ(test, rx_skb->len, 3 * data_len);
997 rc = skb_copy_bits(rx_skb, 0, flat, rx_skb->len);
998 for (int i = 0; i < rx_skb->len; i++)
999 compare[i] = (i / data_len) * 0x11;
1000 /* Set type byte */
1001 compare[0] = 0;
1002
1003 KUNIT_EXPECT_MEMEQ(test, flat, compare, rx_skb->len);
1004 KUNIT_EXPECT_EQ(test, refcount_read(&rx_skb->users), 1);
1005 kfree_skb(rx_skb);
1006
1007 /* Receive second reassembled message */
1008 rx_skb = skb_recv_datagram(sock->sk, MSG_DONTWAIT, &rc);
1009 KUNIT_EXPECT_EQ(test, rc, 0);
1010 KUNIT_EXPECT_EQ(test, rx_skb->len, 2 * data_len);
1011 rc = skb_copy_bits(rx_skb, 0, flat, rx_skb->len);
1012 for (int i = 0; i < rx_skb->len; i++)
1013 compare[i] = (i / data_len + 3) * 0x11;
1014 /* Set type byte */
1015 compare[0] = 0;
1016
1017 KUNIT_EXPECT_MEMEQ(test, flat, compare, rx_skb->len);
1018 KUNIT_EXPECT_EQ(test, refcount_read(&rx_skb->users), 1);
1019 kfree_skb(rx_skb);
1020
1021 /* Check input skb refcounts */
1022 for (int i = 0; i < 5; i++) {
1023 KUNIT_EXPECT_EQ(test, refcount_read(&skb[i]->users), 1);
1024 kfree_skb(skb[i]);
1025 }
1026
1027 __mctp_route_test_fini(test, dev, rt, sock);
1028 }
1029
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
Powered by blists - more mailing lists