net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes

net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes

[kernel test robot]

tree:   https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git master
head:   86731a2a651e58953fc949573895f2fa6d456841
commit: 5800b1cf3fd8ccab752a101865be1e76dac33142 rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE
date:   2 months ago
config: s390-allyesconfig (https://download.01.org/0day-ci/archive/20250624/202506240423.E942yKJP-lkp@intel.com/config)
compiler: s390-linux-gcc (GCC) 15.1.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20250624/202506240423.E942yKJP-lkp@intel.com/reproduce)

If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202506240423.E942yKJP-lkp@intel.com/

All warnings (new ones prefixed by >>):

   net/rxrpc/output.c: In function 'rxrpc_send_response':
>> net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes [-Wframe-larger-than=]
     974 | }
         | ^


vim +974 net/rxrpc/output.c

   919	
   920	/*
   921	 * Send a RESPONSE message.
   922	 */
   923	void rxrpc_send_response(struct rxrpc_connection *conn, struct sk_buff *response)
   924	{
   925		struct rxrpc_skb_priv *sp = rxrpc_skb(response);
   926		struct scatterlist sg[16];
   927		struct bio_vec bvec[16];
   928		struct msghdr msg;
   929		size_t len = sp->resp.len;
   930		__be32 wserial;
   931		u32 serial = 0;
   932		int ret, nr_sg;
   933	
   934		_enter("C=%x,%x", conn->debug_id, sp->resp.challenge_serial);
   935	
   936		sg_init_table(sg, ARRAY_SIZE(sg));
   937		ret = skb_to_sgvec(response, sg, 0, len);
   938		if (ret < 0)
   939			goto fail;
   940		nr_sg = ret;
   941	
   942		for (int i = 0; i < nr_sg; i++)
   943			bvec_set_page(&bvec[i], sg_page(&sg[i]), sg[i].length, sg[i].offset);
   944	
   945		iov_iter_bvec(&msg.msg_iter, WRITE, bvec, nr_sg, len);
   946	
   947		msg.msg_name	= &conn->peer->srx.transport;
   948		msg.msg_namelen	= conn->peer->srx.transport_len;
   949		msg.msg_control	= NULL;
   950		msg.msg_controllen = 0;
   951		msg.msg_flags	= MSG_SPLICE_PAGES;
   952	
   953		serial = rxrpc_get_next_serials(conn, 1);
   954		wserial = htonl(serial);
   955	
   956		ret = skb_store_bits(response, offsetof(struct rxrpc_wire_header, serial),
   957				     &wserial, sizeof(wserial));
   958		if (ret < 0)
   959			goto fail;
   960	
   961		rxrpc_local_dont_fragment(conn->local, false);
   962	
   963		ret = do_udp_sendmsg(conn->local->socket, &msg, len);
   964		if (ret < 0)
   965			goto fail;
   966	
   967		conn->peer->last_tx_at = ktime_get_seconds();
   968		return;
   969	
   970	fail:
   971		trace_rxrpc_tx_fail(conn->debug_id, serial, ret,
   972				    rxrpc_tx_point_response);
   973		kleave(" = %d", ret);
 > 974	}

-- 
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki

Re: net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes

[David Howells]

I think the attached patch should fix this.

David
---
rxrpc: Fix over large frame size warning

Under some circumstances, the compiler will emit the following warning for
rxrpc_send_response():

   net/rxrpc/output.c: In function 'rxrpc_send_response':
   net/rxrpc/output.c:974:1: warning: the frame size of 1160 bytes is larger than 1024 bytes

This occurs because the local variables include a 16-element scatterlist
array and a 16-element bio_vec array.  It's probably not actually a problem
as this function is only called by the rxrpc I/O thread function in a
kernel thread and there won't be much on the stack before it.

Fix this by overlaying the bio_vec array over the kvec array in the
rxrpc_local struct.  There is one of these per I/O thread and the kvec
array is intended for pointing at bits of a packet to be transmitted,
typically a DATA or an ACK packet.  As packets for a local endpoint are
only transmitted by its specific I/O thread, there can be no race, and so
overlaying this bit of memory should be no problem.

Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202506240423.E942yKJP-lkp@intel.com/
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Eric Dumazet <edumazet@google.com>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
---
 net/rxrpc/ar-internal.h |   15 +++++++++------
 net/rxrpc/output.c      |    5 ++++-
 2 files changed, 13 insertions(+), 7 deletions(-)

diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index 5bd3922c310d..376e33dce8c1 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -361,12 +361,15 @@ struct rxrpc_local {
 	struct list_head	new_client_calls; /* Newly created client calls need connection */
 	spinlock_t		client_call_lock; /* Lock for ->new_client_calls */
 	struct sockaddr_rxrpc	srx;		/* local address */
-	/* Provide a kvec table sufficiently large to manage either a DATA
-	 * packet with a maximum set of jumbo subpackets or a PING ACK padded
-	 * out to 64K with zeropages for PMTUD.
-	 */
-	struct kvec		kvec[1 + RXRPC_MAX_NR_JUMBO > 3 + 16 ?
-				     1 + RXRPC_MAX_NR_JUMBO : 3 + 16];
+	union {
+		/* Provide a kvec table sufficiently large to manage either a
+		 * DATA packet with a maximum set of jumbo subpackets or a PING
+		 * ACK padded out to 64K with zeropages for PMTUD.
+		 */
+		struct kvec		kvec[1 + RXRPC_MAX_NR_JUMBO > 3 + 16 ?
+					     1 + RXRPC_MAX_NR_JUMBO : 3 + 16];
+		struct bio_vec		bvec[3 + 16];
+	};
 };
 
 /*
diff --git a/net/rxrpc/output.c b/net/rxrpc/output.c
index 0af19bcdc80a..ef7b3096c95e 100644
--- a/net/rxrpc/output.c
+++ b/net/rxrpc/output.c
@@ -924,7 +924,7 @@ void rxrpc_send_response(struct rxrpc_connection *conn, struct sk_buff *response
 {
 	struct rxrpc_skb_priv *sp = rxrpc_skb(response);
 	struct scatterlist sg[16];
-	struct bio_vec bvec[16];
+	struct bio_vec *bvec = conn->local->bvec;
 	struct msghdr msg;
 	size_t len = sp->resp.len;
 	__be32 wserial;
@@ -938,6 +938,9 @@ void rxrpc_send_response(struct rxrpc_connection *conn, struct sk_buff *response
 	if (ret < 0)
 		goto fail;
 	nr_sg = ret;
+	ret = -EIO;
+	if (WARN_ON_ONCE(nr_sg > ARRAY_SIZE(conn->local->bvec)))
+		goto fail;
 
 	for (int i = 0; i < nr_sg; i++)
 		bvec_set_page(&bvec[i], sg_page(&sg[i]), sg[i].length, sg[i].offset);