From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
patches@lists.linux.dev, Marc Kleine-Budde <mkl@pengutronix.de>,
Oliver Hartkopp <socketcan@hartkopp.net>,
Paolo Abeni <pabeni@redhat.com>
Subject: [PATCH 5.10 53/57] can: use skb hash instead of private variable in headroom
Date: Tue, 25 Aug 2026 15:27:15 +0200 [thread overview]
Message-ID: <20260825132543.414661213@linuxfoundation.org> (raw)
In-Reply-To: <20260825132541.342390421@linuxfoundation.org>
5.10-stable review patch. If anyone has any objections, please let me know.
------------------
From: Oliver Hartkopp <socketcan@hartkopp.net>
commit d4fb6514ff8ed6912a71294e6b66a5d59ee88007 upstream.
The can_skb_priv::skbcnt variable is used to identify CAN skbs in the RX
path analogue to the skb->hash.
As the skb hash is not filled in CAN skbs move the private skbcnt value to
skb->hash and set skb->sw_hash accordingly. The skb->hash is a value used
for RPS to identify skbs. Use it as intended.
Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260201-can_skb_ext-v8-1-3635d790fe8b@hartkopp.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/can/dev/dev.c | 2 --
drivers/net/can/slcan.c | 1 -
include/linux/can/core.h | 1 +
include/linux/can/dev.h | 1 -
include/linux/can/skb.h | 2 --
net/can/af_can.c | 14 +++++++++++---
net/can/bcm.c | 2 --
net/can/isotp.c | 3 ---
net/can/j1939/socket.c | 1 -
net/can/j1939/transport.c | 2 --
net/can/raw.c | 7 +++----
11 files changed, 15 insertions(+), 21 deletions(-)
--- a/drivers/net/can/dev/dev.c
+++ b/drivers/net/can/dev/dev.c
@@ -694,7 +694,6 @@ struct sk_buff *alloc_can_skb(struct net
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
*cf = skb_put_zero(skb, sizeof(struct can_frame));
@@ -722,7 +721,6 @@ struct sk_buff *alloc_canfd_skb(struct n
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
*cfd = skb_put_zero(skb, sizeof(struct canfd_frame));
--- a/drivers/net/can/slcan.c
+++ b/drivers/net/can/slcan.c
@@ -213,7 +213,6 @@ static void slc_bump(struct slcan *sl)
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = sl->dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skb_put_data(skb, &cf, sizeof(struct can_frame));
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -58,6 +58,7 @@ extern void can_rx_unregister(struct net
void *data);
extern int can_send(struct sk_buff *skb, int loop);
+void can_set_skb_uid(struct sk_buff *skb);
void can_sock_destruct(struct sock *sk);
#endif /* !_CAN_CORE_H */
--- a/include/linux/can/dev.h
+++ b/include/linux/can/dev.h
@@ -119,7 +119,6 @@ static inline bool can_skb_headroom_vali
if (skb->ip_summed == CHECKSUM_NONE) {
/* init headroom */
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skb->ip_summed = CHECKSUM_UNNECESSARY;
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -28,12 +28,10 @@
/**
* struct can_skb_priv - private additional data inside CAN sk_buffs
* @ifindex: ifindex of the first interface the CAN frame appeared on
- * @skbcnt: atomic counter to have an unique id together with skb pointer
* @cf: align to the following CAN frame at skb->data
*/
struct can_skb_priv {
int ifindex;
- int skbcnt;
struct can_frame cf[];
};
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -641,6 +641,16 @@ static int can_rcv_filter(struct can_dev
return matches;
}
+void can_set_skb_uid(struct sk_buff *skb)
+{
+ /* create non-zero unique skb identifier together with *skb */
+ while (!(skb->hash))
+ skb->hash = atomic_inc_return(&skbcounter);
+
+ skb->sw_hash = 1;
+}
+EXPORT_SYMBOL(can_set_skb_uid);
+
static void can_receive(struct sk_buff *skb, struct net_device *dev)
{
struct can_dev_rcv_lists *dev_rcv_lists;
@@ -652,9 +662,7 @@ static void can_receive(struct sk_buff *
atomic_long_inc(&pkg_stats->rx_frames);
atomic_long_inc(&pkg_stats->rx_frames_delta);
- /* create non-zero unique skb identifier together with *skb */
- while (!(can_skb_prv(skb)->skbcnt))
- can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
+ can_set_skb_uid(skb);
rcu_read_lock();
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -338,7 +338,6 @@ static void bcm_can_tx(struct bcm_op *op
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skb_put_data(skb, cf, op->cfsiz);
@@ -1577,7 +1576,6 @@ static int bcm_tx_send(struct msghdr *ms
}
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skb->dev = dev;
can_skb_set_owner(skb, sk);
err = can_send(skb, 1); /* send with loopback */
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -218,7 +218,6 @@ static int isotp_send_fc(struct sock *sk
can_skb_reserve(nskb);
can_skb_prv(nskb)->ifindex = dev->ifindex;
- can_skb_prv(nskb)->skbcnt = 0;
nskb->dev = dev;
can_skb_set_owner(nskb, sk);
@@ -773,7 +772,6 @@ static void isotp_send_cframe(struct iso
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
cf = (struct canfd_frame *)skb->data;
skb_put_zero(skb, so->ll.mtu);
@@ -1069,7 +1067,6 @@ static int isotp_sendmsg(struct socket *
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
so->tx.len = size;
so->tx.idx = 0;
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -889,7 +889,6 @@ static struct sk_buff *j1939_sk_alloc_sk
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = ndev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skb_reserve(skb, offsetof(struct can_frame, data));
ret = memcpy_from_msg(skb_put(skb, size), msg, size);
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -608,7 +608,6 @@ sk_buff *j1939_tp_tx_dat_new(struct j193
skb->dev = priv->ndev;
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
/* reserve CAN header */
skb_reserve(skb, offsetof(struct can_frame, data));
@@ -1535,7 +1534,6 @@ j1939_session *j1939_session_fresh_new(s
skb->dev = priv->ndev;
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
skcb = j1939_skb_to_cb(skb);
memcpy(skcb, rel_skcb, sizeof(*skcb));
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -74,8 +74,8 @@ MODULE_ALIAS("can-proto-1");
*/
struct uniqframe {
- int skbcnt;
const struct sk_buff *skb;
+ u32 hash;
unsigned int join_rx_count;
};
@@ -135,7 +135,7 @@ static void raw_rcv(struct sk_buff *oskb
/* eliminate multiple filter matches for the same skb */
if (this_cpu_ptr(ro->uniq)->skb == oskb &&
- this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
+ this_cpu_ptr(ro->uniq)->hash == oskb->hash) {
if (ro->join_filters) {
this_cpu_inc(ro->uniq->join_rx_count);
/* drop frame until all enabled filters matched */
@@ -146,7 +146,7 @@ static void raw_rcv(struct sk_buff *oskb
}
} else {
this_cpu_ptr(ro->uniq)->skb = oskb;
- this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
+ this_cpu_ptr(ro->uniq)->hash = oskb->hash;
this_cpu_ptr(ro->uniq)->join_rx_count = 1;
/* drop first frame to check all enabled filters? */
if (ro->join_filters && ro->count > 1)
@@ -812,7 +812,6 @@ static int raw_sendmsg(struct socket *so
can_skb_reserve(skb);
can_skb_prv(skb)->ifindex = dev->ifindex;
- can_skb_prv(skb)->skbcnt = 0;
err = memcpy_from_msg(skb_put(skb, size), msg, size);
if (err < 0)
next prev parent reply other threads:[~2026-08-25 14:01 UTC|newest]
Thread overview: 64+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-25 13:26 [PATCH 5.10 00/57] 5.10.267-rc1 review Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 01/57] Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 02/57] rndis_host: add overflow check in rndis_rx_fixup() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 03/57] ocfs2: fix missing metadata reservation for large xattrs Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 04/57] ext4: stop retrying saturated xattr cache entries Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 05/57] ext4: clear error before retrying inode xattr space fallback Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 06/57] xfs: validate attr entry pointer before field access Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 07/57] net/x25: fix use-after-free of the socket by its timers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 08/57] mm/huge_memory: fix huge_zero_pfn race Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 09/57] staging: rtl8723bs: fix OOB read in WMM_param_handler() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 10/57] misc: fastrpc: separate fastrpc device from channel context Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 11/57] misc: fastrpc: Rework fastrpc_req_munmap Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 12/57] misc: fastrpc: Remove buffer from list prior to unmap operation Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 13/57] net: ipv4: Publish fib_nlmsg_size() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 14/57] ipv4: Fix fib_nlmsg_size() for RTA_VIA nexthops Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 15/57] NTB: ntb_netdev: Preserve RX queue depth on allocation failure Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 16/57] serial: amba-pl011: synchronize DMA teardown Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 17/57] perf: Fix cgroup state vs ERROR Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 18/57] perf: Fix dangling cgroup pointer in cpuctx Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 19/57] perf/core: Fix group leader use-after-free after sibling detach Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 20/57] packet: use consistent hard_header_len in non-ring send paths Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 21/57] packet: use consistent hard_header_len in TX_RING send path Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 22/57] net/sched: reject overly deep qdisc hierarchies Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 23/57] packet: synchronize pressure clearing with ring reconfiguration Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 24/57] inet: frags: publish queues before arming timer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 25/57] xfs: fix ilock leak on error in xfs_dq_get_next_id Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 26/57] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 27/57] s390/vfio_ccw: Cancel existing workqueues Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 28/57] KVM: arm64: Retry fault if vma_lookup() results become invalid Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 29/57] nfc: digital: clamp SENSF_RES length to the destination buffer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 30/57] nfc: fdp: bound the device-reported read length and fix an skb leak Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 31/57] nfc: microread: validate target discovery payload lengths Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 32/57] nfc: llcp: bound the connect_sn TLV walk to the skb Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 33/57] nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 34/57] nfc: llcp: reject PDUs shorter than the LLCP header Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 35/57] nfc: pn533: purge fragmented skbs during cleanup Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 36/57] nfc: st21nfca: validate ATR_REQ length against the received frame Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 5.10 37/57] nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 38/57] nfc: nci: free destination parameters when closing a connection Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 39/57] xfs: bounds-check buffer log items dirty bitmap Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 40/57] ipv4: reject undersized MTUs in ip_do_fragment() Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 41/57] ipv6: fix use-after-free in ip6_finish_output2() Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 42/57] nvmet-fc: fix invalid free in LS IOD error path Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 43/57] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 44/57] gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 45/57] libceph: fix OOB read in decode_watchers() via missing bounds check Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 46/57] HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 47/57] HID: core: fix OOB read of field->usage in hid_set_field() Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 48/57] Revert "Input: ims-pcu - fix race condition in reset_device sysfs callback" Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 49/57] xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 50/57] iomap: adjust read range correctly for non-block-aligned positions Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 51/57] s390/vfio_ccw: Free all memory if cp_init() fails Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 52/57] bpf: reject negative CO-RE accessor indices in bpf_core_parse_spec() Greg Kroah-Hartman
2026-08-25 13:27 ` Greg Kroah-Hartman [this message]
2026-08-25 13:27 ` [PATCH 5.10 54/57] can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 55/57] HID: core: fix number/pointer type confusion on long items Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 56/57] HID: sensor: custom: Fix use-after-free in enable_sensor Greg Kroah-Hartman
2026-08-25 13:27 ` [PATCH 5.10 57/57] HID: hyperv: validate initial device info bounds Greg Kroah-Hartman
2026-08-25 17:47 ` [PATCH 5.10 00/57] 5.10.267-rc1 review Florian Fainelli
2026-08-25 19:26 ` Pavel Machek
2026-08-25 21:14 ` Woody Suwalski
2026-08-26 5:03 ` Barry K. Nathan
2026-08-26 8:02 ` Dominique Martinet
2026-08-26 10:32 ` Brett A C Sheffield
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260825132543.414661213@linuxfoundation.org \
--to=gregkh@linuxfoundation.org \
--cc=mkl@pengutronix.de \
--cc=pabeni@redhat.com \
--cc=patches@lists.linux.dev \
--cc=socketcan@hartkopp.net \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox