Archive-only list for patches
 help / color / mirror / Atom feed
From: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
To: stable@vger.kernel.org
Cc: Greg Kroah-Hartman <gregkh@linuxfoundation.org>,
	patches@lists.linux.dev, Marc Kleine-Budde <mkl@pengutronix.de>,
	Oliver Hartkopp <socketcan@hartkopp.net>,
	Paolo Abeni <pabeni@redhat.com>
Subject: [PATCH 6.1 72/79] can: use skb hash instead of private variable in headroom
Date: Tue, 25 Aug 2026 15:26:52 +0200	[thread overview]
Message-ID: <20260825132544.496194998@linuxfoundation.org> (raw)
In-Reply-To: <20260825132541.677185791@linuxfoundation.org>

6.1-stable review patch.  If anyone has any objections, please let me know.

------------------

From: Oliver Hartkopp <socketcan@hartkopp.net>

commit d4fb6514ff8ed6912a71294e6b66a5d59ee88007 upstream.

The can_skb_priv::skbcnt variable is used to identify CAN skbs in the RX
path analogue to the skb->hash.

As the skb hash is not filled in CAN skbs move the private skbcnt value to
skb->hash and set skb->sw_hash accordingly. The skb->hash is a value used
for RPS to identify skbs. Use it as intended.

Signed-off-by: Marc Kleine-Budde <mkl@pengutronix.de>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Link: https://patch.msgid.link/20260201-can_skb_ext-v8-1-3635d790fe8b@hartkopp.net
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Signed-off-by: Oliver Hartkopp <socketcan@hartkopp.net>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
 drivers/net/can/dev/skb.c |    2 --
 include/linux/can/core.h  |    1 +
 include/linux/can/skb.h   |    2 --
 net/can/af_can.c          |   14 +++++++++++---
 net/can/bcm.c             |    2 --
 net/can/isotp.c           |    3 ---
 net/can/j1939/socket.c    |    1 -
 net/can/j1939/transport.c |    2 --
 net/can/raw.c             |    7 +++----
 9 files changed, 15 insertions(+), 19 deletions(-)

--- a/drivers/net/can/dev/skb.c
+++ b/drivers/net/can/dev/skb.c
@@ -202,7 +202,6 @@ static void init_can_skb_reserve(struct
 	skb_reset_transport_header(skb);
 
 	can_skb_reserve(skb);
-	can_skb_prv(skb)->skbcnt = 0;
 }
 
 struct sk_buff *alloc_can_skb(struct net_device *dev, struct can_frame **cf)
@@ -312,7 +311,6 @@ static bool can_skb_headroom_valid(struc
 	if (skb->ip_summed == CHECKSUM_NONE) {
 		/* init headroom */
 		can_skb_prv(skb)->ifindex = dev->ifindex;
-		can_skb_prv(skb)->skbcnt = 0;
 
 		skb->ip_summed = CHECKSUM_UNNECESSARY;
 
--- a/include/linux/can/core.h
+++ b/include/linux/can/core.h
@@ -58,6 +58,7 @@ extern void can_rx_unregister(struct net
 			      void *data);
 
 extern int can_send(struct sk_buff *skb, int loop);
+void can_set_skb_uid(struct sk_buff *skb);
 void can_sock_destruct(struct sock *sk);
 
 #endif /* !_CAN_CORE_H */
--- a/include/linux/can/skb.h
+++ b/include/linux/can/skb.h
@@ -49,13 +49,11 @@ bool can_dropped_invalid_skb(struct net_
 /**
  * struct can_skb_priv - private additional data inside CAN sk_buffs
  * @ifindex:	ifindex of the first interface the CAN frame appeared on
- * @skbcnt:	atomic counter to have an unique id together with skb pointer
  * @frame_len:	length of CAN frame in data link layer
  * @cf:		align to the following CAN frame at skb->data
  */
 struct can_skb_priv {
 	int ifindex;
-	int skbcnt;
 	unsigned int frame_len;
 	struct can_frame cf[];
 };
--- a/net/can/af_can.c
+++ b/net/can/af_can.c
@@ -640,6 +640,16 @@ static int can_rcv_filter(struct can_dev
 	return matches;
 }
 
+void can_set_skb_uid(struct sk_buff *skb)
+{
+	/* create non-zero unique skb identifier together with *skb */
+	while (!(skb->hash))
+		skb->hash = atomic_inc_return(&skbcounter);
+
+	skb->sw_hash = 1;
+}
+EXPORT_SYMBOL(can_set_skb_uid);
+
 static void can_receive(struct sk_buff *skb, struct net_device *dev)
 {
 	struct can_dev_rcv_lists *dev_rcv_lists;
@@ -651,9 +661,7 @@ static void can_receive(struct sk_buff *
 	atomic_long_inc(&pkg_stats->rx_frames);
 	atomic_long_inc(&pkg_stats->rx_frames_delta);
 
-	/* create non-zero unique skb identifier together with *skb */
-	while (!(can_skb_prv(skb)->skbcnt))
-		can_skb_prv(skb)->skbcnt = atomic_inc_return(&skbcounter);
+	can_set_skb_uid(skb);
 
 	rcu_read_lock();
 
--- a/net/can/bcm.c
+++ b/net/can/bcm.c
@@ -338,7 +338,6 @@ static void bcm_can_tx(struct bcm_op *op
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 
 	skb_put_data(skb, cf, op->cfsiz);
 
@@ -1582,7 +1581,6 @@ static int bcm_tx_send(struct msghdr *ms
 	}
 
 	can_skb_prv(skb)->ifindex = dev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 	skb->dev = dev;
 	can_skb_set_owner(skb, sk);
 	err = can_send(skb, 1); /* send with loopback */
--- a/net/can/isotp.c
+++ b/net/can/isotp.c
@@ -218,7 +218,6 @@ static int isotp_send_fc(struct sock *sk
 
 	can_skb_reserve(nskb);
 	can_skb_prv(nskb)->ifindex = dev->ifindex;
-	can_skb_prv(nskb)->skbcnt = 0;
 
 	nskb->dev = dev;
 	can_skb_set_owner(nskb, sk);
@@ -773,7 +772,6 @@ static void isotp_send_cframe(struct iso
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 
 	cf = (struct canfd_frame *)skb->data;
 	skb_put_zero(skb, so->ll.mtu);
@@ -1069,7 +1067,6 @@ static int isotp_sendmsg(struct socket *
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 
 	so->tx.len = size;
 	so->tx.idx = 0;
--- a/net/can/j1939/socket.c
+++ b/net/can/j1939/socket.c
@@ -889,7 +889,6 @@ static struct sk_buff *j1939_sk_alloc_sk
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = ndev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 	skb_reserve(skb, offsetof(struct can_frame, data));
 
 	ret = memcpy_from_msg(skb_put(skb, size), msg, size);
--- a/net/can/j1939/transport.c
+++ b/net/can/j1939/transport.c
@@ -613,7 +613,6 @@ sk_buff *j1939_tp_tx_dat_new(struct j193
 	skb->dev = priv->ndev;
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 	/* reserve CAN header */
 	skb_reserve(skb, offsetof(struct can_frame, data));
 
@@ -1553,7 +1552,6 @@ j1939_session *j1939_session_fresh_new(s
 	skb->dev = priv->ndev;
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = priv->ndev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 	skcb = j1939_skb_to_cb(skb);
 	memcpy(skcb, rel_skcb, sizeof(*skcb));
 
--- a/net/can/raw.c
+++ b/net/can/raw.c
@@ -75,8 +75,8 @@ MODULE_ALIAS("can-proto-1");
  */
 
 struct uniqframe {
-	int skbcnt;
 	const struct sk_buff *skb;
+	u32 hash;
 	unsigned int join_rx_count;
 };
 
@@ -140,7 +140,7 @@ static void raw_rcv(struct sk_buff *oskb
 
 	/* eliminate multiple filter matches for the same skb */
 	if (this_cpu_ptr(ro->uniq)->skb == oskb &&
-	    this_cpu_ptr(ro->uniq)->skbcnt == can_skb_prv(oskb)->skbcnt) {
+	    this_cpu_ptr(ro->uniq)->hash == oskb->hash) {
 		if (!ro->join_filters)
 			return;
 
@@ -150,7 +150,7 @@ static void raw_rcv(struct sk_buff *oskb
 			return;
 	} else {
 		this_cpu_ptr(ro->uniq)->skb = oskb;
-		this_cpu_ptr(ro->uniq)->skbcnt = can_skb_prv(oskb)->skbcnt;
+		this_cpu_ptr(ro->uniq)->hash = oskb->hash;
 		this_cpu_ptr(ro->uniq)->join_rx_count = 1;
 		/* drop first frame to check all enabled filters? */
 		if (ro->join_filters && ro->count > 1)
@@ -870,7 +870,6 @@ static int raw_sendmsg(struct socket *so
 
 	can_skb_reserve(skb);
 	can_skb_prv(skb)->ifindex = dev->ifindex;
-	can_skb_prv(skb)->skbcnt = 0;
 
 	/* fill the skb before testing for valid CAN frames */
 	err = memcpy_from_msg(skb_put(skb, size), msg, size);



  parent reply	other threads:[~2026-08-25 13:54 UTC|newest]

Thread overview: 88+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2026-08-25 13:25 [PATCH 6.1 00/79] 6.1.185-rc1 review Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 01/79] PCI: host-generic: Fix NULL pointer dereference on 32-bit CAM systems Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 02/79] Bluetooth: RFCOMM: take rfcomm_mutex for the deferred setup accept Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 03/79] rndis_host: add overflow check in rndis_rx_fixup() Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 04/79] ALSA: dummy: Check card index validity at probe Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 05/79] ocfs2: fix missing metadata reservation for large xattrs Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 06/79] null_blk: fix UBSAN shift-out-of-bounds when zone_size is 0 or overflows Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 07/79] kcov: fix data corruption and race conditions on PREEMPT_RT Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 08/79] ext4: stop retrying saturated xattr cache entries Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 09/79] ext4: clear error before retrying inode xattr space fallback Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 10/79] xfs: validate attr entry pointer before field access Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 11/79] misc: fastrpc: Rework fastrpc_req_munmap Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 12/79] misc: fastrpc: Remove buffer from list prior to unmap operation Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 13/79] NTB: ntb_netdev: Preserve RX queue depth on allocation failure Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 14/79] serial: amba-pl011: synchronize DMA teardown Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 15/79] perf/core: Fix child_total_time_enabled accounting bug at task exit Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 16/79] perf: Fix cgroup state vs ERROR Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 17/79] perf: Fix dangling cgroup pointer in cpuctx Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 18/79] perf/core: Fix group leader use-after-free after sibling detach Greg Kroah-Hartman
2026-08-25 13:25 ` [PATCH 6.1 19/79] packet: use consistent hard_header_len in non-ring send paths Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 20/79] packet: use consistent hard_header_len in TX_RING send path Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 21/79] serial: sc16is7xx: fix copy-paste errors in EFR_SWFLOWx_BIT constants Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 22/79] serial: sc16is7xx: convert bitmask definitions to use BIT() macro Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 23/79] serial: sc16is7xx: rename EFR mutex with generic name Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 24/79] serial: sc16is7xx: use guards for simple mutex locks Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 25/79] serial: sc16is7xx: enable THRI before filling TX FIFO Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 26/79] net/packet: convert po->pressure to an atomic flag Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 27/79] packet: synchronize pressure clearing with ring reconfiguration Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 28/79] inet: frags: publish queues before arming timer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 29/79] mmc: atmel-mci: Fix use-after-free in atmci_remove due to race condition Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 30/79] s390/vfio_ccw: Cancel existing workqueues Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 31/79] drm/amdgpu: disallow multiple FENCE chunks in one submit Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 32/79] s390/vfio_ccw: Move cp cleanup out of not operational Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 33/79] s390/vfio_ccw: Selectively expand io_mutex Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 34/79] s390/vfio_ccw: Implement a crw lock Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 35/79] xfs: dont use a xfs_log_iovec for ri_buf in log recovery Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 36/79] xfs: bounds-check buffer log items dirty bitmap Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 37/79] drm/amdgpu: check ASPM on the dGPU host link Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 38/79] gpio: ml-ioh: use raw_spinlock_t for the register lock Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 39/79] tls: fix lockless read of strp->msg_ready in ->poll Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 40/79] tls: handle data disappearing from under the TLS ULP Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 41/79] iomap: adjust read range correctly for non-block-aligned positions Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 42/79] nfc: digital: clamp SENSF_RES length to the destination buffer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 43/79] nfc: fdp: bound the device-reported read length and fix an skb leak Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 44/79] nfc: microread: validate target discovery payload lengths Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 45/79] nfc: llcp: bound the connect_sn TLV walk to the skb Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 46/79] nfc: llcp: fix OOB read and u8 offset wrap in TLV parsers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 47/79] nfc: llcp: reject PDUs shorter than the LLCP header Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 48/79] nfc: pn533: purge fragmented skbs during cleanup Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 49/79] nfc: st21nfca: validate ATR_REQ length against the received frame Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 50/79] nfc: nci: fix out-of-bounds write in nci_target_auto_activated() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 51/79] nfc: nci: fix uninit-value in the RF discover/activated NTF handlers Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 52/79] nfc: nci: free destination parameters when closing a connection Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 53/79] ndisc: ndisc_send_redirect() cleanup Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 54/79] libceph: fix OOB read in decode_watchers() via missing bounds check Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 55/79] ipv4: reject undersized MTUs in ip_do_fragment() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 56/79] ipv6: fix use-after-free in ip6_finish_output2() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 57/79] nvmet-auth: zero the AUTH_RECEIVE response buffer Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 58/79] nvmet-fc: fix invalid free in LS IOD error path Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 59/79] nvmet-tcp: Do not WARN on remotely-controlled oversized SGL allocations Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 60/79] Input: byd - synchronize timer deletion before freeing private data Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 61/79] ASoC: codecs: lpass-tx-macro: Fix enum kcontrol accesses Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 62/79] mptcp: pm: ADD_ADDR rtx: always decrease sk refcount Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 63/79] mptcp: pm: ADD_ADDR rtx: free sk if last Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 64/79] mptcp: pm: fix data race in add_addr timer callback Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 65/79] HID: magicmouse: do not keep a stale msc->input if no input is claimed Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 66/79] HID: magicmouse: Prevent out-of-bounds (OOB) read during DOUBLE_REPORT_ID Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 67/79] HID: core: fix OOB read of field->usage in hid_set_field() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 68/79] xfrm: fix sk_dst_cache double-free in xfrm_user_policy() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 69/79] s390/vfio_ccw: Free all memory if cp_init() fails Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 70/79] Input: atkbd - skip deactivate for HONOR FMB-Ps internal keyboard Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 71/79] Input: atkbd - skip deactivate for HONOR ZQC-P Greg Kroah-Hartman
2026-08-25 13:26 ` Greg Kroah-Hartman [this message]
2026-08-25 13:26 ` [PATCH 6.1 73/79] can: isotp: fix timer drain order, wakeup handling and tx_gen ordering Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 74/79] misc: fastrpc: Fix double free of buf in error path Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 75/79] HID: nintendo: fix out-of-bounds read in joycon_ctlr_read_handler() Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 76/79] HID: core: fix number/pointer type confusion on long items Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 77/79] HID: sensor: custom: Fix use-after-free in enable_sensor Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 78/79] HID: hyperv: validate initial device info bounds Greg Kroah-Hartman
2026-08-25 13:26 ` [PATCH 6.1 79/79] Bluetooth: hci_event: fix LE list UAF on reset Greg Kroah-Hartman
2026-08-25 19:30 ` [PATCH 6.1 00/79] 6.1.185-rc1 review Pavel Machek
2026-08-25 21:31 ` Florian Fainelli
2026-08-26  0:22 ` Shuah Khan
2026-08-26  6:28 ` Ron Economos
2026-08-26 10:32 ` Brett A C Sheffield
2026-08-26 11:20 ` Peter Schneider
2026-08-26 11:50 ` Miguel Ojeda
2026-08-27  2:40 ` Barry K. Nathan

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=20260825132544.496194998@linuxfoundation.org \
    --to=gregkh@linuxfoundation.org \
    --cc=mkl@pengutronix.de \
    --cc=pabeni@redhat.com \
    --cc=patches@lists.linux.dev \
    --cc=socketcan@hartkopp.net \
    --cc=stable@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox