* [PATCH 01/13 RFC net-next] net: ipv4: introduce CONFIG_IPV4 to decouple the IPv4 stack
From: Fernando Fernandez Mancera @ 2026-07-12 1:38 UTC (permalink / raw)
To: netdev
Cc: davem, edumazet, kuba, pabeni, dsahern, horms, idosch,
Fernando Fernandez Mancera, Jason Gunthorpe, Leon Romanovsky,
Andrew Lunn, Tony Nguyen, Przemek Kitszel, Elad Nachman,
Saeed Mahameed, Tariq Toukan, Mark Bloch, Petr Machata,
Edward Cree, Maxime Coquelin, Alexandre Torgue, Arend van Spriel,
Miri Korenblit, Keith Busch, Jens Axboe, Christoph Hellwig,
Sagi Grimberg, Chaitanya Kulkarni, Saurav Kashyap, Javed Hasan,
GR-QLogic-Storage-Upstream, James E.J. Bottomley,
Martin K. Petersen, Nilesh Javali, Manish Rangankar,
Varun Prakash, Alexander Viro, Christian Brauner, Jan Kara,
David Howells, Marc Dionne, Trond Myklebust, Anna Schumaker,
Chuck Lever, Jeff Layton, NeilBrown, Olga Kornievskaia, Dai Ngo,
Tom Talpey, Marek Lindner, Simon Wunderlich, Antonio Quartulli,
Sven Eckelmann, Nikolay Aleksandrov, Pablo Neira Ayuso,
Florian Westphal, Phil Sutter, Johannes Berg, Matthieu Baerts,
Mat Martineau, Geliang Tang, Julian Anastasov, Aaron Conole,
Eelco Chaudron, Ilya Maximets, Allison Henderson,
Jamal Hadi Salim, Jiri Pirko, Marcelo Ricardo Leitner, Xin Long,
D. Wythe, Dust Li, Sidraya Jayagond, Wenjia Zhang,
Mahanta Jambigi, Tony Lu, Wen Gu, Jon Maloy, Steffen Klassert,
Herbert Xu, Vikas Gupta, Rajashekar Hudumula, Justin Chen,
Bhargava Marreddy, Arnd Bergmann, Nicolai Buchwitz,
Florian Fainelli, Heiner Kallweit, Krzysztof Kozlowski,
Russell King (Oracle), Yao Zi, Yanteng Si, Maxime Chevallier,
Julian Braha, Joey Lu, Shangjuan Wei, Chen-Yu Tsai, Inochi Amaoto,
Lad Prabhakar, Qingfang Deng, Greg Kroah-Hartman, Eric Biggers,
Ethan Nelson-Moore, Ard Biesheuvel, Dmitry Safonov,
Kuniyuki Iwashima, Alyssa Ross, linux-rdma, linux-kernel,
intel-wired-lan, oss-drivers, linux-net-drivers, linux-stm32,
linux-arm-kernel, linux-wireless, brcm80211,
brcm80211-dev-list.pdl, linux-nvme, linux-scsi, target-devel,
linux-fsdevel, linux-afs, linux-nfs, b.a.t.m.a.n, bridge,
netfilter-devel, coreteam, mptcp, lvs-devel, dev, rds-devel,
linux-sctp, linux-s390, tipc-discussion
In-Reply-To: <20260712013941.4570-1-fmancera@suse.de>
Historically, the IPv4 protocol has been linked to the core INET
subsystem. Because shared infrastructure like the TCP/UDP engine,
routing or INET hashtables live inside net/ipv4/, it has been impossible
to compile a kernel with only IPv6 support.
This patch introduces the CONFIG_IPV4 Kconfig symbol, which is set to
'def_bool y' for now. This does not allow to completely disable the
IPv4 stack yet but it lays the necessary build-system work for that
goal.
In addition, multiple subsystems Kconfig symbols across networking
features like tunnels, drivers and filesystems have been adjusted to
depend on IPv4. Keep on mind that follow-up work is required to convert
the Kconfig symbol to bool and remove the dependency on IPv4 where it
makes sense.
Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
---
drivers/infiniband/Kconfig | 2 +-
drivers/net/Kconfig | 24 ++++++++++---------
drivers/net/ethernet/broadcom/Kconfig | 2 ++
drivers/net/ethernet/chelsio/Kconfig | 2 +-
drivers/net/ethernet/intel/Kconfig | 2 ++
drivers/net/ethernet/marvell/prestera/Kconfig | 1 +
.../net/ethernet/mellanox/mlx5/core/Kconfig | 3 ++-
drivers/net/ethernet/mellanox/mlxsw/Kconfig | 1 +
drivers/net/ethernet/netronome/Kconfig | 1 +
drivers/net/ethernet/qlogic/Kconfig | 2 ++
drivers/net/ethernet/sfc/Kconfig | 1 +
drivers/net/ethernet/stmicro/stmmac/Kconfig | 1 +
drivers/net/ethernet/via/Kconfig | 1 +
drivers/net/ppp/Kconfig | 1 +
.../broadcom/brcm80211/brcmfmac/Kconfig | 1 +
drivers/net/wireless/intel/iwlwifi/Kconfig | 1 +
drivers/nvme/host/Kconfig | 2 +-
drivers/nvme/target/Kconfig | 2 +-
drivers/scsi/bnx2fc/Kconfig | 1 +
drivers/scsi/bnx2i/Kconfig | 1 +
drivers/scsi/cxgbi/cxgb3i/Kconfig | 2 +-
drivers/scsi/cxgbi/cxgb4i/Kconfig | 2 +-
drivers/target/iscsi/Kconfig | 2 +-
fs/Kconfig | 1 +
fs/afs/Kconfig | 2 +-
fs/nfs/Kconfig | 2 +-
fs/nfsd/Kconfig | 2 +-
net/Kconfig | 6 ++---
net/batman-adv/Kconfig | 1 +
net/bridge/Kconfig | 3 ++-
net/bridge/netfilter/Kconfig | 6 ++---
net/ipv4/Kconfig | 21 +++++++++++++---
net/ipv4/Makefile | 21 ++++++++--------
net/ipv4/netfilter/Kconfig | 2 +-
net/ipv6/Kconfig | 17 +++++++++----
net/ipv6/netfilter/Kconfig | 2 +-
net/l2tp/Kconfig | 2 +-
net/mac80211/Kconfig | 2 +-
net/mpls/Kconfig | 1 +
net/mptcp/Kconfig | 2 +-
net/netfilter/Kconfig | 2 +-
net/netfilter/ipset/Kconfig | 2 +-
net/netfilter/ipvs/Kconfig | 2 +-
net/openvswitch/Kconfig | 2 +-
net/packet/Kconfig | 1 +
net/rds/Kconfig | 2 +-
net/rxrpc/Kconfig | 2 +-
net/sched/Kconfig | 2 +-
net/sctp/Kconfig | 2 +-
net/smc/Kconfig | 2 +-
net/sunrpc/Kconfig | 2 +-
net/tipc/Kconfig | 2 +-
net/xfrm/Kconfig | 12 ++++++++--
53 files changed, 121 insertions(+), 65 deletions(-)
diff --git a/drivers/infiniband/Kconfig b/drivers/infiniband/Kconfig
index 086195758a8a..e9302002b6ea 100644
--- a/drivers/infiniband/Kconfig
+++ b/drivers/infiniband/Kconfig
@@ -3,7 +3,7 @@ menuconfig INFINIBAND
tristate "InfiniBand support"
depends on HAS_IOMEM && HAS_DMA
depends on NET
- depends on INET
+ depends on INET && IPV4
depends on !ALPHA
select DMA_SHARED_BUFFER
select IRQ_POLL
diff --git a/drivers/net/Kconfig b/drivers/net/Kconfig
index ff79c466712d..8e66b3015698 100644
--- a/drivers/net/Kconfig
+++ b/drivers/net/Kconfig
@@ -40,7 +40,7 @@ if NET_CORE
config BONDING
tristate "Bonding driver support"
- depends on INET
+ depends on INET && IPV4
depends on TLS || TLS_DEVICE=n
help
Say 'Y' or 'M' if you wish to be able to 'bond' multiple Ethernet
@@ -73,7 +73,7 @@ config DUMMY
config WIREGUARD
tristate "WireGuard secure network tunnel"
- depends on NET && INET
+ depends on NET && INET && IPV4
select NET_UDP_TUNNEL
select DST_CACHE
select CRYPTO_LIB_CURVE25519
@@ -102,7 +102,7 @@ config WIREGUARD_DEBUG
config OVPN
tristate "OpenVPN data channel offload"
- depends on NET && INET
+ depends on NET && INET && IPV4
select DST_CACHE
select NET_UDP_TUNNEL
select CRYPTO
@@ -164,6 +164,7 @@ source "drivers/net/team/Kconfig"
config MACVLAN
tristate "MAC-VLAN support"
+ depends on IPV4
help
This allows one to create virtual interfaces that map packets to
or from specific MAC addresses to a particular interface.
@@ -198,7 +199,7 @@ config IPVLAN_L3S
config IPVLAN
tristate "IP-VLAN support"
- depends on INET
+ depends on INET && IPV4
help
This allows one to create virtual devices off of a main interface
and packets will be delivered based on the dest L3 (IPv6/IPv4 addr)
@@ -229,7 +230,7 @@ config IPVTAP
config VXLAN
tristate "Virtual eXtensible Local Area Network (VXLAN)"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
select GRO_CELLS
help
@@ -244,7 +245,7 @@ config VXLAN
config GENEVE
tristate "Generic Network Virtualization Encapsulation"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
select GRO_CELLS
help
@@ -259,7 +260,7 @@ config GENEVE
config BAREUDP
tristate "Bare UDP Encapsulation"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
select GRO_CELLS
help
@@ -271,7 +272,7 @@ config BAREUDP
config GTP
tristate "GPRS Tunneling Protocol datapath (GTP-U)"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
help
This allows one to create gtp virtual interfaces that provide
@@ -288,7 +289,7 @@ config GTP
config PFCP
tristate "Packet Forwarding Control Protocol (PFCP)"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
help
This allows one to create PFCP virtual interfaces that allows to
@@ -301,7 +302,7 @@ config PFCP
config AMT
tristate "Automatic Multicast Tunneling (AMT)"
- depends on INET && IP_MULTICAST
+ depends on INET && IP_MULTICAST && IPV4
select NET_UDP_TUNNEL
help
This allows one to create AMT(Automatic Multicast Tunneling)
@@ -471,6 +472,7 @@ config NETKIT
config NET_VRF
tristate "Virtual Routing and Forwarding (Lite)"
+ depends on IPV4
depends on IP_MULTIPLE_TABLES
depends on NET_L3_MASTER_DEV
depends on IPV6_MULTIPLE_TABLES || IPV6=n
@@ -604,7 +606,7 @@ source "drivers/net/hyperv/Kconfig"
config NETDEVSIM
tristate "Simulated networking device"
depends on DEBUG_FS
- depends on INET
+ depends on INET && IPV4
depends on PSAMPLE || PSAMPLE=n
depends on PTP_1588_CLOCK_MOCK || PTP_1588_CLOCK_MOCK=n
select NET_DEVLINK
diff --git a/drivers/net/ethernet/broadcom/Kconfig b/drivers/net/ethernet/broadcom/Kconfig
index f0bac0dd1439..02469b439127 100644
--- a/drivers/net/ethernet/broadcom/Kconfig
+++ b/drivers/net/ethernet/broadcom/Kconfig
@@ -97,6 +97,7 @@ config BNX2
config CNIC
tristate "QLogic CNIC support"
+ depends on IPV4
depends on PCI
select BNX2
select UIO
@@ -208,6 +209,7 @@ config BNXT
tristate "Broadcom NetXtreme-C/E support"
depends on PCI
depends on PTP_1588_CLOCK_OPTIONAL
+ depends on IPV4
select FW_LOADER
select CRC32
select NET_DEVLINK
diff --git a/drivers/net/ethernet/chelsio/Kconfig b/drivers/net/ethernet/chelsio/Kconfig
index 96d7779cd2f0..c738820688e0 100644
--- a/drivers/net/ethernet/chelsio/Kconfig
+++ b/drivers/net/ethernet/chelsio/Kconfig
@@ -48,7 +48,7 @@ config CHELSIO_T1_1G
config CHELSIO_T3
tristate "Chelsio Communications T3 10Gb Ethernet support"
- depends on PCI && INET
+ depends on PCI && INET && IPV4
select FW_LOADER
select MDIO
help
diff --git a/drivers/net/ethernet/intel/Kconfig b/drivers/net/ethernet/intel/Kconfig
index 288fa8ce53af..d975e41a2b68 100644
--- a/drivers/net/ethernet/intel/Kconfig
+++ b/drivers/net/ethernet/intel/Kconfig
@@ -193,6 +193,7 @@ config IXGBE_DCB
config IXGBE_IPSEC
bool "IPSec XFRM cryptography-offload acceleration"
+ depends on IPV4
depends on IXGBE
depends on XFRM_OFFLOAD
default y
@@ -219,6 +220,7 @@ config IXGBEVF
config IXGBEVF_IPSEC
bool "IPSec XFRM cryptography-offload acceleration"
+ depends on IPV4
depends on IXGBEVF
depends on XFRM_OFFLOAD
default y
diff --git a/drivers/net/ethernet/marvell/prestera/Kconfig b/drivers/net/ethernet/marvell/prestera/Kconfig
index f2f7663c3d10..4c7486c7e706 100644
--- a/drivers/net/ethernet/marvell/prestera/Kconfig
+++ b/drivers/net/ethernet/marvell/prestera/Kconfig
@@ -7,6 +7,7 @@ config PRESTERA
tristate "Marvell Prestera Switch ASICs support"
depends on NET_SWITCHDEV && VLAN_8021Q
depends on BRIDGE || BRIDGE=n
+ depends on IPV4
select NET_DEVLINK
select PHYLINK
help
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
index 925ee25d05b4..86b0884968b6 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlx5/core/Kconfig
@@ -12,6 +12,7 @@ config MLX5_CORE
depends on PTP_1588_CLOCK_OPTIONAL
depends on PCI_HYPERV_INTERFACE || !PCI_HYPERV_INTERFACE
depends on HWMON || !HWMON
+ depends on IPV4
help
Core driver for low level functionality of the ConnectX-4 and
Connect-IB cards by Mellanox Technologies.
@@ -28,7 +29,7 @@ config MLX5_FPGA
config MLX5_CORE_EN
bool "Mellanox 5th generation network adapters (ConnectX series) Ethernet support"
- depends on NETDEVICES && ETHERNET && INET && PCI && MLX5_CORE
+ depends on NETDEVICES && ETHERNET && INET && PCI && MLX5_CORE && IPV4
select PAGE_POOL
select PAGE_POOL_STATS
select DIMLIB
diff --git a/drivers/net/ethernet/mellanox/mlxsw/Kconfig b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
index 2229a2694aa5..d12c33044a1d 100644
--- a/drivers/net/ethernet/mellanox/mlxsw/Kconfig
+++ b/drivers/net/ethernet/mellanox/mlxsw/Kconfig
@@ -53,6 +53,7 @@ config MLXSW_I2C
config MLXSW_SPECTRUM
tristate "Mellanox Technologies Spectrum family support"
+ depends on IPV4
depends on MLXSW_CORE && MLXSW_PCI && NET_SWITCHDEV && VLAN_8021Q
depends on PSAMPLE || PSAMPLE=n
depends on BRIDGE || BRIDGE=n
diff --git a/drivers/net/ethernet/netronome/Kconfig b/drivers/net/ethernet/netronome/Kconfig
index d115d16d4649..2ac3f89e1f26 100644
--- a/drivers/net/ethernet/netronome/Kconfig
+++ b/drivers/net/ethernet/netronome/Kconfig
@@ -18,6 +18,7 @@ if NET_VENDOR_NETRONOME
config NFP
tristate "Netronome(R) NFP4000/NFP6000 NIC driver"
+ depends on IPV4
depends on PCI_MSI
depends on VXLAN || VXLAN=n
depends on TLS && TLS_DEVICE || TLS_DEVICE=n
diff --git a/drivers/net/ethernet/qlogic/Kconfig b/drivers/net/ethernet/qlogic/Kconfig
index 1203353238e5..d198f6add1a8 100644
--- a/drivers/net/ethernet/qlogic/Kconfig
+++ b/drivers/net/ethernet/qlogic/Kconfig
@@ -29,6 +29,7 @@ config QLA3XXX
config QLCNIC
tristate "QLOGIC QLCNIC 1/10Gb Converged Ethernet NIC Support"
depends on PCI
+ depends on IPV4
select FW_LOADER
help
This driver supports QLogic QLE8240 and QLE8242 Converged Ethernet
@@ -68,6 +69,7 @@ config QLCNIC_HWMON
config NETXEN_NIC
tristate "NetXen Multi port (1/10) Gigabit Ethernet NIC"
+ depends on IPV4
depends on PCI
select FW_LOADER
help
diff --git a/drivers/net/ethernet/sfc/Kconfig b/drivers/net/ethernet/sfc/Kconfig
index 979f2801e2a8..d2e32e8ffce8 100644
--- a/drivers/net/ethernet/sfc/Kconfig
+++ b/drivers/net/ethernet/sfc/Kconfig
@@ -18,6 +18,7 @@ if NET_VENDOR_SOLARFLARE
config SFC
tristate "Solarflare SFC9100/EF100-family support"
+ depends on IPV4
depends on PCI
depends on PTP_1588_CLOCK_OPTIONAL
select MDIO
diff --git a/drivers/net/ethernet/stmicro/stmmac/Kconfig b/drivers/net/ethernet/stmicro/stmmac/Kconfig
index e3dd5adda5ac..4ac59a43d71c 100644
--- a/drivers/net/ethernet/stmicro/stmmac/Kconfig
+++ b/drivers/net/ethernet/stmicro/stmmac/Kconfig
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config STMMAC_ETH
tristate "STMicroelectronics Multi-Gigabit Ethernet driver"
+ depends on IPV4
depends on HAS_IOMEM && HAS_DMA
depends on PTP_1588_CLOCK_OPTIONAL
depends on ETHTOOL_NETLINK
diff --git a/drivers/net/ethernet/via/Kconfig b/drivers/net/ethernet/via/Kconfig
index 00773f5e4d7e..a62eb98f2e27 100644
--- a/drivers/net/ethernet/via/Kconfig
+++ b/drivers/net/ethernet/via/Kconfig
@@ -45,6 +45,7 @@ config VIA_RHINE_MMIO
config VIA_VELOCITY
tristate "VIA Velocity support"
+ depends on IPV4
depends on (PCI || (OF_ADDRESS && OF_IRQ))
depends on HAS_DMA
select CRC32
diff --git a/drivers/net/ppp/Kconfig b/drivers/net/ppp/Kconfig
index 4047f13b83dc..16826da75d1e 100644
--- a/drivers/net/ppp/Kconfig
+++ b/drivers/net/ppp/Kconfig
@@ -160,6 +160,7 @@ config PPPOE_HASH_BITS
config PPTP
tristate "PPP over IPv4 (PPTP)"
+ depends on IPV4
depends on NET_IPGRE_DEMUX
select PPPOX
help
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig
index 32794c1eca23..95d685f165ea 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/Kconfig
@@ -1,6 +1,7 @@
config BRCMFMAC
tristate "Broadcom FullMAC WLAN driver"
depends on CFG80211
+ depends on IPV4
select BRCMUTIL
help
This module adds support for wireless adapters based on Broadcom
diff --git a/drivers/net/wireless/intel/iwlwifi/Kconfig b/drivers/net/wireless/intel/iwlwifi/Kconfig
index 153a8368b412..d2efd96cd513 100644
--- a/drivers/net/wireless/intel/iwlwifi/Kconfig
+++ b/drivers/net/wireless/intel/iwlwifi/Kconfig
@@ -2,6 +2,7 @@
config IWLWIFI
tristate "Intel Wireless WiFi Next Gen AGN - Wireless-N/Advanced-N/Ultimate-N (iwlwifi) "
depends on PCI && HAS_IOMEM && CFG80211
+ depends on IPV4
depends on IWLMEI || !IWLMEI
select FW_LOADER
help
diff --git a/drivers/nvme/host/Kconfig b/drivers/nvme/host/Kconfig
index 31974c7dd20c..6e119cf475de 100644
--- a/drivers/nvme/host/Kconfig
+++ b/drivers/nvme/host/Kconfig
@@ -82,7 +82,7 @@ config NVME_FC
config NVME_TCP
tristate "NVM Express over Fabrics TCP host driver"
- depends on INET
+ depends on INET && IPV4
depends on BLOCK
select CRC32
select NET_CRC32C
diff --git a/drivers/nvme/target/Kconfig b/drivers/nvme/target/Kconfig
index 69bde270115e..f731a043f6a9 100644
--- a/drivers/nvme/target/Kconfig
+++ b/drivers/nvme/target/Kconfig
@@ -86,7 +86,7 @@ config NVME_TARGET_FCLOOP
config NVME_TARGET_TCP
tristate "NVMe over Fabrics TCP target support"
- depends on INET
+ depends on INET && IPV4
depends on NVME_TARGET
help
This enables the NVMe TCP target support, which allows exporting NVMe
diff --git a/drivers/scsi/bnx2fc/Kconfig b/drivers/scsi/bnx2fc/Kconfig
index d12eeb13384a..d5065b8fdea9 100644
--- a/drivers/scsi/bnx2fc/Kconfig
+++ b/drivers/scsi/bnx2fc/Kconfig
@@ -1,6 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config SCSI_BNX2X_FCOE
tristate "QLogic FCoE offload support"
+ depends on IPV4
depends on PCI
depends on LIBFC
depends on LIBFCOE
diff --git a/drivers/scsi/bnx2i/Kconfig b/drivers/scsi/bnx2i/Kconfig
index e649a04fab1d..0458e4811731 100644
--- a/drivers/scsi/bnx2i/Kconfig
+++ b/drivers/scsi/bnx2i/Kconfig
@@ -2,6 +2,7 @@
config SCSI_BNX2_ISCSI
tristate "QLogic NetXtreme II iSCSI support"
depends on NET
+ depends on IPV4
depends on PCI
select SCSI_ISCSI_ATTRS
select NETDEVICES
diff --git a/drivers/scsi/cxgbi/cxgb3i/Kconfig b/drivers/scsi/cxgbi/cxgb3i/Kconfig
index 143e881ec77e..abb4a462cb37 100644
--- a/drivers/scsi/cxgbi/cxgb3i/Kconfig
+++ b/drivers/scsi/cxgbi/cxgb3i/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config SCSI_CXGB3_ISCSI
tristate "Chelsio T3 iSCSI support"
- depends on PCI && INET
+ depends on PCI && INET && IPV4
select NETDEVICES
select ETHERNET
select NET_VENDOR_CHELSIO
diff --git a/drivers/scsi/cxgbi/cxgb4i/Kconfig b/drivers/scsi/cxgbi/cxgb4i/Kconfig
index dd1c8ff36b00..04b3e7b053dc 100644
--- a/drivers/scsi/cxgbi/cxgb4i/Kconfig
+++ b/drivers/scsi/cxgbi/cxgb4i/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config SCSI_CXGB4_ISCSI
tristate "Chelsio T4 iSCSI support"
- depends on PCI && INET
+ depends on PCI && INET && IPV4
depends on PTP_1588_CLOCK_OPTIONAL
depends on THERMAL || !THERMAL
depends on ETHERNET
diff --git a/drivers/target/iscsi/Kconfig b/drivers/target/iscsi/Kconfig
index 70d76f3dd693..362edff80c15 100644
--- a/drivers/target/iscsi/Kconfig
+++ b/drivers/target/iscsi/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config ISCSI_TARGET
tristate "SCSI Target Mode Stack"
- depends on INET
+ depends on INET && IPV4
select CRC32
select CRYPTO
select CRYPTO_HASH
diff --git a/fs/Kconfig b/fs/Kconfig
index cf6ae64776e6..20199c1cc93a 100644
--- a/fs/Kconfig
+++ b/fs/Kconfig
@@ -360,6 +360,7 @@ config GRACE_PERIOD
config LOCKD
tristate
+ depends on IPV4
depends on FILE_LOCKING
select CRC32
select GRACE_PERIOD
diff --git a/fs/afs/Kconfig b/fs/afs/Kconfig
index 682bd8ec2c10..e7ed46426f81 100644
--- a/fs/afs/Kconfig
+++ b/fs/afs/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config AFS_FS
tristate "Andrew File System support (AFS)"
- depends on INET
+ depends on INET && IPV4
select AF_RXRPC
select DNS_RESOLVER
select NETFS_SUPPORT
diff --git a/fs/nfs/Kconfig b/fs/nfs/Kconfig
index 6bb30543eff0..52efd3664d21 100644
--- a/fs/nfs/Kconfig
+++ b/fs/nfs/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config NFS_FS
tristate "NFS client support"
- depends on INET && FILE_LOCKING && MULTIUSER
+ depends on INET && FILE_LOCKING && MULTIUSER && IPV4
select CRC32
select LOCKD
select SUNRPC
diff --git a/fs/nfsd/Kconfig b/fs/nfsd/Kconfig
index ffb76761d6a8..153a9918214d 100644
--- a/fs/nfsd/Kconfig
+++ b/fs/nfsd/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config NFSD
tristate "NFS server support"
- depends on INET
+ depends on INET && IPV4
depends on FILE_LOCKING
depends on FSNOTIFY
select CRC32
diff --git a/net/Kconfig b/net/Kconfig
index e38477393551..27de9e69b5f7 100644
--- a/net/Kconfig
+++ b/net/Kconfig
@@ -385,7 +385,7 @@ menu "Network testing"
config NET_PKTGEN
tristate "Packet Generator (USE WITH CAUTION)"
- depends on INET && PROC_FS
+ depends on INET && IPV4 && PROC_FS
help
This module will inject preconfigured packets, at a configurable
rate, out of a given interface. It is used for network interface
@@ -452,7 +452,7 @@ config LWTUNNEL
config LWTUNNEL_BPF
bool "Execute BPF program as route nexthop action"
- depends on LWTUNNEL && INET
+ depends on LWTUNNEL && INET && IPV4
default y if LWTUNNEL=y
help
Allows to run BPF programs as a nexthop action following a route
@@ -474,7 +474,7 @@ config NET_IEEE8021Q_HELPERS
config NET_SELFTESTS
def_tristate PHYLIB
- depends on PHYLIB && INET
+ depends on PHYLIB && INET && IPV4
config NET_SOCK_MSG
bool
diff --git a/net/batman-adv/Kconfig b/net/batman-adv/Kconfig
index 58c408b7a7d9..60ad4b09be6e 100644
--- a/net/batman-adv/Kconfig
+++ b/net/batman-adv/Kconfig
@@ -9,6 +9,7 @@
config BATMAN_ADV
tristate "B.A.T.M.A.N. Advanced Meshing Protocol"
+ depends on IPV4
select CRC32
help
B.A.T.M.A.N. (better approach to mobile ad-hoc networking) is
diff --git a/net/bridge/Kconfig b/net/bridge/Kconfig
index 318715c8fc9b..421892a03129 100644
--- a/net/bridge/Kconfig
+++ b/net/bridge/Kconfig
@@ -7,6 +7,7 @@ config BRIDGE
tristate "802.1d Ethernet Bridging"
select LLC
select STP
+ depends on IPV4
help
If you say Y here, then your Linux box will be able to act as an
Ethernet bridge, which means that the different Ethernet segments it
@@ -36,7 +37,7 @@ config BRIDGE
config BRIDGE_IGMP_SNOOPING
bool "IGMP/MLD snooping"
depends on BRIDGE
- depends on INET
+ depends on INET && IPV4
default y
help
If you say Y here, then the Ethernet bridge will be able selectively
diff --git a/net/bridge/netfilter/Kconfig b/net/bridge/netfilter/Kconfig
index 4fd5a6ea26b4..003f055f8cfe 100644
--- a/net/bridge/netfilter/Kconfig
+++ b/net/bridge/netfilter/Kconfig
@@ -4,7 +4,7 @@
#
#
menuconfig NF_TABLES_BRIDGE
- depends on BRIDGE && NETFILTER && NF_TABLES
+ depends on BRIDGE && NETFILTER && NF_TABLES && IPV4
select NETFILTER_FAMILY_BRIDGE
tristate "Ethernet Bridge nf_tables support"
@@ -43,7 +43,7 @@ config NF_CONNTRACK_BRIDGE
config BRIDGE_NF_EBTABLES_LEGACY
tristate "Legacy EBTABLES support"
depends on BRIDGE && NETFILTER_XTABLES_LEGACY
- depends on NETFILTER_XTABLES
+ depends on NETFILTER_XTABLES && IPV4
default n
help
Legacy ebtables packet/frame classifier.
@@ -52,7 +52,7 @@ config BRIDGE_NF_EBTABLES_LEGACY
menuconfig BRIDGE_NF_EBTABLES
tristate "Ethernet Bridge tables (ebtables) support"
- depends on BRIDGE && NETFILTER && NETFILTER_XTABLES
+ depends on BRIDGE && NETFILTER && NETFILTER_XTABLES && IPV4
select NETFILTER_FAMILY_BRIDGE
help
ebtables is a general, extensible frame/packet identification
diff --git a/net/ipv4/Kconfig b/net/ipv4/Kconfig
index 301b47660305..51bf05d9770c 100644
--- a/net/ipv4/Kconfig
+++ b/net/ipv4/Kconfig
@@ -2,6 +2,9 @@
#
# IP configuration
#
+config IPV4
+ def_bool y
+
config IP_MULTICAST
bool "IP: multicasting"
help
@@ -62,7 +65,7 @@ config IP_FIB_TRIE_STATS
config IP_MULTIPLE_TABLES
bool "IP: policy routing"
- depends on IP_ADVANCED_ROUTER
+ depends on IPV4 && IP_ADVANCED_ROUTER
select FIB_RULES
help
Normally, a router decides what to do with a received packet based
@@ -105,6 +108,7 @@ config IP_ROUTE_CLASSID
config IP_PNP
bool "IP: kernel level autoconfiguration"
+ depends on IPV4
help
This enables automatic configuration of IP addresses of devices and
of the routing table during kernel boot, based on either information
@@ -161,6 +165,7 @@ config IP_PNP_RARP
config NET_IPIP
tristate "IP: tunneling"
+ depends on IPV4
select INET_TUNNEL
select NET_IP_TUNNEL
help
@@ -185,12 +190,14 @@ config NET_IPGRE_DEMUX
config NET_IP_TUNNEL
tristate
+ depends on IPV4
select DST_CACHE
select GRO_CELLS
default n
config NET_IPGRE
tristate "IP: GRE tunnels over IP"
+ depends on IPV4
depends on NET_IPGRE_DEMUX
select NET_IP_TUNNEL
help
@@ -219,7 +226,7 @@ config IP_MROUTE_COMMON
config IP_MROUTE
bool "IP: multicast routing"
- depends on IP_MULTICAST
+ depends on IP_MULTICAST && IPV4
select IP_MROUTE_COMMON
help
This is used if you want your machine to act as a router for IP
@@ -267,6 +274,7 @@ config IP_PIMSM_V2
config SYN_COOKIES
bool "IP: TCP syncookie support"
+ depends on IPV4
help
Normal TCP/IP networking is open to an attack known as "SYN
flooding". This denial-of-service attack prevents legitimate remote
@@ -303,6 +311,7 @@ config SYN_COOKIES
config NET_IPVTI
tristate "Virtual (secure) IP: tunneling"
+ depends on IPV4
select INET_TUNNEL
select NET_IP_TUNNEL
select XFRM
@@ -315,11 +324,13 @@ config NET_IPVTI
config NET_UDP_TUNNEL
tristate
+ depends on IPV4
select NET_IP_TUNNEL
default n
config NET_FOU
tristate "IP: Foo (IP protocols) over UDP"
+ depends on IPV4
select NET_UDP_TUNNEL
help
Foo over UDP allows any IP protocol to be directly encapsulated
@@ -338,6 +349,7 @@ config NET_FOU_IP_TUNNELS
config INET_AH
tristate "IP: AH transformation"
+ depends on IPV4
select XFRM_AH
help
Support for IPsec AH (Authentication Header).
@@ -353,6 +365,7 @@ config INET_AH
config INET_ESP
tristate "IP: ESP transformation"
+ depends on IPV4
select XFRM_ESP
help
Support for IPsec ESP (Encapsulating Security Payload).
@@ -393,6 +406,7 @@ config INET_ESPINTCP
config INET_IPCOMP
tristate "IP: IPComp transformation"
+ depends on IPV4
select INET_XFRM_TUNNEL
select XFRM_IPCOMP
help
@@ -747,7 +761,7 @@ config TCP_AO
select CRYPTO_LIB_SHA1
select CRYPTO_LIB_SHA256
select CRYPTO_LIB_UTILS
- depends on 64BIT # seq-number extension needs WRITE_ONCE(u64)
+ depends on IPV4 && 64BIT # seq-number extension needs WRITE_ONCE(u64)
help
TCP-AO specifies the use of stronger Message Authentication Codes (MACs),
protects against replays for long-lived TCP connections, and
@@ -758,6 +772,7 @@ config TCP_AO
config TCP_MD5SIG
bool "TCP: MD5 Signature Option support (RFC2385)"
+ depends on IPV4
select CRYPTO_LIB_MD5
select CRYPTO_LIB_UTILS
help
diff --git a/net/ipv4/Makefile b/net/ipv4/Makefile
index 06e21c26b76f..8b148be79fa4 100644
--- a/net/ipv4/Makefile
+++ b/net/ipv4/Makefile
@@ -3,18 +3,17 @@
# Makefile for the Linux TCP/IP (INET) layer.
#
-obj-y := route.o inetpeer.o protocol.o \
- ip_input.o ip_fragment.o ip_forward.o ip_options.o \
- ip_output.o ip_sockglue.o inet_hashtables.o \
- inet_timewait_sock.o inet_connection_sock.o \
- tcp.o tcp_input.o tcp_output.o tcp_timer.o tcp_ipv4.o \
+obj-y := inetpeer.o protocol.o inet_hashtables.o inet_timewait_sock.o \
+ inet_connection_sock.o tcp.o tcp_input.o tcp_output.o tcp_timer.o \
tcp_minisocks.o tcp_cong.o tcp_metrics.o tcp_fastopen.o \
- tcp_recovery.o tcp_ulp.o \
- tcp_offload.o tcp_plb.o datagram.o raw.o udp.o \
- udp_offload.o arp.o icmp.o devinet.o af_inet.o igmp.o \
- fib_frontend.o fib_semantics.o fib_trie.o fib_notifier.o \
- inet_fragment.o ping.o ip_tunnel_core.o gre_offload.o \
- metrics.o netlink.o nexthop.o udp_tunnel_stub.o
+ tcp_recovery.o tcp_ulp.o tcp_offload.o tcp_plb.o raw.o udp.o \
+ udp_offload.o af_inet.o inet_fragment.o ping.o ip_tunnel_core.o \
+ gre_offload.o metrics.o netlink.o nexthop.o udp_tunnel_stub.o
+
+obj-$(CONFIG_IPV4) += route.o ip_input.o ip_fragment.o ip_forward.o ip_options.o \
+ ip_sockglue.o tcp_ipv4.o datagram.o icmp.o arp.o devinet.o \
+ igmp.o fib_notifier.o ip_output.o fib_frontend.o \
+ fib_semantics.o fib_trie.o
obj-$(CONFIG_NET_IP_TUNNEL) += ip_tunnel.o
obj-$(CONFIG_SYSCTL) += sysctl_net_ipv4.o
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 7dc9772fe2d8..ab4fa6a6d453 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -4,7 +4,7 @@
#
menu "IP: Netfilter Configuration"
- depends on INET && NETFILTER
+ depends on INET && NETFILTER && IPV4
config NF_DEFRAG_IPV4
tristate
diff --git a/net/ipv6/Kconfig b/net/ipv6/Kconfig
index c3806c6ac96f..f83efc1505cc 100644
--- a/net/ipv6/Kconfig
+++ b/net/ipv6/Kconfig
@@ -47,6 +47,7 @@ config IPV6_OPTIMISTIC_DAD
config INET6_AH
tristate "IPv6: AH transformation"
select XFRM_AH
+ depends on IPV4
help
Support for IPsec AH (Authentication Header).
@@ -61,6 +62,7 @@ config INET6_AH
config INET6_ESP
tristate "IPv6: ESP transformation"
+ depends on IPV4
select XFRM_ESP
help
Support for IPsec ESP (Encapsulating Security Payload).
@@ -101,6 +103,7 @@ config INET6_ESPINTCP
config INET6_IPCOMP
tristate "IPv6: IPComp transformation"
+ depends on IPV4
select INET6_XFRM_TUNNEL
select XFRM_IPCOMP
help
@@ -111,6 +114,7 @@ config INET6_IPCOMP
config IPV6_MIP6
tristate "IPv6: Mobility"
+ depends on IPV4
select XFRM
help
Support for IPv6 Mobility described in RFC 3775.
@@ -119,6 +123,7 @@ config IPV6_MIP6
config IPV6_ILA
tristate "IPv6: Identifier Locator Addressing (ILA)"
+ depends on IPV4
depends on NETFILTER
select DST_CACHE
select LWTUNNEL
@@ -149,6 +154,7 @@ config INET6_TUNNEL
config IPV6_VTI
tristate "Virtual (secure) IPv6: tunneling"
+ depends on IPV4
select IPV6_TUNNEL
select NET_IP_TUNNEL
select XFRM
@@ -161,6 +167,7 @@ config IPV6_VTI
config IPV6_SIT
tristate "IPv6: IPv6-in-IPv4 tunnel (SIT driver)"
+ depends on IPV4
select INET_TUNNEL
select NET_IP_TUNNEL
select IPV6_NDISC_NODETYPE
@@ -198,6 +205,7 @@ config IPV6_NDISC_NODETYPE
config IPV6_TUNNEL
tristate "IPv6: IP-in-IPv6 tunnel (RFC2473)"
+ depends on IPV4
select INET6_TUNNEL
select DST_CACHE
select GRO_CELLS
@@ -209,6 +217,7 @@ config IPV6_TUNNEL
config IPV6_GRE
tristate "IPv6: GRE tunnel"
+ depends on IPV4
select IPV6_TUNNEL
select NET_IP_TUNNEL
depends on NET_IPGRE_DEMUX
@@ -256,7 +265,7 @@ config IPV6_SUBTREES
config IPV6_MROUTE
bool "IPv6: multicast routing"
- depends on IPV6
+ depends on IPV4 && IPV6
select IP_MROUTE_COMMON
help
Support for IPv6 multicast forwarding.
@@ -285,7 +294,7 @@ config IPV6_PIMSM_V2
config IPV6_SEG6_LWTUNNEL
bool "IPv6: Segment Routing Header encapsulation support"
- depends on IPV6
+ depends on IPV4 && IPV6
select LWTUNNEL
select DST_CACHE
select IPV6_MULTIPLE_TABLES
@@ -316,7 +325,7 @@ config IPV6_SEG6_BPF
config IPV6_RPL_LWTUNNEL
bool "IPv6: RPL Source Routing Header support"
- depends on IPV6
+ depends on IPV4 && IPV6
select LWTUNNEL
select DST_CACHE
help
@@ -327,7 +336,7 @@ config IPV6_RPL_LWTUNNEL
config IPV6_IOAM6_LWTUNNEL
bool "IPv6: IOAM Pre-allocated Trace insertion support"
- depends on IPV6
+ depends on IPV4 && IPV6
select LWTUNNEL
select DST_CACHE
help
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index 81daf82ddc2d..f99a2176bf3d 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -4,7 +4,7 @@
#
menu "IPv6: Netfilter Configuration"
- depends on INET && IPV6 && NETFILTER
+ depends on INET && IPV6 && NETFILTER && IPV4
# old sockopt interface and eval loop
config IP6_NF_IPTABLES_LEGACY
diff --git a/net/l2tp/Kconfig b/net/l2tp/Kconfig
index 0de178d5baba..e92cf6d94135 100644
--- a/net/l2tp/Kconfig
+++ b/net/l2tp/Kconfig
@@ -5,7 +5,7 @@
menuconfig L2TP
tristate "Layer Two Tunneling Protocol (L2TP)"
- depends on INET
+ depends on INET && IPV4
select NET_UDP_TUNNEL
help
Layer Two Tunneling Protocol
diff --git a/net/mac80211/Kconfig b/net/mac80211/Kconfig
index d6bc295e23a1..ec485da28373 100644
--- a/net/mac80211/Kconfig
+++ b/net/mac80211/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config MAC80211
tristate "Generic IEEE 802.11 Networking Stack (mac80211)"
- depends on CFG80211
+ depends on CFG80211 && IPV4
select CRYPTO
select CRYPTO_LIB_AES_CBC_MACS
select CRYPTO_LIB_ARC4
diff --git a/net/mpls/Kconfig b/net/mpls/Kconfig
index d672ab72ab12..541ba192e2a1 100644
--- a/net/mpls/Kconfig
+++ b/net/mpls/Kconfig
@@ -25,6 +25,7 @@ config NET_MPLS_GSO
config MPLS_ROUTING
tristate "MPLS: routing support"
+ depends on IPV4
depends on NET_IP_TUNNEL || NET_IP_TUNNEL=n
depends on PROC_SYSCTL
help
diff --git a/net/mptcp/Kconfig b/net/mptcp/Kconfig
index be71fc9b4638..c5b660fdda4c 100644
--- a/net/mptcp/Kconfig
+++ b/net/mptcp/Kconfig
@@ -1,7 +1,7 @@
config MPTCP
bool "MPTCP: Multipath TCP"
- depends on INET
+ depends on INET && IPV4
select SKB_EXTENSIONS
select CRYPTO_LIB_SHA256
select CRYPTO_LIB_UTILS
diff --git a/net/netfilter/Kconfig b/net/netfilter/Kconfig
index 4c04cd8d40a2..3ee9bb726e40 100644
--- a/net/netfilter/Kconfig
+++ b/net/netfilter/Kconfig
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0-only
menu "Core Netfilter Configuration"
- depends on INET && NETFILTER
+ depends on INET && IPV4 && NETFILTER
config NETFILTER_INGRESS
bool "Netfilter ingress support"
diff --git a/net/netfilter/ipset/Kconfig b/net/netfilter/ipset/Kconfig
index 6c4d54758106..e6537c842a45 100644
--- a/net/netfilter/ipset/Kconfig
+++ b/net/netfilter/ipset/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
menuconfig IP_SET
tristate "IP set support"
- depends on INET && NETFILTER
+ depends on INET && IPV4 && NETFILTER
select NETFILTER_NETLINK
help
This option adds IP set support to the kernel.
diff --git a/net/netfilter/ipvs/Kconfig b/net/netfilter/ipvs/Kconfig
index 7724cb44e6de..fb09218d84d0 100644
--- a/net/netfilter/ipvs/Kconfig
+++ b/net/netfilter/ipvs/Kconfig
@@ -4,7 +4,7 @@
#
menuconfig IP_VS
tristate "IP virtual server support"
- depends on INET && NETFILTER
+ depends on INET && NETFILTER && IPV4
depends on (NF_CONNTRACK || NF_CONNTRACK=n)
help
IP Virtual Server support will let you build a high-performance
diff --git a/net/openvswitch/Kconfig b/net/openvswitch/Kconfig
index e6aaee92dba4..5931c28ef965 100644
--- a/net/openvswitch/Kconfig
+++ b/net/openvswitch/Kconfig
@@ -5,7 +5,7 @@
config OPENVSWITCH
tristate "Open vSwitch"
- depends on INET
+ depends on INET && IPV4
depends on !NF_CONNTRACK || \
(NF_CONNTRACK && ((!NF_DEFRAG_IPV6 || NF_DEFRAG_IPV6) && \
(!NF_NAT || NF_NAT) && \
diff --git a/net/packet/Kconfig b/net/packet/Kconfig
index 2997382d597c..00fda9e08cb0 100644
--- a/net/packet/Kconfig
+++ b/net/packet/Kconfig
@@ -5,6 +5,7 @@
config PACKET
tristate "Packet socket"
+ depends on IPV4
help
The Packet protocol is used by applications which communicate
directly with network devices without an intermediate network
diff --git a/net/rds/Kconfig b/net/rds/Kconfig
index f007730aa2bb..d33cf3d89632 100644
--- a/net/rds/Kconfig
+++ b/net/rds/Kconfig
@@ -2,7 +2,7 @@
config RDS
tristate "The Reliable Datagram Sockets Protocol"
- depends on INET
+ depends on INET && IPV4
help
The RDS (Reliable Datagram Sockets) protocol provides reliable,
sequenced delivery of datagrams over Infiniband or TCP.
diff --git a/net/rxrpc/Kconfig b/net/rxrpc/Kconfig
index 2cebb666dc07..2029d2d1065f 100644
--- a/net/rxrpc/Kconfig
+++ b/net/rxrpc/Kconfig
@@ -5,7 +5,7 @@
config AF_RXRPC
tristate "RxRPC session sockets"
- depends on INET
+ depends on INET && IPV4
select CRYPTO
select CRYPTO_LIB_DES if RXKAD
select KEYS
diff --git a/net/sched/Kconfig b/net/sched/Kconfig
index 6ddff028b81a..bb782822c3fb 100644
--- a/net/sched/Kconfig
+++ b/net/sched/Kconfig
@@ -807,7 +807,7 @@ config NET_ACT_SKBEDIT
config NET_ACT_CSUM
tristate "Checksum Updating"
- depends on NET_CLS_ACT && INET
+ depends on NET_CLS_ACT && INET && IPV4
select NET_CRC32C
help
Say Y here to update some common checksum after some direct
diff --git a/net/sctp/Kconfig b/net/sctp/Kconfig
index fc989a3791b3..eb3e2bf1ec3a 100644
--- a/net/sctp/Kconfig
+++ b/net/sctp/Kconfig
@@ -5,7 +5,7 @@
menuconfig IP_SCTP
tristate "The SCTP Protocol"
- depends on INET
+ depends on INET && IPV4
select CRYPTO_LIB_SHA1
select CRYPTO_LIB_SHA256
select CRYPTO_LIB_UTILS
diff --git a/net/smc/Kconfig b/net/smc/Kconfig
index 277ef504bc26..52005e4bf77d 100644
--- a/net/smc/Kconfig
+++ b/net/smc/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config SMC
tristate "SMC socket protocol family"
- depends on INET && INFINIBAND && DIBS
+ depends on INET && INFINIBAND && DIBS && IPV4
help
SMC-R provides a "sockets over RDMA" solution making use of
RDMA over Converged Ethernet (RoCE) technology to upgrade
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index e7808e5714dc..58e6f6db3100 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -1,7 +1,7 @@
# SPDX-License-Identifier: GPL-2.0-only
config SUNRPC
tristate
- depends on MULTIUSER
+ depends on MULTIUSER && IPV4
config SUNRPC_GSS
tristate
diff --git a/net/tipc/Kconfig b/net/tipc/Kconfig
index 18f62135e47b..869e3fe961f9 100644
--- a/net/tipc/Kconfig
+++ b/net/tipc/Kconfig
@@ -5,7 +5,7 @@
menuconfig TIPC
tristate "The TIPC Protocol"
- depends on INET
+ depends on INET && IPV4
help
The Transparent Inter Process Communication (TIPC) protocol is
specially designed for intra cluster communication. This protocol
diff --git a/net/xfrm/Kconfig b/net/xfrm/Kconfig
index 4a62817a88f8..2e4d466c7bd3 100644
--- a/net/xfrm/Kconfig
+++ b/net/xfrm/Kconfig
@@ -4,7 +4,7 @@
#
config XFRM
bool
- depends on INET
+ depends on INET && IPV4
select GRO_CELLS
select SKB_EXTENSIONS
@@ -13,6 +13,7 @@ config XFRM_OFFLOAD
config XFRM_ALGO
tristate
+ depends on IPV4
select XFRM
select CRYPTO
select CRYPTO_AEAD
@@ -23,6 +24,7 @@ if INET
config XFRM_USER
tristate "Transformation user configuration interface"
select XFRM_ALGO
+ depends on IPV4
help
Support for Transformation(XFRM) user configuration interface
like IPsec used by native Linux tools.
@@ -42,7 +44,7 @@ config XFRM_USER_COMPAT
config XFRM_INTERFACE
tristate "Transformation virtual interface"
- depends on XFRM && IPV6
+ depends on XFRM && IPV4 && IPV6
help
This provides a virtual interface to route IPsec traffic.
@@ -83,6 +85,7 @@ config XFRM_STATISTICS
# RFC 8221 lists as MUST be implemented.
config XFRM_AH
tristate
+ depends on IPV4
select XFRM_ALGO
select CRYPTO
select CRYPTO_HMAC
@@ -92,6 +95,7 @@ config XFRM_AH
# algorithms that RFC 8221 lists as MUST be implemented.
config XFRM_ESP
tristate
+ depends on IPV4
select XFRM_ALGO
select CRYPTO
select CRYPTO_AES
@@ -105,12 +109,14 @@ config XFRM_ESP
config XFRM_IPCOMP
tristate
+ depends on IPV4
select XFRM_ALGO
select CRYPTO
select CRYPTO_DEFLATE
config NET_KEY
tristate "PF_KEY sockets (deprecated)"
+ depends on IPV4
select XFRM_ALGO
help
PF_KEYv2 socket family, compatible to KAME ones.
@@ -140,6 +146,7 @@ config NET_KEY_MIGRATE
config XFRM_IPTFS
tristate "IPsec IP-TFS/AGGFRAG (RFC 9347) encapsulation support"
+ depends on IPV4
depends on XFRM
help
Information on the IP-TFS/AGGFRAG encapsulation can be found
@@ -156,5 +163,6 @@ config XFRM_IPTFS
config XFRM_ESPINTCP
bool
+ depends on IPV4
endif # INET
--
2.54.0
^ permalink raw reply related
* Re: [PATCH rtw-next v2 1/9] wifi: rtw89: coex: Add Init info version 10
From: Ping-Ke Shih @ 2026-07-12 1:26 UTC (permalink / raw)
To: Ping-Ke Shih, linux-wireless; +Cc: ku920601
In-Reply-To: <20260706025445.18428-2-pkshih@realtek.com>
Ping-Ke Shih <pkshih@realtek.com> wrote:
> From: Ching-Te Ku <ku920601@realtek.com>
>
> The version 10 Init info add I/O offload type & variable Bluetooth
> function (EX: Zigbee/Thread...etc) into the structure definition.
> Firmware need to synchronize these information to do corresponding
> setting.
>
> Signed-off-by: Ching-Te Ku <ku920601@realtek.com>
> Signed-off-by: Ping-Ke Shih <pkshih@realtek.com>
9 patch(es) applied to rtw-next branch of rtw.git, thanks.
0b79ae7b09a8 wifi: rtw89: coex: Add Init info version 10
c595e0a0958c wifi: rtw89: coex: add rtw89_btc_init() entry for initialization once
2c5af470819b wifi: rtw89: coex: Update TDMA descriptor for dual MAC
2b497ba92abe wifi: rtw89: coex: Add Bluetooth binding for Bluetooth TX power setting
fe8f6ddb9095 wifi: rtw89: coex: Add Bluetooth binding for Bluetooth RX gain setting
564dd7a95047 wifi: rtw89: coex: Add WiFi/Bluetooth adapter binding info
3244261af915 wifi: rtw89: coex: Add TDMA binding for dual MAC
36f90091ee57 wifi: rtw89: coex: Update scoreboard related logic for dual Bluetooth
d01bcd34dd98 wifi: rtw89: coex: Add Co-RX logic
---
https://github.com/pkshih/rtw.git
^ permalink raw reply
* [PATCH wireless] wifi: mac80211: tear down new links on vif update error path
From: Xiang Mei @ 2026-07-11 21:03 UTC (permalink / raw)
To: Johannes Berg
Cc: Benjamin Berg, Gregory Greenman, linux-wireless, linux-kernel,
Weiming Shi, Xiang Mei
When ieee80211_vif_update_links() adds new links it allocates a link
container for each and calls ieee80211_link_init() (which registers the
per-link debugfs files with file->private_data pointing into the container)
and ieee80211_link_setup(). If the subsequent drv_change_vif_links() fails,
the error path restores the old pointers and jumps to 'free', which frees
the new containers but never removes their debugfs entries or stops the
links. The debugfs files survive with file->private_data dangling at the
freed container, so a later open()+read() (e.g. link-1/txpower)
dereferences freed memory in ieee80211_if_read_link(), a use-after-free.
The removal path already dismantles links correctly via
ieee80211_tear_down_links(), which removes each link's keys and debugfs
entries and calls ieee80211_link_stop(); the add path on the error branch
does not. Commit be1ba9ed221f ("wifi: mac80211: avoid weird state in error
path") hardened this same error path for the link-removal case
(new_links == 0) but left the newly-added links' teardown unaddressed.
drv_change_vif_links() can fail at runtime on MLO drivers (internal
allocation / queue / firmware command failures).
Remove the new links' debugfs entries and stop them before freeing.
BUG: KASAN: slab-use-after-free in ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)
Read of size 8 at addr ffff888011290000 by task exploit/145
Call Trace:
...
ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)
short_proxy_read (fs/debugfs/file.c:373)
vfs_read (fs/read_write.c:572)
ksys_read (fs/read_write.c:716)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
...
Oops: general protection fault, probably for non-canonical address 0xdffffc000000000a
RIP: 0010:ieee80211_if_read_link (net/mac80211/debugfs_netdev.c:127)
Kernel panic - not syncing: Fatal exception
Fixes: 170cd6a66d9a ("wifi: mac80211: add netdev per-link debugfs data and driver hook")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
net/mac80211/link.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/net/mac80211/link.c b/net/mac80211/link.c
index d0535268962c..dc68144dc363 100644
--- a/net/mac80211/link.c
+++ b/net/mac80211/link.c
@@ -399,6 +399,10 @@ static int ieee80211_vif_update_links(struct ieee80211_sub_if_data *sdata,
memcpy(sdata->link, old_data, sizeof(old_data));
memcpy(sdata->vif.link_conf, old, sizeof(old));
ieee80211_set_vif_links_bitmaps(sdata, old_links, dormant_links);
+ for_each_set_bit(link_id, &add, IEEE80211_MLD_MAX_NUM_LINKS) {
+ ieee80211_link_debugfs_remove(&links[link_id]->data);
+ ieee80211_link_stop(&links[link_id]->data);
+ }
/* and free (only) the newly allocated links */
memset(to_free, 0, sizeof(links));
goto free;
--
2.43.0
^ permalink raw reply related
* [PATCH ath-current v2] wifi: ath6kl: avoid buffer overreads in WMI event handlers
From: Jeff Johnson @ 2026-07-11 18:04 UTC (permalink / raw)
To: linux-wireless; +Cc: linux-kernel, Jeff Johnson
The following WMI event handlers currently read from the event buffer
without first verifying that the message was large enough to hold the
expected event:
ath6kl_wmi_scan_complete_rx()
ath6kl_wmi_addba_req_event_rx()
ath6kl_wmi_delba_req_event_rx()
Add length checks to prevent overread.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Assisted-by: Claude:claude-sonnet-4-6
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
---
Changes in v2:
- Added fixes for two more functions: ath6kl_wmi_addba_req_event_rx and ath6kl_wmi_delba_req_event_rx
- v1 subject: [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
- Link to v1: https://patch.msgid.link/20260711-ath6kl_wmi_scan_complete_rx-v1-1-7b11e5f8b96c@oss.qualcomm.com
---
drivers/net/wireless/ath/ath6kl/wmi.c | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d..08030d88c7d3 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
{
struct wmi_scan_complete_event *ev;
+ if (len < sizeof(*ev))
+ return -EINVAL;
+
ev = (struct wmi_scan_complete_event *) datap;
ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
@@ -3352,7 +3355,12 @@ static int ath6kl_wmi_get_pmkid_list_event_rx(struct wmi *wmi, u8 *datap,
static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_addba_req_event *cmd = (struct wmi_addba_req_event *) datap;
+ struct wmi_addba_req_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_addba_req_event *) datap;
aggr_recv_addba_req_evt(vif, cmd->tid,
le16_to_cpu(cmd->st_seq_no), cmd->win_sz);
@@ -3363,7 +3371,12 @@ static int ath6kl_wmi_addba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
static int ath6kl_wmi_delba_req_event_rx(struct wmi *wmi, u8 *datap, int len,
struct ath6kl_vif *vif)
{
- struct wmi_delba_event *cmd = (struct wmi_delba_event *) datap;
+ struct wmi_delba_event *cmd;
+
+ if (len < sizeof(*cmd))
+ return -EINVAL;
+
+ cmd = (struct wmi_delba_event *) datap;
aggr_recv_delba_req_evt(vif, cmd->tid);
---
base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7
^ permalink raw reply related
* Re: ath11k_pci: QCNFA765 connection failure with PREV_AUTH_NOT_VALID / "Secrets were required" state machine crash on Fedora 44
From: Jeff Johnson @ 2026-07-11 17:19 UTC (permalink / raw)
To: Nilesh Kumar, linux-wireless; +Cc: ath11k
In-Reply-To: <CA+=sdFznhv0RqfNaYYgpit3bqo1kvqDQT6CZta8=ZHPUXZE7zQ@mail.gmail.com>
On 7/4/2026 4:55 AM, Nilesh Kumar wrote:
> Hello,
>
> I am experiencing a persistent Wi-Fi disconnection issue on Fedora 44 that
> eventually locks up the driver state machine until a full system reboot. The
> network adapter is a Qualcomm QCNFA765 using the ath11k_pci driver.
>
> - Distro: Fedora 44
> - Wireless Adapter: Qualcomm Technologies, Inc QCNFA765 [17cb:1103] (rev 01)
> - Subsystem: Lenovo Device [17aa:9309]
> - Driver: ath11k_pci
>
> PROBLEM DESCRIPTION
> The interface disconnects after a few sessions. Once disconnected,
> NetworkManager and wpa_supplicant enter a state-machine loop where they are
> unable to re-associate, repeatedly throwing "Secrets were required, but not
> provided" errors, even when credentials are explicitly forced or provided via
> a passwd-file inline during 'nmcli c up'.
> Even after purging the connection profile, restarting NetworkManager/
> wpa_supplicant, and manually bringing the link up/down, the driver appears to
> remain in a glitched state where it refuses to pass the authentication keys to
> the AP. Only a full system restart resolves the condition temporarily.
>
> RELEVANT LOG SNIPPETS
> logs generated are attached with the mail.
You should contact Fedora support for issues with their distribution.
If you can recreate this issue with the current mainline kernel then you can
submit a bug report using the guidance at:
https://wireless.docs.kernel.org/en/latest/en/users/drivers/ath11k/bugreport.html
/jeff
^ permalink raw reply
* [PATCH ath-current] wifi: ath6kl: avoid buffer overread in ath6kl_wmi_scan_complete_rx()
From: Jeff Johnson @ 2026-07-11 17:09 UTC (permalink / raw)
To: linux-wireless; +Cc: linux-kernel, Jeff Johnson
Currently, ath6kl_wmi_scan_complete_rx() dereferences ev->status
without first verifying that the event buffer is large enough to hold
a wmi_scan_complete_event. Add a length check to prevent overread.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath6kl/wmi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d..1645f59b0dc1 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -1276,6 +1276,9 @@ static int ath6kl_wmi_scan_complete_rx(struct wmi *wmi, u8 *datap, int len,
{
struct wmi_scan_complete_event *ev;
+ if (len < sizeof(*ev))
+ return -EINVAL;
+
ev = (struct wmi_scan_complete_event *) datap;
ath6kl_scan_complete_evt(vif, a_sle32_to_cpu(ev->status));
---
base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
change-id: 20260711-ath6kl_wmi_scan_complete_rx-a97c9cb39da7
^ permalink raw reply related
* Re: [PATCH v9 11/14] net: ipa: Switch to generic PAS TZ APIs
From: Bjorn Andersson @ 2026-07-11 16:06 UTC (permalink / raw)
To: Sumit Garg
Cc: konradybcio, linux-arm-msm, devicetree, dri-devel, freedreno,
linux-media, netdev, linux-wireless, ath12k, linux-remoteproc,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, bod, mchehab, elder, andrew+netdev, davem,
edumazet, kuba, pabeni, jjohnson, mathieu.poirier,
trilokkumar.soni, mukesh.ojha, pavan.kondeti, jorge.ramirez,
tonyh, vignesh.viswanathan, srinivas.kandagatla, amirreza.zarrabi,
jenswi, op-tee, apurupa, skare, linux-kernel, Sumit Garg,
Alex Elder, Konrad Dybcio
In-Reply-To: <20260702115835.167602-12-sumit.garg@kernel.org>
On Thu, Jul 02, 2026 at 05:28:27PM +0530, Sumit Garg wrote:
> From: Sumit Garg <sumit.garg@oss.qualcomm.com>
>
> Switch ipa client driver over to generic PAS TZ APIs. Generic PAS TZ
> service allows to support multiple TZ implementation backends like QTEE
> based SCM PAS service, OP-TEE based PAS service and any further future TZ
> backend service.
>
Please find an immutable branch with the dependencies for this patch at:
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git 20260702115835.167602-2-sumit.garg@kernel.org
Alternatively, if you think there will be no conflicting patches in the
time leading up to next merge window provide an Ack and I can pick this
through the qcom tree.
Thanks,
Bjorn
> Reviewed-by: Alex Elder <elder@riscstar.com>
> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> ---
> drivers/net/ipa/Kconfig | 2 +-
> drivers/net/ipa/ipa_main.c | 13 ++++++++-----
> 2 files changed, 9 insertions(+), 6 deletions(-)
>
> diff --git a/drivers/net/ipa/Kconfig b/drivers/net/ipa/Kconfig
> index 01d219d3760c..a9aff1b7977d 100644
> --- a/drivers/net/ipa/Kconfig
> +++ b/drivers/net/ipa/Kconfig
> @@ -6,7 +6,7 @@ config QCOM_IPA
> depends on QCOM_RPROC_COMMON || (QCOM_RPROC_COMMON=n && COMPILE_TEST)
> depends on QCOM_AOSS_QMP || QCOM_AOSS_QMP=n
> select QCOM_MDT_LOADER
> - select QCOM_SCM
> + select QCOM_PAS
> select QCOM_QMI_HELPERS
> help
> Choose Y or M here to include support for the Qualcomm
> diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
> index 788dd99af2a4..3cd9e44680e9 100644
> --- a/drivers/net/ipa/ipa_main.c
> +++ b/drivers/net/ipa/ipa_main.c
> @@ -14,7 +14,7 @@
> #include <linux/pm_runtime.h>
> #include <linux/types.h>
>
> -#include <linux/firmware/qcom/qcom_scm.h>
> +#include <linux/firmware/qcom/qcom_pas.h>
> #include <linux/soc/qcom/mdt_loader.h>
>
> #include "ipa.h"
> @@ -624,10 +624,13 @@ static int ipa_firmware_load(struct device *dev)
> }
>
> ret = qcom_mdt_load(dev, fw, path, IPA_PAS_ID, virt, phys, size, NULL);
> - if (ret)
> + if (ret) {
> dev_err(dev, "error %d loading \"%s\"\n", ret, path);
> - else if ((ret = qcom_scm_pas_auth_and_reset(IPA_PAS_ID)))
> - dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
> + } else {
> + ret = qcom_pas_auth_and_reset(IPA_PAS_ID);
> + if (ret)
> + dev_err(dev, "error %d authenticating \"%s\"\n", ret, path);
> + }
>
> memunmap(virt);
> out_release_firmware:
> @@ -758,7 +761,7 @@ static enum ipa_firmware_loader ipa_firmware_loader(struct device *dev)
> return IPA_LOADER_INVALID;
> out_self:
> /* We need Trust Zone to load firmware; make sure it's available */
> - if (qcom_scm_is_available())
> + if (qcom_pas_is_available())
> return IPA_LOADER_SELF;
>
> return IPA_LOADER_DEFER;
> --
> 2.53.0
>
^ permalink raw reply
* Re: [PATCH v9 09/14] media: qcom: Switch to generic PAS TZ APIs
From: Bjorn Andersson @ 2026-07-11 16:05 UTC (permalink / raw)
To: Sumit Garg
Cc: konradybcio, linux-arm-msm, devicetree, dri-devel, freedreno,
linux-media, netdev, linux-wireless, ath12k, linux-remoteproc,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, bod, mchehab, elder, andrew+netdev, davem,
edumazet, kuba, pabeni, jjohnson, mathieu.poirier,
trilokkumar.soni, mukesh.ojha, pavan.kondeti, jorge.ramirez,
tonyh, vignesh.viswanathan, srinivas.kandagatla, amirreza.zarrabi,
jenswi, op-tee, apurupa, skare, linux-kernel, Sumit Garg,
Konrad Dybcio
In-Reply-To: <20260702115835.167602-10-sumit.garg@kernel.org>
On Thu, Jul 02, 2026 at 05:28:25PM +0530, Sumit Garg wrote:
> From: Sumit Garg <sumit.garg@oss.qualcomm.com>
>
> Switch qcom media client drivers over to generic PAS TZ APIs. Generic PAS
> TZ service allows to support multiple TZ implementation backends like QTEE
> based SCM PAS service, OP-TEE based PAS service and any further future TZ
> backend service.
>
Please find an immutable branch with the dependencies for this patch at:
https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git 20260702115835.167602-2-sumit.garg@kernel.org
Alternatively, if you think there will be no conflicting patches in the
time leading up to next merge window provide an Ack and I can pick this
through the qcom tree.
Thanks,
Bjorn
> Reviewed-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com>
> Tested-by: Mukesh Ojha <mukesh.ojha@oss.qualcomm.com> # Lemans
> Reviewed-by: Konrad Dybcio <konrad.dybcio@oss.qualcomm.com>
> Signed-off-by: Sumit Garg <sumit.garg@oss.qualcomm.com>
> ---
> drivers/media/platform/qcom/iris/Kconfig | 27 ++++++++++---------
> .../media/platform/qcom/iris/iris_firmware.c | 9 ++++---
> drivers/media/platform/qcom/venus/Kconfig | 1 +
> drivers/media/platform/qcom/venus/firmware.c | 11 ++++----
> 4 files changed, 26 insertions(+), 22 deletions(-)
>
> diff --git a/drivers/media/platform/qcom/iris/Kconfig b/drivers/media/platform/qcom/iris/Kconfig
> index af78a1775937..388c9bbc8136 100644
> --- a/drivers/media/platform/qcom/iris/Kconfig
> +++ b/drivers/media/platform/qcom/iris/Kconfig
> @@ -1,14 +1,15 @@
> config VIDEO_QCOM_IRIS
> - tristate "Qualcomm iris V4L2 decoder driver"
> - depends on VIDEO_DEV
> - depends on ARCH_QCOM || COMPILE_TEST
> - select V4L2_MEM2MEM_DEV
> - select QCOM_MDT_LOADER
> - select QCOM_SCM
> - select QCOM_UBWC_CONFIG
> - select VIDEOBUF2_DMA_CONTIG
> - help
> - This is a V4L2 driver for Qualcomm iris video accelerator
> - hardware. It accelerates decoding operations on various
> - Qualcomm SoCs.
> - To compile this driver as a module choose m here.
> + tristate "Qualcomm iris V4L2 decoder driver"
> + depends on VIDEO_DEV
> + depends on ARCH_QCOM || COMPILE_TEST
> + select V4L2_MEM2MEM_DEV
> + select QCOM_MDT_LOADER
> + select QCOM_SCM
> + select QCOM_PAS
> + select QCOM_UBWC_CONFIG
> + select VIDEOBUF2_DMA_CONTIG
> + help
> + This is a V4L2 driver for Qualcomm iris video accelerator
> + hardware. It accelerates decoding operations on various
> + Qualcomm SoCs.
> + To compile this driver as a module choose m here.
> diff --git a/drivers/media/platform/qcom/iris/iris_firmware.c b/drivers/media/platform/qcom/iris/iris_firmware.c
> index 1a476146d758..ea9654dd679e 100644
> --- a/drivers/media/platform/qcom/iris/iris_firmware.c
> +++ b/drivers/media/platform/qcom/iris/iris_firmware.c
> @@ -4,6 +4,7 @@
> */
>
> #include <linux/firmware.h>
> +#include <linux/firmware/qcom/qcom_pas.h>
> #include <linux/firmware/qcom/qcom_scm.h>
> #include <linux/of_address.h>
> #include <linux/of_reserved_mem.h>
> @@ -80,7 +81,7 @@ int iris_fw_load(struct iris_core *core)
> return -ENOMEM;
> }
>
> - ret = qcom_scm_pas_auth_and_reset(IRIS_PAS_ID);
> + ret = qcom_pas_auth_and_reset(IRIS_PAS_ID);
> if (ret) {
> dev_err(core->dev, "auth and reset failed: %d\n", ret);
> return ret;
> @@ -94,7 +95,7 @@ int iris_fw_load(struct iris_core *core)
> cp_config->cp_nonpixel_size);
> if (ret) {
> dev_err(core->dev, "qcom_scm_mem_protect_video_var failed: %d\n", ret);
> - qcom_scm_pas_shutdown(IRIS_PAS_ID);
> + qcom_pas_shutdown(IRIS_PAS_ID);
> return ret;
> }
> }
> @@ -104,10 +105,10 @@ int iris_fw_load(struct iris_core *core)
>
> int iris_fw_unload(struct iris_core *core)
> {
> - return qcom_scm_pas_shutdown(IRIS_PAS_ID);
> + return qcom_pas_shutdown(IRIS_PAS_ID);
> }
>
> int iris_set_hw_state(struct iris_core *core, bool resume)
> {
> - return qcom_scm_set_remote_state(resume, 0);
> + return qcom_pas_set_remote_state(resume, 0);
> }
> diff --git a/drivers/media/platform/qcom/venus/Kconfig b/drivers/media/platform/qcom/venus/Kconfig
> index 63ee8c78dc6d..7997b8aa427a 100644
> --- a/drivers/media/platform/qcom/venus/Kconfig
> +++ b/drivers/media/platform/qcom/venus/Kconfig
> @@ -6,6 +6,7 @@ config VIDEO_QCOM_VENUS
> select OF_DYNAMIC if ARCH_QCOM
> select QCOM_MDT_LOADER
> select QCOM_SCM
> + select QCOM_PAS
> select VIDEOBUF2_DMA_CONTIG
> select V4L2_MEM2MEM_DEV
> help
> diff --git a/drivers/media/platform/qcom/venus/firmware.c b/drivers/media/platform/qcom/venus/firmware.c
> index 1de7436713ed..3a38ff985822 100644
> --- a/drivers/media/platform/qcom/venus/firmware.c
> +++ b/drivers/media/platform/qcom/venus/firmware.c
> @@ -12,6 +12,7 @@
> #include <linux/of_reserved_mem.h>
> #include <linux/platform_device.h>
> #include <linux/of_device.h>
> +#include <linux/firmware/qcom/qcom_pas.h>
> #include <linux/firmware/qcom/qcom_scm.h>
> #include <linux/sizes.h>
> #include <linux/soc/qcom/mdt_loader.h>
> @@ -58,7 +59,7 @@ int venus_set_hw_state(struct venus_core *core, bool resume)
> int ret;
>
> if (core->use_tz) {
> - ret = qcom_scm_set_remote_state(resume, 0);
> + ret = qcom_pas_set_remote_state(resume, 0);
> if (resume && ret == -EINVAL)
> ret = 0;
> return ret;
> @@ -218,7 +219,7 @@ int venus_boot(struct venus_core *core)
> int ret;
>
> if (!IS_ENABLED(CONFIG_QCOM_MDT_LOADER) ||
> - (core->use_tz && !qcom_scm_is_available()))
> + (core->use_tz && !qcom_pas_is_available()))
> return -EPROBE_DEFER;
>
> ret = of_property_read_string_index(dev->of_node, "firmware-name", 0,
> @@ -236,7 +237,7 @@ int venus_boot(struct venus_core *core)
> core->fw.mem_phys = mem_phys;
>
> if (core->use_tz)
> - ret = qcom_scm_pas_auth_and_reset(VENUS_PAS_ID);
> + ret = qcom_pas_auth_and_reset(VENUS_PAS_ID);
> else
> ret = venus_boot_no_tz(core, mem_phys, mem_size);
>
> @@ -259,7 +260,7 @@ int venus_boot(struct venus_core *core)
> res->cp_nonpixel_start,
> res->cp_nonpixel_size);
> if (ret) {
> - qcom_scm_pas_shutdown(VENUS_PAS_ID);
> + qcom_pas_shutdown(VENUS_PAS_ID);
> dev_err(dev, "set virtual address ranges fail (%d)\n",
> ret);
> return ret;
> @@ -274,7 +275,7 @@ int venus_shutdown(struct venus_core *core)
> int ret;
>
> if (core->use_tz)
> - ret = qcom_scm_pas_shutdown(VENUS_PAS_ID);
> + ret = qcom_pas_shutdown(VENUS_PAS_ID);
> else
> ret = venus_shutdown_no_tz(core);
>
> --
> 2.53.0
>
^ permalink raw reply
* Re: (subset) [PATCH v9 00/14] firmware: qcom: Add OP-TEE PAS service support
From: Bjorn Andersson @ 2026-07-11 16:03 UTC (permalink / raw)
To: Sumit Garg
Cc: konradybcio, linux-arm-msm, devicetree, dri-devel, freedreno,
linux-media, netdev, linux-wireless, ath12k, linux-remoteproc,
robh, krzk+dt, conor+dt, robin.clark, sean, akhilpo, lumag,
abhinav.kumar, jesszhan0024, marijn.suijten, airlied, simona,
vikash.garodia, bod, mchehab, elder, andrew+netdev, davem,
edumazet, kuba, pabeni, jjohnson, mathieu.poirier,
trilokkumar.soni, mukesh.ojha, pavan.kondeti, jorge.ramirez,
tonyh, vignesh.viswanathan, srinivas.kandagatla, amirreza.zarrabi,
jenswi, op-tee, apurupa, skare, linux-kernel, Sumit Garg
In-Reply-To: <alDhkHVnzReCgU6H@sumit-xelite>
On Fri, Jul 10, 2026 at 05:42:00PM +0530, Sumit Garg wrote:
> Hi Bjorn,
>
> On Thu, Jul 09, 2026 at 02:32:39PM -0500, Bjorn Andersson wrote:
> >
> > On Thu, 02 Jul 2026 17:28:16 +0530, Sumit Garg wrote:
> > > From: Sumit Garg <sumit.garg@oss.qualcomm.com>
> > >
> > > Qcom platforms has the legacy of using non-standard SCM calls
> > > splintered over the various kernel drivers. These SCM calls aren't
> > > compliant with the standard SMC calling conventions which is a
> > > prerequisite to enable migration to the FF-A specifications from Arm.
> > >
> > > [...]
> >
> > Applied, thanks!
> >
> > [01/14] firmware: qcom: Add a generic PAS service
> > commit: 08314e7c2c38b9ae6a5e01c58ed10a950859404d
> > [02/14] firmware: qcom_scm: Migrate to generic PAS service
> > commit: 5c1a2975d23c51c01aca51945d0f10a4ee4c9020
> > [03/14] firmware: qcom: Add a PAS TEE service
> > commit: b6f7978da0c4d26fe465aa6634f5a0b48f900de0
> > [14/14] MAINTAINERS: Add maintainer entry for Qualcomm PAS TZ service
> > commit: 6701259025d49139131a0eb2257659a066dcca22
> >
> > This is available as an immutable branch, for other subsystems to pull at:
> > https://git.kernel.org/pub/scm/linux/kernel/git/qcom/linux.git 20260702115835.167602-2-sumit.garg@kernel.org
> >
> >
> > [04/14] remoteproc: qcom_q6v5_pas: Switch over to generic PAS TZ APIs
> > commit: 254030af0d81b12b7624d9ce85c6bdd3171629c6
> > [05/14] remoteproc: qcom_q6v5_mss: Switch to generic PAS TZ APIs
> > commit: f3b1357673ddb37ae8b9a8fe44df73cbd2a519c5
> > [06/14] remoteproc: qcom_wcnss: Switch to generic PAS TZ APIs
> > commit: ea3b5245f5deba916320b32a8e6510a74c034c17
> > [07/14] remoteproc: qcom: Select QCOM_PAS generic service
> > commit: c4383254ac7a529736577e304176a10371c2ee0b
> >
>
> Thanks for picking the partial set although I expected for you to pick
> the entire set given acks from all the other subsystem maintainers. Let
> me know how we should proceed further.
>
That would be desirable, so that I can also merge the cleanup patch at
the tail end there.
I did miss Dmitry's ack on the drm patch - that one I could have merged,
but I don't see acks from media and net maintainers. I'm fine either way
(them providing acks, or merging the immutable branch and respective
change).
As you can see Jeff did the latter already. Thanks Jeff!
This leaves us with the cleanup patch (13), which I think we can pick
for v7.3-rc2.
Regards,
Bjorn
^ permalink raw reply
* [PATCH 1/2] wifi: ath11k: implement custom wake_tx_queue with flow control
From: Zhi-Jun You @ 2026-07-11 15:33 UTC (permalink / raw)
To: jtornosm; +Cc: ath11k, ath12k, jjohnson, linux-kernel, linux-wireless, hujy652
In-Reply-To: <20260710155443.1761760-2-jtornosm@redhat.com>
Hi Jose,
In wake_tx_queue:
ring_id = txq->ac % ar->ab->hw_params.hal_params->num_tx_rings;
In ath11k_dp_tx which is called by ath11k_mac_op_tx:
ring_selector = ab->hw_params.hw_ops->get_ring_selector(skb);
ti.ring_id = ring_selector % num_tx_rings;
Are you sure ring_id will be the same?
Also mgmt frames use a different path.
Best regards,
Zhi-Jun
^ permalink raw reply
* [PATCH ath-next] wifi: ath12k: Fix ath12k_wifi7_mac_op_tx() style issues
From: Jeff Johnson @ 2026-07-11 15:31 UTC (permalink / raw)
To: Jeff Johnson; +Cc: linux-wireless, ath12k, linux-kernel, Jeff Johnson
Commit e47d6c9bb416 ("wifi: ath12k: Advertise multicast Ethernet
encapsulation offload support") introduced a few style issues.
ath12k-check reports:
drivers/net/wireless/ath/ath12k/wifi7/hw.c:1042: line length of 92 exceeds 90 columns
And automated review did not like one if/else that did not use braces
for a single statement that also included a block comment.
Fix these issues.
Signed-off-by: Jeff Johnson <jeff.johnson@oss.qualcomm.com>
---
drivers/net/wireless/ath/ath12k/wifi7/hw.c | 18 +++++++++++-------
1 file changed, 11 insertions(+), 7 deletions(-)
diff --git a/drivers/net/wireless/ath/ath12k/wifi7/hw.c b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
index e5bf9d218104..d54c2a6d83b2 100644
--- a/drivers/net/wireless/ath/ath12k/wifi7/hw.c
+++ b/drivers/net/wireless/ath/ath12k/wifi7/hw.c
@@ -1031,18 +1031,22 @@ static void ath12k_wifi7_mac_op_tx(struct ieee80211_hw *hw,
if (cb_flags & ATH12K_SKB_HW_80211_ENCAP) {
/*
- * skb->data may be modified for the iova_mask devices.
- * It is better to use skb_copy() for such devices
- * to avoid any potential skb corruption related issues.
+ * skb->data may be modified for the
+ * iova_mask devices. It is better to
+ * use skb_copy() for such devices to
+ * avoid any potential skb corruption
+ * related issues.
*/
- if (tmp_dp->hw_params->iova_mask)
+ if (tmp_dp->hw_params->iova_mask) {
msdu_copied = skb_copy(skb, GFP_ATOMIC);
- else
+ } else {
/*
- * ath12k_wifi7_dp_tx() should treat cloned HW-encap
- * Ethernet multicast frames as read-only.
+ * ath12k_wifi7_dp_tx() should
+ * treat cloned HW-encap Ethernet
+ * multicast frames as read-only.
*/
msdu_copied = skb_clone(skb, GFP_ATOMIC);
+ }
if (!msdu_copied) {
ath12k_err(ar->ab,
"skb copy/clone failure link_id 0x%X vdevid 0x%X\n",
---
base-commit: fa1b1469f1c5f0f54ed9dab80106a117e7736bfd
change-id: 20260703-ath12k_wifi7_mac_op_tx-line-length-de4ed96f4792
^ permalink raw reply related
* [PATCH net] wifi: mac80211_hwsim: reject undersized HWSIM_ATTR_TX_INFO
From: Ibrahim Hashimov @ 2026-07-11 15:15 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, linux-kernel, stable
hwsim_tx_info_frame_received_nl() casts the HWSIM_ATTR_TX_INFO
attribute payload to a `struct hwsim_tx_rate *` and then
unconditionally walks IEEE80211_TX_MAX_RATES (4) entries of it:
tx_attempts = (struct hwsim_tx_rate *)nla_data(
info->attrs[HWSIM_ATTR_TX_INFO]);
...
for (i = 0; i < IEEE80211_TX_MAX_RATES; i++) {
txi->status.rates[i].idx = tx_attempts[i].idx;
txi->status.rates[i].count = tx_attempts[i].count;
}
struct hwsim_tx_rate is `{s8 idx; u8 count;} __packed`, i.e. 2 bytes,
so the loop reads a fixed 8 bytes out of the attribute regardless of
its actual length.
The attribute's policy entry only bounds the payload from above:
[HWSIM_ATTR_TX_INFO] = { .type = NLA_BINARY,
.len = IEEE80211_TX_MAX_RATES *
sizeof(struct hwsim_tx_rate)},
For NLA_BINARY, nla_policy.len is a maximum, not a minimum -
nla_validate() happily accepts a shorter attribute, including a
zero-length one. The HWSIM_CMD_TX_INFO_FRAME op also sets
GENL_DONT_VALIDATE_STRICT, so no implicit minimum-length enforcement
kicks in either. The handler itself never calls nla_len() on
HWSIM_ATTR_TX_INFO before dereferencing it.
The net effect: any process that has completed HWSIM_CMD_REGISTER as
the netgroup's wmediumd (CAP_NET_ADMIN at registration time, e.g. via
an unprivileged user+net namespace) can send a HWSIM_CMD_TX_INFO_FRAME
with a 0-length HWSIM_ATTR_TX_INFO and drive tx_attempts[0..3] to read
up to 8 bytes past the end of the attribute payload.
This driver already validates NLA_BINARY payload length before use in
two other handlers in this same file:
- hwsim_cloned_frame_received_nl() bounds-checks HWSIM_ATTR_FRAME
before touching it:
frame_data_len = nla_len(info->attrs[HWSIM_ATTR_FRAME]);
...
if (frame_data_len < sizeof(struct ieee80211_hdr_3addr) ||
frame_data_len > IEEE80211_MAX_DATA_LEN)
goto err;
- hwsim_new_radio_nl() bounds-checks HWSIM_ATTR_CIPHER_SUPPORT before
use, rejecting a length that doesn't cleanly divide into whole
elements:
u32 len = nla_len(info->attrs[HWSIM_ATTR_CIPHER_SUPPORT]);
...
if (len % sizeof(u32)) {
NL_SET_ERR_MSG_ATTR(...);
return -EINVAL;
}
hwsim_tx_info_frame_received_nl() is missing the equivalent check for
HWSIM_ATTR_TX_INFO. Add a minimum-length check next to the existing
attrs-presence check at the top of the function (before any pending
skb is unlinked from data2->pending, to avoid holding/leaking that skb
on the new error path), requiring at least
IEEE80211_TX_MAX_RATES * sizeof(struct hwsim_tx_rate) bytes - matching
the exact quantity the loop below unconditionally reads. A too-short
attribute now takes the existing `goto out;` / -EINVAL path instead of
reading past the attribute payload.
On a v6.19 KASAN-enabled stand, the differential reproducer confirmed
the unpatched handler accepts a 0-length HWSIM_ATTR_TX_INFO and runs
the fixed-count read loop to completion (ack err = 0); KASAN did not
report anything here, since the resulting 8-byte over-read stays
inside the same skb's kmalloc/shinfo tailroom rather than crossing a
slab redzone. The check added above makes the same 0-length attribute
fail before that loop runs, taking the existing goto out / -EINVAL
path instead.
Fixes: 7882513bacb1 ("mac80211_hwsim driver support userspace frame tx/rx")
Cc: stable@vger.kernel.org
Signed-off-by: Ibrahim Hashimov <security@auditcode.ai>
Assisted-by: AuditCode-AI:2026.07
---
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 11 +++++++++++
1 file changed, 11 insertions(+)
diff --git a/drivers/net/wireless/virtual/mac80211_hwsim_main.c b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
index 0dd8a6c85953..6ef7398ffaad 100644
--- a/drivers/net/wireless/virtual/mac80211_hwsim_main.c
+++ b/drivers/net/wireless/virtual/mac80211_hwsim_main.c
@@ -6340,6 +6340,17 @@ static int hwsim_tx_info_frame_received_nl(struct sk_buff *skb_2,
!info->attrs[HWSIM_ATTR_TX_INFO])
goto out;
+ /*
+ * HWSIM_ATTR_TX_INFO is NLA_BINARY with only a maximum length in
+ * its policy entry, so nla_validate() accepts any shorter (incl.
+ * zero-length) payload. The read loop below unconditionally walks
+ * IEEE80211_TX_MAX_RATES entries, so reject undersized attributes
+ * here before any data is touched.
+ */
+ if (nla_len(info->attrs[HWSIM_ATTR_TX_INFO]) <
+ IEEE80211_TX_MAX_RATES * sizeof(struct hwsim_tx_rate))
+ goto out;
+
src = (void *)nla_data(info->attrs[HWSIM_ATTR_ADDR_TRANSMITTER]);
hwsim_flags = nla_get_u32(info->attrs[HWSIM_ATTR_FLAGS]);
ret_skb_cookie = nla_get_u64(info->attrs[HWSIM_ATTR_COOKIE]);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related
* [PATCH 2/2] wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds
From: Michael Bommarito @ 2026-07-11 15:06 UTC (permalink / raw)
To: Miri Korenblit, Johannes Berg
Cc: Emmanuel Grumbach, Benjamin Berg, linux-wireless, linux-kernel,
stable
In-Reply-To: <20260711150611.2913332-1-michael.bommarito@gmail.com>
Add KUnit coverage for a malformed BA-window notification carrying an
out-of-range station ID, plus a valid-ID/null-station path to exercise the
adjacent non-bug branch. With UBSAN bounds enabled, the malformed case
reports an array-index-out-of-bounds splat before the fix and passes after
it.
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
.../wireless/intel/iwlwifi/mvm/tests/Makefile | 2 +-
.../intel/iwlwifi/mvm/tests/window-status.c | 77 +++++++++++++++++++
2 files changed, 78 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile b/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
index 2267be4cfb441..bf22750fceafc 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/Makefile
@@ -1,3 +1,3 @@
-iwlmvm-tests-y += module.o hcmd.o
+iwlmvm-tests-y += module.o hcmd.o window-status.o
obj-$(CONFIG_IWLWIFI_KUNIT_TESTS) += iwlmvm-tests.o
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c b/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
new file mode 100644
index 0000000000000..06807e2bdbc12
--- /dev/null
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
@@ -0,0 +1,77 @@
+// SPDX-License-Identifier: GPL-2.0 OR BSD-3-Clause
+/*
+ * KUnit tests for MVM BA window status notification handling
+ */
+#include <kunit/test.h>
+#include <linux/mm.h>
+
+#include <iwl-trans.h>
+#include "../fw-api.h"
+#include "../mvm.h"
+
+MODULE_IMPORT_NS("EXPORTED_FOR_KUNIT_TESTING");
+
+static void iwl_mvm_test_window_status(struct kunit *test, u8 sta_id)
+{
+ struct iwl_ba_window_status_notif notif = {};
+ struct iwl_rx_cmd_buffer rxb = {
+ ._offset = 0,
+ ._rx_page_order = 0,
+ };
+ struct iwl_rx_packet *pkt;
+ struct iwl_fw *fw;
+ struct iwl_mvm *mvm;
+ u16 ratid;
+
+ BUILD_BUG_ON((IWL_STATION_COUNT_MAX + 1) >
+ (BA_WINDOW_STATUS_STA_ID_MSK >>
+ BA_WINDOW_STATUS_STA_ID_POS));
+
+ mvm = kunit_kzalloc(test, sizeof(*mvm), GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, mvm);
+
+ fw = kunit_kzalloc(test, sizeof(*fw), GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, fw);
+ fw->ucode_capa.num_stations = IWL_STATION_COUNT_MAX;
+ mvm->fw = fw;
+
+ rxb._page = alloc_page(GFP_KERNEL);
+ KUNIT_ASSERT_NOT_NULL(test, rxb._page);
+
+ ratid = BA_WINDOW_STATUS_VALID_MSK |
+ (sta_id << BA_WINDOW_STATUS_STA_ID_POS);
+ notif.ra_tid[0] = cpu_to_le16(ratid);
+ notif.mpdu_rx_count[0] = cpu_to_le16(1);
+
+ pkt = rxb_addr(&rxb);
+ memset(pkt, 0, PAGE_SIZE);
+ pkt->len_n_flags = cpu_to_le32(sizeof(pkt->hdr) + sizeof(notif));
+ memcpy(pkt->data, ¬if, sizeof(notif));
+
+ iwl_mvm_window_status_notif(mvm, &rxb);
+
+ __free_page(rxb._page);
+}
+
+static void test_ba_window_status_station_id_bounds(struct kunit *test)
+{
+ iwl_mvm_test_window_status(test, IWL_STATION_COUNT_MAX + 1);
+}
+
+static void test_ba_window_status_valid_empty_station(struct kunit *test)
+{
+ iwl_mvm_test_window_status(test, 0);
+}
+
+static struct kunit_case window_status_cases[] = {
+ KUNIT_CASE(test_ba_window_status_station_id_bounds),
+ KUNIT_CASE(test_ba_window_status_valid_empty_station),
+ {},
+};
+
+static struct kunit_suite window_status = {
+ .name = "iwlmvm-window-status",
+ .test_cases = window_status_cases,
+};
+
+kunit_test_suite(window_status);
--
2.53.0
^ permalink raw reply related
* [PATCH 1/2] wifi: iwlwifi: mvm: check BA-window station ID before lookup
From: Michael Bommarito @ 2026-07-11 15:06 UTC (permalink / raw)
To: Miri Korenblit, Johannes Berg
Cc: Emmanuel Grumbach, Benjamin Berg, linux-wireless, linux-kernel,
stable
In-Reply-To: <20260711150611.2913332-1-michael.bommarito@gmail.com>
iwl_mvm_window_status_notif() extracts a station ID from the BA-window
status notification's ra_tid field. The firmware API allocates five bits
for that field, so it can encode values up to 31.
The station map is bounded by the firmware's station capacity and
physically sized to IWL_STATION_COUNT_MAX entries. Validate the extracted
station ID before indexing fw_id_to_mac_id[]. This matches the existing
MVM station lookup helpers, which reject IDs outside
mvm->fw->ucode_capa.num_stations before reading the station map.
Fixes: 3af512d6aac7 ("iwlwifi: mvm: support filtered frames notification")
Cc: stable@vger.kernel.org
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
index 269c4b45de807..d373f0723e13d 100644
--- a/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
+++ b/drivers/net/wireless/intel/iwlwifi/mvm/rx.c
@@ -7,6 +7,7 @@
#include <linux/unaligned.h>
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
+#include "iwl-drv.h"
#include "iwl-trans.h"
#include "mvm.h"
#include "fw-api.h"
@@ -1227,6 +1228,8 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
/* get the station */
sta_id = (ratid & BA_WINDOW_STATUS_STA_ID_MSK)
>> BA_WINDOW_STATUS_STA_ID_POS;
+ if (sta_id >= mvm->fw->ucode_capa.num_stations)
+ continue;
sta = rcu_dereference(mvm->fw_id_to_mac_id[sta_id]);
if (IS_ERR_OR_NULL(sta))
continue;
@@ -1239,3 +1242,4 @@ void iwl_mvm_window_status_notif(struct iwl_mvm *mvm,
}
rcu_read_unlock();
}
+EXPORT_SYMBOL_IF_IWLWIFI_KUNIT(iwl_mvm_window_status_notif);
--
2.53.0
^ permalink raw reply related
* [PATCH 0/2] wifi: iwlwifi: mvm: bound BA-window station ID
From: Michael Bommarito @ 2026-07-11 15:06 UTC (permalink / raw)
To: Miri Korenblit, Johannes Berg
Cc: Emmanuel Grumbach, Benjamin Berg, linux-wireless, linux-kernel,
stable
iwl_mvm_window_status_notif() extracts a 5-bit station ID from the
firmware's BA-window status notification (values up to 31) and indexes
mvm->fw_id_to_mac_id[] with it without first checking it against the
firmware's station capacity. A firmware/backend notification carrying an
out-of-range ID reads past the station map.
Patch 1 validates the station ID against mvm->fw->ucode_capa.num_stations
before the lookup, matching the existing MVM station-lookup helpers. Patch
2 adds KUnit coverage: the malformed out-of-range ID and a valid-ID/
null-station control that must still pass.
Reproduced with the KUnit test under UBSAN bounds: the malformed case
reports an array-index-out-of-bounds splat on stock and passes after the
fix; the valid-ID control passes on both.
Cc: stable@vger.kernel.org
Michael Bommarito (2):
wifi: iwlwifi: mvm: check BA-window station ID before lookup
wifi: iwlwifi: mvm: add KUnit coverage for BA-window station ID bounds
drivers/net/wireless/intel/iwlwifi/mvm/rx.c | 4 +
.../wireless/intel/iwlwifi/mvm/tests/Makefile | 2 +-
.../intel/iwlwifi/mvm/tests/window-status.c | 77 +++++++++++++++++++
3 files changed, 82 insertions(+), 1 deletion(-)
create mode 100644 drivers/net/wireless/intel/iwlwifi/mvm/tests/window-status.c
--
2.53.0
^ permalink raw reply
* Re: [PATCH] wifi: ath6kl: validate assoc info lengths in the WMI connect event
From: Jeff Johnson @ 2026-07-11 14:39 UTC (permalink / raw)
To: Doruk Tan Ozturk, linux-wireless
Cc: Johannes Berg, Peddolla Harshavardhan Reddy, linux-kernel, stable
In-Reply-To: <20260711071336.58324-1-doruk@0sec.ai>
On 7/11/2026 12:13 AM, Doruk Tan Ozturk wrote:
> ath6kl_wmi_connect_event_rx() only checks that the received event is at
> least sizeof(struct wmi_connect_event); it never checks that the trailing
> beacon_ie_len + assoc_req_len + assoc_resp_len fields fit within the
> received buffer. Those attacker/AP-influenced lengths then drive two
> out-of-bounds accesses:
>
> - The WMM information-element scan builds
> peie = assoc_info + beacon_ie_len + assoc_req_len + assoc_resp_len
> and walks up to it, reading past the end of the event buffer when the
> declared lengths exceed the buffer. The walk also dereferences
> pie[1..6] and pie[1] (for the advance) without checking they stay
> within peie.
>
> - ath6kl_cfg80211_connect_event() subtracts fixed offsets from
> assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower
> bound. A short assoc request/response underflows the length to ~250,
> which cfg80211_connect_result() / cfg80211_roamed() then treat as the
> IE length and copy out of bounds from the small assoc_info buffer,
> disclosing adjacent slab memory to user space via nl80211.
>
> Bound the declared IE lengths against the received buffer, bound the WMM
> element reads against peie, and clamp the assoc request/response lengths
> before the subtraction. The sibling wil6210 driver already performs the
> equivalent length check for the same WMI connect event.
>
> Found by 0sec (https://0sec.ai) using automated source analysis; the
> missing bounds are evident from source and cross-checked against the
> sibling wil6210 driver. Compile-tested.
>
> Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
> Cc: stable@vger.kernel.org
> Assisted-by: 0sec:claude-opus-4-8
> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
Some aspects of your patch are already addressed by:
https://lore.kernel.org/all/20260421135009.348084-3-tristmd@gmail.com
So you will need to rebase once that lands.
/jeff
^ permalink raw reply
* Re: Atheros AR9280 / AR7010 Initial low scaning signal range
From: cybersnow_2001 @ 2026-07-11 12:58 UTC (permalink / raw)
To: John Scott; +Cc: Linux Wireless
In-Reply-To: <OwscydZ--F-9@tutamail.com>
After doing more test, I re-confirm that the signal link quality and the signal level goes up by 200% after it connects to a 5Ghz network. I see the link quality "double" from 30% to more than 70%. The signal level goes from -85db to -67db. When it connects first to a 2.4Ghz, it seems to be blocked at a low level, until it switch to 5Ghz, then the signal goes up suddenly after 1 minute... strange behavior.
^ permalink raw reply
* [PATCH] wifi: ath6kl: validate assoc info lengths in the WMI connect event
From: Doruk Tan Ozturk @ 2026-07-11 7:13 UTC (permalink / raw)
To: linux-wireless
Cc: Johannes Berg, Peddolla Harshavardhan Reddy, linux-kernel, stable
ath6kl_wmi_connect_event_rx() only checks that the received event is at
least sizeof(struct wmi_connect_event); it never checks that the trailing
beacon_ie_len + assoc_req_len + assoc_resp_len fields fit within the
received buffer. Those attacker/AP-influenced lengths then drive two
out-of-bounds accesses:
- The WMM information-element scan builds
peie = assoc_info + beacon_ie_len + assoc_req_len + assoc_resp_len
and walks up to it, reading past the end of the event buffer when the
declared lengths exceed the buffer. The walk also dereferences
pie[1..6] and pie[1] (for the advance) without checking they stay
within peie.
- ath6kl_cfg80211_connect_event() subtracts fixed offsets from
assoc_req_len (-= 4) and assoc_resp_len (-= 6), both u8, with no lower
bound. A short assoc request/response underflows the length to ~250,
which cfg80211_connect_result() / cfg80211_roamed() then treat as the
IE length and copy out of bounds from the small assoc_info buffer,
disclosing adjacent slab memory to user space via nl80211.
Bound the declared IE lengths against the received buffer, bound the WMM
element reads against peie, and clamp the assoc request/response lengths
before the subtraction. The sibling wil6210 driver already performs the
equivalent length check for the same WMI connect event.
Found by 0sec (https://0sec.ai) using automated source analysis; the
missing bounds are evident from source and cross-checked against the
sibling wil6210 driver. Compile-tested.
Fixes: bdcd81707973 ("Add ath6kl cleaned up driver")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:claude-opus-4-8
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
drivers/net/wireless/ath/ath6kl/cfg80211.c | 5 +++++
drivers/net/wireless/ath/ath6kl/wmi.c | 10 +++++++++-
2 files changed, 14 insertions(+), 1 deletion(-)
diff --git a/drivers/net/wireless/ath/ath6kl/cfg80211.c b/drivers/net/wireless/ath/ath6kl/cfg80211.c
index cc0f2c45fc3a..62f663c0daa2 100644
--- a/drivers/net/wireless/ath/ath6kl/cfg80211.c
+++ b/drivers/net/wireless/ath/ath6kl/cfg80211.c
@@ -754,6 +754,11 @@ void ath6kl_cfg80211_connect_event(struct ath6kl_vif *vif, u16 channel,
u8 *assoc_resp_ie = assoc_info + beacon_ie_len + assoc_req_len +
assoc_resp_ie_offset;
+ if (assoc_req_len < assoc_req_ie_offset)
+ assoc_req_len = assoc_req_ie_offset;
+ if (assoc_resp_len < assoc_resp_ie_offset)
+ assoc_resp_len = assoc_resp_ie_offset;
+
assoc_req_len -= assoc_req_ie_offset;
assoc_resp_len -= assoc_resp_ie_offset;
diff --git a/drivers/net/wireless/ath/ath6kl/wmi.c b/drivers/net/wireless/ath/ath6kl/wmi.c
index 72611a2ceb9d..fbfd74154d12 100644
--- a/drivers/net/wireless/ath/ath6kl/wmi.c
+++ b/drivers/net/wireless/ath/ath6kl/wmi.c
@@ -862,6 +862,10 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len,
ev = (struct wmi_connect_event *) datap;
+ if (len < sizeof(*ev) + ev->beacon_ie_len + ev->assoc_req_len +
+ ev->assoc_resp_len)
+ return -EINVAL;
+
if (vif->nw_type == AP_NETWORK) {
/* AP mode start/STA connected event */
struct net_device *dev = vif->ndev;
@@ -913,7 +917,8 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len,
while (pie < peie) {
switch (*pie) {
case WLAN_EID_VENDOR_SPECIFIC:
- if (pie[1] > 3 && pie[2] == 0x00 && pie[3] == 0x50 &&
+ if (pie + 7 <= peie && pie[1] > 3 &&
+ pie[2] == 0x00 && pie[3] == 0x50 &&
pie[4] == 0xf2 && pie[5] == WMM_OUI_TYPE) {
/* WMM OUT (00:50:F2) */
if (pie[1] > 5 &&
@@ -926,6 +931,9 @@ static int ath6kl_wmi_connect_event_rx(struct wmi *wmi, u8 *datap, int len,
if (wmi->is_wmm_enabled)
break;
+ if (pie + 1 >= peie)
+ break;
+
pie += pie[1] + 2;
}
--
2.43.0
^ permalink raw reply related
* [PATCH] wifi: mwifiex: bound the pairwise-cipher OUI walk to the IE length
From: Doruk Tan Ozturk @ 2026-07-11 7:13 UTC (permalink / raw)
To: Brian Norris; +Cc: Francesco Dolcini, linux-wireless, linux-kernel, stable
mwifiex_search_oui_in_ie() reads the pairwise-cipher (PTK) count from a
beacon/probe-response RSN or WPA information element:
count = iebody->ptk_cnt[0];
and then walks "count" 4-byte OUIs from the element, comparing each with
memcmp(). The count byte comes straight from the (attacker-supplied) IE
and is never checked against the element's own length. The callers admit
the element on element_id alone (has_ieee_hdr() / has_vendor_hdr(), no
length check), so a crafted RSN/WPA IE with a large pairwise count makes
the walk read up to 255 * 4 bytes past the element -- an out-of-bounds
read of the kmemdup()'d beacon buffer, reachable from any AP whose
beacon/probe response is processed during scan result parsing.
Pass the number of available IE bytes to the walk and reject a count
whose OUI list would not fit, keeping the loop within the element.
Found by 0sec (https://0sec.ai) using automated source analysis; the
unbounded count-driven walk is evident from source. Compile-tested.
Fixes: 5e6e3a92b9a4 ("wireless: mwifiex: initial commit for Marvell mwifiex driver")
Cc: stable@vger.kernel.org
Assisted-by: 0sec:claude-opus-4-8
Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
---
drivers/net/wireless/marvell/mwifiex/scan.c | 22 ++++++++++++++++++---
1 file changed, 19 insertions(+), 3 deletions(-)
diff --git a/drivers/net/wireless/marvell/mwifiex/scan.c b/drivers/net/wireless/marvell/mwifiex/scan.c
index 97c0ec3b822e..3a55fc6f1b54 100644
--- a/drivers/net/wireless/marvell/mwifiex/scan.c
+++ b/drivers/net/wireless/marvell/mwifiex/scan.c
@@ -104,12 +104,21 @@ has_vendor_hdr(struct ieee_types_vendor_specific *ie, u8 key)
* a given oui in PTK.
*/
static u8
-mwifiex_search_oui_in_ie(struct ie_body *iebody, u8 *oui)
+mwifiex_search_oui_in_ie(struct ie_body *iebody, u8 *oui, int ie_len)
{
u8 count;
+ /* Need grp_key_oui[4] + ptk_cnt[2] before reading the OUI count. */
+ if (ie_len < (int)offsetof(struct ie_body, ptk_body))
+ return MWIFIEX_OUI_NOT_PRESENT;
+
count = iebody->ptk_cnt[0];
+ /* Reject an OUI count whose list would run past the element. */
+ if (offsetof(struct ie_body, ptk_body) +
+ count * sizeof(iebody->ptk_body) > (size_t)ie_len)
+ return MWIFIEX_OUI_NOT_PRESENT;
+
/* There could be multiple OUIs for PTK hence
1) Take the length.
2) Check all the OUIs for AES.
@@ -143,11 +152,14 @@ mwifiex_is_rsn_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
u8 ret = MWIFIEX_OUI_NOT_PRESENT;
if (has_ieee_hdr(bss_desc->bcn_rsn_ie, WLAN_EID_RSN)) {
+ int ie_len = (int)bss_desc->bcn_rsn_ie->ieee_hdr.len -
+ RSN_GTK_OUI_OFFSET;
+
iebody = (struct ie_body *)
(((u8 *) bss_desc->bcn_rsn_ie->data) +
RSN_GTK_OUI_OFFSET);
oui = &mwifiex_rsn_oui[cipher][0];
- ret = mwifiex_search_oui_in_ie(iebody, oui);
+ ret = mwifiex_search_oui_in_ie(iebody, oui, ie_len);
if (ret)
return ret;
}
@@ -169,10 +181,14 @@ mwifiex_is_wpa_oui_present(struct mwifiex_bssdescriptor *bss_desc, u32 cipher)
u8 ret = MWIFIEX_OUI_NOT_PRESENT;
if (has_vendor_hdr(bss_desc->bcn_wpa_ie, WLAN_EID_VENDOR_SPECIFIC)) {
+ int ie_len = (int)bss_desc->bcn_wpa_ie->vend_hdr.len -
+ (int)sizeof(bss_desc->bcn_wpa_ie->vend_hdr.oui) -
+ WPA_GTK_OUI_OFFSET;
+
iebody = (struct ie_body *)((u8 *)bss_desc->bcn_wpa_ie->data +
WPA_GTK_OUI_OFFSET);
oui = &mwifiex_wpa_oui[cipher][0];
- ret = mwifiex_search_oui_in_ie(iebody, oui);
+ ret = mwifiex_search_oui_in_ie(iebody, oui, ie_len);
if (ret)
return ret;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH] wifi: brcmfmac: drain bus_reset work on device removal
From: Eddie Phillips @ 2026-07-11 5:23 UTC (permalink / raw)
To: Arend van Spriel
Cc: Fan Wu, Arend van Spriel, Kalle Valo, Franky Lin, Hante Meuleman,
Chi-Hsien Lin, Wright Feng, Chung-Hsien Hsu, David S . Miller,
Jakub Kicinski, linux-wireless, brcm80211-dev-list.pdl,
SHA-cyfmac-dev-list, netdev, linux-kernel, stable
In-Reply-To: <caae46b1-50c6-495d-94fe-c95229d489ce@broadcom.com>
On Fri, Jul 10, 2026 at 12:18 PM Arend van Spriel
<arend.vanspriel@broadcom.com> wrote:
>
> On 10/07/2026 02:23, Eddie Phillips wrote:
> > On Thu, 9 Jul 2026 10:16:35 +0000 Fan Wu <fanwu01@zju.edu.cn> wrote:
> >
> >> brcmf_fw_crashed() and the debugfs "reset" entry both schedule
> >> drvr->bus_reset, whose callback recovers drvr through container_of()
> >> and dereferences it. The teardown paths free drvr (brcmf_free ->
> >> wiphy_free) without draining the work, so a bus_reset callback pending
> >> or running during removal can outlive drvr.
> >>
>
> [...]
>
> >>
> >> This issue was found by an in-house static analysis tool.
> >>
> >> Fixes: 4684997d9eea ("brcmfmac: reset PCIe bus on a firmware crash")
> >> Cc: stable@vger.kernel.org
> >> Signed-off-by: Fan Wu <fanwu01@zju.edu.cn>
> >> Assisted-by: Codex:gpt-5.5
> >> ---
> >> .../broadcom/brcm80211/brcmfmac/bcmsdh.c | 13 ++++++++
> >> .../broadcom/brcm80211/brcmfmac/bus.h | 6 ++++
> >> .../broadcom/brcm80211/brcmfmac/core.c | 33 +++++++++++++++++--
> >> .../broadcom/brcm80211/brcmfmac/pcie.c | 6 ++++
> >> .../broadcom/brcm80211/brcmfmac/sdio.c | 6 ++++
> >> .../broadcom/brcm80211/brcmfmac/sdio.h | 1 +
> >> .../broadcom/brcm80211/brcmfmac/usb.c | 3 ++
> >> 7 files changed, 66 insertions(+), 2 deletions(-)
>
> [...]
>
> >> diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> >> index fed9cd5f2..b934feb9b 100644
> >> --- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> >> +++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/core.c
> >> @@ -1164,6 +1164,35 @@ static int brcmf_revinfo_read(struct seq_file *s, void *data)
> >> return 0;
> >> }
> >>
> >> +/* Serialize bus_reset arming (debugfs reset write, brcmf_fw_crashed) against the
> >> + * teardown drain: the remove path takes bus_reset_lock, sets ->removing and cancels
> >> + * the work under it, so a racing armer either schedules before the cancel (and is
> >> + * drained) or observes ->removing and desists.
> >> + */
> >> +static void brcmf_bus_schedule_reset(struct brcmf_bus *bus_if)
> >> +{
> >> + mutex_lock(&bus_if->bus_reset_lock);
> >> + if (bus_if->drvr && bus_if->drvr->bus_reset.func && !bus_if->removing)
> >> + schedule_work(&bus_if->drvr->bus_reset);
> >> + mutex_unlock(&bus_if->bus_reset_lock);
> >> +}
> >
> > Is this safe in a softIRQ context?
> > mutex_lock() sleeps until it can get the lock.
>
> What softIRQ context? brcmf_fw_crashed() is called by PCIe (thread) and
> SDIO (worker).
Yes, you're right. Since it's thread/worker context, sleeping is fine here.
> >> +
> >> +void brcmf_bus_cancel_reset_work(struct brcmf_bus *bus_if)
> >> +{
> >> + mutex_lock(&bus_if->bus_reset_lock);
> >> + bus_if->removing = true;
> >> + if (bus_if->drvr)
> >> + cancel_work_sync(&bus_if->drvr->bus_reset);
> >> + mutex_unlock(&bus_if->bus_reset_lock);
> >> +}
> >
> > How about if brcmf_pcie_remove() calls brcmf_bus_cancel_reset_work(),
> > takes the lock and calls cancel_work_sync(), sleeps. If debugfs
> > path is already running, it can invoke the worker thread. Is there
> > potential that both try to reset?
>
> What is "both" here?
It may be possible that the worker thread is running and then the device is
unplugged, causing a deadlock.
Another possibility here would be to just lock the state change, but both
implementations should are fine.
Best, Eddie
> Regards,
> Arend
^ permalink raw reply
* [PATCH] wifi: nl80211: say why the association BSS lookup failed
From: Louis Kotze @ 2026-07-11 4:34 UTC (permalink / raw)
To: Johannes Berg; +Cc: linux-wireless, linux-kernel, loukot
The BSS lookup for an association request can fail for three distinct
reasons: cfg80211 has no scan entry at all for the BSSID/channel, an
entry exists but is older than IEEE80211_SCAN_RESULT_EXPIRE (and not
held), or a fresh entry exists but its use_for flags do not allow
this use. All three currently surface as the same generic extack
message "Error fetching BSS for link" on the MLO path, and as a bare
-ENOENT with no message on the non-MLO path.
Since wpa_supplicant logs the extack message verbatim ("nl80211:
kernel reports: ..."), that message is often the only diagnostic a
user sees when an MLO association degrades to fewer links, and it
does not say whether rescanning would help. In practice the expired
case is common for MLO partner links: 6 GHz is passive-scan in many
regulatory domains, so the partner-link entry is routinely stale by
the time userspace requests the association even though the link is
perfectly usable.
Add a cfg80211 helper that classifies, on the failure path only, why
matching entries were rejected, and set a distinct extack message
for each case in nl80211_assoc_bss(). Also give the -EINVAL paths
there proper messages while at it, and keep pointing the bad_attr at
the failing link.
Signed-off-by: Louis Kotze <loukot@gmail.com>
---
Compile-tested (W=1 clean) and exercised on a UML/hwsim rig: an MLO
reassociation whose partner-link entry had aged out now gets
"nl80211: kernel reports: BSS not found in scan results" in the
wpa_supplicant debug log instead of the generic message.
net/wireless/core.h | 12 +++++++++++
net/wireless/nl80211.c | 37 +++++++++++++++++++++++--------
net/wireless/scan.c | 49 ++++++++++++++++++++++++++++++++++++++++++
3 files changed, 89 insertions(+), 9 deletions(-)
diff --git a/net/wireless/core.h b/net/wireless/core.h
index df47ed6208a5..a3778c6e07e4 100644
--- a/net/wireless/core.h
+++ b/net/wireless/core.h
@@ -332,6 +332,18 @@ void ieee80211_set_bitrate_flags(struct wiphy *wiphy);
void cfg80211_bss_expire(struct cfg80211_registered_device *rdev);
void cfg80211_bss_age(struct cfg80211_registered_device *rdev,
unsigned long age_secs);
+
+/* why __cfg80211_get_bss() found no usable BSS entry */
+#define CFG80211_BSS_MISS_EXPIRED BIT(0)
+#define CFG80211_BSS_MISS_USE_FOR BIT(1)
+
+u32 cfg80211_get_bss_miss_reasons(struct wiphy *wiphy,
+ struct ieee80211_channel *channel,
+ const u8 *bssid,
+ const u8 *ssid, size_t ssid_len,
+ enum ieee80211_bss_type bss_type,
+ enum ieee80211_privacy privacy,
+ u32 use_for);
void cfg80211_update_assoc_bss_entry(struct wireless_dev *wdev,
unsigned int link,
struct ieee80211_channel *channel);
diff --git a/net/wireless/nl80211.c b/net/wireless/nl80211.c
index 242071ad10d6..a68390ae6d2c 100644
--- a/net/wireless/nl80211.c
+++ b/net/wireless/nl80211.c
@@ -13036,6 +13036,7 @@ static int nl80211_crypto_settings(struct cfg80211_registered_device *rdev,
}
static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device *rdev,
+ struct genl_info *info,
const u8 *ssid, int ssid_len,
struct nlattr **attrs,
int assoc_link_id, int link_id)
@@ -13043,10 +13044,12 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device
struct ieee80211_channel *chan;
struct cfg80211_bss *bss;
const u8 *bssid;
- u32 freq, use_for = 0;
+ u32 freq, miss, use_for = 0;
- if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ])
+ if (!attrs[NL80211_ATTR_MAC] || !attrs[NL80211_ATTR_WIPHY_FREQ]) {
+ NL_SET_ERR_MSG(info->extack, "BSSID or frequency missing");
return ERR_PTR(-EINVAL);
+ }
bssid = nla_data(attrs[NL80211_ATTR_MAC]);
@@ -13055,8 +13058,10 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device
freq += nla_get_u32(attrs[NL80211_ATTR_WIPHY_FREQ_OFFSET]);
chan = nl80211_get_valid_chan(&rdev->wiphy, freq);
- if (!chan)
+ if (!chan) {
+ NL_SET_ERR_MSG(info->extack, "invalid or disabled channel");
return ERR_PTR(-EINVAL);
+ }
if (assoc_link_id >= 0)
use_for = NL80211_BSS_USE_FOR_MLD_LINK;
@@ -13068,8 +13073,23 @@ static struct cfg80211_bss *nl80211_assoc_bss(struct cfg80211_registered_device
IEEE80211_BSS_TYPE_ESS,
IEEE80211_PRIVACY_ANY,
use_for);
- if (!bss)
+ if (!bss) {
+ miss = cfg80211_get_bss_miss_reasons(&rdev->wiphy, chan,
+ bssid, ssid, ssid_len,
+ IEEE80211_BSS_TYPE_ESS,
+ IEEE80211_PRIVACY_ANY,
+ use_for);
+ if (miss & CFG80211_BSS_MISS_USE_FOR)
+ NL_SET_ERR_MSG(info->extack,
+ "BSS cannot be used for this association");
+ else if (miss & CFG80211_BSS_MISS_EXPIRED)
+ NL_SET_ERR_MSG(info->extack,
+ "BSS entry is expired, scan again");
+ else
+ NL_SET_ERR_MSG(info->extack,
+ "BSS not found in scan results");
return ERR_PTR(-ENOENT);
+ }
return bss;
}
@@ -13106,13 +13126,12 @@ static int nl80211_process_links(struct cfg80211_registered_device *rdev,
return -EINVAL;
}
links[link_id].bss =
- nl80211_assoc_bss(rdev, ssid, ssid_len, attrs,
+ nl80211_assoc_bss(rdev, info, ssid, ssid_len, attrs,
assoc_link_id, link_id);
if (IS_ERR(links[link_id].bss)) {
err = PTR_ERR(links[link_id].bss);
links[link_id].bss = NULL;
- NL_SET_ERR_MSG_ATTR(info->extack, link,
- "Error fetching BSS for link");
+ NL_SET_BAD_ATTR(info->extack, link);
return err;
}
@@ -13328,8 +13347,8 @@ static int nl80211_associate(struct sk_buff *skb, struct genl_info *info)
if (req.link_id >= 0)
return -EINVAL;
- req.bss = nl80211_assoc_bss(rdev, ssid, ssid_len, info->attrs,
- -1, -1);
+ req.bss = nl80211_assoc_bss(rdev, info, ssid, ssid_len,
+ info->attrs, -1, -1);
if (IS_ERR(req.bss))
return PTR_ERR(req.bss);
ap_addr = req.bss->bssid;
diff --git a/net/wireless/scan.c b/net/wireless/scan.c
index 05b7dc6b766c..f0e13b178b74 100644
--- a/net/wireless/scan.c
+++ b/net/wireless/scan.c
@@ -1655,6 +1655,55 @@ struct cfg80211_bss *__cfg80211_get_bss(struct wiphy *wiphy,
}
EXPORT_SYMBOL(__cfg80211_get_bss);
+/*
+ * Report why __cfg80211_get_bss() with the same arguments found no
+ * usable entry: matching entries exist but are expired, or are not
+ * usable for the requested use. Returns 0 if no entry matches at all.
+ */
+u32 cfg80211_get_bss_miss_reasons(struct wiphy *wiphy,
+ struct ieee80211_channel *channel,
+ const u8 *bssid,
+ const u8 *ssid, size_t ssid_len,
+ enum ieee80211_bss_type bss_type,
+ enum ieee80211_privacy privacy,
+ u32 use_for)
+{
+ struct cfg80211_registered_device *rdev = wiphy_to_rdev(wiphy);
+ struct cfg80211_internal_bss *bss;
+ unsigned long now = jiffies;
+ u32 reasons = 0;
+ int bss_privacy;
+
+ spin_lock_bh(&rdev->bss_lock);
+
+ list_for_each_entry(bss, &rdev->bss_list, list) {
+ if (!cfg80211_bss_type_match(bss->pub.capability,
+ bss->pub.channel->band, bss_type))
+ continue;
+
+ bss_privacy = (bss->pub.capability & WLAN_CAPABILITY_PRIVACY);
+ if ((privacy == IEEE80211_PRIVACY_ON && !bss_privacy) ||
+ (privacy == IEEE80211_PRIVACY_OFF && bss_privacy))
+ continue;
+ if (channel && bss->pub.channel != channel)
+ continue;
+ if (!is_valid_ether_addr(bss->pub.bssid))
+ continue;
+ if (!is_bss(&bss->pub, bssid, ssid, ssid_len))
+ continue;
+
+ if (time_after(now, bss->ts + IEEE80211_SCAN_RESULT_EXPIRE) &&
+ !atomic_read(&bss->hold))
+ reasons |= CFG80211_BSS_MISS_EXPIRED;
+ else if ((bss->pub.use_for & use_for) != use_for)
+ reasons |= CFG80211_BSS_MISS_USE_FOR;
+ }
+
+ spin_unlock_bh(&rdev->bss_lock);
+
+ return reasons;
+}
+
static bool rb_insert_bss(struct cfg80211_registered_device *rdev,
struct cfg80211_internal_bss *bss)
{
base-commit: ac798f757d6475dc6fee2ec899980d6740714596
--
2.55.0
^ permalink raw reply related
* [wireless:main] BUILD SUCCESS a0d82fb8505326cbc53dc9a0c08f97d11197bb30
From: kernel test robot @ 2026-07-11 3:30 UTC (permalink / raw)
To: Paolo Abeni; +Cc: Johannes Berg, linux-wireless
tree/branch: https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git main
branch HEAD: a0d82fb8505326cbc53dc9a0c08f97d11197bb30 Merge tag 'wireless-2026-07-09' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
elapsed time: 760m
configs tested: 241
configs skipped: 4
The following configs have been built successfully.
More configs may be tested in the coming days.
tested configs:
alpha allnoconfig gcc-16.1.0
alpha allyesconfig gcc-16.1.0
alpha defconfig gcc-16.1.0
arc allmodconfig clang-23
arc allmodconfig gcc-16.1.0
arc allnoconfig gcc-16.1.0
arc allyesconfig clang-23
arc allyesconfig gcc-16.1.0
arc defconfig gcc-16.1.0
arc randconfig-001-20260711 gcc-13.4.0
arc randconfig-002-20260711 gcc-13.4.0
arm allnoconfig clang-17
arm allnoconfig gcc-16.1.0
arm allyesconfig clang-23
arm allyesconfig gcc-16.1.0
arm defconfig gcc-16.1.0
arm omap1_defconfig gcc-16.1.0
arm randconfig-001-20260711 gcc-13.4.0
arm randconfig-002-20260711 gcc-13.4.0
arm randconfig-003-20260711 gcc-13.4.0
arm randconfig-004-20260711 gcc-13.4.0
arm vexpress_defconfig gcc-16.1.0
arm64 allmodconfig clang-23
arm64 allnoconfig gcc-16.1.0
arm64 defconfig gcc-16.1.0
arm64 randconfig-001-20260711 gcc-16.1.0
arm64 randconfig-002-20260711 gcc-16.1.0
arm64 randconfig-003-20260711 gcc-16.1.0
arm64 randconfig-004-20260711 gcc-16.1.0
csky allmodconfig gcc-16.1.0
csky allnoconfig gcc-16.1.0
csky defconfig gcc-16.1.0
csky randconfig-001-20260711 gcc-16.1.0
csky randconfig-002-20260711 gcc-16.1.0
hexagon allmodconfig clang-23
hexagon allmodconfig gcc-16.1.0
hexagon allnoconfig clang-23
hexagon allnoconfig gcc-16.1.0
hexagon defconfig gcc-16.1.0
hexagon randconfig-001-20260711 clang-17
hexagon randconfig-001-20260711 gcc-16.1.0
hexagon randconfig-002-20260711 clang-23
hexagon randconfig-002-20260711 gcc-16.1.0
i386 allmodconfig clang-22
i386 allmodconfig gcc-14
i386 allnoconfig gcc-14
i386 allnoconfig gcc-16.1.0
i386 allyesconfig clang-22
i386 allyesconfig gcc-14
i386 buildonly-randconfig-001-20260711 gcc-14
i386 buildonly-randconfig-002-20260711 gcc-14
i386 buildonly-randconfig-003-20260711 gcc-14
i386 buildonly-randconfig-004-20260711 gcc-14
i386 buildonly-randconfig-005-20260711 gcc-14
i386 buildonly-randconfig-006-20260711 gcc-14
i386 defconfig gcc-16.1.0
i386 randconfig-001-20260711 clang-22
i386 randconfig-002-20260711 clang-22
i386 randconfig-003-20260711 clang-22
i386 randconfig-004-20260711 clang-22
i386 randconfig-005-20260711 clang-22
i386 randconfig-006-20260711 clang-22
i386 randconfig-007-20260711 clang-22
i386 randconfig-011-20260711 gcc-13
i386 randconfig-012-20260711 gcc-13
i386 randconfig-013-20260711 gcc-13
i386 randconfig-014-20260711 gcc-13
i386 randconfig-015-20260711 gcc-13
i386 randconfig-016-20260711 gcc-13
i386 randconfig-017-20260711 gcc-13
loongarch allmodconfig clang-19
loongarch allmodconfig clang-23
loongarch allnoconfig clang-20
loongarch allnoconfig gcc-16.1.0
loongarch defconfig clang-23
loongarch randconfig-001-20260711 gcc-16.1.0
loongarch randconfig-002-20260711 gcc-15.2.0
loongarch randconfig-002-20260711 gcc-16.1.0
m68k allmodconfig gcc-16.1.0
m68k allnoconfig gcc-16.1.0
m68k allyesconfig clang-23
m68k allyesconfig gcc-16.1.0
m68k defconfig clang-23
microblaze allnoconfig gcc-16.1.0
microblaze allyesconfig gcc-16.1.0
microblaze defconfig clang-23
mips allmodconfig gcc-16.1.0
mips allnoconfig gcc-16.1.0
mips allyesconfig gcc-16.1.0
mips malta_qemu_32r6_defconfig gcc-16.1.0
nios2 allmodconfig clang-20
nios2 allnoconfig clang-23
nios2 allnoconfig gcc-11.5.0
nios2 defconfig clang-23
nios2 randconfig-001-20260711 gcc-16.1.0
nios2 randconfig-001-20260711 gcc-8.5.0
nios2 randconfig-002-20260711 gcc-11.5.0
nios2 randconfig-002-20260711 gcc-16.1.0
openrisc allmodconfig clang-20
openrisc allnoconfig clang-23
openrisc allnoconfig gcc-16.1.0
openrisc defconfig gcc-16.1.0
parisc allmodconfig gcc-16.1.0
parisc allnoconfig clang-23
parisc allnoconfig gcc-16.1.0
parisc allyesconfig clang-17
parisc allyesconfig gcc-16.1.0
parisc defconfig gcc-16.1.0
parisc randconfig-001 clang-17
parisc randconfig-001 gcc-10.5.0
parisc randconfig-001-20260711 clang-17
parisc randconfig-001-20260711 gcc-10.5.0
parisc randconfig-001-20260711 gcc-12.5.0
parisc randconfig-002 clang-17
parisc randconfig-002 gcc-10.5.0
parisc randconfig-002-20260711 clang-17
parisc randconfig-002-20260711 gcc-10.5.0
parisc64 defconfig clang-23
powerpc allmodconfig gcc-16.1.0
powerpc allnoconfig clang-23
powerpc allnoconfig gcc-16.1.0
powerpc mvme5100_defconfig gcc-16.1.0
powerpc randconfig-001 clang-17
powerpc randconfig-001 gcc-10.5.0
powerpc randconfig-001-20260711 clang-17
powerpc randconfig-001-20260711 gcc-10.5.0
powerpc randconfig-001-20260711 gcc-11.5.0
powerpc randconfig-002 clang-17
powerpc randconfig-002 gcc-10.5.0
powerpc randconfig-002-20260711 clang-17
powerpc64 randconfig-001 clang-17
powerpc64 randconfig-001-20260711 clang-17
powerpc64 randconfig-001-20260711 gcc-10.5.0
powerpc64 randconfig-002 clang-17
powerpc64 randconfig-002 gcc-10.5.0
powerpc64 randconfig-002-20260711 clang-17
powerpc64 randconfig-002-20260711 gcc-10.5.0
powerpc64 randconfig-002-20260711 gcc-11.5.0
riscv allmodconfig clang-23
riscv allnoconfig clang-23
riscv allnoconfig gcc-16.1.0
riscv allyesconfig clang-23
riscv defconfig gcc-16.1.0
riscv randconfig-001-20260711 clang-17
riscv randconfig-001-20260711 gcc-8.5.0
riscv randconfig-002-20260711 gcc-8.5.0
s390 allmodconfig clang-17
s390 allmodconfig clang-23
s390 allnoconfig clang-23
s390 allyesconfig gcc-16.1.0
s390 defconfig gcc-16.1.0
s390 randconfig-001-20260711 clang-19
s390 randconfig-001-20260711 gcc-8.5.0
s390 randconfig-002-20260711 gcc-8.5.0
sh allmodconfig gcc-16.1.0
sh allnoconfig clang-23
sh allnoconfig gcc-16.1.0
sh allyesconfig clang-17
sh allyesconfig gcc-16.1.0
sh defconfig gcc-14
sh defconfig gcc-16.1.0
sh randconfig-001-20260711 gcc-11.5.0
sh randconfig-001-20260711 gcc-8.5.0
sh randconfig-002-20260711 gcc-8.5.0
sh randconfig-002-20260711 gcc-9.5.0
sh sh7724_generic_defconfig gcc-16.1.0
sparc allnoconfig clang-23
sparc allnoconfig gcc-16.1.0
sparc defconfig gcc-16.1.0
sparc randconfig-001-20260711 gcc-16.1.0
sparc randconfig-002-20260711 gcc-16.1.0
sparc64 allmodconfig clang-20
sparc64 defconfig clang-23
sparc64 defconfig gcc-14
sparc64 randconfig-001-20260711 gcc-16.1.0
sparc64 randconfig-002-20260711 gcc-16.1.0
um allmodconfig clang-17
um allnoconfig clang-17
um allnoconfig clang-23
um allyesconfig gcc-14
um allyesconfig gcc-16.1.0
um defconfig clang-23
um defconfig gcc-14
um i386_defconfig gcc-14
um randconfig-001-20260711 gcc-16.1.0
um randconfig-002-20260711 gcc-16.1.0
um x86_64_defconfig clang-23
um x86_64_defconfig gcc-14
x86_64 allmodconfig clang-22
x86_64 allnoconfig clang-22
x86_64 allnoconfig clang-23
x86_64 allyesconfig clang-22
x86_64 buildonly-randconfig-001-20260711 gcc-14
x86_64 buildonly-randconfig-002-20260711 gcc-14
x86_64 buildonly-randconfig-003-20260711 gcc-14
x86_64 buildonly-randconfig-004-20260711 gcc-14
x86_64 buildonly-randconfig-005-20260711 gcc-14
x86_64 buildonly-randconfig-006-20260711 gcc-14
x86_64 defconfig gcc-14
x86_64 kexec clang-22
x86_64 randconfig-001 clang-22
x86_64 randconfig-001-20260711 gcc-14
x86_64 randconfig-002 clang-22
x86_64 randconfig-002-20260711 gcc-14
x86_64 randconfig-003 clang-22
x86_64 randconfig-003-20260711 gcc-14
x86_64 randconfig-004 clang-22
x86_64 randconfig-004-20260711 gcc-14
x86_64 randconfig-005 clang-22
x86_64 randconfig-005-20260711 gcc-14
x86_64 randconfig-006 clang-22
x86_64 randconfig-006-20260711 gcc-14
x86_64 randconfig-011-20260711 clang-22
x86_64 randconfig-011-20260711 gcc-14
x86_64 randconfig-012-20260711 clang-22
x86_64 randconfig-012-20260711 gcc-14
x86_64 randconfig-013-20260711 gcc-14
x86_64 randconfig-014-20260711 gcc-14
x86_64 randconfig-015-20260711 gcc-14
x86_64 randconfig-016-20260711 clang-22
x86_64 randconfig-016-20260711 gcc-14
x86_64 randconfig-071-20260711 clang-22
x86_64 randconfig-071-20260711 gcc-14
x86_64 randconfig-072-20260711 gcc-14
x86_64 randconfig-073-20260711 clang-22
x86_64 randconfig-073-20260711 gcc-14
x86_64 randconfig-074-20260711 gcc-14
x86_64 randconfig-075-20260711 gcc-14
x86_64 randconfig-076-20260711 gcc-14
x86_64 rhel-9.4 clang-22
x86_64 rhel-9.4-bpf gcc-14
x86_64 rhel-9.4-func clang-22
x86_64 rhel-9.4-kselftests clang-22
x86_64 rhel-9.4-kunit gcc-14
x86_64 rhel-9.4-ltp gcc-14
x86_64 rhel-9.4-rust clang-22
xtensa allnoconfig clang-23
xtensa allnoconfig gcc-16.1.0
xtensa allyesconfig clang-20
xtensa randconfig-001-20260711 gcc-16.1.0
xtensa randconfig-002-20260711 gcc-16.1.0
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* [PATCH net-next v2 3/3] net: ipv4: clear dev->ip_ptr before destroying inetdev
From: Yuyang Huang @ 2026-07-11 0:54 UTC (permalink / raw)
To: Yuyang Huang
Cc: David S. Miller, Andrew Lunn, David Ahern, Elad Nachman,
Eric Dumazet, Ido Schimmel, Jakub Kicinski, Johannes Berg,
Paolo Abeni, Simon Horman, linux-kernel, linux-wireless, netdev,
Kuniyuki Iwashima
In-Reply-To: <20260711005405.2861680-1-yuyanghuang@google.com>
To prevent RCU readers from accessing a partially destroyed in_device,
clear dev->ip_ptr early in inetdev_destroy() before freeing the
multicast list and individual IP addresses. This aligns the IPv4 teardown
sequence with the IPv6 implementation.
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
---
net/ipv4/devinet.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c
index a35b72662e43..3b31f4bec30e 100644
--- a/net/ipv4/devinet.c
+++ b/net/ipv4/devinet.c
@@ -322,6 +322,8 @@ static void inetdev_destroy(struct in_device *in_dev)
in_dev->dead = 1;
+ RCU_INIT_POINTER(dev->ip_ptr, NULL);
+
ip_mc_destroy_dev(in_dev);
while ((ifa = rtnl_dereference(in_dev->ifa_list)) != NULL) {
@@ -329,8 +331,6 @@ static void inetdev_destroy(struct in_device *in_dev)
inet_free_ifa(ifa);
}
- RCU_INIT_POINTER(dev->ip_ptr, NULL);
-
devinet_sysctl_unregister(in_dev);
neigh_parms_release(&arp_tbl, in_dev->arp_parms);
arp_ifdown(dev);
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related
* [PATCH net-next v2 2/3] wifi: mac80211: use ifa_dev from event argument
From: Yuyang Huang @ 2026-07-11 0:54 UTC (permalink / raw)
To: Yuyang Huang
Cc: David S. Miller, Andrew Lunn, David Ahern, Elad Nachman,
Eric Dumazet, Ido Schimmel, Jakub Kicinski, Johannes Berg,
Paolo Abeni, Simon Horman, linux-kernel, linux-wireless, netdev,
Kuniyuki Iwashima
In-Reply-To: <20260711005405.2861680-1-yuyanghuang@google.com>
During address teardown, the netdevice's ip_ptr might be cleared before
the inetaddr notifier is called. In this case, __in_dev_get_rtnl()
returns NULL, causing the notifier to abort early and fail to update
the ARP filter.
Fix this by using the in_device pointer from the event argument
(ifa->ifa_dev) which is guaranteed to be valid.
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
---
net/mac80211/main.c | 4 +---
1 file changed, 1 insertion(+), 3 deletions(-)
diff --git a/net/mac80211/main.c b/net/mac80211/main.c
index 90d295cc364f..0e7a60dd1d8d 100644
--- a/net/mac80211/main.c
+++ b/net/mac80211/main.c
@@ -588,9 +588,7 @@ static int ieee80211_ifa_changed(struct notifier_block *nb,
if (sdata->vif.type != NL80211_IFTYPE_STATION)
return NOTIFY_DONE;
- idev = __in_dev_get_rtnl(sdata->dev);
- if (!idev)
- return NOTIFY_DONE;
+ idev = ifa->ifa_dev;
ifmgd = &sdata->u.mgd;
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related
* [PATCH net-next v2 1/3] net: prestera: ignore duplicate RIF destruction events
From: Yuyang Huang @ 2026-07-11 0:54 UTC (permalink / raw)
To: Yuyang Huang
Cc: David S. Miller, Andrew Lunn, David Ahern, Elad Nachman,
Eric Dumazet, Ido Schimmel, Jakub Kicinski, Johannes Berg,
Paolo Abeni, Simon Horman, linux-kernel, linux-wireless, netdev,
Kuniyuki Iwashima
In-Reply-To: <20260711005405.2861680-1-yuyanghuang@google.com>
During address teardown, the inetaddr notifier may be called multiple
times for the same interface. Ignore NETDEV_DOWN events if the RIF has
already been destroyed, rather than returning -EEXIST, which aborts the
notifier chain.
Cc: Ido Schimmel <idosch@nvidia.com>
Cc: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Yuyang Huang <yuyanghuang@google.com>
---
drivers/net/ethernet/marvell/prestera/prestera_router.c | 6 ++----
1 file changed, 2 insertions(+), 4 deletions(-)
diff --git a/drivers/net/ethernet/marvell/prestera/prestera_router.c b/drivers/net/ethernet/marvell/prestera/prestera_router.c
index b036b173a308..0c4f462baa6e 100644
--- a/drivers/net/ethernet/marvell/prestera/prestera_router.c
+++ b/drivers/net/ethernet/marvell/prestera/prestera_router.c
@@ -1302,10 +1302,8 @@ static int __prestera_inetaddr_port_event(struct net_device *port_dev,
dev_hold(port_dev);
break;
case NETDEV_DOWN:
- if (!re) {
- NL_SET_ERR_MSG_MOD(extack, "Can't find RIF");
- return -EEXIST;
- }
+ if (!re)
+ return 0;
prestera_rif_entry_destroy(port->sw, re);
dev_put(port_dev);
break;
--
2.55.0.795.g602f6c329a-goog
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox