[PATCH net 0/4] wireguard fixes for 6.17-rc6

[PATCH net 0/4] wireguard fixes for 6.17-rc6

[Jason A. Donenfeld]

Hi Jakub,

Please find three small fixes to wireguard:

1) A general simplification to the way wireguard chooses the next
   available cpu, by making use of cpumask_nth(), and covering an edge
   case.

2) A cleanup to the selftests kconfig.

3) A fix to the selftests kconfig so that it actually runs again.

Thanks,
Jason

David Hildenbrand (1):
  wireguard: selftests: remove CONFIG_SPARSEMEM_VMEMMAP=y from qemu
    kernel config

Jason A. Donenfeld (1):
  wireguard: selftests: select CONFIG_IP_NF_IPTABLES_LEGACY

Yury Norov (NVIDIA) (1):
  wireguard: queueing: always return valid online CPU in
    wg_cpumask_choose_online()

Yury Norov [NVIDIA] (1):
  wireguard: queueing: simplify wg_cpumask_next_online()

 drivers/net/wireguard/queueing.h                    | 13 ++++---------
 .../testing/selftests/wireguard/qemu/kernel.config  |  8 ++++----
 2 files changed, 8 insertions(+), 13 deletions(-)

-- 
2.51.0

[PATCH net 1/4] wireguard: queueing: simplify wg_cpumask_next_online()

[Jason A. Donenfeld]

From: "Yury Norov [NVIDIA]" <yury.norov@gmail.com>

wg_cpumask_choose_online() opencodes cpumask_nth(). Use it and make the
function significantly simpler. While there, fix opencoded cpu_online()
too.

Signed-off-by: Yury Norov <yury.norov@gmail.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 drivers/net/wireguard/queueing.h | 13 ++++---------
 1 file changed, 4 insertions(+), 9 deletions(-)

diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h
index 7eb76724b3ed..56314f98b6ba 100644
--- a/drivers/net/wireguard/queueing.h
+++ b/drivers/net/wireguard/queueing.h
@@ -104,16 +104,11 @@ static inline void wg_reset_packet(struct sk_buff *skb, bool encapsulating)
 
 static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id)
 {
-	unsigned int cpu = *stored_cpu, cpu_index, i;
+	unsigned int cpu = *stored_cpu;
+
+	if (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu)))
+		cpu = *stored_cpu = cpumask_nth(id % num_online_cpus(), cpu_online_mask);
 
-	if (unlikely(cpu >= nr_cpu_ids ||
-		     !cpumask_test_cpu(cpu, cpu_online_mask))) {
-		cpu_index = id % cpumask_weight(cpu_online_mask);
-		cpu = cpumask_first(cpu_online_mask);
-		for (i = 0; i < cpu_index; ++i)
-			cpu = cpumask_next(cpu, cpu_online_mask);
-		*stored_cpu = cpu;
-	}
 	return cpu;
 }
 
-- 
2.51.0

[PATCH net 2/4] wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online()

[Jason A. Donenfeld]

From: "Yury Norov (NVIDIA)" <yury.norov@gmail.com>

The function gets number of online CPUS, and uses it to search for
Nth cpu in cpu_online_mask.

If id == num_online_cpus() - 1, and one CPU gets offlined between
calling num_online_cpus() -> cpumask_nth(), there's a chance for
cpumask_nth() to find nothing and return >= nr_cpu_ids.

The caller code in __queue_work() tries to avoid that by checking the
returned CPU against WORK_CPU_UNBOUND, which is NR_CPUS. It's not the
same as '>= nr_cpu_ids'. On a typical Ubuntu desktop, NR_CPUS is 8192,
while nr_cpu_ids is the actual number of possible CPUs, say 8.

The non-existing cpu may later be passed to rcu_dereference() and
corrupt the logic. Fix it by switching from 'if' to 'while'.

Suggested-by: Jason A. Donenfeld <Jason@zx2c4.com>
Signed-off-by: Yury Norov (NVIDIA) <yury.norov@gmail.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 drivers/net/wireguard/queueing.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/drivers/net/wireguard/queueing.h b/drivers/net/wireguard/queueing.h
index 56314f98b6ba..79b6d70de236 100644
--- a/drivers/net/wireguard/queueing.h
+++ b/drivers/net/wireguard/queueing.h
@@ -106,7 +106,7 @@ static inline int wg_cpumask_choose_online(int *stored_cpu, unsigned int id)
 {
 	unsigned int cpu = *stored_cpu;
 
-	if (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu)))
+	while (unlikely(cpu >= nr_cpu_ids || !cpu_online(cpu)))
 		cpu = *stored_cpu = cpumask_nth(id % num_online_cpus(), cpu_online_mask);
 
 	return cpu;
-- 
2.51.0

[PATCH net 3/4] wireguard: selftests: remove CONFIG_SPARSEMEM_VMEMMAP=y from qemu kernel config

[Jason A. Donenfeld]

From: David Hildenbrand <david@redhat.com>

It's no longer user-selectable (and the default was already "y"), so
let's just drop it.

It was never really relevant to the wireguard selftests either way.

Cc: Shuah Khan <shuah@kernel.org>
Acked-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Reviewed-by: Lorenzo Stoakes <lorenzo.stoakes@oracle.com>
Reviewed-by: Liam R. Howlett <Liam.Howlett@oracle.com>
Signed-off-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 tools/testing/selftests/wireguard/qemu/kernel.config | 1 -
 1 file changed, 1 deletion(-)

diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config
index 0a5381717e9f..1149289f4b30 100644
--- a/tools/testing/selftests/wireguard/qemu/kernel.config
+++ b/tools/testing/selftests/wireguard/qemu/kernel.config
@@ -48,7 +48,6 @@ CONFIG_JUMP_LABEL=y
 CONFIG_FUTEX=y
 CONFIG_SHMEM=y
 CONFIG_SLUB=y
-CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_SMP=y
 CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
-- 
2.51.0

[PATCH net 4/4] wireguard: selftests: select CONFIG_IP_NF_IPTABLES_LEGACY

[Jason A. Donenfeld]

This is required on recent kernels, where it is now off by default.
While we're here, fix some stray =m's that were supposed to be =y.

Signed-off-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
 tools/testing/selftests/wireguard/qemu/kernel.config | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/tools/testing/selftests/wireguard/qemu/kernel.config b/tools/testing/selftests/wireguard/qemu/kernel.config
index 1149289f4b30..936b18be07cf 100644
--- a/tools/testing/selftests/wireguard/qemu/kernel.config
+++ b/tools/testing/selftests/wireguard/qemu/kernel.config
@@ -20,9 +20,10 @@ CONFIG_NETFILTER_XTABLES_LEGACY=y
 CONFIG_NETFILTER_XT_NAT=y
 CONFIG_NETFILTER_XT_MATCH_LENGTH=y
 CONFIG_NETFILTER_XT_MARK=y
-CONFIG_NETFILTER_XT_TARGET_MASQUERADE=m
-CONFIG_IP_NF_TARGET_REJECT=m
-CONFIG_IP6_NF_TARGET_REJECT=m
+CONFIG_NETFILTER_XT_TARGET_MASQUERADE=y
+CONFIG_IP_NF_TARGET_REJECT=y
+CONFIG_IP6_NF_TARGET_REJECT=y
+CONFIG_IP_NF_IPTABLES_LEGACY=y
 CONFIG_IP_NF_IPTABLES=y
 CONFIG_IP_NF_FILTER=y
 CONFIG_IP_NF_MANGLE=y
-- 
2.51.0

Re: [PATCH net 0/4] wireguard fixes for 6.17-rc6

[Jakub Kicinski]

On Wed, 10 Sep 2025 03:36:40 +0200 Jason A. Donenfeld wrote:
> 1) A general simplification to the way wireguard chooses the next
>    available cpu, by making use of cpumask_nth(), and covering an edge
>    case.
> 
> 2) A cleanup to the selftests kconfig.
> 
> 3) A fix to the selftests kconfig so that it actually runs again.

These don't really seem 6.17-worthy TBH.
Do you care deeply or can we push these to -next?

Re: [PATCH net 0/4] wireguard fixes for 6.17-rc6

[Jason A. Donenfeld]

On Thu, Sep 11, 2025 at 4:20 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Wed, 10 Sep 2025 03:36:40 +0200 Jason A. Donenfeld wrote:
> > 1) A general simplification to the way wireguard chooses the next
> >    available cpu, by making use of cpumask_nth(), and covering an edge
> >    case.
> >
> > 2) A cleanup to the selftests kconfig.
> >
> > 3) A fix to the selftests kconfig so that it actually runs again.
>
> These don't really seem 6.17-worthy TBH.
> Do you care deeply or can we push these to -next?

I was mainly concerned about (3), so that the tests would run again,
but I guess it's not a huge deal, and I see you already applied these
to -next, so that's fine.

Jason

Re: [PATCH net 0/4] wireguard fixes for 6.17-rc6

[patchwork-bot+netdevbpf]

Hello:

This series was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:

On Wed, 10 Sep 2025 03:36:40 +0200 you wrote:
> Hi Jakub,
> 
> Please find three small fixes to wireguard:
> 
> 1) A general simplification to the way wireguard chooses the next
>    available cpu, by making use of cpumask_nth(), and covering an edge
>    case.
> 
> [...]

Here is the summary with links:
  - [net,1/4] wireguard: queueing: simplify wg_cpumask_next_online()
    https://git.kernel.org/netdev/net-next/c/5551d2128470
  - [net,2/4] wireguard: queueing: always return valid online CPU in wg_cpumask_choose_online()
    https://git.kernel.org/netdev/net-next/c/5bd8de20770c
  - [net,3/4] wireguard: selftests: remove CONFIG_SPARSEMEM_VMEMMAP=y from qemu kernel config
    https://git.kernel.org/netdev/net-next/c/30e1a1dfa228
  - [net,4/4] wireguard: selftests: select CONFIG_IP_NF_IPTABLES_LEGACY
    https://git.kernel.org/netdev/net-next/c/ff78bfe48be8

You are awesome, thank you!
-- 
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html

Re: [PATCH net 0/4] wireguard fixes for 6.17-rc6

[Hangbin Liu]

On Wed, Sep 10, 2025 at 03:36:40AM +0200, Jason A. Donenfeld wrote:
> Hi Jakub,
> 
> Please find three small fixes to wireguard:
> 
> 1) A general simplification to the way wireguard chooses the next
>    available cpu, by making use of cpumask_nth(), and covering an edge
>    case.
> 
> 2) A cleanup to the selftests kconfig.
> 
> 3) A fix to the selftests kconfig so that it actually runs again.

Hi Jason,

Sorry to bother you, but I have a WireGuard self-test update [1] that has been
stuck in "Awaiting Upstream" for a long time without any comments. Could you
please help review it?

[1] https://lore.kernel.org/netdev/20250527032635.10361-1-liuhangbin@gmail.com

Thanks
Hangbin