* [PATCH v3 5/7] net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
From: Stephen Hemminger @ 2026-03-26 18:01 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, Victor Nogueira, Stephen Hemminger, Jiri Pirko,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Toke Høiland-Jørgensen, Kuniyuki Iwashima,
open list
In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org>
From: Jamal Hadi Salim <jhs@mojatatu.com>
When mirred redirects to ingress (from either ingress or egress) the loop
state from sched_mirred_dev array dev is lost because of 1) the packet
deferral into the backlog and 2) the fact the sched_mirred_dev array is
cleared. In such cases, if there was a loop we won't discover it.
Here's a simple test to reproduce:
ip a add dev port0 10.10.10.11/24
tc qdisc add dev port0 clsact
tc filter add dev port0 egress protocol ip \
prio 10 matchall action mirred ingress redirect dev port1
tc qdisc add dev port1 clsact
tc filter add dev port1 ingress protocol ip \
prio 10 matchall action mirred egress redirect dev port0
ping -c 1 -W0.01 10.10.10.10
Fixes: fe946a751d9b ("net/sched: act_mirred: add loop detection")
Tested-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/act_mirred.c | 47 +++++++++++++++++++++++++++---------------
1 file changed, 30 insertions(+), 17 deletions(-)
diff --git a/net/sched/act_mirred.c b/net/sched/act_mirred.c
index 05e0b14b5773..001dd9275e9b 100644
--- a/net/sched/act_mirred.c
+++ b/net/sched/act_mirred.c
@@ -26,6 +26,10 @@
#include <net/tc_act/tc_mirred.h>
#include <net/tc_wrapper.h>
+#define MIRRED_DEFER_LIMIT 3
+_Static_assert(MIRRED_DEFER_LIMIT <= 3,
+ "MIRRED_DEFER_LIMIT exceeds tc_depth bitfield width");
+
static LIST_HEAD(mirred_list);
static DEFINE_SPINLOCK(mirred_list_lock);
@@ -234,12 +238,15 @@ tcf_mirred_forward(bool at_ingress, bool want_ingress, struct sk_buff *skb)
{
int err;
- if (!want_ingress)
+ if (!want_ingress) {
err = tcf_dev_queue_xmit(skb, dev_queue_xmit);
- else if (!at_ingress)
- err = netif_rx(skb);
- else
- err = netif_receive_skb(skb);
+ } else {
+ skb->tc_depth++;
+ if (!at_ingress)
+ err = netif_rx(skb);
+ else
+ err = netif_receive_skb(skb);
+ }
return err;
}
@@ -426,6 +433,7 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
struct netdev_xmit *xmit;
bool m_mac_header_xmit;
struct net_device *dev;
+ bool want_ingress;
int i, m_eaction;
u32 blockid;
@@ -434,7 +442,8 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
#else
xmit = this_cpu_ptr(&softnet_data.xmit);
#endif
- if (unlikely(xmit->sched_mirred_nest >= MIRRED_NEST_LIMIT)) {
+ if (unlikely(xmit->sched_mirred_nest >= MIRRED_NEST_LIMIT ||
+ skb->tc_depth >= MIRRED_DEFER_LIMIT)) {
net_warn_ratelimited("Packet exceeded mirred recursion limit on dev %s\n",
netdev_name(skb->dev));
return TC_ACT_SHOT;
@@ -453,23 +462,27 @@ TC_INDIRECT_SCOPE int tcf_mirred_act(struct sk_buff *skb,
tcf_action_inc_overlimit_qstats(&m->common);
return retval;
}
- for (i = 0; i < xmit->sched_mirred_nest; i++) {
- if (xmit->sched_mirred_dev[i] != dev)
- continue;
- pr_notice_once("tc mirred: loop on device %s\n",
- netdev_name(dev));
- tcf_action_inc_overlimit_qstats(&m->common);
- return retval;
- }
- xmit->sched_mirred_dev[xmit->sched_mirred_nest++] = dev;
+ m_eaction = READ_ONCE(m->tcfm_eaction);
+ want_ingress = tcf_mirred_act_wants_ingress(m_eaction);
+ if (!want_ingress) {
+ for (i = 0; i < xmit->sched_mirred_nest; i++) {
+ if (xmit->sched_mirred_dev[i] != dev)
+ continue;
+ pr_notice_once("tc mirred: loop on device %s\n",
+ netdev_name(dev));
+ tcf_action_inc_overlimit_qstats(&m->common);
+ return retval;
+ }
+ xmit->sched_mirred_dev[xmit->sched_mirred_nest++] = dev;
+ }
m_mac_header_xmit = READ_ONCE(m->tcfm_mac_header_xmit);
- m_eaction = READ_ONCE(m->tcfm_eaction);
retval = tcf_mirred_to_dev(skb, m, dev, m_mac_header_xmit, m_eaction,
retval);
- xmit->sched_mirred_nest--;
+ if (!want_ingress)
+ xmit->sched_mirred_nest--;
return retval;
}
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net-next] virtio_net: sync RX buffer before reading the header
From: Simon Horman @ 2026-03-26 18:17 UTC (permalink / raw)
To: Michael S. Tsirkin
Cc: linux-kernel, Omar Elghoul, Srikanth Aithal, Jason Wang,
Xuan Zhuo, Eugenio Pérez, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Alexei Starovoitov,
Daniel Borkmann, Jesper Dangaard Brouer, John Fastabend,
Stanislav Fomichev, Vishwanath Seshagiri, netdev, virtualization,
bpf
In-Reply-To: <f4caa9be9e5addae7851c012cab0a733be7f0974.1774365273.git.mst@redhat.com>
On Tue, Mar 24, 2026 at 11:15:54AM -0400, Michael S. Tsirkin wrote:
> receive_buf() reads the virtio header through buf before
> page_pool_dma_sync_for_cpu() runs in receive_small() or
> receive_mergeable(). The header buffer is thus unsynchronized at the
> point where flags and, for mergeable buffers, num_buffers are consumed.
>
> Omar Elghoul reported that on s390x Secure Execution this showed up as
> greatly reduced virtio-net performance together with "bad gso" and
> "bad csum" messages in dmesg. This is because with SE sync actually
> copies data, so the header is uninitialized.
>
> Move the sync into receive_buf() so the
> header is synchronized before any access through buf.
>
> Tool use: Cursor with GPT-5.4 drafted the initial code move from prompt:
> "in drivers/net/virtio_net.c, move page_pool_dma_sync_for_cpu on receive
> path to before memory is accessed through buf".
> The result and the commit log were reviewed and edited manually.
>
> Fixes: 168b61da6871 ("virtio_net: add page_pool support for buffer allocation")
Hi Michael,
The hash for a patch with that subject in net-next appears to be 24fbd3967f3f.
> Reported-by: Omar Elghoul <oelghoul@linux.ibm.com>
> Tested-by: Srikanth Aithal <sraithal@amd.com>
> Tested-by: Omar Elghoul <oelghoul@linux.ibm.com>
> Link: https://lore.kernel.org/r/20260323150136.14452-1-oelghoul@linux.ibm.com
> Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
...
^ permalink raw reply
* [PATCH v3 4/7] net/sched: fix packet loop on netem when duplicate is on
From: Stephen Hemminger @ 2026-03-26 18:01 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, William Liu, Savino Dicanosa, Victor Nogueira,
Stephen Hemminger, Jiri Pirko, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, open list
In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org>
From: Jamal Hadi Salim <jhs@mojatatu.com>
When netem duplicates a packet it re-enqueues the copy at the root qdisc.
If another netem sits in the tree the copy can be duplicated
again, recursing until the stack or memory is exhausted.
The original duplication guard temporarily zeroed q->duplicate around
the re-enqueue, but that does not cover all cases because it is
per-qdisc state shared across all concurrent enqueue paths
and is not safe without additional locking.
Use the skb tc_depth field introduced in an earlier patch:
- increment it on the duplicate before re-enqueue
- skip duplication for any skb whose tc_depth is already non-zero.
This marks the packet itself rather than mutating qdisc state,
therefore it is safe regardless of tree topology or concurrency.
Fixes: 0afb51e72855 ("[PKT_SCHED]: netem: reinsert for duplication")
Reported-by: William Liu <will@willsroot.io>
Reported-by: Savino Dicanosa <savy@syst3mfailure.io>
Closes: https://lore.kernel.org/netdev/8DuRWwfqjoRDLDmBMlIfbrsZg9Gx50DHJc1ilxsEBNe2D6NMoigR_eIRIG0LOjMc3r10nUUZtArXx4oZBIdUfZQrwjcQhdinnMis_0G7VEk=@willsroot.io/
Co-developed-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Victor Nogueira <victor@mojatatu.com>
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/sch_netem.c | 7 +++----
1 file changed, 3 insertions(+), 4 deletions(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 0ccf74a9cb82..6086700eb1e7 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -461,7 +461,8 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
skb->prev = NULL;
/* Random duplication */
- if (q->duplicate && q->duplicate >= get_crandom(&q->dup_cor, &q->prng))
+ if (q->duplicate && skb->tc_depth == 0 &&
+ q->duplicate >= get_crandom(&q->dup_cor, &q->prng))
++count;
/* Drop packet? */
@@ -539,11 +540,9 @@ static int netem_enqueue(struct sk_buff *skb, struct Qdisc *sch,
*/
if (skb2) {
struct Qdisc *rootq = qdisc_root_bh(sch);
- u32 dupsave = q->duplicate; /* prevent duplicating a dup... */
- q->duplicate = 0;
+ skb2->tc_depth++; /* prevent duplicating a dup... */
rootq->enqueue(skb2, rootq, to_free);
- q->duplicate = dupsave;
skb2 = NULL;
}
--
2.53.0
^ permalink raw reply related
* [PATCH v3 3/7] Revert "selftests/tc-testing: Add tests for restrictions on netem duplication"
From: Stephen Hemminger @ 2026-03-26 18:01 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, Stephen Hemminger, Jiri Pirko, Shuah Khan,
Victor Nogueira, Cong Wang, Jakub Kicinski, Paolo Abeni,
William Liu, Xiang Mei, Savino Dicanosa,
open list:KERNEL SELFTEST FRAMEWORK, open list
In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org>
From: Jamal Hadi Salim <jhs@mojatatu.com>
This reverts commit ecdec65ec78d67d3ebd17edc88b88312054abe0d.
The tests added were related to check_netem_in_tree() which was
just reverted in the previous patch.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
.../tc-testing/tc-tests/infra/qdiscs.json | 5 +-
.../tc-testing/tc-tests/qdiscs/netem.json | 81 -------------------
2 files changed, 3 insertions(+), 83 deletions(-)
diff --git a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
index 6a39640aa2a8..ceb993ed04b2 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/infra/qdiscs.json
@@ -702,6 +702,7 @@
"$TC qdisc add dev $DUMMY parent 1:1 handle 2:0 netem duplicate 100%",
"$TC filter add dev $DUMMY parent 1:0 protocol ip prio 1 u32 match ip dst 10.10.10.1/32 flowid 1:1",
"$TC class add dev $DUMMY parent 1:0 classid 1:2 hfsc ls m2 10Mbit",
+ "$TC qdisc add dev $DUMMY parent 1:2 handle 3:0 netem duplicate 100%",
"$TC filter add dev $DUMMY parent 1:0 protocol ip prio 2 u32 match ip dst 10.10.10.2/32 flowid 1:2",
"ping -c 1 10.10.10.1 -I$DUMMY > /dev/null || true",
"$TC filter del dev $DUMMY parent 1:0 protocol ip prio 1",
@@ -714,8 +715,8 @@
{
"kind": "hfsc",
"handle": "1:",
- "bytes": 294,
- "packets": 3
+ "bytes": 392,
+ "packets": 4
}
],
"matchCount": "1",
diff --git a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/netem.json b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/netem.json
index 718d2df2aafa..3c4444961488 100644
--- a/tools/testing/selftests/tc-testing/tc-tests/qdiscs/netem.json
+++ b/tools/testing/selftests/tc-testing/tc-tests/qdiscs/netem.json
@@ -336,86 +336,5 @@
"teardown": [
"$TC qdisc del dev $DUMMY handle 1: root"
]
- },
- {
- "id": "d34d",
- "name": "NETEM test qdisc duplication restriction in qdisc tree in netem_change root",
- "category": ["qdisc", "netem"],
- "plugins": {
- "requires": "nsPlugin"
- },
- "setup": [
- "$TC qdisc add dev $DUMMY root handle 1: netem limit 1",
- "$TC qdisc add dev $DUMMY parent 1: handle 2: netem limit 1"
- ],
- "cmdUnderTest": "$TC qdisc change dev $DUMMY handle 1: netem duplicate 50%",
- "expExitCode": "2",
- "verifyCmd": "$TC -s qdisc show dev $DUMMY",
- "matchPattern": "qdisc netem",
- "matchCount": "2",
- "teardown": [
- "$TC qdisc del dev $DUMMY handle 1:0 root"
- ]
- },
- {
- "id": "b33f",
- "name": "NETEM test qdisc duplication restriction in qdisc tree in netem_change non-root",
- "category": ["qdisc", "netem"],
- "plugins": {
- "requires": "nsPlugin"
- },
- "setup": [
- "$TC qdisc add dev $DUMMY root handle 1: netem limit 1",
- "$TC qdisc add dev $DUMMY parent 1: handle 2: netem limit 1"
- ],
- "cmdUnderTest": "$TC qdisc change dev $DUMMY handle 2: netem duplicate 50%",
- "expExitCode": "2",
- "verifyCmd": "$TC -s qdisc show dev $DUMMY",
- "matchPattern": "qdisc netem",
- "matchCount": "2",
- "teardown": [
- "$TC qdisc del dev $DUMMY handle 1:0 root"
- ]
- },
- {
- "id": "cafe",
- "name": "NETEM test qdisc duplication restriction in qdisc tree",
- "category": ["qdisc", "netem"],
- "plugins": {
- "requires": "nsPlugin"
- },
- "setup": [
- "$TC qdisc add dev $DUMMY root handle 1: netem limit 1 duplicate 100%"
- ],
- "cmdUnderTest": "$TC qdisc add dev $DUMMY parent 1: handle 2: netem duplicate 100%",
- "expExitCode": "2",
- "verifyCmd": "$TC -s qdisc show dev $DUMMY",
- "matchPattern": "qdisc netem",
- "matchCount": "1",
- "teardown": [
- "$TC qdisc del dev $DUMMY handle 1:0 root"
- ]
- },
- {
- "id": "1337",
- "name": "NETEM test qdisc duplication restriction in qdisc tree across branches",
- "category": ["qdisc", "netem"],
- "plugins": {
- "requires": "nsPlugin"
- },
- "setup": [
- "$TC qdisc add dev $DUMMY parent root handle 1:0 hfsc",
- "$TC class add dev $DUMMY parent 1:0 classid 1:1 hfsc rt m2 10Mbit",
- "$TC qdisc add dev $DUMMY parent 1:1 handle 2:0 netem",
- "$TC class add dev $DUMMY parent 1:0 classid 1:2 hfsc rt m2 10Mbit"
- ],
- "cmdUnderTest": "$TC qdisc add dev $DUMMY parent 1:2 handle 3:0 netem duplicate 100%",
- "expExitCode": "2",
- "verifyCmd": "$TC -s qdisc show dev $DUMMY",
- "matchPattern": "qdisc netem",
- "matchCount": "1",
- "teardown": [
- "$TC qdisc del dev $DUMMY handle 1:0 root"
- ]
}
]
--
2.53.0
^ permalink raw reply related
* [PATCH v3 2/7] net/sched: Revert "net/sched: Restrict conditions for adding duplicating netems to qdisc tree"
From: Stephen Hemminger @ 2026-03-26 18:01 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, Ji-Soo Chung, Gerlinde, zyc zyc, Manas Ghandat,
Stephen Hemminger, Jiri Pirko, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, William Liu,
Savino Dicanosa, open list
In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org>
From: Jamal Hadi Salim <jhs@mojatatu.com>
This reverts commit ec8e0e3d7adef940cdf9475e2352c0680189d14e.
The original patch rejects any tree containing two netems when
either has duplication set, even when they sit on unrelated classes
of the same classful parent. That broke configurations that have
worked since netem was introduced.
The re-entrancy problem the original commit was trying to solve is
handled by later patch using tc_depth flag.
Doing this revert will (re)expose the original bug with multiple
netem duplication. When this patch is backported make sure
and get the full series.
Fixes: ec8e0e3d7ade ("net/sched: Restrict conditions for adding duplicating netems to qdisc tree")
Reported-by: Ji-Soo Chung <jschung2@proton.me>
Reported-by: Gerlinde <lrGerlinde@mailfence.com>
Closes: https://bugzilla.kernel.org/show_bug.cgi?id=220774
Reported-by: zyc zyc <zyc199902@zohomail.cn>
Closes: https://lore.kernel.org/all/19adda5a1e2.12410b78222774.9191120410578703463@zohomail.cn/
Reported-by: Manas Ghandat <ghandatmanas@gmail.com>
Closes: https://lore.kernel.org/netdev/f69b2c8f-8325-4c2e-a011-6dbc089f30e4@gmail.com/
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
net/sched/sch_netem.c | 40 ----------------------------------------
1 file changed, 40 deletions(-)
diff --git a/net/sched/sch_netem.c b/net/sched/sch_netem.c
index 5de1c932944a..0ccf74a9cb82 100644
--- a/net/sched/sch_netem.c
+++ b/net/sched/sch_netem.c
@@ -974,41 +974,6 @@ static int parse_attr(struct nlattr *tb[], int maxtype, struct nlattr *nla,
return 0;
}
-static const struct Qdisc_class_ops netem_class_ops;
-
-static int check_netem_in_tree(struct Qdisc *sch, bool duplicates,
- struct netlink_ext_ack *extack)
-{
- struct Qdisc *root, *q;
- unsigned int i;
-
- root = qdisc_root_sleeping(sch);
-
- if (sch != root && root->ops->cl_ops == &netem_class_ops) {
- if (duplicates ||
- ((struct netem_sched_data *)qdisc_priv(root))->duplicate)
- goto err;
- }
-
- if (!qdisc_dev(root))
- return 0;
-
- hash_for_each(qdisc_dev(root)->qdisc_hash, i, q, hash) {
- if (sch != q && q->ops->cl_ops == &netem_class_ops) {
- if (duplicates ||
- ((struct netem_sched_data *)qdisc_priv(q))->duplicate)
- goto err;
- }
- }
-
- return 0;
-
-err:
- NL_SET_ERR_MSG(extack,
- "netem: cannot mix duplicating netems with other netems in tree");
- return -EINVAL;
-}
-
/* Parse netlink message to set options */
static int netem_change(struct Qdisc *sch, struct nlattr *opt,
struct netlink_ext_ack *extack)
@@ -1067,11 +1032,6 @@ static int netem_change(struct Qdisc *sch, struct nlattr *opt,
q->gap = qopt->gap;
q->counter = 0;
q->loss = qopt->loss;
-
- ret = check_netem_in_tree(sch, qopt->duplicate, extack);
- if (ret)
- goto unlock;
-
q->duplicate = qopt->duplicate;
/* for compatibility with earlier versions.
--
2.53.0
^ permalink raw reply related
* [PATCH v3 1/7] net: Introduce skb tc depth field to track packet loops
From: Stephen Hemminger @ 2026-03-26 18:01 UTC (permalink / raw)
To: netdev
Cc: Jamal Hadi Salim, Stephen Hemminger, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
open list
In-Reply-To: <20260326181701.308275-1-stephen@networkplumber.org>
From: Jamal Hadi Salim <jhs@mojatatu.com>
Add a 2-bit per-skb tc depth field to track packet loops across the stack.
The previous per-CPU loop counters like MIRRED_NEST_LIMIT
assume a single call stack and lose state in two cases:
1) When a packet is queued and reprocessed later (e.g., egress->ingress
via backlog), the per-cpu state is gone by the time it is dequeued.
2) With XPS/RPS a packet may arrive on one CPU and be processed on
another.
A per-skb field solves both by travelling with the packet itself.
The field fits in existing padding, using 2 bits that were previously a
hole:
pahole before(-) and after (+) diff looks like:
__u8 slow_gro:1; /* 132: 3 1 */
__u8 csum_not_inet:1; /* 132: 4 1 */
__u8 unreadable:1; /* 132: 5 1 */
+ __u8 tc_depth:2; /* 132: 6 1 */
- /* XXX 2 bits hole, try to pack */
/* XXX 1 byte hole, try to pack */
__u16 tc_index; /* 134 2 */
There used to be a ttl field which was removed as part of tc_verd in commit
aec745e2c520 ("net-tc: remove unused tc_verd fields"). It was already
unused by that time, due to remove earlier in commit c19ae86a510c ("tc: remove
unused redirect ttl").
The first user of this field is netem, which increments tc_depth on
duplicated packets before re-enqueueing them at the root qdisc. On
re-entry, netem skips duplication for any skb with tc_depth already set,
bounding recursion to a single level regardless of tree topology.
The other user is mirred which increments it on each pass
and limits to depth to MIRRED_DEFER_LIMIT (3).
The new field was called ttl in earlier versions of this patch
but renamed to tc_depth to avoid confusion with IP ttl.
Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
Reviewed-by: Stephen Hemminger <stephen@networkplumber.org>
---
include/linux/skbuff.h | 2 ++
1 file changed, 2 insertions(+)
diff --git a/include/linux/skbuff.h b/include/linux/skbuff.h
index daa4e4944ce3..aba4c88a1b3f 100644
--- a/include/linux/skbuff.h
+++ b/include/linux/skbuff.h
@@ -821,6 +821,7 @@ enum skb_tstamp_type {
* @_sk_redir: socket redirection information for skmsg
* @_nfct: Associated connection, if any (with nfctinfo bits)
* @skb_iif: ifindex of device we arrived on
+ * @tc_depth: counter for packet duplication
* @tc_index: Traffic control index
* @hash: the packet hash
* @queue_mapping: Queue mapping for multiqueue devices
@@ -1030,6 +1031,7 @@ struct sk_buff {
__u8 csum_not_inet:1;
#endif
__u8 unreadable:1;
+ __u8 tc_depth:2;
#if defined(CONFIG_NET_SCHED) || defined(CONFIG_NET_XGRESS)
__u16 tc_index; /* traffic control index */
#endif
--
2.53.0
^ permalink raw reply related
* [PATCH net v3 0/7] net/sched: Fix packet loops in mirred and netem
From: Stephen Hemminger @ 2026-03-26 18:00 UTC (permalink / raw)
To: netdev; +Cc: Stephen Hemminger
This a minor revision of Jamal's series that
fixes packet loops caused by mirred ingress redirects
and netem duplication in stacked qdisc trees.
The core idea is a 2-bit per-skb tc_depth counter that travels with
the packet. The existing per-CPU mirred nest tracking loses state
when a packet is deferred through the backlog or moves between CPUs
via XPS/RPS. A per-skb field covers both cases.
Patch 1 adds the tc_depth field in a padding hole in sk_buff.
Patches 2-3 revert the check_netem_in_tree() fix and its tests,
which broke legitimate multi-netem configurations.
Patch 4 uses tc_depth to stop netem duplicate recursion.
Patch 5 uses tc_depth to catch mirred ingress redirect loops.
Patches 6-7 add mirred and netem test cases.
Thanks to Jamal and Victor for fixing this.
There are additional netem bug fixes in the pipeline but those
are held back until this series lands.
Changes in v3:
- Renamed skb->ttl to skb->tc_depth to avoid confusion with IP TTL
- Expanded commit messages
- Split mirred and netem test cases into separate patches
- No code changes from v2
Changes in v2:
- Do not reuse skb->from_ingress (which was moved to skb->cb)
Jamal Hadi Salim (5):
net: Introduce skb tc depth field to track packet loops
net/sched: Revert "net/sched: Restrict conditions for adding
duplicating netems to qdisc tree"
Revert "selftests/tc-testing: Add tests for restrictions on netem
duplication"
net/sched: fix packet loop on netem when duplicate is on
net/sched: Fix ethx:ingress -> ethy:egress -> ethx:ingress mirred loop
Victor Nogueira (2):
selftests/tc-testing: Add mirred test cases exercising loops
selftests/tc-testing: Add netem test case exercising loops
include/linux/skbuff.h | 2 +
net/sched/act_mirred.c | 47 +-
net/sched/sch_netem.c | 47 +-
.../tc-testing/tc-tests/actions/mirred.json | 616 +++++++++++++++++-
.../tc-testing/tc-tests/infra/qdiscs.json | 5 +-
.../tc-testing/tc-tests/qdiscs/netem.json | 96 +--
6 files changed, 676 insertions(+), 137 deletions(-)
--
2.53.0
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: stmmac: remove axi_kbbe, axi_mb and axi_rb members
From: Russell King (Oracle) @ 2026-03-26 18:15 UTC (permalink / raw)
To: Simon Horman
Cc: Andrew Lunn, Alexandre Torgue, Andrew Lunn, Conor Dooley,
David S. Miller, devicetree, Eric Dumazet, Giuseppe Cavallaro,
Jakub Kicinski, Jose Abreu, Krzysztof Kozlowski, linux-arm-kernel,
linux-stm32, netdev, Paolo Abeni, Rob Herring, Yao Zi
In-Reply-To: <acVxNBLE8Ck2qfjc@shell.armlinux.org.uk>
On Thu, Mar 26, 2026 at 05:47:32PM +0000, Russell King (Oracle) wrote:
> On Thu, Mar 26, 2026 at 05:29:43PM +0000, Simon Horman wrote:
> > On Tue, Mar 24, 2026 at 10:05:40AM +0000, Russell King (Oracle) wrote:
> > > axi_kbbe, axi_mb and axi_rb are all written, but nothing ever reads
> > > their values. Remove the code that sets these and the struct members.
> > >
> > > Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
> >
> > Hi Russell,
> >
> > FYI, AI review suggests that these fields should also be removed from
> > Documentation/networking/device_drivers/ethernet/stmicro/stmmac.rst
>
> I noticed. I've prepared an update if netdev folk want that to happen
> as I've noticed that that documentation is fairly out of date now.
There's another reason I haven't submitted an update, and that's
because netdev is fairly backlogged at the moment - currently there's
381 patches in patchwork - four pages of patchwork, with the oldest
"new" patch dated 21st March. I don't think netdev patchwork needs
more patches at the moment!
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH v4 net 03/11] xsk: fix XDP_UMEM_SG_FLAG issues
From: Björn Töpel @ 2026-03-26 18:13 UTC (permalink / raw)
To: Maciej Fijalkowski, netdev
Cc: bpf, magnus.karlsson, stfomichev, kuba, pabeni, horms,
larysa.zaremba, aleksander.lobakin, Maciej Fijalkowski
In-Reply-To: <20260326114919.519456-4-maciej.fijalkowski@intel.com>
Maciej Fijalkowski <maciej.fijalkowski@intel.com> writes:
> Currently xp_assign_dev_shared() is missing XDP_USE_SG being propagated
> to flags so set it in order to preserve mtu check that is supposed to be
> done only when no multi-buffer setup is in picture.
>
> Also, this flag has the same value as XDP_UMEM_TX_SW_CSUM so we could
> get unexpected SG setups for software Tx checksums. Since csum flag is
> UAPI, modify value of XDP_UMEM_SG_FLAG.
>
> Fixes: d609f3d228a8 ("xsk: add multi-buffer support for sockets sharing umem")
> Signed-off-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Reviewed-by: Björn Töpel <bjorn@kernel.org>
^ permalink raw reply
* Re: [PATCH net-next 03/15] net: stmmac: qcom-ethqos: eliminate configure_func
From: Russell King (Oracle) @ 2026-03-26 18:12 UTC (permalink / raw)
To: Simon Horman
Cc: Andrew Lunn, Alexandre Torgue, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, linux-arm-kernel, linux-arm-msm,
linux-stm32, Mohd Ayaan Anwar, netdev, Paolo Abeni
In-Reply-To: <20260326180453.GU111839@horms.kernel.org>
On Thu, Mar 26, 2026 at 06:04:53PM +0000, Simon Horman wrote:
> On Tue, Mar 24, 2026 at 01:11:44PM +0000, Russell King (Oracle) wrote:
> > Since ethqos_fix_mac_speed() is called via a function pointer, and only
> > indirects via the configure_func function pointer, eliminate this
> > unnecessary indirection.
> >
> > Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
>
> ...
>
> > @@ -623,14 +627,6 @@ static void ethqos_configure_sgmii(struct qcom_ethqos *ethqos,
> > ethqos_pcs_set_inband(ethqos, interface == PHY_INTERFACE_MODE_SGMII);
> > }
> >
> > -static void ethqos_fix_mac_speed(void *priv, phy_interface_t interface,
> > - int speed, unsigned int mode)
> > -{
> > - struct qcom_ethqos *ethqos = priv;
> > -
> > - ethqos->configure_func(ethqos, interface, speed);
> > -}
> > -
> > static int qcom_ethqos_serdes_powerup(struct net_device *ndev, void *priv)
> > {
> > struct qcom_ethqos *ethqos = priv;
>
> Hi Russell,
>
> FYI, AI generated review reports that the comment in ethqos_clks_config()
> that references ethqos_fix_mac_speed() should also be updated.
Also already noted (yesterday).
I do keep an eye on patchwork for my own patches - I have a firefox tab
permanently open for my patches in patchwork:
https://patchwork.kernel.org/project/netdevbpf/list/?submitter=165511
Thanks anyway.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH net-next v4 1/2] net: stmmac: provide flag to disable EEE
From: Russell King (Oracle) @ 2026-03-26 18:10 UTC (permalink / raw)
To: Kieran Bingham
Cc: Laurent Pinchart, imx, netdev, Andrew Lunn, David S. Miller,
Eric Dumazet, Fabio Estevam, Francesco Dolcini, Frank Li,
Jakub Kicinski, Joy Zou, Marco Felsch, Paolo Abeni,
Pengutronix Kernel Team, Stefan Klug, linux-arm-kernel
In-Reply-To: <177454628933.1078312.13488207016388509694@ping.linuxembedded.co.uk>
On Thu, Mar 26, 2026 at 05:31:29PM +0000, Kieran Bingham wrote:
> This one has been a roller coaster, but I'm glad we got to the bottom of
> it.
>
> I hope someone from synopsis takes note and and documents this for
> future silicon integrations.
I would say that it _is_ clearly documented in the databook. v3.74a
4.3.4. LPI Interrupt already states that this signal is generated in
the receive clock domain, and is not cleared immediately after the LPI
control and status register is read.
It goes on to state that this is because the signal to clear it has to
cross from the CSR clock domain to the receive clock domain to clear
the signal - and states that it is at least _four_ receive clock
cycles.
So, if the dwmac core is operating at 10Mbps, that means its receive
clock is running at 2.5MHz which has a period of 400ns. In this case,
the four receive clock cycles to clear this interrupt is 1.6us,
assuming that the receive clock is running.
However, if EEE is enabled, the receive clock comes from the PHY,
which may gate off when the link re-enters LPI - and this event is
under the control of the remote end, not the local end. So, what this
means is that even though it states four receive clocks to clear the
lpi_intr_o signal, that doesn't necessarily mean it will clear in
1.6us as the receive clock may be stopped.
So, I think it is clearly stated in the databook already, but as it's
just two paragraphs buried in around 1500 pages, that may explain why
it has been missed on iMX.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH net-next 03/15] net: stmmac: qcom-ethqos: eliminate configure_func
From: Simon Horman @ 2026-03-26 18:04 UTC (permalink / raw)
To: Russell King (Oracle)
Cc: Andrew Lunn, Alexandre Torgue, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, linux-arm-kernel, linux-arm-msm,
linux-stm32, Mohd Ayaan Anwar, netdev, Paolo Abeni
In-Reply-To: <E1w51Xs-0000000DwVV-2bnh@rmk-PC.armlinux.org.uk>
On Tue, Mar 24, 2026 at 01:11:44PM +0000, Russell King (Oracle) wrote:
> Since ethqos_fix_mac_speed() is called via a function pointer, and only
> indirects via the configure_func function pointer, eliminate this
> unnecessary indirection.
>
> Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
...
> @@ -623,14 +627,6 @@ static void ethqos_configure_sgmii(struct qcom_ethqos *ethqos,
> ethqos_pcs_set_inband(ethqos, interface == PHY_INTERFACE_MODE_SGMII);
> }
>
> -static void ethqos_fix_mac_speed(void *priv, phy_interface_t interface,
> - int speed, unsigned int mode)
> -{
> - struct qcom_ethqos *ethqos = priv;
> -
> - ethqos->configure_func(ethqos, interface, speed);
> -}
> -
> static int qcom_ethqos_serdes_powerup(struct net_device *ndev, void *priv)
> {
> struct qcom_ethqos *ethqos = priv;
Hi Russell,
FYI, AI generated review reports that the comment in ethqos_clks_config()
that references ethqos_fix_mac_speed() should also be updated.
...
^ permalink raw reply
* Re: [PATCH v2 3/5] bpf: add helper masks for ADJ_ROOM flags and encap validation
From: Martin KaFai Lau @ 2026-03-26 17:49 UTC (permalink / raw)
To: Hudson, Nick
Cc: Willem de Bruijn, Tottenham, Max, Glasgall, Anna,
Alexei Starovoitov, Daniel Borkmann, Andrii Nakryiko,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
bpf@vger.kernel.org, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <9E9BE3BD-1640-49E7-8801-130945073B24@akamai.com>
On 3/26/26 10:02 AM, Hudson, Nick wrote:
>>> static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>>> u64 flags)
>>> @@ -3502,6 +3513,11 @@ static int bpf_skb_net_grow(struct sk_buff *skb, u32 off, u32 len_diff,
>>> unsigned int gso_type = SKB_GSO_DODGY;
>>> int ret;
>>> + if (unlikely(flags & ~(BPF_F_ADJ_ROOM_ENCAP_MASK |
>>> + BPF_F_ADJ_ROOM_NO_CSUM_RESET |
>>> + BPF_F_ADJ_ROOM_FIXED_GSO)))
>> Under which case this new check will be hit?
> If a user supplies +ve len_diff and attempts to pass a DECAP flag.
>
> The commit message had
>
> Add flag validation to bpf_skb_net_grow() to reject invalid encap
> flags early.
There is DECAP_MASK check in bpf_skb_adjust_room() and then !shrink is
rejected. What am I missing?
^ permalink raw reply
* [PATCH net-next] net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG
From: Erni Sri Satya Vennela @ 2026-03-26 17:48 UTC (permalink / raw)
To: kys, haiyangz, wei.liu, decui, longli, andrew+netdev, davem,
edumazet, kuba, pabeni, ernis, ssengar, dipayanroy, gargaditya,
shirazsaleem, kees, linux-hyperv, netdev, linux-kernel
As a part of MANA hardening for CVM, validate that max_num_sq and
max_num_rq returned by MANA_QUERY_VPORT_CONFIG are not zero. These
values flow into apc->num_queues, which is used as an allocation count
and loop bound. A zero value would result in zero-size allocations and
incorrect driver behavior.
Return -EPROTO if either value is zero.
Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
---
drivers/net/ethernet/microsoft/mana/mana_en.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index b39e8b920791..a4197b4b0597 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -1249,6 +1249,12 @@ static int mana_query_vport_cfg(struct mana_port_context *apc, u32 vport_index,
*max_sq = resp.max_num_sq;
*max_rq = resp.max_num_rq;
+
+ if (*max_sq == 0 || *max_rq == 0) {
+ netdev_err(apc->ndev, "Invalid max queues from vPort config\n");
+ return -EPROTO;
+ }
+
if (resp.num_indirection_ent > 0 &&
resp.num_indirection_ent <= MANA_INDIRECT_TABLE_MAX_SIZE &&
is_power_of_2(resp.num_indirection_ent)) {
--
2.34.1
^ permalink raw reply related
* Re: [PATCH net-next 2/3] dpll: add actual frequency monitoring callback ops
From: Ivan Vecera @ 2026-03-26 17:48 UTC (permalink / raw)
To: Vadim Fedorenko, netdev
Cc: Arkadiusz Kubalewski, Jiri Pirko, Jonathan Corbet, Shuah Khan,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Donald Hunter, Prathosh Satish, Petr Oros,
linux-doc, linux-kernel
In-Reply-To: <d0a6d302-c5af-4ad1-87e2-fa017bdd96a8@linux.dev>
On 3/26/26 12:21 PM, Vadim Fedorenko wrote:
> On 25/03/2026 19:39, Ivan Vecera wrote:
>
>> +static int dpll_msg_add_actual_freq(struct sk_buff *msg, struct
>> dpll_pin *pin,
>> + struct dpll_pin_ref *ref,
>> + struct netlink_ext_ack *extack)
>> +{
>> + const struct dpll_device_ops *dev_ops = dpll_device_ops(ref->dpll);
>> + const struct dpll_pin_ops *ops = dpll_pin_ops(ref);
>> + struct dpll_device *dpll = ref->dpll;
>> + enum dpll_feature_state state;
>> + u64 actual_freq;
>> + int ret;
>> +
>> + if (!ops->actual_freq_get)
>> + return 0;
>> + if (dev_ops->freq_monitor_get) {
>> + ret = dev_ops->freq_monitor_get(dpll, dpll_priv(dpll),
>> + &state, extack);
>> + if (ret)
>> + return ret;
>> + if (state == DPLL_FEATURE_STATE_DISABLE)
>> + return 0;
>
> I think we have to signal back to user that frequency monitoring is
> disabled via extack.
Hi Vadim,
This would break pin-get operation... Do or dump pin-get operation would
fail with this extack message.
Here we can check if the freq-monitoring is enabled and conditionally
call actual_freq_get() or measured_freq_get()
-or-
Call this callback unconditionally and check for return code and if a
driver returns e.g. -ENODATA then skip nla_put_64bit() but return
success.
WDYT?
Thanks,
Ivan
^ permalink raw reply
* Re: [PATCH net-next 1/2] net: stmmac: remove axi_kbbe, axi_mb and axi_rb members
From: Russell King (Oracle) @ 2026-03-26 17:47 UTC (permalink / raw)
To: Simon Horman
Cc: Andrew Lunn, Alexandre Torgue, Andrew Lunn, Conor Dooley,
David S. Miller, devicetree, Eric Dumazet, Giuseppe Cavallaro,
Jakub Kicinski, Jose Abreu, Krzysztof Kozlowski, linux-arm-kernel,
linux-stm32, netdev, Paolo Abeni, Rob Herring, Yao Zi
In-Reply-To: <20260326172943.GR111839@horms.kernel.org>
On Thu, Mar 26, 2026 at 05:29:43PM +0000, Simon Horman wrote:
> On Tue, Mar 24, 2026 at 10:05:40AM +0000, Russell King (Oracle) wrote:
> > axi_kbbe, axi_mb and axi_rb are all written, but nothing ever reads
> > their values. Remove the code that sets these and the struct members.
> >
> > Signed-off-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
>
> Hi Russell,
>
> FYI, AI review suggests that these fields should also be removed from
> Documentation/networking/device_drivers/ethernet/stmicro/stmmac.rst
I noticed. I've prepared an update if netdev folk want that to happen
as I've noticed that that documentation is fairly out of date now.
Do we think it's still useful, or should we consider deleting or
trimming it down? Would it be better to move the struct definitions
into the header file and making the header file part of the docs so
that the documentation is local to the structs?
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH] qed: iscsi: limit command queue array fill to the ramrod array size
From: Simon Horman @ 2026-03-26 17:47 UTC (permalink / raw)
To: Pengpeng Hou
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, netdev,
linux-kernel
In-Reply-To: <20260324105629.61282-1-pengpeng@iscas.ac.cn>
On Tue, Mar 24, 2026 at 06:56:29PM +0800, Pengpeng Hou wrote:
> qed_sp_iscsi_func_start() validates p_params->num_queues against the
> number of command queues exposed by the hardware resource table, but it
> then uses that count to fill q_params.cq_cmdq_sb_num_arr[] in the SCSI
> init ramrod. That array is fixed at SCSI_MAX_NUM_OF_CMDQS entries.
>
> The in-tree qedi caller derives num_queues from the device's reported
> num_cqs and the online CPU count, so current-tree callers can request
> more queues than fit in the fixed ramrod array on sufficiently large
> systems even though the existing hardware-resource check passes.
>
> Reject queue counts that exceed the command queue array capacity before
> filling the ramrod.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/qlogic/qed/qed_iscsi.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
> index e16808291338..62cf85f9a042 100644
> --- a/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
> +++ b/drivers/net/ethernet/qlogic/qed/qed_iscsi.c
> @@ -177,6 +177,15 @@ qed_sp_iscsi_func_start(struct qed_hwfn *p_hwfn,
> return -EINVAL;
> }
Hi,
As per my comment to your similar patch for fcoe.
The code immediately above checks fcoe_pf_params->num_cqs
against p_hwfn->hw_info.feat_num[QED_ISCSI_CQ], which I assume
is derived from hardware.
Is that sufficient to avoid the OOB access you describe?
>
> + if (p_params->num_queues > ARRAY_SIZE(p_queue->cq_cmdq_sb_num_arr)) {
> + DP_ERR(p_hwfn,
> + "Cannot fit %u queues in %zu command queue slots. Aborting function start\n",
> + p_params->num_queues,
> + ARRAY_SIZE(p_queue->cq_cmdq_sb_num_arr));
> + qed_sp_destroy_request(p_hwfn, p_ent);
> + return -EINVAL;
> + }
> +
> val = p_params->half_way_close_timeout;
> p_init->half_way_close_timeout = cpu_to_le16(val);
> p_init->num_sq_pages_in_ring = p_params->num_sq_pages_in_ring;
> --
> 2.50.1 (Apple Git-155)
>
^ permalink raw reply
* [PATCH net-next v2 0/2] net: hsr: subsystem cleanups and modernization
From: luka.gejak @ 2026-03-26 17:45 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, netdev
Cc: horms, fmaurer, liuhangbin, linux-kernel, luka.gejak
From: Luka Gejak <luka.gejak@linux.dev>
Changes in v2:
- dropped trivial cleanup-only patches per netdev clean-up policy
- added AI attribution for cover-letter/commit-message wording only
- dropped fallthrough/BIT conversion patches per review
This series contains two focused HSR cleanups with practical benefit.
It constifies protocol operation tables and replaces a hardcoded
function name with __func__ to keep diagnostics correct across
refactoring.
Assisted-by: Copilot:gpt-5.3-codex (cover-letter/commit-message wording
only)
Luka Gejak (2):
net: hsr: constify hsr_ops and prp_ops protocol operation structures
net: hsr: use __func__ instead of hardcoded function name
net/hsr/hsr_device.c | 4 ++--
net/hsr/hsr_forward.c | 2 +-
net/hsr/hsr_main.h | 2 +-
3 files changed, 4 insertions(+), 4 deletions(-)
--
2.53.0
^ permalink raw reply
* [PATCH net-next v2 2/2] net: hsr: use __func__ instead of hardcoded function name
From: luka.gejak @ 2026-03-26 17:46 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, netdev
Cc: horms, fmaurer, liuhangbin, linux-kernel, luka.gejak
In-Reply-To: <20260326174600.136232-1-luka.gejak@linux.dev>
From: Luka Gejak <luka.gejak@linux.dev>
Replace the hardcoded string "hsr_get_untagged_frame" with the
standard __func__ macro in netdev_warn_once() call to make the code
more robust to refactoring.
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
net/hsr/hsr_forward.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index aefc9b6936ba..0aca859c88cb 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -184,7 +184,7 @@ struct sk_buff *hsr_get_untagged_frame(struct hsr_frame_info *frame,
create_stripped_skb_hsr(frame->skb_hsr, frame);
else
netdev_warn_once(port->dev,
- "Unexpected frame received in hsr_get_untagged_frame()\n");
+ "Unexpected frame received in %s()\n", __func__);
if (!frame->skb_std)
return NULL;
--
2.53.0
^ permalink raw reply related
* [PATCH net-next v2 1/2] net: hsr: constify hsr_ops and prp_ops protocol operation structures
From: luka.gejak @ 2026-03-26 17:45 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, netdev
Cc: horms, fmaurer, liuhangbin, linux-kernel, luka.gejak
In-Reply-To: <20260326174600.136232-1-luka.gejak@linux.dev>
From: Luka Gejak <luka.gejak@linux.dev>
The hsr_ops and prp_ops structures are assigned to hsr->proto_ops during
device initialization and are never modified at runtime. Declaring them
as const allows the compiler to place these structures in read-only
memory, which improves security by preventing accidental or malicious
modification of the function pointers they contain.
The proto_ops field in struct hsr_priv is also updated to a const
pointer to maintain type consistency.
Signed-off-by: Luka Gejak <luka.gejak@linux.dev>
---
net/hsr/hsr_device.c | 4 ++--
net/hsr/hsr_main.h | 2 +-
2 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/net/hsr/hsr_device.c b/net/hsr/hsr_device.c
index 5c3eca2235ce..90236028817d 100644
--- a/net/hsr/hsr_device.c
+++ b/net/hsr/hsr_device.c
@@ -616,7 +616,7 @@ static const struct device_type hsr_type = {
.name = "hsr",
};
-static struct hsr_proto_ops hsr_ops = {
+static const struct hsr_proto_ops hsr_ops = {
.send_sv_frame = send_hsr_supervision_frame,
.create_tagged_frame = hsr_create_tagged_frame,
.get_untagged_frame = hsr_get_untagged_frame,
@@ -626,7 +626,7 @@ static struct hsr_proto_ops hsr_ops = {
.register_frame_out = hsr_register_frame_out,
};
-static struct hsr_proto_ops prp_ops = {
+static const struct hsr_proto_ops prp_ops = {
.send_sv_frame = send_prp_supervision_frame,
.create_tagged_frame = prp_create_tagged_frame,
.get_untagged_frame = prp_get_untagged_frame,
diff --git a/net/hsr/hsr_main.h b/net/hsr/hsr_main.h
index 33b0d2460c9b..134e4f3fff60 100644
--- a/net/hsr/hsr_main.h
+++ b/net/hsr/hsr_main.h
@@ -202,7 +202,7 @@ struct hsr_priv {
enum hsr_version prot_version; /* Indicate if HSRv0, HSRv1 or PRPv1 */
spinlock_t seqnr_lock; /* locking for sequence_nr */
spinlock_t list_lock; /* locking for node list */
- struct hsr_proto_ops *proto_ops;
+ const struct hsr_proto_ops *proto_ops;
#define PRP_LAN_ID 0x5 /* 0x1010 for A and 0x1011 for B. Bit 0 is set
* based on SLAVE_A or SLAVE_B
*/
--
2.53.0
^ permalink raw reply related
* Re: [PATCH] qed: fcoe: limit command queue array fill to the ramrod array size
From: Simon Horman @ 2026-03-26 17:46 UTC (permalink / raw)
To: Pengpeng Hou
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, netdev,
linux-kernel
In-Reply-To: <20260324105647.92763-1-pengpeng@iscas.ac.cn>
On Tue, Mar 24, 2026 at 06:56:47PM +0800, Pengpeng Hou wrote:
> qed_sp_fcoe_func_start() validates fcoe_pf_params->num_cqs against the
> number of command queues exposed by the hardware resource table, but it
> then uses that count to fill q_params.cq_cmdq_sb_num_arr[] in the FCoE
> init ramrod. That array is fixed at SCSI_MAX_NUM_OF_CMDQS entries.
>
> The in-tree qedf caller derives num_cqs from the device's reported
> num_cqs and the online CPU count, so current-tree callers can request
> more queues than fit in the fixed ramrod array on sufficiently large
> systems even though the existing hardware-resource check passes.
>
> Reject queue counts that exceed the command queue array capacity before
> filling the ramrod.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/qlogic/qed/qed_fcoe.c | 9 +++++++++
> 1 file changed, 9 insertions(+)
>
> diff --git a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
> index 2ae3639d6cf7..5fbf78f6adca 100644
> --- a/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
> +++ b/drivers/net/ethernet/qlogic/qed/qed_fcoe.c
> @@ -126,6 +126,15 @@ qed_sp_fcoe_func_start(struct qed_hwfn *p_hwfn,
> goto err;
> }
>
Hi,
The code immediately above checks fcoe_pf_params->num_cqs
against p_hwfn->hw_info.feat_num[QED_FCOE_CQ], which I assume
is derived from hardware.
Is that sufficient to avoid the OOB access you describe?
> + if (fcoe_pf_params->num_cqs > ARRAY_SIZE(p_data->q_params.cq_cmdq_sb_num_arr)) {
> + DP_ERR(p_hwfn,
> + "Cannot fit %u queues in %zu command queue slots. Aborting function start\n",
> + fcoe_pf_params->num_cqs,
> + ARRAY_SIZE(p_data->q_params.cq_cmdq_sb_num_arr));
> + rc = -EINVAL;
> + goto err;
> + }
> +
> p_data->mtu = cpu_to_le16(fcoe_pf_params->mtu);
> tmp = cpu_to_le16(fcoe_pf_params->sq_num_pbl_pages);
> p_data->sq_num_pages_in_pbl = tmp;
> --
> 2.50.1 (Apple Git-155)
>
^ permalink raw reply
* Re: [PATCH net-next v2 4/4] net: phy: Introduce Airoha AN8801/R Gigabit Ethernet PHY driver
From: Russell King (Oracle) @ 2026-03-26 17:44 UTC (permalink / raw)
To: Maxime Chevallier
Cc: Andrew Lunn, Andrew Lunn, Louis-Alexis Eyraud, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, AngeloGioacchino Del Regno,
Heiner Kallweit, kevin-kw.huang, macpaul.lin, matthias.bgg,
kernel, netdev, devicetree, linux-arm-kernel, linux-mediatek,
linux-kernel
In-Reply-To: <385d2137-0d15-4dc0-8994-9cd48e4150b4@bootlin.com>
On Thu, Mar 26, 2026 at 06:25:20PM +0100, Maxime Chevallier wrote:
> On 26/03/2026 17:56, Andrew Lunn wrote:
> >> What is the timing requirements for a system going into suspend vs a WoL
> >> packet being sent? Should a WoL packet abort entry into suspend? If yes,
> >> then we need to program the MAC before the PHY is suspended, because
> >> suspend could already be in progress.
> >
> > We would then need to hook into the NETDEV_CHANGEADDR notifier, and
> > call into the PHY driver to let it reprogram the MAC address.
>
> We would also probably have to re-do that MAC addr programming at phy
> attach time ? If the PHY isn't attached (e.g. link admin-down on some
> boards), we can't use that notifier as we don't know what netdev to
> listen to. Or I'm missing something ?
Another point to consider in this area:
Should a detached PHY remain with WoL enabled?
If e.g. the network driver is unbound from its device, which certainly
disconnects the PHY from the network interface, should that PHY still
be able to wake up the system when there is no way to configure,
check its status, or handle its interrupts?
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH net-next 1/3] dpll: add actual frequency monitoring to netlink spec
From: Ivan Vecera @ 2026-03-26 17:41 UTC (permalink / raw)
To: Vadim Fedorenko, netdev
Cc: Arkadiusz Kubalewski, Jiri Pirko, Jonathan Corbet, Shuah Khan,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Donald Hunter, Prathosh Satish, Petr Oros,
linux-doc, linux-kernel
In-Reply-To: <c3a01e7b-0b3a-4a0e-86cb-f9fe79a90a62@linux.dev>
On 3/26/26 12:06 PM, Vadim Fedorenko wrote:
> On 25/03/2026 19:39, Ivan Vecera wrote:
>> Add DPLL_A_FREQUENCY_MONITOR device attribute to allow control over
>> the frequency monitor feature. The attribute uses the existing
>> dpll_feature_state enum (enable/disable) and is present in both
>> device-get reply and device-set request.
>>
>> Add DPLL_A_PIN_ACTUAL_FREQUENCY pin attribute to expose the measured
>> input frequency in Hz. The attribute is present in the pin-get reply.
>
> Overall looks ok, but the wording can be improved, I think. What about
> using "MEASURED" or "READ" instead of "ACTUAL"? The spec file has this
> note already, looks like there were some concerns already?
>
MEASURED looks good... will change this appropriately.
Thanks,
Ivan
^ permalink raw reply
* Re: [PATCH net-next] tcp: tcp_vegas: use tcp_vegas_cwnd_event_tx_start()
From: Kuniyuki Iwashima @ 2026-03-26 17:36 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Jakub Kicinski, Paolo Abeni, Simon Horman,
Neal Cardwell, Willem de Bruijn, netdev, eric.dumazet
In-Reply-To: <20260325212440.4146579-1-edumazet@google.com>
On Wed, Mar 25, 2026 at 2:24 PM Eric Dumazet <edumazet@google.com> wrote:
>
> While net/ipv4/tcp_yeah.c is correctly setting .cwnd_event_tx_start
> to tcp_vegas_cwnd_event_tx_start(), I forgot to do the same in tcp_vegas.c
>
> Fixes: d1e59a469737 ("tcp: add cwnd_event_tx_start to tcp_congestion_ops")
> Signed-off-by: Eric Dumazet <edumazet@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
^ permalink raw reply
* Re: [PATCH bpf v2 2/2] selftests/bpf: Add protocol check test for bpf_sk_assign_tcp_reqsk()
From: Kuniyuki Iwashima @ 2026-03-26 17:33 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, Jiayuan Chen, Martin KaFai Lau, Daniel Borkmann,
John Fastabend, Stanislav Fomichev, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Song Liu, Yonghong Song,
KP Singh, Hao Luo, Jiri Olsa, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan, bpf,
linux-kernel, linux-kselftest
In-Reply-To: <20260326062657.88446-3-jiayuan.chen@linux.dev>
On Wed, Mar 25, 2026 at 11:27 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> From: Jiayuan Chen <jiayuan.chen@shopee.com>
>
> Add test_tcp_custom_syncookie_protocol_check to verify that
> bpf_sk_assign_tcp_reqsk() rejects non-TCP skbs. The test sends a UDP
> packet through TC ingress where a BPF program calls
> bpf_sk_assign_tcp_reqsk() on it and checks that the kfunc returns an
> error. A UDP server recv() is used as synchronization to ensure the
> BPF program has finished processing before checking the result.
>
> Without the fix in bpf_sk_assign_tcp_reqsk(), the kfunc succeeds and
> attaches a TCP reqsk to the UDP skb, which causes a null pointer
> dereference panic when the kernel processes it through the UDP receive
> path.
>
> Test result:
>
> ./test_progs -a tcp_custom_syncookie_protocol_check -v
> setup_netns:PASS:create netns 0 nsec
> setup_netns:PASS:ip 0 nsec
> write_sysctl:PASS:open sysctl 0 nsec
> write_sysctl:PASS:write sysctl 0 nsec
> setup_netns:PASS:write_sysctl 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:open_and_load 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:start tcp_server 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:start udp_server 0 nsec
> setup_tc:PASS:qdisc add dev lo clsact 0 nsec
> setup_tc:PASS:filter add dev lo ingress 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:udp socket 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:sendto udp 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:recv udp 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:udp_intercepted 0 nsec
> test_tcp_custom_syncookie_protocol_check:PASS:assign_ret 0 nsec
> #471 tcp_custom_syncookie_protocol_check:OK
> Summary: 1/0 PASSED, 0 SKIPPED, 0 FAILED
>
> Cc: Jiayuan Chen <jiayuan.chen@linux.dev>
> Signed-off-by: Jiayuan Chen <jiayuan.chen@shopee.com>
> ---
> .../bpf/prog_tests/tcp_custom_syncookie.c | 84 ++++++++++++++++++-
> .../bpf/progs/test_tcp_custom_syncookie.c | 79 +++++++++++++++++
> 2 files changed, 159 insertions(+), 4 deletions(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
> index eaf441dc7e79..c50b76f70988 100644
> --- a/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
> +++ b/tools/testing/selftests/bpf/prog_tests/tcp_custom_syncookie.c
> @@ -5,6 +5,7 @@
> #include <sched.h>
> #include <stdlib.h>
> #include <net/if.h>
> +#include <netinet/in.h>
>
> #include "test_progs.h"
> #include "cgroup_helpers.h"
> @@ -47,11 +48,10 @@ static int setup_netns(void)
> return -1;
> }
>
> -static int setup_tc(struct test_tcp_custom_syncookie *skel)
> +static int setup_tc(int prog_fd)
> {
> LIBBPF_OPTS(bpf_tc_hook, qdisc_lo, .attach_point = BPF_TC_INGRESS);
> - LIBBPF_OPTS(bpf_tc_opts, tc_attach,
> - .prog_fd = bpf_program__fd(skel->progs.tcp_custom_syncookie));
> + LIBBPF_OPTS(bpf_tc_opts, tc_attach, .prog_fd = prog_fd);
>
> qdisc_lo.ifindex = if_nametoindex("lo");
> if (!ASSERT_OK(bpf_tc_hook_create(&qdisc_lo), "qdisc add dev lo clsact"))
> @@ -127,7 +127,7 @@ void test_tcp_custom_syncookie(void)
> if (!ASSERT_OK_PTR(skel, "open_and_load"))
> return;
>
> - if (setup_tc(skel))
> + if (setup_tc(bpf_program__fd(skel->progs.tcp_custom_syncookie)))
> goto destroy_skel;
>
> for (i = 0; i < ARRAY_SIZE(test_cases); i++) {
> @@ -145,6 +145,82 @@ void test_tcp_custom_syncookie(void)
>
> destroy_skel:
> system("tc qdisc del dev lo clsact");
> + test_tcp_custom_syncookie__destroy(skel);
> +}
>
> +/* Test: bpf_sk_assign_tcp_reqsk() should reject non-TCP skb.
> + *
> + * Send a UDP packet through TC ingress where a BPF program calls
> + * bpf_sk_assign_tcp_reqsk() on it. The kfunc should return an error
> + * because the skb carries UDP, not TCP.
> + */
> +void test_tcp_custom_syncookie_protocol_check(void)
> +{
> + int tcp_server = -1, udp_server = -1, udp_client = -1;
> + struct test_tcp_custom_syncookie *skel;
> + struct sockaddr_in udp_addr;
> + char buf[32] = "test";
> + int udp_port, ret;
> +
> + if (setup_netns())
> + return;
> +
> + skel = test_tcp_custom_syncookie__open_and_load();
> + if (!ASSERT_OK_PTR(skel, "open_and_load"))
> + return;
> +
> + /* Create a TCP listener so the BPF can find a LISTEN socket */
> + tcp_server = start_server(AF_INET, SOCK_STREAM, "127.0.0.1", 0, 0);
Can you add IPv6 test as well ?
You can reuse test_tcp_custom_syncookie_case[].
> + if (!ASSERT_NEQ(tcp_server, -1, "start tcp_server"))
> + goto destroy_skel;
> +
> + /* Create a UDP server to receive the packet as synchronization */
> + udp_server = start_server(AF_INET, SOCK_DGRAM, "127.0.0.1", 0, 0);
You can specify the port to get_socket_local_port(tcp_server),
> + if (!ASSERT_NEQ(udp_server, -1, "start udp_server"))
> + goto close_tcp;
> +
> + skel->bss->tcp_listener_port = ntohs(get_socket_local_port(tcp_server));
> + udp_port = ntohs(get_socket_local_port(udp_server));
> + skel->bss->udp_test_port = udp_port;
then the 3 lines above will be unnecessary,
> +
> + ret = bpf_program__fd(skel->progs.tcp_custom_syncookie_badproto);
> + if (setup_tc(ret))
> + goto close_udp_server;
> +
> + udp_client = socket(AF_INET, SOCK_DGRAM, 0);
> + if (!ASSERT_NEQ(udp_client, -1, "udp socket"))
> + goto cleanup_tc;
> +
> + memset(&udp_addr, 0, sizeof(udp_addr));
> + udp_addr.sin_family = AF_INET;
> + udp_addr.sin_addr.s_addr = htonl(INADDR_LOOPBACK);
> + udp_addr.sin_port = htons(udp_port);
and you can reuse get_socket_local_port(tcp_server) here too.
> +
> + ret = sendto(udp_client, buf, sizeof(buf), 0,
> + (struct sockaddr *)&udp_addr, sizeof(udp_addr));
> + if (!ASSERT_EQ(ret, sizeof(buf), "sendto udp"))
> + goto cleanup_tc;
> +
> + /* recv() ensures TC ingress BPF has processed the skb */
> + ret = recv(udp_server, buf, sizeof(buf), 0);
> + if (!ASSERT_EQ(ret, sizeof(buf), "recv udp"))
> + goto cleanup_tc;
> +
> + ASSERT_EQ(skel->bss->udp_intercepted, true, "udp_intercepted");
> +
> + /* assign_ret == 0 means kfunc accepted UDP skb (bug).
> + * assign_ret < 0 means kfunc correctly rejected it (fixed).
> + */
> + ASSERT_NEQ(skel->data->assign_ret, 0, "assign_ret");
> +
> +cleanup_tc:
> + system("tc qdisc del dev lo clsact");
> + if (udp_client >= 0)
> + close(udp_client);
> +close_udp_server:
> + close(udp_server);
> +close_tcp:
> + close(tcp_server);
> +destroy_skel:
> test_tcp_custom_syncookie__destroy(skel);
> }
> diff --git a/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c b/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c
> index 7d5293de1952..386705b6c9f2 100644
> --- a/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c
> +++ b/tools/testing/selftests/bpf/progs/test_tcp_custom_syncookie.c
> @@ -588,4 +588,83 @@ int tcp_custom_syncookie(struct __sk_buff *skb)
> return tcp_handle_ack(&ctx);
> }
>
> +/* Test: call bpf_sk_assign_tcp_reqsk() on a UDP skb.
> + * The kfunc should reject it, but currently it doesn't check L4 protocol.
> + */
> +__u16 tcp_listener_port = 0;
> +__u16 udp_test_port = 0;
> +int assign_ret = -1;
> +bool udp_intercepted = false;
> +
> +SEC("tc")
> +int tcp_custom_syncookie_badproto(struct __sk_buff *skb)
> +{
> + void *data = (void *)(long)skb->data;
> + void *data_end = (void *)(long)skb->data_end;
> + struct bpf_sock_tuple tuple = {};
> + struct bpf_tcp_req_attrs attrs = {};
> + struct ethhdr *eth;
> + struct iphdr *iph;
> + struct udphdr *udp;
> + struct bpf_sock *skc;
> + struct sock *sk;
> +
> + eth = (struct ethhdr *)data;
> + if (eth + 1 > data_end)
> + return TC_ACT_OK;
> +
> + if (bpf_ntohs(eth->h_proto) != ETH_P_IP)
> + return TC_ACT_OK;
> +
> + iph = (struct iphdr *)(eth + 1);
> + if (iph + 1 > data_end)
> + return TC_ACT_OK;
> +
> + if (iph->protocol != IPPROTO_UDP)
> + return TC_ACT_OK;
> +
> + udp = (struct udphdr *)(iph + 1);
> + if (udp + 1 > data_end)
> + return TC_ACT_OK;
> +
> + if (bpf_ntohs(udp->dest) != udp_test_port)
> + return TC_ACT_OK;
You don't need to worry about other program sending UDP
packets in this netns created by unshare().
> +
> + udp_intercepted = true;
> +
> + tuple.ipv4.saddr = iph->saddr;
> + tuple.ipv4.daddr = iph->daddr;
> + tuple.ipv4.sport = udp->source;
> + tuple.ipv4.dport = bpf_htons(tcp_listener_port);
and you can simply reuse dport here too.
> +
> + skc = bpf_skc_lookup_tcp(skb, &tuple, sizeof(tuple.ipv4), -1, 0);
> + if (!skc)
> + return TC_ACT_OK;
> +
> + if (skc->state != TCP_LISTEN) {
> + bpf_sk_release(skc);
> + return TC_ACT_OK;
> + }
> +
> + sk = (struct sock *)bpf_skc_to_tcp_sock(skc);
> + if (!sk) {
> + bpf_sk_release(skc);
> + return TC_ACT_OK;
> + }
> +
> + attrs.mss = 1460;
> + attrs.wscale_ok = 1;
> + attrs.snd_wscale = 7;
> + attrs.rcv_wscale = 7;
> + attrs.sack_ok = 1;
> +
> + /* Call bpf_sk_assign_tcp_reqsk on a UDP skb. */
> + assign_ret = bpf_sk_assign_tcp_reqsk(skb, sk, &attrs, sizeof(attrs));
> +
> + bpf_sk_release(skc);
> +
> + /* Let the packet continue into the kernel */
> + return TC_ACT_OK;
> +}
> +
> char _license[] SEC("license") = "GPL";
> --
> 2.43.0
>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox