* [PATCH nf v2 2/2] netfilter: require Ethernet MAC header before using eth_hdr()
From: Ren Wei @ 2026-04-04 9:39 UTC (permalink / raw)
To: netfilter-devel, netdev
Cc: pablo, fw, phil, davem, dsahern, edumazet, kuba, pabeni, horms,
yifanwucs, tomapufckgml, yuantan098, bird, enjou1224z, zcliangcn,
n05ec
In-Reply-To: <cover.1774859629.git.zcliangcn@gmail.com>
From: Zhengchuan Liang <zcliangcn@gmail.com>
`ip6t_eui64`, `xt_mac`, the `bitmap:ip,mac`, `hash:ip,mac`, and
`hash:mac` ipset types, and `nf_log_syslog` access `eth_hdr(skb)`
after either assuming that the skb is associated with an Ethernet
device or checking only that the `ETH_HLEN` bytes at
`skb_mac_header(skb)` lie between `skb->head` and `skb->data`.
Make these paths first verify that the skb is associated with an
Ethernet device, that the MAC header was set, and that it spans at
least a full Ethernet header before accessing `eth_hdr(skb)`.
Suggested-by: Florian Westphal <fw@strlen.de>
Tested-by: Ren Wei <enjou1224z@gmail.com>
Signed-off-by: Zhengchuan Liang <zcliangcn@gmail.com>
Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
---
Changes in v2:
This patch addresses suspicious `eth_hdr(skb)` users by requiring an
Ethernet device together with a valid MAC header before accessing it.
net/ipv6/netfilter/ip6t_eui64.c | 7 +++++--
net/netfilter/ipset/ip_set_bitmap_ipmac.c | 5 +++--
net/netfilter/ipset/ip_set_hash_ipmac.c | 9 +++++----
net/netfilter/ipset/ip_set_hash_mac.c | 5 +++--
net/netfilter/nf_log_syslog.c | 7 ++++++-
net/netfilter/xt_mac.c | 4 +---
6 files changed, 23 insertions(+), 14 deletions(-)
diff --git a/net/ipv6/netfilter/ip6t_eui64.c b/net/ipv6/netfilter/ip6t_eui64.c
index da69a27e8332c..bbb684f9964c0 100644
--- a/net/ipv6/netfilter/ip6t_eui64.c
+++ b/net/ipv6/netfilter/ip6t_eui64.c
@@ -7,6 +7,7 @@
#include <linux/module.h>
#include <linux/skbuff.h>
#include <linux/ipv6.h>
+#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/netfilter/x_tables.h>
@@ -21,8 +22,10 @@ eui64_mt6(const struct sk_buff *skb, struct xt_action_param *par)
{
unsigned char eui64[8];
- if (!(skb_mac_header(skb) >= skb->head &&
- skb_mac_header(skb) + ETH_HLEN <= skb->data)) {
+ if (!skb->dev || skb->dev->type != ARPHRD_ETHER)
+ return false;
+
+ if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN) {
par->hotdrop = true;
return false;
}
diff --git a/net/netfilter/ipset/ip_set_bitmap_ipmac.c b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
index 2c625e0f49ec0..752f59ef87442 100644
--- a/net/netfilter/ipset/ip_set_bitmap_ipmac.c
+++ b/net/netfilter/ipset/ip_set_bitmap_ipmac.c
@@ -11,6 +11,7 @@
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
+#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <linux/netlink.h>
#include <linux/jiffies.h>
@@ -220,8 +221,8 @@ bitmap_ipmac_kadt(struct ip_set *set, const struct sk_buff *skb,
return -IPSET_ERR_BITMAP_RANGE;
/* Backward compatibility: we don't check the second flag */
- if (skb_mac_header(skb) < skb->head ||
- (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ if (!skb->dev || skb->dev->type != ARPHRD_ETHER ||
+ !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
return -EINVAL;
e.id = ip_to_id(map, ip);
diff --git a/net/netfilter/ipset/ip_set_hash_ipmac.c b/net/netfilter/ipset/ip_set_hash_ipmac.c
index 467c59a83c0ab..b9a2681e24888 100644
--- a/net/netfilter/ipset/ip_set_hash_ipmac.c
+++ b/net/netfilter/ipset/ip_set_hash_ipmac.c
@@ -11,6 +11,7 @@
#include <linux/skbuff.h>
#include <linux/errno.h>
#include <linux/random.h>
+#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <net/ip.h>
#include <net/ipv6.h>
@@ -89,8 +90,8 @@ hash_ipmac4_kadt(struct ip_set *set, const struct sk_buff *skb,
struct hash_ipmac4_elem e = { .ip = 0, { .foo[0] = 0, .foo[1] = 0 } };
struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
- if (skb_mac_header(skb) < skb->head ||
- (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ if (!skb->dev || skb->dev->type != ARPHRD_ETHER ||
+ !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
return -EINVAL;
if (opt->flags & IPSET_DIM_TWO_SRC)
@@ -205,8 +206,8 @@ hash_ipmac6_kadt(struct ip_set *set, const struct sk_buff *skb,
};
struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
- if (skb_mac_header(skb) < skb->head ||
- (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ if (!skb->dev || skb->dev->type != ARPHRD_ETHER ||
+ !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
return -EINVAL;
if (opt->flags & IPSET_DIM_TWO_SRC)
diff --git a/net/netfilter/ipset/ip_set_hash_mac.c b/net/netfilter/ipset/ip_set_hash_mac.c
index 718814730acf6..41a122591fe24 100644
--- a/net/netfilter/ipset/ip_set_hash_mac.c
+++ b/net/netfilter/ipset/ip_set_hash_mac.c
@@ -8,6 +8,7 @@
#include <linux/etherdevice.h>
#include <linux/skbuff.h>
#include <linux/errno.h>
+#include <linux/if_arp.h>
#include <linux/if_ether.h>
#include <net/netlink.h>
@@ -77,8 +78,8 @@ hash_mac4_kadt(struct ip_set *set, const struct sk_buff *skb,
struct hash_mac4_elem e = { { .foo[0] = 0, .foo[1] = 0 } };
struct ip_set_ext ext = IP_SET_INIT_KEXT(skb, opt, set);
- if (skb_mac_header(skb) < skb->head ||
- (skb_mac_header(skb) + ETH_HLEN) > skb->data)
+ if (!skb->dev || skb->dev->type != ARPHRD_ETHER ||
+ !skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
return -EINVAL;
if (opt->flags & IPSET_DIM_ONE_SRC)
diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index 41503847d9d7f..f62049d429653 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -78,7 +78,9 @@ dump_arp_packet(struct nf_log_buf *m,
else
logflags = NF_LOG_DEFAULT_MASK;
- if (logflags & NF_LOG_MACDECODE) {
+ if ((logflags & NF_LOG_MACDECODE) &&
+ skb->dev && skb->dev->type == ARPHRD_ETHER &&
+ skb_mac_header_was_set(skb) &&
+ skb_mac_header_len(skb) >= ETH_HLEN) {
nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
nf_log_dump_vlan(m, skb);
@@ -789,6 +791,9 @@ static void dump_mac_header(struct nf_log_buf *m,
switch (dev->type) {
case ARPHRD_ETHER:
+ if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
+ return;
+
nf_log_buf_add(m, "MACSRC=%pM MACDST=%pM ",
eth_hdr(skb)->h_source, eth_hdr(skb)->h_dest);
nf_log_dump_vlan(m, skb);
diff --git a/net/netfilter/xt_mac.c b/net/netfilter/xt_mac.c
index 81649da57ba5d..4798cd2ca26ed 100644
--- a/net/netfilter/xt_mac.c
+++ b/net/netfilter/xt_mac.c
@@ -29,9 +29,7 @@ static bool mac_mt(const struct sk_buff *skb, struct xt_action_param *par)
if (skb->dev == NULL || skb->dev->type != ARPHRD_ETHER)
return false;
- if (skb_mac_header(skb) < skb->head)
- return false;
- if (skb_mac_header(skb) + ETH_HLEN > skb->data)
+ if (!skb_mac_header_was_set(skb) || skb_mac_header_len(skb) < ETH_HLEN)
return false;
ret = ether_addr_equal(eth_hdr(skb)->h_source, info->srcaddr);
ret ^= info->invert;
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net v3 4/7] net/sched: netem: restructure dequeue to avoid re-entrancy with child qdisc
From: Simon Horman @ 2026-04-04 9:49 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, open list
In-Reply-To: <20260402202037.176299-5-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:32PM -0700, Stephen Hemminger wrote:
> netem_dequeue() enqueues packets into its child qdisc while being
> called from the parent's dequeue path. This causes two problems:
>
> - HFSC tracks class active/inactive state on qlen transitions.
> A child enqueue during dequeue causes double-insertion into
> the eltree (CVE-2025-37890, CVE-2025-38001).
>
> - Non-work-conserving children like TBF may refuse to dequeue
> packets just enqueued, causing netem to return NULL despite
> having backlog. Parents like DRR then incorrectly deactivate
> the class.
>
> Split the dequeue into helpers:
>
> netem_pull_tfifo() - remove head packet from tfifo
> netem_slot_account() - update slot pacing counters
> netem_dequeue_child() - batch-transfer ready packets to the
> child, then dequeue from the child
> netem_dequeue_direct()- dequeue from tfifo when no child
>
> When a child qdisc is present, all time-ready packets are moved
> into the child before calling its dequeue. This separates the
> enqueue and dequeue phases so the parent sees consistent qlen
> transitions.
>
> Fixes: 50612537e9ab ("netem: fix classful handling")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> ---
> net/sched/sch_netem.c | 201 +++++++++++++++++++++++++++---------------
> 1 file changed, 128 insertions(+), 73 deletions(-)
Hi Stephen,
As a fix this is a large and complex patch.
Could it be split up somehow to aid review?
...
^ permalink raw reply
* Re: [PATCH net v3 1/7] net/sched: netem: fix probability gaps in 4-state loss model
From: Simon Horman @ 2026-04-04 9:50 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, open list
In-Reply-To: <20260402202037.176299-2-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:29PM -0700, Stephen Hemminger wrote:
> The 4-state Markov chain in loss_4state() has gaps at the boundaries
> between transition probability ranges. The comparisons use:
>
> if (rnd < a4)
> else if (a4 < rnd && rnd < a1 + a4)
>
> When rnd equals a boundary value exactly, neither branch matches and
> no state transition occurs. The redundant lower-bound check (a4 < rnd)
> is already implied by being in the else branch.
>
> Remove the unnecessary lower-bound comparisons so the ranges are
> contiguous and every random value produces a transition, matching
> the GI (General and Intuitive) loss model specification.
>
> This bug goes back to original implementation of this model.
>
> Fixes: 661b79725fea ("netem: revised correlated loss generator")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net v3 2/7] net/sched: netem: fix queue limit check to include reordered packets
From: Simon Horman @ 2026-04-04 9:50 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, open list
In-Reply-To: <20260402202037.176299-3-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:30PM -0700, Stephen Hemminger wrote:
> The queue limit check in netem_enqueue() uses q->t_len which only
> counts packets in the internal tfifo. Packets placed in sch->q by
> the reorder path (__qdisc_enqueue_head) are not counted, allowing
> the total queue occupancy to exceed sch->limit under reordering.
>
> Include sch->q.qlen in the limit check.
>
> Fixes: 50612537e9ab ("netem: fix classful handling")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net v3 3/7] net/sched: netem: only reseed PRNG when seed is explicitly provided
From: Simon Horman @ 2026-04-04 9:50 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, François Michel,
open list
In-Reply-To: <20260402202037.176299-4-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:31PM -0700, Stephen Hemminger wrote:
> netem_change() unconditionally reseeds the PRNG on every tc change
> command. If TCA_NETEM_PRNG_SEED is not specified, a new random seed
> is generated, destroying reproducibility for users who set a
> deterministic seed on a previous change.
>
> Move the initial random seed generation to netem_init() and only
> reseed in netem_change() when TCA_NETEM_PRNG_SEED is explicitly
> provided by the user.
>
> Fixes: 4072d97ddc44 ("netem: add prng attribute to netem_sched_data")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net v3 5/7] net/sched: netem: null-terminate tfifo linear queue tail
From: Simon Horman @ 2026-04-04 9:50 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Peter Oskolkov,
open list
In-Reply-To: <20260402202037.176299-6-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:33PM -0700, Stephen Hemminger wrote:
> When tfifo_enqueue() appends a packet to the linear queue tail,
> nskb->next is never set to NULL. The list terminates correctly
> only by accident if the skb arrived with next already NULL.
>
> Explicitly null-terminate the tail to prevent list corruption.
>
> Fixes: d66280b12bd7 ("net: netem: use a list in addition to rbtree")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net v3 6/7] net/sched: netem: check for invalid slot range
From: Simon Horman @ 2026-04-04 9:51 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Yousuk Seung,
Neal Cardwell, open list
In-Reply-To: <20260402202037.176299-7-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:34PM -0700, Stephen Hemminger wrote:
> Reject slot configuration where min_delay exceeds max_delay.
> The delay range computation in get_slot_next() underflows in
> this case, producing bogus results.
>
> Fixes: 0a9fe5c375b5 ("netem: slotting with non-uniform distribution")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net v3 7/7] net/sched: netem: fix slot delay calculation overflow
From: Simon Horman @ 2026-04-04 9:51 UTC (permalink / raw)
To: Stephen Hemminger
Cc: netdev, Jamal Hadi Salim, Jiri Pirko, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Neal Cardwell,
Yousuk Seung, open list
In-Reply-To: <20260402202037.176299-8-stephen@networkplumber.org>
On Thu, Apr 02, 2026 at 01:19:35PM -0700, Stephen Hemminger wrote:
> get_slot_next() computes a random delay between min_delay and
> max_delay using:
>
> get_random_u32() * (max_delay - min_delay) >> 32
>
> This overflows signed 64-bit arithmetic when the delay range exceeds
> approximately 2.1 seconds (2^31 nanoseconds), producing a negative
> result that effectively disables slot-based pacing. This is a
> realistic configuration for WAN emulation (e.g., slot 1s 5s).
>
> Use mul_u64_u32_shr() which handles the widening multiply without
> overflow.
>
> Fixes: 0a9fe5c375b5 ("netem: slotting with non-uniform distribution")
> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
Reviewed-by: Simon Horman <horms@kernel.org>
^ permalink raw reply
* Re: [PATCH net-next] net: mctp: tests: use actual address when creating dev with addr
From: Simon Horman @ 2026-04-04 9:56 UTC (permalink / raw)
To: Jeremy Kerr
Cc: Matt Johnston, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev
In-Reply-To: <20260403-dev-mctp-fix-test-addr-v1-1-b7fa789cdd9b@codeconstruct.com.au>
On Fri, Apr 03, 2026 at 10:21:04AM +0800, Jeremy Kerr wrote:
> Sashiko reports:
>
> > This isn't a bug in the core networking code, but the addr parameter
> > appears to be ignored here.
>
> In mctp_test_create_dev_with_addr(), we are ignoring the addr argument
> and just using `8`. Use the passed address instead.
>
> All invocations use 8 anyway, so no effective change at present.
>
> Fixes: 22cb45afd221 ("net: mctp: perform source address lookups when we populate our dst")
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Reviewed-by: Simon Horman <horms@verge.net.au>
^ permalink raw reply
* Re: [PATCH v6 net 4/8] xsk: validate MTU against usable frame size on bind
From: Maciej Fijalkowski @ 2026-04-04 10:02 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, bpf, magnus.karlsson, stfomichev, pabeni, horms,
larysa.zaremba, aleksander.lobakin, bjorn
In-Reply-To: <20260403170357.14cb166a@kernel.org>
On Fri, Apr 03, 2026 at 05:03:57PM -0700, Jakub Kicinski wrote:
> On Thu, 2 Apr 2026 17:49:54 +0200 Maciej Fijalkowski wrote:
> > AF_XDP bind currently accepts zero-copy pool configurations without
> > verifying that the device MTU fits into the usable frame space provided
> > by the UMEM chunk.
> >
> > This becomes a problem since we started to respect tailroom which is
> > subtracted from chunk_size (among with headroom). 2k chunk size might
> > not provide enough space for standard 1500 MTU, so let us catch such
> > settings at bind time. Furthermore, validate whether underlying HW will
> > be able to satisfy configured MTU wrt XSK's frame size multiplied by
> > supported Rx buffer chain length (that is exposed via
> > net_device::xdp_zc_max_segs).
>
> For multi-buf - I suppose it's fine, but wouldn't this be potentially
> a regression for setups which use single buf? Suddenly we expect the
> user to provide space for shinfo which was not part of the initial
> AF_XDP design?
For single buf xsk_pool_get_tailroom() gives you 0 so it is not taken into
account when we do comparison of mtu vs xsk frame size (in this case frame
size is defined as chunk size minus headrooms (xdp and user provided
one)).
^ permalink raw reply
* [PATCH net v2] net: hamradio: 6pack: fix uninit-value in sixpack_receive_buf
From: Mashiro Chen @ 2026-04-04 10:03 UTC (permalink / raw)
To: netdev
Cc: Simon Horman, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, syzbot+ecdb8c9878a81eb21e54, ajk, linux-hams,
Mashiro Chen
In-Reply-To: <20260404085658.GR113102@horms.kernel.org>
sixpack_receive_buf() does not properly skip bytes with TTY error flags.
The while loop iterates through the flags buffer but never advances the
data pointer (cp), and passes the original count including error bytes
to sixpack_decode(). This causes sixpack_decode() to process bytes that
should have been skipped due to TTY errors.
Fix this by processing bytes one at a time, advancing cp on each
iteration, and only passing non-error bytes to sixpack_decode().
This matches the pattern used by slip_receive_buf() and
mkiss_receive_buf() for the same purpose.
Reported-by: syzbot+ecdb8c9878a81eb21e54@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=ecdb8c9878a81eb21e54
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Suggested-by: Simon Horman <horms@kernel.org>
Signed-off-by: Mashiro Chen <mashiro.chen@mailbox.org>
---
drivers/net/hamradio/6pack.c | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/drivers/net/hamradio/6pack.c b/drivers/net/hamradio/6pack.c
index 885992951e8a6..9e5220ae98360 100644
--- a/drivers/net/hamradio/6pack.c
+++ b/drivers/net/hamradio/6pack.c
@@ -391,7 +391,6 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
const u8 *fp, size_t count)
{
struct sixpack *sp;
- size_t count1;
if (!count)
return;
@@ -401,16 +400,15 @@ static void sixpack_receive_buf(struct tty_struct *tty, const u8 *cp,
return;
/* Read the characters out of the buffer */
- count1 = count;
- while (count) {
- count--;
+ while (count--) {
if (fp && *fp++) {
if (!test_and_set_bit(SIXPF_ERROR, &sp->flags))
sp->dev->stats.rx_errors++;
- continue;
+ } else {
+ sixpack_decode(sp, cp, 1);
}
+ cp++;
}
- sixpack_decode(sp, cp, count1);
tty_unthrottle(tty);
}
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v6 net 1/8] xsk: tighten UMEM headroom validation to account for tailroom and min frame
From: Maciej Fijalkowski @ 2026-04-04 10:07 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, bpf, magnus.karlsson, stfomichev, pabeni, horms,
larysa.zaremba, aleksander.lobakin, bjorn, Stanislav Fomichev
In-Reply-To: <20260403170126.276f9623@kernel.org>
On Fri, Apr 03, 2026 at 05:01:26PM -0700, Jakub Kicinski wrote:
> On Thu, 2 Apr 2026 17:49:51 +0200 Maciej Fijalkowski wrote:
> > The current headroom validation in xdp_umem_reg() could leave us with
> > insufficient space dedicated to even receive minimum-sized ethernet
> > frame. Furthermore if multi-buffer would come to play then
> > skb_shared_info stored at the end of XSK frame would be corrupted.
> >
> > HW typically works with 128-aligned sizes so let us provide this value
> > as bare minimum.
> >
> > Multi-buffer setting is known later in the configuration process so
> > besides accounting for 128 bytes, let us also take care of tailroom space
> > upfront.
>
> I guess it's a bit late to ask this, but am I the only one that has
> weird feelings about shinfo living in user-mapped memory?
This was the approach was picked to be consistent with XDP side and allow
to use mbuf related helpers. I can imagine you would be suggesting to pick
up pages from system page pool but that would be a major refactor (however
I have not put much not thought into it - i'm here without a coffee and in
easter mode).
Outside of this rewrite this set fixes existing memory corruption, so I
feel it is needed and we can think how should we address the concern you
are bringing up later?
^ permalink raw reply
* Re: [PATCH v6 net 3/8] xsk: fix XDP_UMEM_SG_FLAG issues
From: Maciej Fijalkowski @ 2026-04-04 10:11 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, bpf, magnus.karlsson, stfomichev, pabeni, horms,
larysa.zaremba, aleksander.lobakin, bjorn
In-Reply-To: <20260403165636.1f4ee958@kernel.org>
On Fri, Apr 03, 2026 at 04:56:36PM -0700, Jakub Kicinski wrote:
> On Thu, 2 Apr 2026 17:49:53 +0200 Maciej Fijalkowski wrote:
> > Currently xp_assign_dev_shared() is missing XDP_USE_SG being propagated
> > to flags so set it in order to preserve mtu check that is supposed to be
> > done only when no multi-buffer setup is in picture.
> >
> > Also, this flag has the same value as XDP_UMEM_TX_SW_CSUM so we could
> > get unexpected SG setups for software Tx checksums. Since csum flag is
> > UAPI, modify value of XDP_UMEM_SG_FLAG.
>
> should we maybe add:
>
> BUILD_BUG_ON(XDP_UMEM_SG_FLAG & XDP_UMEM_FLAGS_VALID)
>
> somewhere or use a hack like this ?
>
> #define XDP_UMEM_SG_FLAG (XDP_UMEM_FLAGS_VALID + 1)
Good idea i'd lean towards the latter version. I can send v7 after easter
or if there wouldn't be other issues related to set maybe maintainer could
adjust it? ;)
>
> > diff --git a/include/net/xdp_sock.h b/include/net/xdp_sock.h
> > index 23e8861e8b25..ebac60a3d8a1 100644
> > --- a/include/net/xdp_sock.h
> > +++ b/include/net/xdp_sock.h
> > @@ -14,7 +14,7 @@
> > #include <linux/mm.h>
> > #include <net/sock.h>
> >
> > -#define XDP_UMEM_SG_FLAG (1 << 1)
> > +#define XDP_UMEM_SG_FLAG BIT(3)
> >
> > struct net_device;
> > struct xsk_queue;
> > diff --git a/net/xdp/xsk_buff_pool.c b/net/xdp/xsk_buff_pool.c
> > index 37b7a68b89b3..729602a3cec0 100644
> > --- a/net/xdp/xsk_buff_pool.c
> > +++ b/net/xdp/xsk_buff_pool.c
> > @@ -247,6 +247,10 @@ int xp_assign_dev_shared(struct xsk_buff_pool *pool, struct xdp_sock *umem_xs,
> > struct xdp_umem *umem = umem_xs->umem;
> >
> > flags = umem->zc ? XDP_ZEROCOPY : XDP_COPY;
> > +
> > + if (umem->flags & XDP_UMEM_SG_FLAG)
> > + flags |= XDP_USE_SG;
> > +
> > if (umem_xs->pool->uses_need_wakeup)
> > flags |= XDP_USE_NEED_WAKEUP;
> >
>
^ permalink raw reply
* Re: [PATCH net] ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
From: Justin Iurman @ 2026-04-04 10:13 UTC (permalink / raw)
To: Jakub Kicinski, Eric Dumazet
Cc: davem, pabeni, horms, dsahern, netdev, eric.dumazet,
yimingqian591
In-Reply-To: <20260403145010.4b4e5865@kernel.org>
On 4/3/26 23:50, Jakub Kicinski wrote:
> On Fri, 3 Apr 2026 14:47:32 -0700 Eric Dumazet wrote:
>>> If the ingress device has more RX queues than the egress device (dev) has
>>> TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
>>>
>>> Since skb_get_tx_queue() does not clamp the index, will it return an
>>> out-of-bounds pointer into the egress device's dev->_tx array, causing
>>> dereferencing queue->qdisc to read invalid memory?
>>
>> This seems a different bug ?
>>
>> I mean, do we need to fix all bug in a single patch ?
>
> no no, sorry, i'm just sending this out for Justin or you as a separate
> thing.
Thanks Jakub, I don't know how I missed that. It's not just about a
possible OOB: it's actually incorrect for IOAM to do that because we're
relying on a lucky assumption at best (i.e., if queue_mapping on RX ==
queue_mapping on TX). This unfortunately rules out the possibility to
have an accurate per queue visibility (which I originally provided for
flexibility). I've had a local patch for a long time to aggregate the
queue depth (i.e., sum of all TX queues). It is more expensive(***), but
it would kill two birds with one stone and solve both problems
simultaneously.
Jakub, Eric, please let me know if the following plan works for both of you:
- (net) fix the OOB reported by Jakub (and, while at it, add missing
locks around qdisc_qstats_qlen_backlog() -> also included in my local patch)
- (net-next) after the merge window, add the new feature
After that, the per queue visibility would be considered
legacy/deprecated and not the default behavior. Documentation would be
updated accordingly to explain why per queue visibility cannot be trusted.
(***) the advise to operators in such a case is (obviously) to reduce
the IOAM insertion (with the frequency parameter), especially at line rate.
^ permalink raw reply
* [PATCH] nfc: nci: fix OOB heap read in nci_core_init_rsp_packet_v1()
From: Lekë Hapçiu @ 2026-04-04 10:30 UTC (permalink / raw)
To: netdev; +Cc: kuba, davem, edumazet, pabeni, security, Lekë Hapçiu
From: Lekë Hapçiu <framemain@outlook.com>
nci_core_init_rsp_packet_v1() uses the raw chip-supplied
num_supported_rf_interfaces byte to compute the rsp_2 pointer, but
the preceding min() already stores the capped value in
ndev->num_supported_rf_interfaces. When a hostile chip returns
num_supported_rf_interfaces > 4 the memcpy is safe (capped) but rsp_2
lands past the end of the skb, and the fields copied out of it corrupt
nci_dev with data from adjacent kernel heap.
Use the already-capped ndev->num_supported_rf_interfaces for both the
length check and the pointer, making the relationship between the two
explicit.
Fixes: e8c0dacd9836 ("NFC: Update names and structs to NCI spec 1.0 d18")
Signed-off-by: Lekë Hapçiu <framemain@outlook.com>
---
v2: drop intermediate offset variable, check skb->len directly against
ndev->num_supported_rf_interfaces + sizeof(*rsp_2) (Jakub Kicinski)
net/nfc/nci/rsp.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/net/nfc/nci/rsp.c b/net/nfc/nci/rsp.c
index 9eeb86282..4aaf362b9 100644
--- a/net/nfc/nci/rsp.c
+++ b/net/nfc/nci/rsp.c
@@ -66,7 +66,16 @@ static u8 nci_core_init_rsp_packet_v1(struct nci_dev *ndev,
rsp_1->supported_rf_interfaces,
ndev->num_supported_rf_interfaces);
- rsp_2 = (void *) (skb->data + 6 + rsp_1->num_supported_rf_interfaces);
+ if (skb->len < sizeof(*rsp_1) + ndev->num_supported_rf_interfaces +
+ sizeof(*rsp_2)) {
+ pr_err("CORE_INIT_RSP too short: len=%u need=%zu\n",
+ skb->len,
+ sizeof(*rsp_1) + ndev->num_supported_rf_interfaces +
+ sizeof(*rsp_2));
+ return NCI_STATUS_SYNTAX_ERROR;
+ }
+ rsp_2 = (void *)(skb->data + sizeof(*rsp_1) +
+ ndev->num_supported_rf_interfaces);
ndev->max_logical_connections = rsp_2->max_logical_connections;
ndev->max_routing_table_size =
--
2.51.0
^ permalink raw reply related
* Re: [PATCH v3 1/5] dt-bindings: nfc: nxp,nci: Document PN557 compatible
From: Krzysztof Kozlowski @ 2026-04-04 10:35 UTC (permalink / raw)
To: David Heidelberg
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Alexander Martinz, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Casey Connolly,
Alexander Martinz, Petr Hodina, biemster, netdev, linux-arm-msm,
oe-linux-nfc, devicetree, linux-kernel, phone-devel
In-Reply-To: <20260403-oneplus-nfc-v3-1-fbdce57d63c1@ixit.cz>
On Fri, Apr 03, 2026 at 03:58:46PM +0200, David Heidelberg wrote:
> The PN557 uses the same hardware as the PN553 but ships with
> firmware compliant with NCI 2.0.
>
> Document PN557 as a compatible device.
>
> Signed-off-by: David Heidelberg <david@ixit.cz>
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH v2 1/2] dt-bindings: arm: qcom: Add monaco-evk-ac support
From: Umang Chheda @ 2026-04-04 10:45 UTC (permalink / raw)
To: Dmitry Baryshkov
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Richard Cochran, linux-arm-msm, devicetree,
linux-kernel, netdev
In-Reply-To: <zyarcaimg67uivssnm4uxqiwc2jadolf5kx6moycwlbzhg4gmv@xa75wcpotzpr>
On 4/4/2026 1:58 AM, Dmitry Baryshkov wrote:
> On Fri, Apr 03, 2026 at 04:14:28PM +0530, Umang Chheda wrote:
>> Hello Dmitry,
>>
>> On 4/1/2026 5:06 PM, Dmitry Baryshkov wrote:
>>> On Wed, Apr 01, 2026 at 12:14:42AM +0530, Umang Chheda wrote:
>>>> Introduce bindings for the monaco-evk-ac IoT board, which is
>>>> based on the monaco-ac (QCS8300-AC) SoC variant.
>>>
>>> If it is a different SoC SKU, should it be reflected in the SoC compat
>>> strings?
>>
>> Monaco‑AC does not introduce any S/W differences compared to Monaco SoC
>> -- All IP blocks and bindings remain identical from S/W PoV, Hence
>> haven't included the SoC SKU in the SoC compat strings.
>>
>> Hope this is okay ? Your view on this ?
>
> You are descibing -AC as the main difference between the kits, but then
> you say that -AC doesn't bring new software interfaces. What is the
> difference then between monako-evk and the -ac variant?
>
The major difference between monaco-evk and monaco-ac-evk boards is that
of power grid. monaco-evk requires 4 PMICs (2x PM8650AU + Maxim MAX20018
+ TI TPS6594) to support higher power requirements of monaco-AA variant
of SoC which supports upto 40 TOPS of NPU - whereas this board
"monaco-ac-evk" supports 20 TOPS of NPU and has lesser power
requirements hence 2 PMICs suffice the power requirements (2x PM8650AU).
> Also, from the naming point of view, it is monako-ac-evk, not the other
> way.
Ack, will change this to "monaco-ac-evk" in the next version.
Also, should I change DT name "monaco-ac-sku.dts" instead of current
"monaco-evk-ac-sku" ?
>
>>
>>>
>>>>
>>>> Signed-off-by: Umang Chheda <umang.chheda@oss.qualcomm.com>
>>>> ---
>>>> Documentation/devicetree/bindings/arm/qcom.yaml | 1 +
>>>> 1 file changed, 1 insertion(+)
>>>>
>>>> diff --git a/Documentation/devicetree/bindings/arm/qcom.yaml b/Documentation/devicetree/bindings/arm/qcom.yaml
>>>> index ca880c105f3b..c76365a89687 100644
>>>> --- a/Documentation/devicetree/bindings/arm/qcom.yaml
>>>> +++ b/Documentation/devicetree/bindings/arm/qcom.yaml
>>>> @@ -918,6 +918,7 @@ properties:
>>>> - enum:
>>>> - arduino,monza
>>>> - qcom,monaco-evk
>>>> + - qcom,monaco-evk-ac
>>>> - qcom,qcs8300-ride
>>>> - const: qcom,qcs8300
>>>>
>>>>
>>>> --
>>>> 2.34.1
>>>>
>>>
>>
>> Thanks,
>> Umang
>
Thanks,
Umang
^ permalink raw reply
* Re: [PATCH v2 1/2] dt-bindings: arm: qcom: Add monaco-evk-ac support
From: Umang Chheda @ 2026-04-04 11:12 UTC (permalink / raw)
To: Dmitry Baryshkov
Cc: Bjorn Andersson, Konrad Dybcio, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Richard Cochran, linux-arm-msm, devicetree,
linux-kernel, netdev, umang.chheda
In-Reply-To: <4d32e86f-353c-4951-89ca-46aa49d60f76@oss.qualcomm.com>
On 4/4/2026 4:15 PM, Umang Chheda wrote:
>
>
> On 4/4/2026 1:58 AM, Dmitry Baryshkov wrote:
>> On Fri, Apr 03, 2026 at 04:14:28PM +0530, Umang Chheda wrote:
>>> Hello Dmitry,
>>>
>>> On 4/1/2026 5:06 PM, Dmitry Baryshkov wrote:
>>>> On Wed, Apr 01, 2026 at 12:14:42AM +0530, Umang Chheda wrote:
>>>>> Introduce bindings for the monaco-evk-ac IoT board, which is
>>>>> based on the monaco-ac (QCS8300-AC) SoC variant.
>>>>
>>>> If it is a different SoC SKU, should it be reflected in the SoC compat
>>>> strings?
>>>
>>> Monaco‑AC does not introduce any S/W differences compared to Monaco SoC
>>> -- All IP blocks and bindings remain identical from S/W PoV, Hence
>>> haven't included the SoC SKU in the SoC compat strings.
>>>
>>> Hope this is okay ? Your view on this ?
>>
>> You are descibing -AC as the main difference between the kits, but then
>> you say that -AC doesn't bring new software interfaces. What is the
>> difference then between monako-evk and the -ac variant?
>>
>
> The major difference between monaco-evk and monaco-ac-evk boards is that
> of power grid. monaco-evk requires 4 PMICs (2x PM8650AU + Maxim MAX20018
> + TI TPS6594) to support higher power requirements of monaco-AA variant
> of SoC which supports upto 40 TOPS of NPU - whereas this board
> "monaco-ac-evk" supports 20 TOPS of NPU and has lesser power
> requirements hence 2 PMICs suffice the power requirements (2x PM8650AU).
>
>
>> Also, from the naming point of view, it is monako-ac-evk, not the other
>> way.
>
> Ack, will change this to "monaco-ac-evk" in the next version.
>
> Also, should I change DT name "monaco-ac-evk.dts" instead of current
> "monaco-evk-ac-sku" ?
Corrected Typo - I meant change DT name to "monaco-ac-evk.dts" and drop
"sku" from the DT name as well ?
>
>>
>>>
>>>>
>>>>>
>>>>> Signed-off-by: Umang Chheda <umang.chheda@oss.qualcomm.com>
>>>>> ---
>>>>> Documentation/devicetree/bindings/arm/qcom.yaml | 1 +
>>>>> 1 file changed, 1 insertion(+)
>>>>>
>>>>> diff --git a/Documentation/devicetree/bindings/arm/qcom.yaml b/Documentation/devicetree/bindings/arm/qcom.yaml
>>>>> index ca880c105f3b..c76365a89687 100644
>>>>> --- a/Documentation/devicetree/bindings/arm/qcom.yaml
>>>>> +++ b/Documentation/devicetree/bindings/arm/qcom.yaml
>>>>> @@ -918,6 +918,7 @@ properties:
>>>>> - enum:
>>>>> - arduino,monza
>>>>> - qcom,monaco-evk
>>>>> + - qcom,monaco-evk-ac
>>>>> - qcom,qcs8300-ride
>>>>> - const: qcom,qcs8300
>>>>>
>>>>>
>>>>> --
>>>>> 2.34.1
>>>>>
>>>>
>>>
>>> Thanks,
>>> Umang
>>
>
> Thanks,
> Umang
Thanks,
Umang
>
>
^ permalink raw reply
* Re: [PATCH net v1] net: mptcp: fix slab-use-after-free in __inet_lookup_established
From: Matthieu Baerts @ 2026-04-04 11:15 UTC (permalink / raw)
To: Jiayuan Chen, mptcp, netdev
Cc: Mat Martineau, Geliang Tang, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, linux-kernel
In-Reply-To: <20260403130734.93981-1-jiayuan.chen@linux.dev>
Hi Jiayuan,
On 03/04/2026 15:07, Jiayuan Chen wrote:
> The ehash table lookups are lockless and rely on
> SLAB_TYPESAFE_BY_RCU to guarantee socket memory stability
> during RCU read-side critical sections. Both tcp_prot and
> tcpv6_prot have their slab caches created with this flag
> via proto_register().
>
> However, MPTCP's mptcp_subflow_init() copies tcpv6_prot into
> tcpv6_prot_override during inet_init() (fs_initcall, level 5),
> before inet6_init() (module_init/device_initcall, level 6) has
> called proto_register(&tcpv6_prot). At that point,
> tcpv6_prot.slab is still NULL, so tcpv6_prot_override.slab
> remains NULL permanently.
>
> This causes MPTCP v6 subflow child sockets to be allocated via
> kmalloc (falling into kmalloc-4k) instead of the TCPv6 slab
> cache. The kmalloc-4k cache lacks SLAB_TYPESAFE_BY_RCU, so
> when these sockets are freed without SOCK_RCU_FREE (which is
> cleared for child sockets by design), the memory can be
> immediately reused. Concurrent ehash lookups under
> rcu_read_lock can then access freed memory, triggering a
> slab-use-after-free in __inet_lookup_established.
Good catch! Thank you for this patch.
> Fix this by splitting the IPv6-specific initialization out of
> mptcp_subflow_init() into a new mptcp_subflow_v6_init(), which
> is called from mptcpv6_init() after proto_register(&tcpv6_prot)
> has completed. This ensures tcpv6_prot_override.slab correctly
> inherits the SLAB_TYPESAFE_BY_RCU slab cache.
The split makes sense anyway: better to regroup all v6-related init steps.
> Fixes: b19bc2945b40 ("mptcp: implement delegated actions")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> net/mptcp/ctrl.c | 6 +++++-
> net/mptcp/protocol.h | 1 +
> net/mptcp/subflow.c | 15 +++++++++------
> 3 files changed, 15 insertions(+), 7 deletions(-)
>
> diff --git a/net/mptcp/ctrl.c b/net/mptcp/ctrl.c
> index d96130e49942..5887ddcdb875 100644
> --- a/net/mptcp/ctrl.c
> +++ b/net/mptcp/ctrl.c
> @@ -583,7 +583,11 @@ int __init mptcpv6_init(void)
> int err;
>
> err = mptcp_proto_v6_init();
> + if (err)
> + return err;
>
> - return err;
> + mptcp_subflow_v6_init();
I think it would be better to move this to mptcp_proto_v6_init, similar
to what is done with mptcp_subflow_init, from mptcp_proto_init.
From there, you can even call it before registering the protocol, at the
beginning, so before inet6_register_protosw, which seems more logical
and similar to what is done in v4. WDYT?
If you send a v2, can you please remove the 'net:' prefix please?
'mptcp:' is enough:
[PATCH net v2] mptcp: fix (...)
Also, can you add a "Cc: stable" tag please?
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* [PATCH net v2 1/1] net: hsr: avoid learning unknown senders for local delivery
From: Ao Zhou @ 2026-04-04 11:30 UTC (permalink / raw)
To: netdev, Sebastian Andrzej Siewior
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Felix Maurer, Murali Karicheri, Shaurya Rane,
Ingo Molnar, Kees Cook, Yifan Wu, Juefei Pu, Yuan Tan, Xin Liu,
Yuqi Xu, Ao Zhou, Haoze Xie
In-Reply-To: <cover.1775056603.git.royenheart@outlook.com>
From: Haoze Xie <royenheart@gmail.com>
Traffic that is directly addressed to the local HSR/PRP master can be
delivered locally without creating a persistent node entry. Learning one
node per previously unseen source MAC lets forged sender floods grow
node_db until the prune timer catches up.
Determine whether a frame is locally exclusive before node lookup and
skip learning for unknown senders in that case. When no node state
exists, also skip duplicate discard checks that depend on it.
This keeps locally-destined traffic reachable while avoiding node table
growth from source-MAC floods in both the PRP SAN path and the HSR/PRP
tagged sender paths.
Fixes: f421436a591d ("net/hsr: Add support for the High-availability Seamless Redundancy protocol (HSRv0)")
Fixes: 451d8123f897 ("net: prp: add packet handling support")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Tested-by: Yuqi Xu <xuyuqiabc@gmail.com>
Signed-off-by: Haoze Xie <royenheart@gmail.com>
Signed-off-by: Ao Zhou <n05ec@lzu.edu.cn>
---
changes in v2:
- generalize the fix beyond PRP SAN traffic and cover HSR/PRP tagged sender floods
- decide whether learning is needed from local-exclusive delivery instead of protocol-specific SAN checks
- use the normal NULL return semantics from hsr_get_node() instead of ERR_PTR-based error plumbing
- skip duplicate-discard state checks when no node state exists
net/hsr/hsr_forward.c | 23 +++++++++++++----------
net/hsr/hsr_framereg.c | 5 ++++-
net/hsr/hsr_framereg.h | 2 +-
3 files changed, 18 insertions(+), 12 deletions(-)
diff --git a/net/hsr/hsr_forward.c b/net/hsr/hsr_forward.c
index aefc9b6936ba..15bd17b4ee17 100644
--- a/net/hsr/hsr_forward.c
+++ b/net/hsr/hsr_forward.c
@@ -403,7 +403,8 @@ static void hsr_deliver_master(struct sk_buff *skb, struct net_device *dev,
int res, recv_len;
was_multicast_frame = (skb->pkt_type == PACKET_MULTICAST);
- hsr_addr_subst_source(node_src, skb);
+ if (node_src)
+ hsr_addr_subst_source(node_src, skb);
skb_pull(skb, ETH_HLEN);
recv_len = skb->len;
res = netif_rx(skb);
@@ -545,7 +546,7 @@ static void hsr_forward_do(struct hsr_frame_info *frame)
/* Don't send frame over port where it has been sent before.
* Also for SAN, this shouldn't be done.
*/
- if (!frame->is_from_san &&
+ if (frame->node_src && !frame->is_from_san &&
hsr->proto_ops->register_frame_out &&
hsr->proto_ops->register_frame_out(port, frame))
continue;
@@ -688,21 +689,25 @@ static int fill_frame_info(struct hsr_frame_info *frame,
return -EINVAL;
memset(frame, 0, sizeof(*frame));
+ frame->port_rcv = port;
frame->is_supervision = is_supervision_frame(port->hsr, skb);
if (frame->is_supervision && hsr->redbox)
frame->is_proxy_supervision =
is_proxy_supervision_frame(port->hsr, skb);
+ ethhdr = (struct ethhdr *)skb_mac_header(skb);
+ check_local_dest(port->hsr, skb, frame);
+
n_db = &hsr->node_db;
if (port->type == HSR_PT_INTERLINK)
n_db = &hsr->proxy_node_db;
frame->node_src = hsr_get_node(port, n_db, skb,
- frame->is_supervision, port->type);
- if (!frame->node_src)
- return -1; /* Unknown node and !is_supervision, or no mem */
+ frame->is_supervision, port->type,
+ !frame->is_local_exclusive);
+ if (!frame->node_src && !frame->is_local_exclusive)
+ return -1;
- ethhdr = (struct ethhdr *)skb_mac_header(skb);
frame->is_vlan = false;
proto = ethhdr->h_proto;
@@ -720,13 +725,10 @@ static int fill_frame_info(struct hsr_frame_info *frame,
}
frame->is_from_san = false;
- frame->port_rcv = port;
ret = hsr->proto_ops->fill_frame_info(proto, skb, frame);
if (ret)
return ret;
- check_local_dest(port->hsr, skb, frame);
-
return 0;
}
@@ -739,7 +741,8 @@ void hsr_forward_skb(struct sk_buff *skb, struct hsr_port *port)
if (fill_frame_info(&frame, skb, port) < 0)
goto out_drop;
- hsr_register_frame_in(frame.node_src, port, frame.sequence_nr);
+ if (frame.node_src)
+ hsr_register_frame_in(frame.node_src, port, frame.sequence_nr);
hsr_forward_do(&frame);
rcu_read_unlock();
/* Gets called for ingress frames as well as egress from master port.
diff --git a/net/hsr/hsr_framereg.c b/net/hsr/hsr_framereg.c
index 50996f4de7f9..2bc6f8f154c2 100644
--- a/net/hsr/hsr_framereg.c
+++ b/net/hsr/hsr_framereg.c
@@ -221,7 +221,7 @@ void prp_update_san_info(struct hsr_node *node, bool is_sup)
*/
struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
struct sk_buff *skb, bool is_sup,
- enum hsr_port_type rx_port)
+ enum hsr_port_type rx_port, bool learn)
{
struct hsr_priv *hsr = port->hsr;
struct hsr_node *node;
@@ -270,6 +270,9 @@ struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
san = true;
}
+ if (!learn)
+ return NULL;
+
return hsr_add_node(hsr, node_db, ethhdr->h_source, san, rx_port);
}
diff --git a/net/hsr/hsr_framereg.h b/net/hsr/hsr_framereg.h
index c65ecb925734..3d9c88e83090 100644
--- a/net/hsr/hsr_framereg.h
+++ b/net/hsr/hsr_framereg.h
@@ -33,7 +33,7 @@ void hsr_del_self_node(struct hsr_priv *hsr);
void hsr_del_nodes(struct list_head *node_db);
struct hsr_node *hsr_get_node(struct hsr_port *port, struct list_head *node_db,
struct sk_buff *skb, bool is_sup,
- enum hsr_port_type rx_port);
+ enum hsr_port_type rx_port, bool learn);
void hsr_handle_sup_frame(struct hsr_frame_info *frame);
bool hsr_addr_is_self(struct hsr_priv *hsr, unsigned char *addr);
bool hsr_addr_is_redbox(struct hsr_priv *hsr, unsigned char *addr);
--
2.53.0
^ permalink raw reply related
* Re: [PATCH v1 17/22] dt-bindings: clock: Add StarFive JHB100 Peripheral-2 clock and reset generator
From: Krzysztof Kozlowski @ 2026-04-04 11:34 UTC (permalink / raw)
To: Changhuang Liang
Cc: Michael Turquette, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Stephen Boyd, Paul Walmsley, Palmer Dabbelt, Albert Ou,
Alexandre Ghiti, Philipp Zabel, Emil Renner Berthing, Kees Cook,
Gustavo A . R . Silva, Richard Cochran, linux-clk, linux-kernel,
devicetree, linux-riscv, linux-hardening, netdev, Sia Jee Heng,
Hal Feng, Ley Foon Tan
In-Reply-To: <20260402105523.447523-18-changhuang.liang@starfivetech.com>
On Thu, Apr 02, 2026 at 03:55:18AM -0700, Changhuang Liang wrote:
> + clocks:
> + items:
> + - description: Peripheral-2 600MHz
> + - description: Peripheral-2 400MHz
> + - description: Peripheral-2 125MHz
> + - description: Peripheral-2 GMAC2 RGMII RX
> + - description: Peripheral-2 GMAC2 RMII Reference
> + - description: Peripheral-2 GMAC3 SGMII TX
> + - description: Peripheral-2 GMAC3 SGMII RX
> + - description: Main Oscillator (25 MHz)
> +
> + clock-names:
> + items:
> + - const: per2_600
Does not have any meaningful name in datasheet / clock hierarchy?
> + - const: per2_400
> + - const: per2_125
> + - const: per2_gmac2_rgmii_rx
> + - const: per2_gmac2_rmii_ref
> + - const: per2_gmac3_sgmii_tx
> + - const: per2_gmac3_sgmii_rx
per2 is redundant. Name these according to clock input names.
Same for your patch for per3.
> + - const: osc
> +
> +
Just one blank line
Best regards,
Krzysztof
^ permalink raw reply
* Re: [PATCH iwl-net v1] igc: fix potential skb leak in igc_fpe_xmit_smd_frame()
From: Kohei Enju @ 2026-04-04 11:40 UTC (permalink / raw)
To: Simon Horman
Cc: intel-wired-lan, netdev, Tony Nguyen, Przemek Kitszel,
Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Faizal Rahim
In-Reply-To: <20260403140555.GH113102@horms.kernel.org>
On 04/03 15:05, Simon Horman wrote:
> On Sun, Mar 29, 2026 at 02:50:49PM +0000, Kohei Enju wrote:
> > When igc_fpe_init_tx_descriptor() fails, no one takes care of an
> > allocated skb, leaking it. [1]
> >
> > Use dev_kfree_skb_any() on failure.
> > Also call igc_flush_tx_descriptors() only on success.
> >
> > [1]
> > unreferenced object 0xffff88813aee1b40 (size 224):
> > comm "softirq", pid 0, jiffies 4294709256
> > [...]
> > backtrace (crc dee31384):
> > kmem_cache_alloc_node_noprof+0x54f/0x640
> > __alloc_skb+0xd9/0x5b0
> > igc_fpe_xmit_smd_frame.isra.0+0xad/0x510
> > igc_fpe_send_mpacket+0x32/0x80
> > [...]
> >
> > Fixes: 5422570c0010 ("igc: add support for frame preemption verification")
> > Signed-off-by: Kohei Enju <kohei@enjuk.jp>
>
> I am wondering if we can achieve this while sticking to the idiom
> that the main thread of execution is for the non-error flow,
> while conditions handle errors.
Hi Simon-san, thank you for the suggestion.
I agree. It seems cleaner for me. I'll work on v2.
> Something like this (completely untested!):
>
> diff --git a/drivers/net/ethernet/intel/igc/igc_tsn.c b/drivers/net/ethernet/intel/igc/igc_tsn.c
> index 8a110145bfee..02dd9f0290a3 100644
> --- a/drivers/net/ethernet/intel/igc/igc_tsn.c
> +++ b/drivers/net/ethernet/intel/igc/igc_tsn.c
> @@ -109,10 +109,16 @@ static int igc_fpe_xmit_smd_frame(struct igc_adapter *adapter,
> __netif_tx_lock(nq, cpu);
>
> err = igc_fpe_init_tx_descriptor(ring, skb, type);
> - igc_flush_tx_descriptors(ring);
> + if (err)
> + goto err_free_skb_any;
>
> + igc_flush_tx_descriptors(ring);
> __netif_tx_unlock(nq);
> + return 0;
>
> +err_free_skb_any:
> + __netif_tx_unlock(nq);
> + dev_kfree_skb_any(skb);
> return err;
> }
>
^ permalink raw reply
* Re: [PATCH net] ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
From: Eric Dumazet @ 2026-04-04 11:44 UTC (permalink / raw)
To: Justin Iurman
Cc: Jakub Kicinski, davem, pabeni, horms, dsahern, netdev,
eric.dumazet, yimingqian591
In-Reply-To: <2de5a3d1-cc8f-48c2-a590-09bef92e9adb@gmail.com>
On Sat, Apr 4, 2026 at 3:13 AM Justin Iurman <justin.iurman@gmail.com> wrote:
>
> On 4/3/26 23:50, Jakub Kicinski wrote:
> > On Fri, 3 Apr 2026 14:47:32 -0700 Eric Dumazet wrote:
> >>> If the ingress device has more RX queues than the egress device (dev) has
> >>> TX queues, skb_get_queue_mapping(skb) will exceed dev->num_tx_queues.
> >>>
> >>> Since skb_get_tx_queue() does not clamp the index, will it return an
> >>> out-of-bounds pointer into the egress device's dev->_tx array, causing
> >>> dereferencing queue->qdisc to read invalid memory?
> >>
> >> This seems a different bug ?
> >>
> >> I mean, do we need to fix all bug in a single patch ?
> >
> > no no, sorry, i'm just sending this out for Justin or you as a separate
> > thing.
>
> Thanks Jakub, I don't know how I missed that. It's not just about a
> possible OOB: it's actually incorrect for IOAM to do that because we're
> relying on a lucky assumption at best (i.e., if queue_mapping on RX ==
> queue_mapping on TX). This unfortunately rules out the possibility to
> have an accurate per queue visibility (which I originally provided for
> flexibility). I've had a local patch for a long time to aggregate the
> queue depth (i.e., sum of all TX queues). It is more expensive(***), but
> it would kill two birds with one stone and solve both problems
> simultaneously.
>
> Jakub, Eric, please let me know if the following plan works for both of you:
> - (net) fix the OOB reported by Jakub (and, while at it, add missing
> locks around qdisc_qstats_qlen_backlog() -> also included in my local patch)
> - (net-next) after the merge window, add the new feature
>
> After that, the per queue visibility would be considered
> legacy/deprecated and not the default behavior. Documentation would be
> updated accordingly to explain why per queue visibility cannot be trusted.
>
> (***) the advise to operators in such a case is (obviously) to reduce
> the IOAM insertion (with the frequency parameter), especially at line rate.
Getting qdisc stats can be expensive for qdisc with per-cpu storage
for counters like pfifo-fast.
If your plan is to sum MQ stats, this could have quadratic behavior :
O(nr_cpus ^ 2)
I suggest rate-limiting this very expensive operation, or OAM will
become a nice DOS tool.
(Ie not depend on operators being nice, enforce this on the hosts)
^ permalink raw reply
* [PATCH net 1/1] net: l3mdev: Ignore non-L3 uppers in l3mdev_fib_table_rcu
From: Ao Zhou @ 2026-04-04 11:52 UTC (permalink / raw)
To: netdev
Cc: David Ahern, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Yifan Wu, Juefei Pu, Yuan Tan, Xin Liu,
Ao Zhou, Haoze Xie
In-Reply-To: <cover.1775062214.git.royenheart@gmail.com>
From: Haoze Xie <royenheart@gmail.com>
l3mdev_fib_table_rcu() assumes that any upper device observed for
an IFF_L3MDEV_SLAVE device is an L3 master and dereferences
master->l3mdev_ops unconditionally.
VRF slave setup sets IFF_L3MDEV_SLAVE before the upper link is fully
switched, so readers can transiently observe a non-L3 upper such as a
bridge and follow a NULL l3mdev_ops pointer. Require the current upper
to still be an L3 master before consulting its FIB table.
Fixes: fee6d4c777a1 ("net: Add netif_is_l3_slave")
Reported-by: Yifan Wu <yifanwucs@gmail.com>
Reported-by: Juefei Pu <tomapufckgml@gmail.com>
Co-developed-by: Yuan Tan <yuantan098@gmail.com>
Signed-off-by: Yuan Tan <yuantan098@gmail.com>
Suggested-by: Xin Liu <bird@lzu.edu.cn>
Signed-off-by: Haoze Xie <royenheart@gmail.com>
Signed-off-by: Ao Zhou <n05ec@lzu.edu.cn>
---
net/l3mdev/l3mdev.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/l3mdev/l3mdev.c b/net/l3mdev/l3mdev.c
index 5432a5f2dfc8..b8a3030cb2c4 100644
--- a/net/l3mdev/l3mdev.c
+++ b/net/l3mdev/l3mdev.c
@@ -177,7 +177,7 @@ u32 l3mdev_fib_table_rcu(const struct net_device *dev)
const struct net_device *master;
master = netdev_master_upper_dev_get_rcu(_dev);
- if (master &&
+ if (master && netif_is_l3_master(master) &&
master->l3mdev_ops->l3mdev_fib_table)
tb_id = master->l3mdev_ops->l3mdev_fib_table(master);
}
--
2.53.0
^ permalink raw reply related
* [PATCH v2] treewide: use get_random_u{16,32,64}() where appropriate
From: David Carlier @ 2026-04-04 12:00 UTC (permalink / raw)
To: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Christian Brauner, Kuniyuki Iwashima, Jan Kara,
Jeff Layton, Qiliang Yuan
Cc: netdev, David Carlier
Use the typed random integer helpers instead of
get_random_bytes() when filling a single integer variable.
The helpers return the value directly, require no pointer
or size argument, and better express intent.
Skipped sites writing into __be16 fields (netdevsim) where
a direct assignment would trigger sparse endianness warnings.
Signed-off-by: David Carlier <devnexen@gmail.com>
---
drivers/block/drbd/drbd_main.c | 4 ++--
drivers/block/drbd/drbd_nl.c | 2 +-
drivers/gpu/drm/i915/i915_hdcp_gsc.c | 2 +-
drivers/gpu/drm/xe/xe_gsc_submit.c | 2 +-
drivers/md/dm-vdo/indexer/index-layout.c | 2 +-
drivers/net/netdevsim/psample.c | 4 ++--
drivers/target/iscsi/iscsi_target_seq_pdu_list.c | 2 +-
fs/ext2/super.c | 2 +-
fs/ocfs2/super.c | 2 +-
net/ceph/auth_x.c | 2 +-
net/core/net_namespace.c | 2 +-
net/mac80211/mesh_plink.c | 2 +-
net/mptcp/subflow.c | 4 ++--
net/openvswitch/flow_table.c | 2 +-
net/sctp/sm_make_chunk.c | 4 ++--
net/tipc/node.c | 2 +-
16 files changed, 20 insertions(+), 20 deletions(-)
diff --git a/drivers/block/drbd/drbd_main.c b/drivers/block/drbd/drbd_main.c
index 200d464e984b..b1a721dd0496 100644
--- a/drivers/block/drbd/drbd_main.c
+++ b/drivers/block/drbd/drbd_main.c
@@ -874,7 +874,7 @@ void drbd_gen_and_send_sync_uuid(struct drbd_peer_device *peer_device)
if (uuid && uuid != UUID_JUST_CREATED)
uuid = uuid + UUID_NEW_BM_OFFSET;
else
- get_random_bytes(&uuid, sizeof(u64));
+ uuid = get_random_u64();
drbd_uuid_set(device, UI_BITMAP, uuid);
drbd_print_uuids(device, "updated sync UUID");
drbd_md_sync(device);
@@ -3337,7 +3337,7 @@ void drbd_uuid_new_current(struct drbd_device *device) __must_hold(local)
u64 val;
unsigned long long bm_uuid;
- get_random_bytes(&val, sizeof(u64));
+ val = get_random_u64();
spin_lock_irq(&device->ldev->md.uuid_lock);
bm_uuid = device->ldev->md.uuid[UI_BITMAP];
diff --git a/drivers/block/drbd/drbd_nl.c b/drivers/block/drbd/drbd_nl.c
index e201f0087a0f..377f60b40f28 100644
--- a/drivers/block/drbd/drbd_nl.c
+++ b/drivers/block/drbd/drbd_nl.c
@@ -3173,7 +3173,7 @@ int drbd_adm_resume_io(struct sk_buff *skb, struct genl_info *info)
* matching real data uuid exists).
*/
u64 val;
- get_random_bytes(&val, sizeof(u64));
+ val = get_random_u64();
drbd_set_ed_uuid(device, val);
drbd_warn(device, "Resumed without access to data; please tear down before attempting to re-configure.\n");
}
diff --git a/drivers/gpu/drm/i915/i915_hdcp_gsc.c b/drivers/gpu/drm/i915/i915_hdcp_gsc.c
index 168b9ccbef3e..a0510f5ab25c 100644
--- a/drivers/gpu/drm/i915/i915_hdcp_gsc.c
+++ b/drivers/gpu/drm/i915/i915_hdcp_gsc.c
@@ -196,7 +196,7 @@ static ssize_t intel_hdcp_gsc_msg_send(struct intel_hdcp_gsc_context *gsc_contex
memset(header_in, 0, msg_size_in);
memset(header_out, 0, msg_size_out);
- get_random_bytes(&host_session_id, sizeof(u64));
+ host_session_id = get_random_u64();
intel_gsc_uc_heci_cmd_emit_mtl_header(header_in, HECI_MEADDRESS_HDCP,
msg_size_in, host_session_id);
memcpy(gsc_context->hdcp_cmd_in + sizeof(*header_in), msg_in, msg_in_len);
diff --git a/drivers/gpu/drm/xe/xe_gsc_submit.c b/drivers/gpu/drm/xe/xe_gsc_submit.c
index 08082b596501..195f99e6c3a8 100644
--- a/drivers/gpu/drm/xe/xe_gsc_submit.c
+++ b/drivers/gpu/drm/xe/xe_gsc_submit.c
@@ -49,7 +49,7 @@ u64 xe_gsc_create_host_session_id(void)
{
u64 host_session_id;
- get_random_bytes(&host_session_id, sizeof(u64));
+ host_session_id = get_random_u64();
host_session_id &= ~HOST_SESSION_CLIENT_MASK;
return host_session_id;
}
diff --git a/drivers/md/dm-vdo/indexer/index-layout.c b/drivers/md/dm-vdo/indexer/index-layout.c
index 61edf2b72427..8707930c9910 100644
--- a/drivers/md/dm-vdo/indexer/index-layout.c
+++ b/drivers/md/dm-vdo/indexer/index-layout.c
@@ -256,7 +256,7 @@ static void create_unique_nonce_data(u8 *buffer)
u32 rand;
size_t offset = 0;
- get_random_bytes(&rand, sizeof(u32));
+ rand = get_random_u32();
memcpy(buffer + offset, &now, sizeof(now));
offset += sizeof(now);
memcpy(buffer + offset, &rand, sizeof(rand));
diff --git a/drivers/net/netdevsim/psample.c b/drivers/net/netdevsim/psample.c
index 47d24bc64ee4..717d157c3ae2 100644
--- a/drivers/net/netdevsim/psample.c
+++ b/drivers/net/netdevsim/psample.c
@@ -94,7 +94,7 @@ static void nsim_dev_psample_md_prepare(const struct nsim_dev_psample *psample,
if (psample->out_tc_occ_max) {
u64 out_tc_occ;
- get_random_bytes(&out_tc_occ, sizeof(u64));
+ out_tc_occ = get_random_u64();
md->out_tc_occ = out_tc_occ & (psample->out_tc_occ_max - 1);
md->out_tc_occ_valid = 1;
}
@@ -102,7 +102,7 @@ static void nsim_dev_psample_md_prepare(const struct nsim_dev_psample *psample,
if (psample->latency_max) {
u64 latency;
- get_random_bytes(&latency, sizeof(u64));
+ latency = get_random_u64();
md->latency = latency & (psample->latency_max - 1);
md->latency_valid = 1;
}
diff --git a/drivers/target/iscsi/iscsi_target_seq_pdu_list.c b/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
index 75c37c8866c8..81e28e567a01 100644
--- a/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
+++ b/drivers/target/iscsi/iscsi_target_seq_pdu_list.c
@@ -102,7 +102,7 @@ static void iscsit_create_random_array(u32 *array, u32 count)
for (i = 0; i < count; i++) {
redo:
- get_random_bytes(&j, sizeof(u32));
+ j = get_random_u32();
j = (1 + (int) (9999 + 1) - j) % count;
for (k = 0; k < i + 1; k++) {
j |= 0x80000000;
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index 603f2641fe10..e4136490c883 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1151,7 +1151,7 @@ static int ext2_fill_super(struct super_block *sb, struct fs_context *fc)
goto failed_mount2;
}
sbi->s_gdb_count = db_count;
- get_random_bytes(&sbi->s_next_generation, sizeof(u32));
+ sbi->s_next_generation = get_random_u32();
spin_lock_init(&sbi->s_next_gen_lock);
/* per filesystem reservation list head & lock */
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index d7c58fd7d438..b875f01c9756 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -2124,7 +2124,7 @@ static int ocfs2_initialize_super(struct super_block *sb,
osb->osb_cluster_stack[0] = '\0';
}
- get_random_bytes(&osb->s_next_generation, sizeof(u32));
+ osb->s_next_generation = get_random_u32();
/*
* FIXME
diff --git a/net/ceph/auth_x.c b/net/ceph/auth_x.c
index 692e0b868822..936b43ae4a95 100644
--- a/net/ceph/auth_x.c
+++ b/net/ceph/auth_x.c
@@ -571,7 +571,7 @@ static int ceph_x_build_request(struct ceph_auth_client *ac,
blob = enc_buf + SHA256_DIGEST_SIZE;
}
- get_random_bytes(&auth->client_challenge, sizeof(u64));
+ auth->client_challenge = get_random_u64();
blob->client_challenge = auth->client_challenge;
blob->server_challenge = cpu_to_le64(xi->server_challenge);
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index 1057d16d5dd2..deb8b2ec5674 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -411,7 +411,7 @@ static __net_init int preinit_net(struct net *net, struct user_namespace *user_n
ref_tracker_dir_init(&net->refcnt_tracker, 128, "net_refcnt");
ref_tracker_dir_init(&net->notrefcnt_tracker, 128, "net_notrefcnt");
- get_random_bytes(&net->hash_mix, sizeof(u32));
+ net->hash_mix = get_random_u32();
net->dev_base_seq = 1;
net->user_ns = user_ns;
diff --git a/net/mac80211/mesh_plink.c b/net/mac80211/mesh_plink.c
index 803106fc3134..7cbab90c8784 100644
--- a/net/mac80211/mesh_plink.c
+++ b/net/mac80211/mesh_plink.c
@@ -712,7 +712,7 @@ void mesh_plink_timer(struct timer_list *t)
"Mesh plink for %pM (retry, timeout): %d %d\n",
sta->sta.addr, sta->mesh->plink_retries,
sta->mesh->plink_timeout);
- get_random_bytes(&rand, sizeof(u32));
+ rand = get_random_u32();
sta->mesh->plink_timeout = sta->mesh->plink_timeout +
rand % sta->mesh->plink_timeout;
++sta->mesh->plink_retries;
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index 5cfe19990f31..1a7736145dbc 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -72,7 +72,7 @@ static void subflow_req_create_thmac(struct mptcp_subflow_request_sock *subflow_
struct mptcp_sock *msk = subflow_req->msk;
u8 hmac[SHA256_DIGEST_SIZE];
- get_random_bytes(&subflow_req->local_nonce, sizeof(u32));
+ subflow_req->local_nonce = get_random_u32();
subflow_generate_hmac(READ_ONCE(msk->local_key),
READ_ONCE(msk->remote_key),
@@ -1639,7 +1639,7 @@ int __mptcp_subflow_connect(struct sock *sk, const struct mptcp_pm_local *local,
ssk = sf->sk;
subflow = mptcp_subflow_ctx(ssk);
do {
- get_random_bytes(&subflow->local_nonce, sizeof(u32));
+ subflow->local_nonce = get_random_u32();
} while (!subflow->local_nonce);
/* if 'IPADDRANY', the ID will be set later, after the routing */
diff --git a/net/openvswitch/flow_table.c b/net/openvswitch/flow_table.c
index 61c6a5f77c2e..67d5b8c0fe79 100644
--- a/net/openvswitch/flow_table.c
+++ b/net/openvswitch/flow_table.c
@@ -167,7 +167,7 @@ static struct table_instance *table_instance_alloc(int new_size)
ti->n_buckets = new_size;
ti->node_ver = 0;
- get_random_bytes(&ti->hash_seed, sizeof(u32));
+ ti->hash_seed = get_random_u32();
return ti;
}
diff --git a/net/sctp/sm_make_chunk.c b/net/sctp/sm_make_chunk.c
index 2c0017d058d4..de86ac088289 100644
--- a/net/sctp/sm_make_chunk.c
+++ b/net/sctp/sm_make_chunk.c
@@ -2727,7 +2727,7 @@ __u32 sctp_generate_tag(const struct sctp_endpoint *ep)
__u32 x;
do {
- get_random_bytes(&x, sizeof(__u32));
+ x = get_random_u32();
} while (x == 0);
return x;
@@ -2738,7 +2738,7 @@ __u32 sctp_generate_tsn(const struct sctp_endpoint *ep)
{
__u32 retval;
- get_random_bytes(&retval, sizeof(__u32));
+ retval = get_random_u32();
return retval;
}
diff --git a/net/tipc/node.c b/net/tipc/node.c
index af442a5ef8f3..97aa970a0d83 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -1275,7 +1275,7 @@ void tipc_node_check_dest(struct net *net, u32 addr,
goto exit;
if_name = strchr(b->name, ':') + 1;
- get_random_bytes(&session, sizeof(u16));
+ session = get_random_u16();
if (!tipc_link_create(net, if_name, b->identity, b->tolerance,
b->net_plane, b->mtu, b->priority,
b->min_win, b->max_win, session,
--
2.53.0
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox