* [PATCH net 2/2] net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
From: Luca Weiss @ 2026-04-09 8:13 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-arm-msm,
linux-kernel, Luca Weiss
In-Reply-To: <20260409-ipa-fixes-v1-0-a817c30678ac@fairphone.com>
Initially 'reg' and 'val' are assigned from HW_PARAM_2.
But since IPA v5.0+ takes EV_PER_EE from HW_PARAM_4 (instead of
NUM_EV_PER_EE from HW_PARAM_2), we not only need to re-assign 'reg' but
also read the register value of that register into 'val' so that
reg_decode() works on the correct value.
Fixes: f651334e1ef5 ("net: ipa: add HW_PARAM_4 GSI register")
Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=2
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
drivers/net/ipa/gsi.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/ipa/gsi.c b/drivers/net/ipa/gsi.c
index 4c3227e77898..624649484d62 100644
--- a/drivers/net/ipa/gsi.c
+++ b/drivers/net/ipa/gsi.c
@@ -2044,6 +2044,7 @@ static int gsi_ring_setup(struct gsi *gsi)
count = reg_decode(reg, NUM_EV_PER_EE, val);
} else {
reg = gsi_reg(gsi, HW_PARAM_4);
+ val = ioread32(gsi->virt + reg_offset(reg));
count = reg_decode(reg, EV_PER_EE, val);
}
if (!count) {
--
2.53.0
^ permalink raw reply related
* [PATCH net 1/2] net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
From: Luca Weiss @ 2026-04-09 8:13 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-arm-msm,
linux-kernel, Luca Weiss
In-Reply-To: <20260409-ipa-fixes-v1-0-a817c30678ac@fairphone.com>
The 'val' variable gets overwritten multiple times, discarding previous
values. Looking at the git log shows these should be combined with |=
instead.
Fixes: 9265a4f0f0b4 ("net: ipa: define even more IPA register fields")
Link: https://sashiko.dev/#/patchset/20260403-milos-ipa-v1-0-01e9e4e03d3e%40fairphone.com?part=4
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
drivers/net/ipa/ipa_main.c | 6 +++---
1 file changed, 3 insertions(+), 3 deletions(-)
diff --git a/drivers/net/ipa/ipa_main.c b/drivers/net/ipa/ipa_main.c
index edead9c48d1f..216506eeef1f 100644
--- a/drivers/net/ipa/ipa_main.c
+++ b/drivers/net/ipa/ipa_main.c
@@ -361,7 +361,7 @@ static void ipa_qtime_config(struct ipa *ipa)
{
const struct reg *reg;
u32 offset;
- u32 val;
+ u32 val = 0;
/* Timer clock divider must be disabled when we change the rate */
reg = ipa_reg(ipa, TIMERS_XO_CLK_DIV_CFG);
@@ -374,8 +374,8 @@ static void ipa_qtime_config(struct ipa *ipa)
val |= reg_bit(reg, DPL_TIMESTAMP_SEL);
}
/* Configure tag and NAT Qtime timestamp resolution as well */
- val = reg_encode(reg, TAG_TIMESTAMP_LSB, TAG_TIMESTAMP_SHIFT);
- val = reg_encode(reg, NAT_TIMESTAMP_LSB, NAT_TIMESTAMP_SHIFT);
+ val |= reg_encode(reg, TAG_TIMESTAMP_LSB, TAG_TIMESTAMP_SHIFT);
+ val |= reg_encode(reg, NAT_TIMESTAMP_LSB, NAT_TIMESTAMP_SHIFT);
iowrite32(val, ipa->reg_virt + reg_offset(reg));
--
2.53.0
^ permalink raw reply related
* [PATCH net 0/2] More fixes for the IPA driver
From: Luca Weiss @ 2026-04-09 8:13 UTC (permalink / raw)
To: Alex Elder, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-arm-msm,
linux-kernel, Luca Weiss
Two more fixes for the Qualcomm IPA driver.
Signed-off-by: Luca Weiss <luca.weiss@fairphone.com>
---
Luca Weiss (2):
net: ipa: Fix programming of QTIME_TIMESTAMP_CFG
net: ipa: Fix decoding EV_PER_EE for IPA v5.0+
drivers/net/ipa/gsi.c | 1 +
drivers/net/ipa/ipa_main.c | 6 +++---
2 files changed, 4 insertions(+), 3 deletions(-)
---
base-commit: 56007972c0b1e783ca714d6f1f4d6e66e531d21f
change-id: 20260409-ipa-fixes-a575cf2810df
Best regards,
--
Luca Weiss <luca.weiss@fairphone.com>
^ permalink raw reply
* Re: [PATCH] gcov: use atomic counter updates to fix concurrent access crashes
From: Peter Oberparleiter @ 2026-04-09 8:11 UTC (permalink / raw)
To: Nathan Chancellor, Konstantin Khorenko, Andrew Morton
Cc: Mikhail Zaslonko, Nicolas Schier, Masahiro Yamada,
Thomas Weißschuh, Arnd Bergmann, Steffen Klassert,
Herbert Xu, linux-kbuild, linux-kernel, netdev, Pavel Tikhomirov,
Vasileios Almpanis, Jakub Kicinski
In-Reply-To: <20260406193707.GB1319599@ax162>
On 06.04.2026 21:37, Nathan Chancellor wrote:
> On Thu, Apr 02, 2026 at 05:18:31PM +0300, Konstantin Khorenko wrote:
>> GCC's GCOV instrumentation can merge global branch counters with loop
>> induction variables as an optimization. In inflate_fast(), the inner
>> copy loops get transformed so that the GCOV counter value is loaded
>> multiple times to compute the loop base address, start index, and end
>> bound. Since GCOV counters are global (not per-CPU), concurrent
>> execution on different CPUs causes the counter to change between loads,
>> producing inconsistent values and out-of-bounds memory writes.
>>
>> The crash manifests during IPComp (IP Payload Compression) processing
>> when inflate_fast() runs concurrently on multiple CPUs:
>>
>> BUG: unable to handle page fault for address: ffffd0a3c0902ffa
>> RIP: inflate_fast+1431
>> Call Trace:
>> zlib_inflate
>> __deflate_decompress
>> crypto_comp_decompress
>> ipcomp_decompress [xfrm_ipcomp]
>> ipcomp_input [xfrm_ipcomp]
>> xfrm_input
>>
>> At the crash point, the compiler generated three loads from the same
>> global GCOV counter (__gcov0.inflate_fast+216) to compute base, start,
>> and end for an indexed loop. Another CPU modified the counter between
>> loads, making the values inconsistent — the write went 3.4 MB past a
>> 65 KB buffer.
>>
>> Add -fprofile-update=atomic to CFLAGS_GCOV at the global level in the
>> top-level Makefile. This tells GCC that GCOV counters may be
>> concurrently accessed, causing counter updates to use atomic
>> instructions (lock addq) instead of plain load/store. This prevents
>> the compiler from merging counters with loop induction variables.
>>
>> Applying this globally rather than per-subsystem not only addresses the
>> observed crash in zlib but makes GCOV coverage data more consistent
>> overall, preventing similar issues in any kernel code path that may
>> execute concurrently.
>>
>> Signed-off-by: Konstantin Khorenko <khorenko@virtuozzo.com>
>> Tested-by: Peter Oberparleiter <oberpar@linux.ibm.com>
>> Reviewed-by: Peter Oberparleiter <oberpar@linux.ibm.com>
>
> While this is obviously a fix, what are the chances of regressions from
> this change? As this should only impact GCOV, this could go via whatever
> tree carries GCOV patches. If Kbuild is to take this change, my vote
> would be to defer it to 7.2 at this point in the development cycle so
> that it can have most of a cycle to sit in -next.
Adding Andrew since he typically integrates GCOV patches via his tree,
and for input on how to handle this patch.
To summarize the situation, this patch:
- is only effective with GCC + GCOV profiling enabled
- fixes a run-time crash
- improves overall GCOV coverage data consistency
- triggers a number of build errors due to side-effects on GCC constant
folding and therefore depends on the associated series [1] that fixes
these build-errors
- has a non-zero chance to trigger additional build-time errors, e.g.
in similar macros guarded by arch/config symbols not covered by
current testing
Given the last point, I agree with Nathan that this patch would benefit
from additional test coverage to minimize regression risks, e.g. via a
cycle in -next.
[1]
https://lore.kernel.org/lkml/20260402140558.1437002-1-khorenko@virtuozzo.com/
>> ---
>> Makefile | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/Makefile b/Makefile
>> index 6b1d9fb1a6b4..a55ad668d6ba 100644
>> --- a/Makefile
>> +++ b/Makefile
>> @@ -806,7 +806,7 @@ all: vmlinux
>>
>> CFLAGS_GCOV := -fprofile-arcs -ftest-coverage
>> ifdef CONFIG_CC_IS_GCC
>> -CFLAGS_GCOV += -fno-tree-loop-im
>> +CFLAGS_GCOV += -fno-tree-loop-im -fprofile-update=atomic
>> endif
>> export CFLAGS_GCOV
>>
>> --
>> 2.43.5
>>
--
Peter Oberparleiter
Linux on IBM Z Development - IBM Germany R&D
^ permalink raw reply
* Re: [PATCH net] net: fix __this_cpu_add() in preemptible code in dev_xmit_recursion_inc/dec
From: Eric Dumazet @ 2026-04-09 8:10 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, Andrew Lunn, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Weiming Shi, linux-kernel,
linux-rt-devel
In-Reply-To: <8c761de0-4d8c-4b2e-89a6-80f12016fd78@linux.dev>
On Thu, Apr 9, 2026 at 12:50 AM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
> Thanks
>
> I checked all callers of dev_xmit_recursion_inc(). Most are fine.
>
> The only problematic ones are iptunnel_xmit() and ip6tunnel_xmit(),
>
> I think adding guard(migrate)() at the top of both functions is enough
Seems fine to me, thanks.
^ permalink raw reply
* Re: [PATCH v4 net-next 10/14] net: dsa: netc: introduce NXP NETC switch driver for i.MX94
From: Vladimir Oltean @ 2026-04-09 8:07 UTC (permalink / raw)
To: Wei Fang
Cc: Jakub Kicinski, Claudiu Manoil, Clark Wang, andrew+netdev@lunn.ch,
davem@davemloft.net, edumazet@google.com, pabeni@redhat.com,
robh@kernel.org, krzk+dt@kernel.org, conor+dt@kernel.org,
f.fainelli@gmail.com, Frank Li, chleroy@kernel.org,
horms@kernel.org, linux@armlinux.org.uk, andrew@lunn.ch,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
devicetree@vger.kernel.org, linuxppc-dev@lists.ozlabs.org,
linux-arm-kernel@lists.infradead.org, imx@lists.linux.dev
In-Reply-To: <AM8PR04MB72840DBFC7F3FD578DFF6AF8885BA@AM8PR04MB7284.eurprd04.prod.outlook.com>
On Wed, Apr 08, 2026 at 11:59:24AM +0300, Wei Fang wrote:
> > > +static int netc_init_switch_id(struct netc_switch *priv)
> > > +{
> > > + struct netc_switch_regs *regs = &priv->regs;
> > > + struct dsa_switch *ds = priv->ds;
> > > +
> > > + /* The value of 0 is reserved for the VEPA switch and cannot
> > > + * be used.
> > > + */
> > > + if (ds->index > SWCR_SWID || !ds->index) {
> > > + dev_err(priv->dev, "Switch index %d out of range\n",
> > > + ds->index);
> > > + return -ERANGE;
> > > + }
> >
> > Does this check cause the probe to fail unconditionally for standard
> > single-switch topologies?
> >
> > The DSA core typically assigns ds->index = 0 by default for the first switch.
> > Because !ds->index evaluates to true for index 0, this setup function will
> > always fail unless the dsa,member property is explicitly overridden in the
> > device tree.
>
> As I mentioned in another mail, we added the 'dsa,member' property to the
> netc switch DT-binding doc, specifying that the 'member' (switch index) value
> cannot be 0. And 'dsa,member' is a required property for netc switch.
>
> >
> > Could the driver translate the hardware ID internally, for example by writing
> > ds->index + 1 to NETC_SWCR, rather than forcing this hardware-specific
> > restriction onto the software DSA index?
>
> The current approach is based on Vladimir's suggestion. I need to confirm with
> Vladimir which approach is better.
>
> Hi Vladimir,
>
> What are your thoughts on this suggestion? Is this approach better?
I maintain it is preferable/simpler the way you are doing it, with a 1:1 mapping.
The LLM's concern would be more valid if the switch were discrete and every
board DTS author would have to remember to place the dsa,member property.
But the switch OF node will live in an SoC dtsi.
Maybe you could put something along these lines in the commit message,
hopefully the LLM will pick it up and stop complaining.
^ permalink raw reply
* Re: [PATCH 0/6] IPA v5.2 support for Milos and Fairphone (Gen. 6)
From: patchwork-bot+netdevbpf @ 2026-04-09 8:00 UTC (permalink / raw)
To: Luca Weiss
Cc: elder, andrew+netdev, davem, edumazet, kuba, pabeni, robh,
krzk+dt, conor+dt, andersson, konradybcio, akoskovich,
~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
Hello:
This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Fri, 03 Apr 2026 18:43:46 +0200 you wrote:
> First, two fixes that unbreak IPA v5.0+, which can be applied
> independently.
>
> Then add support for IPA v5.2 which can be found in the Milos SoC. And
> finally enable it on Fairphone (Gen. 6) so that mobile data (4G/5G/..)
> starts working.
>
> [...]
Here is the summary with links:
- [1/6] net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
https://git.kernel.org/netdev/net/c/9709b56d908a
- [2/6] net: ipa: fix event ring index not programmed for IPA v5.0+
https://git.kernel.org/netdev/net/c/56007972c0b1
- [3/6] dt-bindings: net: qcom,ipa: add Milos compatible
(no matching commit)
- [4/6] net: ipa: add IPA v5.2 configuration data
(no matching commit)
- [5/6] arm64: dts: qcom: milos: Add IPA node
(no matching commit)
- [6/6] arm64: dts: qcom: milos-fairphone-fp6: Enable IPA
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [5/6] arm64: dts: qcom: milos: Add IPA node
From: Krzysztof Kozlowski @ 2026-04-09 8:00 UTC (permalink / raw)
To: Paolo Abeni, luca.weiss
Cc: krzk+dt, akoskovich, konradybcio, linux-kernel, conor+dt,
devicetree, andersson, netdev, kuba, linux-arm-msm, andrew+netdev,
davem, robh, edumazet, ~postmarketos/upstreaming, phone-devel,
elder
In-Reply-To: <20260409075854.308955-1-pabeni@redhat.com>
On 09/04/2026 09:58, Paolo Abeni wrote:
> This is an AI-generated review of your patch. The human sending this
> email has considered the AI review valid, or at least plausible.
>
> For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
> ---
...
>> +
>> + qcom,smem-states = <&smp2p_ipa_out 0>,
>> + <&smp2p_ipa_out 1>;
>> + qcom,smem-state-names = "ipa-clock-enabled-valid",
>> + "ipa-clock-enabled";
>> +
>> + sram = <&ipa_modem_tables>;
>> ^^^^^^^^^^^^^^^^^^
>
> Is the ipa_modem_tables label defined anywhere? The Device Tree Compiler
> will fail with "Reference to non-existent node or label
> 'ipa_modem_tables'" if this label doesn't exist.
Paul, please ignore all of such review from AI tools. It is completely
wrong and pointless.
Best regards,
Krzysztof
^ permalink raw reply
* Re: [5/6] arm64: dts: qcom: milos: Add IPA node
From: Paolo Abeni @ 2026-04-09 7:58 UTC (permalink / raw)
To: luca.weiss
Cc: pabeni, krzk+dt, akoskovich, konradybcio, linux-kernel, conor+dt,
devicetree, andersson, netdev, kuba, linux-arm-msm, andrew+netdev,
davem, robh, edumazet, ~postmarketos/upstreaming, phone-devel,
elder
In-Reply-To: <20260403-milos-ipa-v1-5-01e9e4e03d3e@fairphone.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
For local reproduction steps see https://netdev-ai.bots.linux.dev/ai-local.html
---
arm64: dts: qcom: milos: Add IPA node
Add the description of the IPA block in the Milos SoC.
> diff --git a/arch/arm64/boot/dts/qcom/milos.dtsi b/arch/arm64/boot/dts/qcom/milos.dtsi
> index e1a51d43943f..a244e136a877 100644
> --- a/arch/arm64/boot/dts/qcom/milos.dtsi
> +++ b/arch/arm64/boot/dts/qcom/milos.dtsi
> @@ -1281,6 +1281,50 @@ adreno_smmu: iommu@3da0000 {
> dma-coherent;
> };
>
> + ipa: ipa@3f40000 {
> + compatible = "qcom,milos-ipa";
> +
> + reg = <0x0 0x03f40000 0x0 0x10000>,
> + <0x0 0x03f50000 0x0 0x5000>,
> + <0x0 0x03e04000 0x0 0xfc000>;
> + reg-names = "ipa-reg",
> + "ipa-shared",
> + "gsi";
> +
> + interrupts-extended = <&intc GIC_SPI 654 IRQ_TYPE_EDGE_RISING 0>,
> + <&intc GIC_SPI 432 IRQ_TYPE_LEVEL_HIGH 0>,
> + <&smp2p_ipa_in 0 IRQ_TYPE_EDGE_RISING>,
> + <&smp2p_ipa_in 1 IRQ_TYPE_EDGE_RISING>;
> + interrupt-names = "ipa",
> + "gsi",
> + "ipa-clock-query",
> + "ipa-setup-ready";
> +
> + clocks = <&rpmhcc RPMH_IPA_CLK>;
> + clock-names = "core";
> +
> + interconnects = <&aggre2_noc MASTER_IPA QCOM_ICC_TAG_ALWAYS
> + &mc_virt SLAVE_EBI1 QCOM_ICC_TAG_ALWAYS>,
> + <&gem_noc MASTER_APPSS_PROC QCOM_ICC_TAG_ACTIVE_ONLY
> + &cnoc_main SLAVE_IPA_CFG QCOM_ICC_TAG_ACTIVE_ONLY>;
> + interconnect-names = "memory",
> + "config";
> +
> + iommus = <&apps_smmu 0x4a0 0x0>,
> + <&apps_smmu 0x4a2 0x0>;
> +
> + qcom,qmp = <&aoss_qmp>;
> +
> + qcom,smem-states = <&smp2p_ipa_out 0>,
> + <&smp2p_ipa_out 1>;
> + qcom,smem-state-names = "ipa-clock-enabled-valid",
> + "ipa-clock-enabled";
> +
> + sram = <&ipa_modem_tables>;
> ^^^^^^^^^^^^^^^^^^
Is the ipa_modem_tables label defined anywhere? The Device Tree Compiler
will fail with "Reference to non-existent node or label
'ipa_modem_tables'" if this label doesn't exist.
The sram property is optional according to the qcom,ipa.yaml binding, and
other similar Qualcomm SoCs like SM8350, SM8550, and SM8650 don't include
this property in their IPA nodes. Should this line be removed, or does the
ipa_modem_tables node need to be added to the reserved-memory section?
> +
> + status = "disabled";
> + };
> +
[ ... ]
^ permalink raw reply
* [PATCH iwl-next v2] igb: use ktime_get_real helpers in igb_ptp_reset()
From: Aleksandr Loktionov @ 2026-04-09 7:55 UTC (permalink / raw)
To: intel-wired-lan, anthony.l.nguyen, aleksandr.loktionov
Cc: netdev, Jacob Keller, Simon Horman, Paul Menzel
Replace ktime_to_ns(ktime_get_real()) with the direct equivalent
ktime_get_real_ns() and ktime_to_timespec64(ktime_get_real()) with
ktime_get_real_ts64() in igb_ptp_reset(). Using the combined helpers
makes the intent clearer.
Suggested-by: Jacob Keller <jacob.e.keller@intel.com>
Suggested-by: Simon Horman <horms@kernel.org>
Reviewed-by: Paul Menzel <pmenzel@molgen.mpg.de>
Signed-off-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
---
v1 -> v2 removed the inaccurate claim, + Pauls RB
---
drivers/net/ethernet/intel/igb/igb_ptp.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/igb/igb_ptp.c b/drivers/net/ethernet/intel/igb/igb_ptp.c
index bd85d02..638d824 100644
--- a/drivers/net/ethernet/intel/igb/igb_ptp.c
+++ b/drivers/net/ethernet/intel/igb/igb_ptp.c
@@ -1500,12 +1500,13 @@ void igb_ptp_reset(struct igb_adapter *adapter)
/* Re-initialize the timer. */
if ((hw->mac.type == e1000_i210) || (hw->mac.type == e1000_i211)) {
- struct timespec64 ts = ktime_to_timespec64(ktime_get_real());
+ struct timespec64 ts;
+ ktime_get_real_ts64(&ts);
igb_ptp_write_i210(adapter, &ts);
} else {
timecounter_init(&adapter->tc, &adapter->cc,
- ktime_to_ns(ktime_get_real()));
+ ktime_get_real_ns());
}
out:
spin_unlock_irqrestore(&adapter->tmreg_lock, flags);
--
2.52.0
^ permalink raw reply related
* Re: [PATCH net] net: fix __this_cpu_add() in preemptible code in dev_xmit_recursion_inc/dec
From: Jiayuan Chen @ 2026-04-09 7:50 UTC (permalink / raw)
To: Eric Dumazet
Cc: netdev, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, Andrew Lunn, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Weiming Shi, linux-kernel,
linux-rt-devel
In-Reply-To: <CANn89iLEpVVo=q4FPpBQ5FomoLmdrfW3su7Mb0ZES4EV9=Q4xA@mail.gmail.com>
On 4/9/26 3:18 PM, Eric Dumazet wrote:
> On Wed, Apr 8, 2026 at 8:54 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>> dev_xmit_recursion_inc/dec() use __this_cpu_inc/dec() which requires
>> migration to be disabled. However, some callers like SCTP's UDP
>> encapsulation path invoke iptunnel_xmit() from process context without
>> disabling BH or preemption:
>>
>> sctp_inet_connect -> __sctp_connect -> sctp_do_sm ->
>> sctp_outq_flush -> sctp_packet_transmit -> sctp_v4_xmit ->
>> udp_tunnel_xmit_skb -> iptunnel_xmit -> dev_xmit_recursion_inc
>>
>> This triggers the following warning on PREEMPT(full) kernels:
>>
>>
>> Fix this by adding migrate_disable/enable() around the __this_cpu
>> operations in dev_xmit_recursion_inc/dec() to ensure the per-cpu
>> variable is accessed on the same CPU throughout the inc/dec pair.
>>
>> Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
>> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
>> ---
>> include/linux/netdevice.h | 5 +++++
>> 1 file changed, 5 insertions(+)
>>
>> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
>> index 7ca01eb3f7d2..6b1cd5380d70 100644
>> --- a/include/linux/netdevice.h
>> +++ b/include/linux/netdevice.h
>> @@ -3591,14 +3591,19 @@ static inline bool dev_xmit_recursion(void)
>> XMIT_RECURSION_LIMIT);
>> }
>>
>> +/* Non PREEMPT_RT version: inc and dec must run on the same CPU,
>> + * migrate_disable is sufficient.
>> + */
>> static inline void dev_xmit_recursion_inc(void)
>> {
>> + migrate_disable();
>> __this_cpu_inc(softnet_data.xmit.recursion);
>> }
>>
>> static inline void dev_xmit_recursion_dec(void)
>> {
>> __this_cpu_dec(softnet_data.xmit.recursion);
>> + migrate_enable();
>> }
>> #else
>> static inline int dev_recursion_level(void)
>> --
>> 2.43.0
> This seems wrong.
>
> The migrate_disable() should happen before dev_recursion_level().
Thanks
I checked all callers of dev_xmit_recursion_inc(). Most are fine.
The only problematic ones are iptunnel_xmit() and ip6tunnel_xmit(),
I think adding guard(migrate)() at the top of both functions is enough
^ permalink raw reply
* [PATCH iwl-next 1/1] igc: add support for forcing link speed without autonegotiation
From: KhaiWenTan @ 2026-04-09 7:27 UTC (permalink / raw)
To: anthony.l.nguyen, przemyslaw.kitszel, andrew+netdev, davem,
edumazet, kuba, pabeni
Cc: intel-wired-lan, netdev, linux-kernel, faizal.abdul.rahim,
hector.blanco.alcaine, hong.aun.looi, khai.wen.tan, Faizal Rahim,
Looi, KhaiWenTan
From: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
Allow users to force 10/100 Mb/s link speed and duplex via ethtool
when autonegotiation is disabled. Previously, the driver rejected
"ethtool -s <dev> autoneg off speed <N> duplex <half|full>" with
"Force mode currently not supported."
When autoneg is disabled, the driver programs both the GPY PHY and
I225/I226 MAC control registers to bypass autonegotiation and apply
the requested speed and duplex. The MAC CTRL register is configured
with FRCSPD, FRCDPLX, and the appropriate SPEED and FD bits, while
the PHY STD_CTRL register has ANEN cleared and SSM/SSL/DPLX set to
match. Flow control is also forced on the MAC side when autoneg is
disabled, consistent with the existing autoneg-failed path.
Forcing 1000 Mb/s and 2500 Mb/s is not supported by this change.
Reviewed-by: Looi, Hong Aun <hong.aun.looi@intel.com>
Signed-off-by: Faizal Rahim <faizal.abdul.rahim@linux.intel.com>
Signed-off-by: KhaiWenTan <khai.wen.tan@linux.intel.com>
---
drivers/net/ethernet/intel/igc/igc_base.c | 35 +++++-
drivers/net/ethernet/intel/igc/igc_defines.h | 9 +-
drivers/net/ethernet/intel/igc/igc_ethtool.c | 122 ++++++++++++++-----
drivers/net/ethernet/intel/igc/igc_hw.h | 9 ++
drivers/net/ethernet/intel/igc/igc_mac.c | 2 +-
drivers/net/ethernet/intel/igc/igc_main.c | 2 +-
drivers/net/ethernet/intel/igc/igc_phy.c | 66 +++++++++-
drivers/net/ethernet/intel/igc/igc_phy.h | 1 +
8 files changed, 201 insertions(+), 45 deletions(-)
diff --git a/drivers/net/ethernet/intel/igc/igc_base.c b/drivers/net/ethernet/intel/igc/igc_base.c
index 1613b562d17c..ab9120a3127f 100644
--- a/drivers/net/ethernet/intel/igc/igc_base.c
+++ b/drivers/net/ethernet/intel/igc/igc_base.c
@@ -114,11 +114,35 @@ static s32 igc_setup_copper_link_base(struct igc_hw *hw)
u32 ctrl;
ctrl = rd32(IGC_CTRL);
- ctrl |= IGC_CTRL_SLU;
- ctrl &= ~(IGC_CTRL_FRCSPD | IGC_CTRL_FRCDPX);
- wr32(IGC_CTRL, ctrl);
-
- ret_val = igc_setup_copper_link(hw);
+ ctrl &= ~(IGC_CTRL_FRCSPD | IGC_CTRL_FRCDPX |
+ IGC_CTRL_SPEED_MASK | IGC_CTRL_FD);
+
+ if (hw->mac.autoneg_enabled) {
+ ctrl |= IGC_CTRL_SLU;
+ wr32(IGC_CTRL, ctrl);
+ ret_val = igc_setup_copper_link(hw);
+ } else {
+ ctrl |= IGC_CTRL_SLU | IGC_CTRL_FRCSPD | IGC_CTRL_FRCDPX;
+
+ switch (hw->mac.forced_speed_duplex) {
+ case IGC_FORCED_10H:
+ ctrl |= IGC_CTRL_SPEED_10;
+ break;
+ case IGC_FORCED_10F:
+ ctrl |= IGC_CTRL_SPEED_10 | IGC_CTRL_FD;
+ break;
+ case IGC_FORCED_100H:
+ ctrl |= IGC_CTRL_SPEED_100;
+ break;
+ case IGC_FORCED_100F:
+ ctrl |= IGC_CTRL_SPEED_100 | IGC_CTRL_FD;
+ break;
+ default:
+ return -IGC_ERR_CONFIG;
+ }
+ wr32(IGC_CTRL, ctrl);
+ ret_val = igc_setup_copper_link(hw);
+ }
return ret_val;
}
@@ -443,6 +467,7 @@ static const struct igc_phy_operations igc_phy_ops_base = {
.reset = igc_phy_hw_reset,
.read_reg = igc_read_phy_reg_gpy,
.write_reg = igc_write_phy_reg_gpy,
+ .force_speed_duplex = igc_force_speed_duplex,
};
const struct igc_info igc_base_info = {
diff --git a/drivers/net/ethernet/intel/igc/igc_defines.h b/drivers/net/ethernet/intel/igc/igc_defines.h
index 9482ab11f050..3f504751c2d9 100644
--- a/drivers/net/ethernet/intel/igc/igc_defines.h
+++ b/drivers/net/ethernet/intel/igc/igc_defines.h
@@ -129,10 +129,13 @@
#define IGC_ERR_SWFW_SYNC 13
/* Device Control */
+#define IGC_CTRL_FD BIT(0) /* Full Duplex */
#define IGC_CTRL_RST 0x04000000 /* Global reset */
-
#define IGC_CTRL_PHY_RST 0x80000000 /* PHY Reset */
#define IGC_CTRL_SLU 0x00000040 /* Set link up (Force Link) */
+#define IGC_CTRL_SPEED_MASK GENMASK(10, 8)
+#define IGC_CTRL_SPEED_10 FIELD_PREP(IGC_CTRL_SPEED_MASK, 0)
+#define IGC_CTRL_SPEED_100 FIELD_PREP(IGC_CTRL_SPEED_MASK, 1)
#define IGC_CTRL_FRCSPD 0x00000800 /* Force Speed */
#define IGC_CTRL_FRCDPX 0x00001000 /* Force Duplex */
#define IGC_CTRL_VME 0x40000000 /* IEEE VLAN mode enable */
@@ -673,6 +676,10 @@
#define IGC_GEN_POLL_TIMEOUT 1920
/* PHY Control Register */
+#define MII_CR_SPEED_MASK (BIT(6) | BIT(13))
+#define MII_CR_SPEED_10 0x0000 /* SSM=0, SSL=0: 10 Mb/s */
+#define MII_CR_SPEED_100 BIT(13) /* SSM=0, SSL=1: 100 Mb/s */
+#define MII_CR_DUPLEX_EN BIT(8) /* 0 = Half Duplex, 1 = Full Duplex */
#define MII_CR_RESTART_AUTO_NEG 0x0200 /* Restart auto negotiation */
#define MII_CR_POWER_DOWN 0x0800 /* Power down */
#define MII_CR_AUTO_NEG_EN 0x1000 /* Auto Neg Enable */
diff --git a/drivers/net/ethernet/intel/igc/igc_ethtool.c b/drivers/net/ethernet/intel/igc/igc_ethtool.c
index 0122009bedd0..e14771532dad 100644
--- a/drivers/net/ethernet/intel/igc/igc_ethtool.c
+++ b/drivers/net/ethernet/intel/igc/igc_ethtool.c
@@ -1930,7 +1930,12 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
/* set autoneg settings */
ethtool_link_ksettings_add_link_mode(cmd, supported, Autoneg);
- ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg);
+ if (hw->mac.autoneg_enabled) {
+ ethtool_link_ksettings_add_link_mode(cmd, advertising, Autoneg);
+ cmd->base.autoneg = AUTONEG_ENABLE;
+ } else {
+ cmd->base.autoneg = AUTONEG_DISABLE;
+ }
/* Set pause flow control settings */
ethtool_link_ksettings_add_link_mode(cmd, supported, Pause);
@@ -1983,7 +1988,6 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
cmd->base.duplex = DUPLEX_UNKNOWN;
}
cmd->base.speed = speed;
- cmd->base.autoneg = AUTONEG_ENABLE;
/* MDI-X => 2; MDI =>1; Invalid =>0 */
if (hw->phy.media_type == igc_media_type_copper)
@@ -2000,37 +2004,54 @@ static int igc_ethtool_get_link_ksettings(struct net_device *netdev,
return 0;
}
-static int
-igc_ethtool_set_link_ksettings(struct net_device *netdev,
- const struct ethtool_link_ksettings *cmd)
+/**
+ * igc_handle_autoneg_disabled - Configure forced speed/duplex settings
+ * @netdev: network interface device structure
+ * @speed: requested speed
+ * @duplex: requested duplex
+ *
+ * Validates and records forced speed/duplex when autoneg is disabled.
+ * Only 10/100 Mb/s speeds are supported.
+ *
+ * Return: 0 on success, negative errno on failure.
+ */
+static int igc_handle_autoneg_disabled(struct net_device *netdev, u32 speed,
+ u8 duplex)
{
struct igc_adapter *adapter = netdev_priv(netdev);
- struct net_device *dev = adapter->netdev;
- struct igc_hw *hw = &adapter->hw;
- u16 advertised = 0;
+ struct igc_mac_info *mac = &adapter->hw.mac;
+ enum igc_forced_speed_duplex forced_speed_duplex;
- /* When adapter in resetting mode, autoneg/speed/duplex
- * cannot be changed
- */
- if (igc_check_reset_block(hw)) {
- netdev_err(dev, "Cannot change link characteristics when reset is active\n");
+ switch (speed) {
+ case SPEED_10:
+ forced_speed_duplex = (duplex == DUPLEX_FULL) ? IGC_FORCED_10F : IGC_FORCED_10H;
+ break;
+ case SPEED_100:
+ forced_speed_duplex = (duplex == DUPLEX_FULL) ? IGC_FORCED_100F : IGC_FORCED_100H;
+ break;
+ default:
+ netdev_info(netdev, "Unsupported speed for forced link\n");
return -EINVAL;
}
- /* MDI setting is only allowed when autoneg enabled because
- * some hardware doesn't allow MDI setting when speed or
- * duplex is forced.
- */
- if (cmd->base.eth_tp_mdix_ctrl) {
- if (cmd->base.eth_tp_mdix_ctrl != ETH_TP_MDI_AUTO &&
- cmd->base.autoneg != AUTONEG_ENABLE) {
- netdev_err(dev, "Forcing MDI/MDI-X state is not supported when link speed and/or duplex are forced\n");
- return -EINVAL;
- }
- }
+ mac->autoneg_enabled = false;
+ mac->forced_speed_duplex = forced_speed_duplex;
+ return 0;
+}
- while (test_and_set_bit(__IGC_RESETTING, &adapter->state))
- usleep_range(1000, 2000);
+/**
+ * igc_handle_autoneg_enabled - Configure autonegotiation advertisement
+ * @adapter: private driver structure
+ * @cmd: ethtool link ksettings from user
+ *
+ * Records advertised speeds and flow control settings when autoneg
+ * is enabled.
+ */
+static void igc_handle_autoneg_enabled(struct igc_adapter *adapter,
+ const struct ethtool_link_ksettings *cmd)
+{
+ struct igc_hw *hw = &adapter->hw;
+ u16 advertised = 0;
if (ethtool_link_ksettings_test_link_mode(cmd, advertising,
2500baseT_Full))
@@ -2056,12 +2077,51 @@ igc_ethtool_set_link_ksettings(struct net_device *netdev,
10baseT_Half))
advertised |= ADVERTISE_10_HALF;
- if (cmd->base.autoneg == AUTONEG_ENABLE) {
- hw->phy.autoneg_advertised = advertised;
- if (adapter->fc_autoneg)
- hw->fc.requested_mode = igc_fc_default;
+ hw->mac.autoneg_enabled = true;
+ hw->phy.autoneg_advertised = advertised;
+ if (adapter->fc_autoneg)
+ hw->fc.requested_mode = igc_fc_default;
+}
+
+static int
+igc_ethtool_set_link_ksettings(struct net_device *netdev,
+ const struct ethtool_link_ksettings *cmd)
+{
+ struct igc_adapter *adapter = netdev_priv(netdev);
+ struct net_device *dev = adapter->netdev;
+ struct igc_hw *hw = &adapter->hw;
+
+ /* When adapter in resetting mode, autoneg/speed/duplex
+ * cannot be changed
+ */
+ if (igc_check_reset_block(hw)) {
+ netdev_err(dev, "Cannot change link characteristics when reset is active\n");
+ return -EINVAL;
+ }
+
+ /* MDI setting is only allowed when autoneg enabled because
+ * some hardware doesn't allow MDI setting when speed or
+ * duplex is forced.
+ */
+ if (cmd->base.eth_tp_mdix_ctrl) {
+ if (cmd->base.eth_tp_mdix_ctrl != ETH_TP_MDI_AUTO &&
+ cmd->base.autoneg != AUTONEG_ENABLE) {
+ netdev_err(dev, "Forcing MDI/MDI-X state is not supported when link speed and/or duplex are forced\n");
+ return -EINVAL;
+ }
+ }
+
+ while (test_and_set_bit(__IGC_RESETTING, &adapter->state))
+ usleep_range(1000, 2000);
+
+ if (cmd->base.autoneg == AUTONEG_DISABLE) {
+ if (igc_handle_autoneg_disabled(netdev, cmd->base.speed,
+ cmd->base.duplex)) {
+ clear_bit(__IGC_RESETTING, &adapter->state);
+ return -EINVAL;
+ }
} else {
- netdev_info(dev, "Force mode currently not supported\n");
+ igc_handle_autoneg_enabled(adapter, cmd);
}
/* MDI-X => 2; MDI => 1; Auto => 3 */
diff --git a/drivers/net/ethernet/intel/igc/igc_hw.h b/drivers/net/ethernet/intel/igc/igc_hw.h
index be8a49a86d09..0794139dbc24 100644
--- a/drivers/net/ethernet/intel/igc/igc_hw.h
+++ b/drivers/net/ethernet/intel/igc/igc_hw.h
@@ -73,6 +73,13 @@ struct igc_info {
extern const struct igc_info igc_base_info;
+enum igc_forced_speed_duplex {
+ IGC_FORCED_10H,
+ IGC_FORCED_10F,
+ IGC_FORCED_100H,
+ IGC_FORCED_100F,
+};
+
struct igc_mac_info {
struct igc_mac_operations ops;
@@ -94,6 +101,8 @@ struct igc_mac_info {
bool autoneg_failed;
bool get_link_status;
+ bool autoneg_enabled;
+ enum igc_forced_speed_duplex forced_speed_duplex;
};
struct igc_nvm_operations {
diff --git a/drivers/net/ethernet/intel/igc/igc_mac.c b/drivers/net/ethernet/intel/igc/igc_mac.c
index 7ac6637f8db7..16b0f2db0689 100644
--- a/drivers/net/ethernet/intel/igc/igc_mac.c
+++ b/drivers/net/ethernet/intel/igc/igc_mac.c
@@ -452,7 +452,7 @@ s32 igc_config_fc_after_link_up(struct igc_hw *hw)
* so we had to force link. In this case, we need to force the
* configuration of the MAC to match the "fc" parameter.
*/
- if (mac->autoneg_failed)
+ if (mac->autoneg_failed || !mac->autoneg_enabled)
ret_val = igc_force_mac_fc(hw);
if (ret_val) {
diff --git a/drivers/net/ethernet/intel/igc/igc_main.c b/drivers/net/ethernet/intel/igc/igc_main.c
index 72bc5128d8b8..437e1d1ef1e4 100644
--- a/drivers/net/ethernet/intel/igc/igc_main.c
+++ b/drivers/net/ethernet/intel/igc/igc_main.c
@@ -7298,7 +7298,7 @@ static int igc_probe(struct pci_dev *pdev,
/* Initialize link properties that are user-changeable */
adapter->fc_autoneg = true;
hw->phy.autoneg_advertised = 0xaf;
-
+ hw->mac.autoneg_enabled = true;
hw->fc.requested_mode = igc_fc_default;
hw->fc.current_mode = igc_fc_default;
diff --git a/drivers/net/ethernet/intel/igc/igc_phy.c b/drivers/net/ethernet/intel/igc/igc_phy.c
index 6c4d204aecfa..51870a5c00a6 100644
--- a/drivers/net/ethernet/intel/igc/igc_phy.c
+++ b/drivers/net/ethernet/intel/igc/igc_phy.c
@@ -494,12 +494,20 @@ s32 igc_setup_copper_link(struct igc_hw *hw)
s32 ret_val = 0;
bool link;
- /* Setup autoneg and flow control advertisement and perform
- * autonegotiation.
- */
- ret_val = igc_copper_link_autoneg(hw);
- if (ret_val)
- goto out;
+ if (hw->mac.autoneg_enabled) {
+ /* Setup autoneg and flow control advertisement and perform
+ * autonegotiation.
+ */
+ ret_val = igc_copper_link_autoneg(hw);
+ if (ret_val)
+ goto out;
+ } else {
+ ret_val = hw->phy.ops.force_speed_duplex(hw);
+ if (ret_val) {
+ hw_dbg("Error Forcing Speed/Duplex\n");
+ goto out;
+ }
+ }
/* Check link status. Wait up to 100 microseconds for link to become
* valid.
@@ -778,3 +786,49 @@ u16 igc_read_phy_fw_version(struct igc_hw *hw)
return gphy_version;
}
+
+/**
+ * igc_force_speed_duplex - Force PHY speed and duplex settings
+ * @hw: pointer to the HW structure
+ *
+ * Programs the GPY PHY control register to disable autonegotiation
+ * and force the speed/duplex indicated by hw->mac.forced_speed_duplex.
+ */
+s32 igc_force_speed_duplex(struct igc_hw *hw)
+{
+ enum igc_forced_speed_duplex forced_speed_duplex = hw->mac.forced_speed_duplex;
+ struct igc_phy_info *phy = &hw->phy;
+ u16 phy_ctrl;
+ s32 ret_val;
+
+ ret_val = phy->ops.read_reg(hw, PHY_CONTROL, &phy_ctrl);
+ if (ret_val)
+ return ret_val;
+
+ phy_ctrl &= ~(MII_CR_SPEED_MASK | MII_CR_DUPLEX_EN |
+ MII_CR_AUTO_NEG_EN | MII_CR_RESTART_AUTO_NEG);
+
+ switch (forced_speed_duplex) {
+ case IGC_FORCED_10H:
+ phy_ctrl |= MII_CR_SPEED_10;
+ break;
+ case IGC_FORCED_10F:
+ phy_ctrl |= MII_CR_SPEED_10 | MII_CR_DUPLEX_EN;
+ break;
+ case IGC_FORCED_100H:
+ phy_ctrl |= MII_CR_SPEED_100;
+ break;
+ case IGC_FORCED_100F:
+ phy_ctrl |= MII_CR_SPEED_100 | MII_CR_DUPLEX_EN;
+ break;
+ default:
+ return -IGC_ERR_CONFIG;
+ }
+
+ ret_val = phy->ops.write_reg(hw, PHY_CONTROL, phy_ctrl);
+ if (ret_val)
+ return ret_val;
+
+ hw->mac.get_link_status = true;
+ return 0;
+}
diff --git a/drivers/net/ethernet/intel/igc/igc_phy.h b/drivers/net/ethernet/intel/igc/igc_phy.h
index 832a7e359f18..d37a89174826 100644
--- a/drivers/net/ethernet/intel/igc/igc_phy.h
+++ b/drivers/net/ethernet/intel/igc/igc_phy.h
@@ -18,5 +18,6 @@ void igc_power_down_phy_copper(struct igc_hw *hw);
s32 igc_write_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 data);
s32 igc_read_phy_reg_gpy(struct igc_hw *hw, u32 offset, u16 *data);
u16 igc_read_phy_fw_version(struct igc_hw *hw);
+s32 igc_force_speed_duplex(struct igc_hw *hw);
#endif
--
2.43.0
^ permalink raw reply related
* Re: [PATCH 0/6] IPA v5.2 support for Milos and Fairphone (Gen. 6)
From: Paolo Abeni @ 2026-04-09 7:46 UTC (permalink / raw)
To: Luca Weiss, Alex Elder, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Rob Herring, Krzysztof Kozlowski,
Conor Dooley, Bjorn Andersson, Konrad Dybcio, Alexander Koskovich
Cc: ~postmarketos/upstreaming, phone-devel, netdev, linux-kernel,
linux-arm-msm, devicetree
In-Reply-To: <20260403-milos-ipa-v1-0-01e9e4e03d3e@fairphone.com>
On 4/3/26 6:43 PM, Luca Weiss wrote:
> First, two fixes that unbreak IPA v5.0+, which can be applied
> independently.
>
> Then add support for IPA v5.2 which can be found in the Milos SoC. And
> finally enable it on Fairphone (Gen. 6) so that mobile data (4G/5G/..)
> starts working.
You should have probably split the series in 2, with patches 1 & 2
targeting net and the following ones targeting net-next. It looks like
patch 5 needs some adjustment. I'm applying the first 2.
/P
^ permalink raw reply
* [PATCH 5.10.y] Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
From: Jianqiang kang @ 2026-04-09 7:44 UTC (permalink / raw)
To: gregkh, stable, imv4bel
Cc: patches, linux-kernel, marcel, johan.hedberg, luiz.dentz, davem,
kuba, linux-bluetooth, netdev, luiz.von.dentz
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately
releases the lock without holding a reference to the socket. A concurrent
close() can free the socket between the lock release and the subsequent
sk->sk_state access, resulting in a use-after-free.
Other functions in the same file (sco_sock_timeout(), sco_conn_del())
correctly use sco_sock_hold() to safely hold a reference under the lock.
Fix by using sco_sock_hold() to take a reference before releasing the
lock, and adding sock_put() on all exit paths.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
---
net/bluetooth/sco.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index ce084a184a1c..c441e5225458 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -305,7 +305,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
struct sock *sk;
sco_conn_lock(conn);
- sk = conn->sk;
+ sk = sco_sock_hold(conn);
sco_conn_unlock(conn);
if (!sk)
@@ -314,11 +314,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
BT_DBG("sk %p len %d", sk, skb->len);
if (sk->sk_state != BT_CONNECTED)
- goto drop;
+ goto drop_put;
- if (!sock_queue_rcv_skb(sk, skb))
+ if (!sock_queue_rcv_skb(sk, skb)) {
+ sock_put(sk);
return;
+ }
+drop_put:
+ sock_put(sk);
drop:
kfree_skb(skb);
}
--
2.34.1
^ permalink raw reply related
* [PATCH RESEND net-next 2/2] KEYS: annotate struct user_key_payload with __counted_by
From: Thorsten Blum @ 2026-04-09 7:37 UTC (permalink / raw)
To: David Howells, Jarkko Sakkinen, Kees Cook, Gustavo A. R. Silva
Cc: Thorsten Blum, netdev, keyrings, linux-kernel, linux-hardening
In-Reply-To: <20260409073711.57020-4-thorsten.blum@linux.dev>
Add the __counted_by() compiler attribute to the flexible array member
'data' to improve access bounds-checking via CONFIG_UBSAN_BOUNDS and
CONFIG_FORTIFY_SOURCE.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
Resending this because patch 2/2 didn't go to netdev@ (Jakub)
Cc: netdev@vger.kernel.org
---
include/keys/user-type.h | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index 386c31432789..2305991f4fcd 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -27,7 +27,8 @@
struct user_key_payload {
struct rcu_head rcu; /* RCU destructor */
unsigned short datalen; /* length of this data */
- char data[] __aligned(__alignof__(u64)); /* actual data */
+ char data[] /* actual data */
+ __aligned(__alignof__(u64)) __counted_by(datalen);
};
extern struct key_type key_type_user;
^ permalink raw reply related
* [PATCH RESEND net-next 1/2] keys, dns: drop unused upayload->data NUL terminator
From: Thorsten Blum @ 2026-04-09 7:37 UTC (permalink / raw)
To: David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Tim Bird, Thorsten Blum
Cc: netdev, linux-kernel
In dns_resolver_preparse(), do not NUL-terminate ->data and allocate one
byte less. The NUL terminator is never used and only ->datalen bytes are
accessed.
Signed-off-by: Thorsten Blum <thorsten.blum@linux.dev>
---
Resending this because patch 2/2 didn't go to netdev@ (Jakub)
Cc: netdev@vger.kernel.org
---
net/dns_resolver/dns_key.c | 3 +--
1 file changed, 1 insertion(+), 2 deletions(-)
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index c3c8c3240ef9..451247864a63 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -203,7 +203,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
kdebug("store result");
prep->quotalen = result_len;
- upayload = kmalloc_flex(*upayload, data, result_len + 1);
+ upayload = kmalloc_flex(*upayload, data, result_len);
if (!upayload) {
kleave(" = -ENOMEM");
return -ENOMEM;
@@ -211,7 +211,6 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
upayload->datalen = result_len;
memcpy(upayload->data, data, result_len);
- upayload->data[result_len] = '\0';
prep->payload.data[dns_key_data] = upayload;
kleave(" = 0");
^ permalink raw reply related
* Re: [PATCH net v2] net_sched: fix skb memory leak in deferred qdisc drops
From: Eric Dumazet @ 2026-04-09 7:37 UTC (permalink / raw)
To: Fernando Fernandez Mancera
Cc: netdev, horms, pabeni, kuba, davem, Damilola Bello
In-Reply-To: <20260408100044.4530-1-fmancera@suse.de>
On Wed, Apr 8, 2026 at 3:01 AM Fernando Fernandez Mancera
<fmancera@suse.de> wrote:
>
> When the network stack cleans up the deferred list via qdisc_run_end(),
> it operates on the root qdisc. If the root qdisc do not implement the
> TCQ_F_DEQUEUE_DROPS flag the packets queue to free are never freed and
> gets stranded on the child's local to_free list.
>
> Fix this by making qdisc_dequeue_drop() aware of the root qdisc. It
> fetches the root qdisc and check for the TCQ_F_DEQUEUE_DROPS flag. If
> the flag is present, the packet is appended directly to the root's
> to_free list. Otherwise, drop it directly as it was done before the
> optimization was implemented.
>
> Fixes: a6efc273ab82 ("net_sched: use qdisc_dequeue_drop() in cake, codel, fq_codel")
> Reported-by: Damilola Bello <damilola@aterlo.com>
> Closes: https://lore.kernel.org/netdev/CAPgFtOLaedBMU0f_BxV2bXftTJSmJr018Q5uozOo5vVo6b9tjw@mail.gmail.com/
> Signed-off-by: Fernando Fernandez Mancera <fmancera@suse.de>
> ---
Reviewed-by: Eric Dumazet <edumazet@google.com>
Thanks !
^ permalink raw reply
* Re: [PATCH net-next v9 00/10] net: phy_port: SFP modules representation and phy_port listing
From: Paolo Abeni @ 2026-04-09 7:35 UTC (permalink / raw)
To: Maxime Chevallier, davem, Andrew Lunn, Jakub Kicinski,
Eric Dumazet, Russell King, Heiner Kallweit
Cc: netdev, linux-kernel, thomas.petazzoni, Christophe Leroy,
Herve Codina, Florian Fainelli, Vladimir Oltean,
Köry Maincent, Marek Behún, Oleksij Rempel,
Nicolò Veronese, Simon Horman, mwojtas, Romain Gantois,
Daniel Golle, Dimitri Fedrau
In-Reply-To: <20260403123755.175742-1-maxime.chevallier@bootlin.com>
On 4/3/26 2:37 PM, Maxime Chevallier wrote:
> Hello everyone,
>
> Here's V9 for the phy_port netlink interface (get-only for now).
>
> V9 addresses sashiko's issues (not all of them, as some don't make
> sense), and updates the missings parts in the doc.
>
> This work extends on the recent addition of phy_port representation to enable
> listing the front-facing ports of an interface. For now, we don't control
> these ports, we merely list their presence and their capabilities.
>
> As the most common use-case of multi-port interfaces is combo-ports that
> provide both RJ45 and SFP connectors on a single MAC, there's a lot of
> SFP stuff in this series.
>
> This series is in 2 main parts. The first one aims at representing the
> SFP cages and modules using phy_port, as combo-ports with RJ45 + SFP are
> by far the most common cases for multi-connector setups.
>
> The second part is the netlink interface to list those ports, now that
> most use-cases are covered.
>
> Let's see what we can do with some examples of the new ethtool API :
>
> - Get MII interfaces supported by an empty SFP cage :
>
> # ethtool --show-ports eth3
>
> Port for eth3:
> Port id: 1
> Vacant: yes
> Supported MII interfaces : sgmii, 1000base-x, 2500base-x
> Port type: sfp
>
> - Get Combo-ports supported modes, on each port :
>
> # ethtool --show-ports eth1
>
> Port for eth1:
> Port id: 1
> Vacant: no
> Supported link modes: 10baseT/Half 10baseT/Full
> 100baseT/Half 100baseT/Full
> 1000baseT/Full
> 10000baseT/Full
> 2500baseT/Full
> 5000baseT/Full
>
> Port type: mdi
>
> Port for eth1:
> Port id: 2
> Vacant: yes
> Supported MII interfaces : 10gbase-r
> Port type: sfp
>
> - Get Achievable linkmodes on a SFP module (combo port with a DAC in the
> SFP cage)
>
> # ethtool --show-ports eth1
>
> Port for eth1:
> Port id: 1
> Vacant: no
> Supported link modes: 10baseT/Half 10baseT/Full
> 100baseT/Half 100baseT/Full
> 1000baseT/Full
> 10000baseT/Full
> 2500baseT/Full
> 5000baseT/Full
> Port type: mdi
>
> Port for eth1:
> Port id: 2
> Vacant: no
> Supported MII interfaces : 10gbase-r
> Port type: sfp
>
> Port for eth1:
> Port id: 3
> Vacant: no
> Supported link modes: 10000baseCR/Full
> Port type: mdi
>
> Note that here, we have 3 ports :
> - The Copper port
> - The SFP Cage itself, marked as 'occupied'
> - The SFP module
>
> This series builds on top of phy_port and phy_link_topology to allow
> tracking the ports of an interface. We maintain a list of supported
> linkmodes/interfaces on each port, which allows for fine-grained
> reporting of each port's capability.
>
> What this series doesn't do :
> - We don't support selecting which port is active. This is the next step.
> - We only support PHY-driven combo ports. The end-goal of this whole
> journey that started with phy_link_topology is to get support for MII
> muxes, such as the one we have on the Turris Omnia. This will eventually
> be upstreamed as well.
>
> If you want to play around with it, here's [1] the patched ethtool that I've
> been using to produce the outputs above.
>
> Thanks !
>
> Maxime
>
> [1] : https://github.com/minimaxwell/ethtool/tree/mc/ethtool_port
Some feedback from Andrew, Russell or Heiner would be very appreciated.
@Maxime: I went over sashiko feedback and I *think* it ranges from
orthogonal to wrong, but it would be useful if you could go over it.
Thanks,
Paolo
^ permalink raw reply
* Re: [RFC net-next 2/4] selftests: drv-net: tso: add helpers for double tunneling GSO
From: Xu Du @ 2026-04-09 7:35 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, edumazet, pabeni, horms, shuah, netdev, linux-kselftest,
linux-kernel
In-Reply-To: <20260408172741.39e65ab3@kernel.org>
On Thu, Apr 9, 2026 at 8:27 AM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Wed, 8 Apr 2026 10:04:09 +0800 Xu Du wrote:
> > On Tue, Apr 7, 2026 at 11:08 PM Jakub Kicinski <kuba@kernel.org> wrote:
> > >
> > > On Tue, 7 Apr 2026 10:45:09 +0800 Xu Du wrote:
> > > > As the YNL Python module cannot be invoked across different devices or
> > > > environments directly in its current form, the helper abstracts the
> > > > YNL CLI calls to ensure proper configuration of the tunneling device
> > > > features.
> > >
> > > Can you explain more? Why can't you use class RtnlFamily?
> >
> > I want to test the gro-hint parameter functionality of the GENEVE tunnel,
> > so I intend to use YNL for the testing. I am conducting the test between
> > two machines using SSH type. I want to add the gro-hint parameter on
> > both the local and remote nodes; however, I am unable to invoke class
> > RtnlFamily on the remote node via SSH.
>
> Oh. But that's not really what you're doing:
>
> +def ynlcli(family, args, json=None, ns=None, host=None):
> + if (KSFT_DIR / "kselftest-list.txt").exists():
> + cli = KSFT_DIR / "net/lib/ynl/pyynl/cli.py"
> + spec = KSFT_DIR / f"net/lib/specs/{family}.yaml"
> + else:
> + cli = KSRC / "tools/net/ynl/pyynl/cli.py"
> + spec = KSRC / f"Documentation/netlink/specs/{family}.yaml"
> + if not cli.exists():
> + raise FileNotFoundError(f"cli not found at {cli}")
> + args = f"--spec {spec} --no-schema {args}"
> + return tool(cli.as_posix(), args, json=json, ns=ns, host=host, shell=True)
>
> You're not deploying anything to the remote system.
> Are you assuming that the remote system magically has the same
> filesystem layout?
>
> You can use the ynl CLI but it has to be whatever version is on
> the remote system. Just call ynl --family rt-link, don't dig
> around for the spec paths etc.
>
In fact, I have tested this from two different locations. The first is in
tools/testing/selftests/drivers/net/hw/ using python3 tso.py,
which utilizes the specs located in Documentation/netlink/specs/.
The second follows the testing methodology described in the
README.rst of tools/testing/selftests/drivers/net/, which uses the specs
in net/lib/specs/. Based on this, I include that different processes utilize
different spec locations.
I also referred to the implementation in net/lib/py/ynl.py, which employs
a similar handling logic. Both using the source code repository and
installing the package can meet the requirements for remote testing.
--
Regards,
Xu
^ permalink raw reply
* [PATCH 5.15.y] Bluetooth: SCO: Fix use-after-free in sco_recv_frame() due to missing sock_hold
From: Jianqiang kang @ 2026-04-09 7:26 UTC (permalink / raw)
To: gregkh, stable, imv4bel
Cc: patches, linux-kernel, marcel, johan.hedberg, luiz.dentz, davem,
kuba, linux-bluetooth, netdev, luiz.von.dentz
From: Hyunwoo Kim <imv4bel@gmail.com>
[ Upstream commit 598dbba9919c5e36c54fe1709b557d64120cb94b ]
sco_recv_frame() reads conn->sk under sco_conn_lock() but immediately
releases the lock without holding a reference to the socket. A concurrent
close() can free the socket between the lock release and the subsequent
sk->sk_state access, resulting in a use-after-free.
Other functions in the same file (sco_sock_timeout(), sco_conn_del())
correctly use sco_sock_hold() to safely hold a reference under the lock.
Fix by using sco_sock_hold() to take a reference before releasing the
lock, and adding sock_put() on all exit paths.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Hyunwoo Kim <imv4bel@gmail.com>
Signed-off-by: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
Signed-off-by: Jianqiang kang <jianqkang@sina.cn>
---
net/bluetooth/sco.c | 10 +++++++---
1 file changed, 7 insertions(+), 3 deletions(-)
diff --git a/net/bluetooth/sco.c b/net/bluetooth/sco.c
index d98648bcc1a8..d0ef74c45914 100644
--- a/net/bluetooth/sco.c
+++ b/net/bluetooth/sco.c
@@ -311,7 +311,7 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
struct sock *sk;
sco_conn_lock(conn);
- sk = conn->sk;
+ sk = sco_sock_hold(conn);
sco_conn_unlock(conn);
if (!sk)
@@ -320,11 +320,15 @@ static void sco_recv_frame(struct sco_conn *conn, struct sk_buff *skb)
BT_DBG("sk %p len %u", sk, skb->len);
if (sk->sk_state != BT_CONNECTED)
- goto drop;
+ goto drop_put;
- if (!sock_queue_rcv_skb(sk, skb))
+ if (!sock_queue_rcv_skb(sk, skb)) {
+ sock_put(sk);
return;
+ }
+drop_put:
+ sock_put(sk);
drop:
kfree_skb(skb);
}
--
2.34.1
^ permalink raw reply related
* Re: [PATCH v2 1/2] drm/drm_ras: Add clear-error-counter netlink command to drm_ras
From: Tauro, Riana @ 2026-04-09 7:21 UTC (permalink / raw)
To: intel-xe, dri-devel, netdev, rodrigo.vivi, Zack McKevitt,
joonas.lahtinen, aravind.iddamsetty
Cc: anshuman.gupta, simona.vetter, airlied, pratik.bari,
joshua.santosh.ranjan, ashwin.kumar.kulkarni, shubham.kumar,
ravi.kishore.koppuravuri, raag.jadav, anvesh.bakwad,
maarten.lankhorst, Jakub Kicinski, Lijo Lazar, Hawking Zhang,
David S. Miller, Paolo Abeni, Eric Dumazet
In-Reply-To: <20260409073318.2909379-5-riana.tauro@intel.com>
Hi Zack
Could you please take a look at this patch if applicable to your
usecase. Please let me know if any
changes are required
@Rodrigo This is already reviewed by Jakub and Raag.
If there are no opens, can this be merged via drm_misc
Thanks
Riana
On 4/9/2026 1:03 PM, Riana Tauro wrote:
> Introduce a new 'clear-error-counter' drm_ras command to reset the counter
> value for a specific error counter of a given node.
>
> The command is a 'do' netlink request with 'node-id' and 'error-id'
> as parameters with no response payload.
>
> Usage:
>
> $ sudo ynl --family drm_ras --do clear-error-counter --json \
> '{"node-id":1, "error-id":1}'
> None
>
> Cc: Jakub Kicinski <kuba@kernel.org>
> Cc: Zack McKevitt <zachary.mckevitt@oss.qualcomm.com>
> Cc: Lijo Lazar <lijo.lazar@amd.com>
> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> Cc: David S. Miller <davem@davemloft.net>
> Cc: Paolo Abeni <pabeni@redhat.com>
> Cc: Eric Dumazet <edumazet@google.com>
> Signed-off-by: Riana Tauro <riana.tauro@intel.com>
> Reviewed-by: Jakub Kicinski <kuba@kernel.org>
> Reviewed-by: Raag Jadav <raag.jadav@intel.com>
> ---
> Documentation/gpu/drm-ras.rst | 8 +++++
> Documentation/netlink/specs/drm_ras.yaml | 13 ++++++-
> drivers/gpu/drm/drm_ras.c | 43 +++++++++++++++++++++++-
> drivers/gpu/drm/drm_ras_nl.c | 13 +++++++
> drivers/gpu/drm/drm_ras_nl.h | 2 ++
> include/drm/drm_ras.h | 11 ++++++
> include/uapi/drm/drm_ras.h | 1 +
> 7 files changed, 89 insertions(+), 2 deletions(-)
>
> diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
> index 70b246a78fc8..4636e68f5678 100644
> --- a/Documentation/gpu/drm-ras.rst
> +++ b/Documentation/gpu/drm-ras.rst
> @@ -52,6 +52,8 @@ User space tools can:
> as a parameter.
> * Query specific error counter values with the ``get-error-counter`` command, using both
> ``node-id`` and ``error-id`` as parameters.
> +* Clear specific error counters with the ``clear-error-counter`` command, using both
> + ``node-id`` and ``error-id`` as parameters.
>
> YAML-based Interface
> --------------------
> @@ -101,3 +103,9 @@ Example: Query an error counter for a given node
> sudo ynl --family drm_ras --do get-error-counter --json '{"node-id":0, "error-id":1}'
> {'error-id': 1, 'error-name': 'error_name1', 'error-value': 0}
>
> +Example: Clear an error counter for a given node
> +
> +.. code-block:: bash
> +
> + sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
> + None
> diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
> index 79af25dac3c5..e113056f8c01 100644
> --- a/Documentation/netlink/specs/drm_ras.yaml
> +++ b/Documentation/netlink/specs/drm_ras.yaml
> @@ -99,7 +99,7 @@ operations:
> flags: [admin-perm]
> do:
> request:
> - attributes:
> + attributes: &id-attrs
> - node-id
> - error-id
> reply:
> @@ -113,3 +113,14 @@ operations:
> - node-id
> reply:
> attributes: *errorinfo
> + -
> + name: clear-error-counter
> + doc: >-
> + Clear error counter for a given node.
> + The request includes the error-id and node-id of the
> + counter to be cleared.
> + attribute-set: error-counter-attrs
> + flags: [admin-perm]
> + do:
> + request:
> + attributes: *id-attrs
> diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
> index b2fa5ab86d87..d6eab29a1394 100644
> --- a/drivers/gpu/drm/drm_ras.c
> +++ b/drivers/gpu/drm/drm_ras.c
> @@ -26,7 +26,7 @@
> * efficient lookup by ID. Nodes can be registered or unregistered
> * dynamically at runtime.
> *
> - * A Generic Netlink family `drm_ras` exposes two main operations to
> + * A Generic Netlink family `drm_ras` exposes the below operations to
> * userspace:
> *
> * 1. LIST_NODES: Dump all currently registered RAS nodes.
> @@ -37,6 +37,10 @@
> * Returns all counters of a node if only Node ID is provided or specific
> * error counters.
> *
> + * 3. CLEAR_ERROR_COUNTER: Clear error counter of a given node.
> + * Userspace must provide Node ID, Error ID.
> + * Clears specific error counter of a node if supported.
> + *
> * Node registration:
> *
> * - drm_ras_node_register(): Registers a new node and assigns
> @@ -66,6 +70,8 @@
> * operation, fetching all counters from a specific node.
> * - drm_ras_nl_get_error_counter_doit(): Implements the GET_ERROR_COUNTER doit
> * operation, fetching a counter value from a specific node.
> + * - drm_ras_nl_clear_error_counter_doit(): Implements the CLEAR_ERROR_COUNTER doit
> + * operation, clearing a counter value from a specific node.
> */
>
> static DEFINE_XARRAY_ALLOC(drm_ras_xa);
> @@ -314,6 +320,41 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
> return doit_reply_value(info, node_id, error_id);
> }
>
> +/**
> + * drm_ras_nl_clear_error_counter_doit() - Clear an error counter of a node
> + * @skb: Netlink message buffer
> + * @info: Generic Netlink info containing attributes of the request
> + *
> + * Extracts the node ID and error ID from the netlink attributes and
> + * clears the current value.
> + *
> + * Return: 0 on success, or negative errno on failure.
> + */
> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> + struct genl_info *info)
> +{
> + struct drm_ras_node *node;
> + u32 node_id, error_id;
> +
> + if (!info->attrs ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID))
> + return -EINVAL;
> +
> + node_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
> + error_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
> +
> + node = xa_load(&drm_ras_xa, node_id);
> + if (!node || !node->clear_error_counter)
> + return -ENOENT;
> +
> + if (error_id < node->error_counter_range.first ||
> + error_id > node->error_counter_range.last)
> + return -EINVAL;
> +
> + return node->clear_error_counter(node, error_id);
> +}
> +
> /**
> * drm_ras_node_register() - Register a new RAS node
> * @node: Node structure to register
> diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
> index 16803d0c4a44..dea1c1b2494e 100644
> --- a/drivers/gpu/drm/drm_ras_nl.c
> +++ b/drivers/gpu/drm/drm_ras_nl.c
> @@ -22,6 +22,12 @@ static const struct nla_policy drm_ras_get_error_counter_dump_nl_policy[DRM_RAS_
> [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> };
>
> +/* DRM_RAS_CMD_CLEAR_ERROR_COUNTER - do */
> +static const struct nla_policy drm_ras_clear_error_counter_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID + 1] = {
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
> +};
> +
> /* Ops table for drm_ras */
> static const struct genl_split_ops drm_ras_nl_ops[] = {
> {
> @@ -43,6 +49,13 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
> .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID,
> .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DUMP,
> },
> + {
> + .cmd = DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
> + .doit = drm_ras_nl_clear_error_counter_doit,
> + .policy = drm_ras_clear_error_counter_nl_policy,
> + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
> + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> + },
> };
>
> struct genl_family drm_ras_nl_family __ro_after_init = {
> diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
> index 06ccd9342773..a398643572a5 100644
> --- a/drivers/gpu/drm/drm_ras_nl.h
> +++ b/drivers/gpu/drm/drm_ras_nl.h
> @@ -18,6 +18,8 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
> struct genl_info *info);
> int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
> struct netlink_callback *cb);
> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> + struct genl_info *info);
>
> extern struct genl_family drm_ras_nl_family;
>
> diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
> index 5d50209e51db..f2a787bc4f64 100644
> --- a/include/drm/drm_ras.h
> +++ b/include/drm/drm_ras.h
> @@ -58,6 +58,17 @@ struct drm_ras_node {
> int (*query_error_counter)(struct drm_ras_node *node, u32 error_id,
> const char **name, u32 *val);
>
> + /**
> + * @clear_error_counter:
> + *
> + * This callback is used by drm_ras to clear a specific error counter.
> + * Driver should implement this callback to support clearing error counters
> + * of a node.
> + *
> + * Returns: 0 on success, negative error code on failure.
> + */
> + int (*clear_error_counter)(struct drm_ras_node *node, u32 error_id);
> +
> /** @priv: Driver private data */
> void *priv;
> };
> diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
> index 5f40fa5b869d..218a3ee86805 100644
> --- a/include/uapi/drm/drm_ras.h
> +++ b/include/uapi/drm/drm_ras.h
> @@ -41,6 +41,7 @@ enum {
> enum {
> DRM_RAS_CMD_LIST_NODES = 1,
> DRM_RAS_CMD_GET_ERROR_COUNTER,
> + DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
>
> __DRM_RAS_CMD_MAX,
> DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
^ permalink raw reply
* Re: [PATCH net] net: fix __this_cpu_add() in preemptible code in dev_xmit_recursion_inc/dec
From: Eric Dumazet @ 2026-04-09 7:18 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, David S. Miller, Jakub Kicinski, Paolo Abeni,
Simon Horman, Andrew Lunn, Sebastian Andrzej Siewior,
Clark Williams, Steven Rostedt, Weiming Shi, linux-kernel,
linux-rt-devel
In-Reply-To: <20260409035344.214279-1-jiayuan.chen@linux.dev>
On Wed, Apr 8, 2026 at 8:54 PM Jiayuan Chen <jiayuan.chen@linux.dev> wrote:
>
> dev_xmit_recursion_inc/dec() use __this_cpu_inc/dec() which requires
> migration to be disabled. However, some callers like SCTP's UDP
> encapsulation path invoke iptunnel_xmit() from process context without
> disabling BH or preemption:
>
> sctp_inet_connect -> __sctp_connect -> sctp_do_sm ->
> sctp_outq_flush -> sctp_packet_transmit -> sctp_v4_xmit ->
> udp_tunnel_xmit_skb -> iptunnel_xmit -> dev_xmit_recursion_inc
>
> This triggers the following warning on PREEMPT(full) kernels:
>
>
> Fix this by adding migrate_disable/enable() around the __this_cpu
> operations in dev_xmit_recursion_inc/dec() to ensure the per-cpu
> variable is accessed on the same CPU throughout the inc/dec pair.
>
> Fixes: 6f1a9140ecda ("net: add xmit recursion limit to tunnel xmit functions")
> Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
> ---
> include/linux/netdevice.h | 5 +++++
> 1 file changed, 5 insertions(+)
>
> diff --git a/include/linux/netdevice.h b/include/linux/netdevice.h
> index 7ca01eb3f7d2..6b1cd5380d70 100644
> --- a/include/linux/netdevice.h
> +++ b/include/linux/netdevice.h
> @@ -3591,14 +3591,19 @@ static inline bool dev_xmit_recursion(void)
> XMIT_RECURSION_LIMIT);
> }
>
> +/* Non PREEMPT_RT version: inc and dec must run on the same CPU,
> + * migrate_disable is sufficient.
> + */
> static inline void dev_xmit_recursion_inc(void)
> {
> + migrate_disable();
> __this_cpu_inc(softnet_data.xmit.recursion);
> }
>
> static inline void dev_xmit_recursion_dec(void)
> {
> __this_cpu_dec(softnet_data.xmit.recursion);
> + migrate_enable();
> }
> #else
> static inline int dev_recursion_level(void)
> --
> 2.43.0
This seems wrong.
The migrate_disable() should happen before dev_recursion_level().
^ permalink raw reply
* Re: [PATCH net v3] ppp: require CAP_NET_ADMIN in target netns for unattached ioctls
From: 하태구 @ 2026-04-09 7:18 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Qingfang Deng, Kees Cook, Taegu Ha,
Kuniyuki Iwashima, Sebastian Andrzej Siewior, Cyrill Gorcunov,
linux-ppp, netdev, linux-kernel
Cc: qingfang.deng, gnault, jaco, richardbgobert, ericwouds,
teknoraver
In-Reply-To: <20260409071117.4354-1-hataegu0826@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 2749 bytes --]
Hello,
Yes, I have a QEMU-based PoC and validation log for the current patch.
The reproducer starts as an unprivileged uid, verifies that open("/dev/ppp")
fails before CLONE_NEWUSER, then creates only a new user namespace while
keeping the same network namespace, and finally attempts PPPIOCNEWUNIT.
With the current patch applied, the original userns-only inherited-netns path
is blocked as expected. In the same network namespace, open("/dev/ppp") still
succeeds after CLONE_NEWUSER, but PPPIOCNEWUNIT now fails with EPERM.
Relevant log lines from my current QEMU run:
[*] initial netns ino=4026531833
[*] dropped to uid=65534 gid=65534 before userns
[*] open(/dev/ppp) before userns failed as expected: Operation not permitted
[*] after userns-only unshare netns ino=4026531833
[*] now uid=0 gid=65534 in new userns
[*] open(/dev/ppp) after userns succeeded
ioctl(PPPIOCNEWUNIT): Operation not permitted
I am attaching:
- the minimal guest reproducer used in QEMU
- the guest serial log from the current patched run
Thanks,
Taegu Ha
hataegu0826@gmail.com
2026년 4월 9일 (목) 오후 4:12, Taegu Ha <hataegu0826@gmail.com>님이 작성:
>
> /dev/ppp open is currently authorized against file->f_cred->user_ns,
> while unattached administrative ioctls operate on current->nsproxy->net_ns.
>
> As a result, a local unprivileged user can create a new user namespace
> with CLONE_NEWUSER, gain CAP_NET_ADMIN only in that new user namespace,
> and still issue PPPIOCNEWUNIT, PPPIOCATTACH, or PPPIOCATTCHAN against
> an inherited network namespace.
>
> Require CAP_NET_ADMIN in the user namespace that owns the target network
> namespace before handling unattached PPP administrative ioctls.
>
> This preserves normal pppd operation in the network namespace it is
> actually privileged in, while rejecting the userns-only inherited-netns
> case.
>
> Fixes: 273ec51dd7ce ("net: ppp_generic - introduce net-namespace functionality v2")
> Signed-off-by: Taegu Ha <hataegu0826@gmail.com>
> ---
> drivers/net/ppp/ppp_generic.c | 3 +++
> 1 file changed, 3 insertions(+)
>
> diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
> index e9b41777be80..c2024684b10d 100644
> --- a/drivers/net/ppp/ppp_generic.c
> +++ b/drivers/net/ppp/ppp_generic.c
> @@ -1057,6 +1057,9 @@ static int ppp_unattached_ioctl(struct net *net, struct ppp_file *pf,
> struct ppp_net *pn;
> int __user *p = (int __user *)arg;
>
> + if (!ns_capable(net->user_ns, CAP_NET_ADMIN))
> + return -EPERM;
> +
> switch (cmd) {
> case PPPIOCNEWUNIT:
> /* Create a new ppp unit */
> --
> 2.43.0
>
[-- Attachment #2: ppp_v3_validation.log --]
[-- Type: application/octet-stream, Size: 25420 bytes --]
[ 0.000000] Linux version 7.0.0-rc6-00005-g48278fa03093-dirty (root@dbdd95a60758) (gcc (Ubuntu 13.3.0-6ubuntu2~24.04.1) 13.3.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #3 SMP PREEMPT_DYNAMIC Thu Apr 9 15:57:17 KST 2026
[ 0.000000] Command line: console=ttyS0 rdinit=/init panic=-1
[ 0.000000] BIOS-provided physical RAM map:
[ 0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009fbff] System RAM
[ 0.000000] BIOS-e820: [mem 0x000000000009fc00-0x000000000009ffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x00000000000a0000-0x00000000000effff]
[ 0.000000] BIOS-e820: [mem 0x00000000000f0000-0x00000000000fffff] device reserved
[ 0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000003ffdffff] System RAM
[ 0.000000] BIOS-e820: [mem 0x000000003ffe0000-0x000000003fffffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x0000000040000000-0x00000000fffbffff]
[ 0.000000] BIOS-e820: [mem 0x00000000fffc0000-0x00000000ffffffff] device reserved
[ 0.000000] BIOS-e820: [gap 0x0000000100000000-0x000000fcffffffff]
[ 0.000000] BIOS-e820: [mem 0x000000fd00000000-0x000000ffffffffff] device reserved
[ 0.000000] NX (Execute Disable) protection: active
[ 0.000000] APIC: Static calls initialized
[ 0.000000] SMBIOS 3.0.0 present.
[ 0.000000] DMI: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 0.000000] DMI: Memory slots populated: 1/1
[ 0.000000] tsc: Fast TSC calibration using PIT
[ 0.000000] tsc: Detected 3792.994 MHz processor
[ 0.005455] last_pfn = 0x3ffe0 max_arch_pfn = 0x400000000
[ 0.005805] MTRR map: 4 entries (3 fixed + 1 variable; max 19), built from 8 variable MTRRs
[ 0.005895] x86/PAT: Configuration [0-7]: WB WC UC- UC WB WP UC- WT
[ 0.014429] found SMP MP-table at [mem 0x000f5480-0x000f548f]
[ 0.017601] RAMDISK: [mem 0x3ff15000-0x3ffdffff]
[ 0.017906] ACPI: Early table checksum verification disabled
[ 0.018121] ACPI: RSDP 0x00000000000F5290 000014 (v00 BOCHS )
[ 0.018272] ACPI: RSDT 0x000000003FFE1C52 000034 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.018650] ACPI: FACP 0x000000003FFE1B06 000074 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.019010] ACPI: DSDT 0x000000003FFE0040 001AC6 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.019050] ACPI: FACS 0x000000003FFE0000 000040
[ 0.019078] ACPI: APIC 0x000000003FFE1B7A 000078 (v03 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.019090] ACPI: HPET 0x000000003FFE1BF2 000038 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.019101] ACPI: WAET 0x000000003FFE1C2A 000028 (v01 BOCHS BXPC 00000001 BXPC 00000001)
[ 0.019153] ACPI: Reserving FACP table memory at [mem 0x3ffe1b06-0x3ffe1b79]
[ 0.019165] ACPI: Reserving DSDT table memory at [mem 0x3ffe0040-0x3ffe1b05]
[ 0.019168] ACPI: Reserving FACS table memory at [mem 0x3ffe0000-0x3ffe003f]
[ 0.019171] ACPI: Reserving APIC table memory at [mem 0x3ffe1b7a-0x3ffe1bf1]
[ 0.019175] ACPI: Reserving HPET table memory at [mem 0x3ffe1bf2-0x3ffe1c29]
[ 0.019178] ACPI: Reserving WAET table memory at [mem 0x3ffe1c2a-0x3ffe1c51]
[ 0.020290] No NUMA configuration found
[ 0.020302] Faking a node at [mem 0x0000000000000000-0x000000003ffdffff]
[ 0.020707] NODE_DATA(0) allocated [mem 0x3ff11900-0x3ff14fff]
[ 0.021163] ACPI: PM-Timer IO Port: 0x608
[ 0.021362] ACPI: LAPIC_NMI (acpi_id[0xff] dfl dfl lint[0x1])
[ 0.021575] IOAPIC[0]: apic_id 0, version 32, address 0xfec00000, GSI 0-23
[ 0.021639] ACPI: INT_SRC_OVR (bus 0 bus_irq 0 global_irq 2 dfl dfl)
[ 0.021776] ACPI: INT_SRC_OVR (bus 0 bus_irq 5 global_irq 5 high level)
[ 0.021802] ACPI: INT_SRC_OVR (bus 0 bus_irq 9 global_irq 9 high level)
[ 0.021848] ACPI: INT_SRC_OVR (bus 0 bus_irq 10 global_irq 10 high level)
[ 0.021853] ACPI: INT_SRC_OVR (bus 0 bus_irq 11 global_irq 11 high level)
[ 0.021963] ACPI: Using ACPI (MADT) for SMP configuration information
[ 0.021985] ACPI: HPET id: 0x8086a201 base: 0xfed00000
[ 0.022198] CPU topo: Max. logical packages: 1
[ 0.022228] CPU topo: Max. logical nodes: 1
[ 0.022234] CPU topo: Num. nodes per package: 1
[ 0.022265] CPU topo: Max. logical dies: 1
[ 0.022269] CPU topo: Max. dies per package: 1
[ 0.022301] CPU topo: Max. threads per core: 1
[ 0.022390] CPU topo: Num. cores per package: 1
[ 0.022398] CPU topo: Num. threads per package: 1
[ 0.022403] CPU topo: Allowing 1 present CPUs plus 0 hotplug CPUs
[ 0.022831] PM: hibernation: Registered nosave memory: [mem 0x00000000-0x00000fff]
[ 0.022849] PM: hibernation: Registered nosave memory: [mem 0x0009f000-0x000fffff]
[ 0.022913] [gap 0x40000000-0xfffbffff] available for PCI devices
[ 0.022942] Booting paravirtualized kernel on bare hardware
[ 0.023091] clocksource: refined-jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1910969940391419 ns
[ 0.032850] Zone ranges:
[ 0.032863] DMA [mem 0x0000000000001000-0x0000000000ffffff]
[ 0.032901] DMA32 [mem 0x0000000001000000-0x000000003ffdffff]
[ 0.032906] Normal empty
[ 0.032918] Movable zone start for each node
[ 0.032932] Early memory node ranges
[ 0.032949] node 0: [mem 0x0000000000001000-0x000000000009efff]
[ 0.033016] node 0: [mem 0x0000000000100000-0x000000003ffdffff]
[ 0.033083] Initmem setup node 0 [mem 0x0000000000001000-0x000000003ffdffff]
[ 0.033573] On node 0, zone DMA: 1 pages in unavailable ranges
[ 0.033719] On node 0, zone DMA: 97 pages in unavailable ranges
[ 0.066668] On node 0, zone DMA32: 32 pages in unavailable ranges
[ 0.066853] setup_percpu: NR_CPUS:64 nr_cpumask_bits:1 nr_cpu_ids:1 nr_node_ids:1
[ 0.069179] percpu: Embedded 52 pages/cpu s175576 r8192 d29224 u2097152
[ 0.070901] Kernel command line: console=ttyS0 rdinit=/init panic=-1
[ 0.071568] printk: log buffer data + meta data: 262144 + 917504 = 1179648 bytes
[ 0.071813] Dentry cache hash table entries: 131072 (order: 8, 1048576 bytes, linear)
[ 0.071911] Inode-cache hash table entries: 65536 (order: 7, 524288 bytes, linear)
[ 0.074500] Fallback order for Node 0: 0
[ 0.074662] Built 1 zonelists, mobility grouping on. Total pages: 262014
[ 0.074672] Policy zone: DMA32
[ 0.074799] mem auto-init: stack:all(zero), heap alloc:off, heap free:off
[ 0.082635] SLUB: HWalign=64, Order=0-3, MinObjects=0, CPUs=1, Nodes=1
[ 0.090001] Dynamic Preempt: lazy
[ 0.094095] rcu: Preemptible hierarchical RCU implementation.
[ 0.094103] rcu: RCU event tracing is enabled.
[ 0.094117] rcu: RCU restricting CPUs from NR_CPUS=64 to nr_cpu_ids=1.
[ 0.094201] Trampoline variant of Tasks RCU enabled.
[ 0.094206] Tracing variant of Tasks RCU enabled.
[ 0.094258] rcu: RCU calculated value of scheduler-enlistment delay is 100 jiffies.
[ 0.094273] rcu: Adjusting geometry for rcu_fanout_leaf=16, nr_cpu_ids=1
[ 0.095174] RCU Tasks: Setting shift to 0 and lim to 1 rcu_task_cb_adjust=1 rcu_task_cpu_ids=1.
[ 0.110272] NR_IRQS: 4352, nr_irqs: 256, preallocated irqs: 16
[ 0.115637] rcu: srcu_init: Setting srcu_struct sizes based on contention.
[ 0.120260] Console: colour VGA+ 80x25
[ 0.121453] printk: legacy console [ttyS0] enabled
[ 0.135220] ACPI: Core revision 20251212
[ 0.138632] clocksource: hpet: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 19112604467 ns
[ 0.139929] APIC: Switch to symmetric I/O mode setup
[ 0.144392] ..TIMER: vector=0x30 apic1=0 pin1=2 apic2=-1 pin2=-1
[ 0.149615] clocksource: tsc-early: mask: 0xffffffffffffffff max_cycles: 0x6d58fc573b0, max_idle_ns: 881590936876 ns
[ 0.150050] Calibrating delay loop (skipped), value calculated using timer frequency.. 7585.98 BogoMIPS (lpj=3792994)
[ 0.152522] Last level iTLB entries: 4KB 512, 2MB 255, 4MB 127
[ 0.152657] Last level dTLB entries: 4KB 512, 2MB 255, 4MB 127, 1GB 0
[ 0.152961] mitigations: Enabled attack vectors: user_kernel, user_user, SMT mitigations: auto
[ 0.153340] Spectre V2 : Mitigation: Retpolines
[ 0.153513] Spectre V1 : Mitigation: usercopy/swapgs barriers and __user pointer sanitization
[ 0.153725] Spectre V2 : Spectre v2 / SpectreRSB: Filling RSB on context switch and VMEXIT
[ 0.154352] x86/fpu: x87 FPU will use FXSAVE
[ 0.418474] Freeing SMP alternatives memory: 56K
[ 0.419136] pid_max: default: 32768 minimum: 301
[ 0.424060] SELinux: Initializing.
[ 0.429842] Mount-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.429944] Mountpoint-cache hash table entries: 2048 (order: 2, 16384 bytes, linear)
[ 0.435955] VFS: Finished mounting rootfs on nullfs
[ 0.551901] smpboot: CPU0: AMD QEMU Virtual CPU version 2.5+ (family: 0xf, model: 0x6b, stepping: 0x1)
[ 0.557585] Performance Events: PMU not available due to virtualization, using software events only.
[ 0.558212] signal: max sigframe size: 1440
[ 0.559136] rcu: Hierarchical SRCU implementation.
[ 0.559257] rcu: Max phase no-delay instances is 400.
[ 0.561958] smp: Bringing up secondary CPUs ...
[ 0.564130] smp: Brought up 1 node, 1 CPU
[ 0.564279] smpboot: Total of 1 processors activated (7585.98 BogoMIPS)
[ 0.569817] Memory: 983832K/1048056K available (19112K kernel code, 3002K rwdata, 7644K rodata, 2932K init, 596K bss, 60904K reserved, 0K cma-reserved)
[ 0.574670] devtmpfs: initialized
[ 0.580583] clocksource: jiffies: mask: 0xffffffff max_cycles: 0xffffffff, max_idle_ns: 1911260446275000 ns
[ 0.581206] posixtimers hash table entries: 512 (order: 1, 8192 bytes, linear)
[ 0.581516] futex hash table entries: 256 (16384 bytes on 1 NUMA nodes, total 16 KiB, linear).
[ 0.583781] PM: RTC time: 06:57:28, date: 2026-04-09
[ 0.587571] NET: Registered PF_NETLINK/PF_ROUTE protocol family
[ 0.589521] audit: initializing netlink subsys (disabled)
[ 0.591100] audit: type=2000 audit(1775717847.449:1): state=initialized audit_enabled=0 res=1
[ 0.593761] thermal_sys: Registered thermal governor 'step_wise'
[ 0.594067] cpuidle: using governor menu
[ 0.596122] PCI: Using configuration type 1 for base access
[ 0.597816] kprobes: kprobe jump-optimization is enabled. All kprobes are optimized if possible.
[ 0.602020] HugeTLB: registered 2.00 MiB page size, pre-allocated 0 pages
[ 0.602183] HugeTLB: 28 KiB vmemmap can be freed for a 2.00 MiB page
[ 0.607208] ACPI: Added _OSI(Module Device)
[ 0.607316] ACPI: Added _OSI(Processor Device)
[ 0.607404] ACPI: Added _OSI(Processor Aggregator Device)
[ 0.631255] ACPI: 1 ACPI AML tables successfully acquired and loaded
[ 0.648440] ACPI: \_SB_: platform _OSC: OS support mask [002a7eee]
[ 0.653647] ACPI: Interpreter enabled
[ 0.656377] ACPI: PM: (supports S0 S3 S4 S5)
[ 0.656496] ACPI: Using IOAPIC for interrupt routing
[ 0.656812] PCI: Using host bridge windows from ACPI; if necessary, use "pci=nocrs" and report a bug
[ 0.656926] PCI: Using E820 reservations for host bridge windows
[ 0.657966] ACPI: Enabled 2 GPEs in block 00 to 0F
[ 0.701836] ACPI: PCI Root Bridge [PCI0] (domain 0000 [bus 00-ff])
[ 0.704285] acpi PNP0A03:00: _OSC: OS supports [ASPM ClockPM Segments MSI HPX-Type3]
[ 0.704523] acpi PNP0A03:00: _OSC: not requesting OS control; OS requires [ExtendedConfig ASPM ClockPM MSI]
[ 0.704894] acpi PNP0A03:00: _OSC: platform retains control of PCIe features (AE_ERROR)
[ 0.705299] acpi PNP0A03:00: fail to add MMCONFIG information, can't access extended configuration space under this bridge
[ 0.709334] PCI host bridge to bus 0000:00
[ 0.709556] pci_bus 0000:00: root bus resource [io 0x0000-0x0cf7 window]
[ 0.709759] pci_bus 0000:00: root bus resource [io 0x0d00-0xffff window]
[ 0.711907] pci_bus 0000:00: root bus resource [mem 0x000a0000-0x000bffff window]
[ 0.712086] pci_bus 0000:00: root bus resource [mem 0x40000000-0xfebfffff window]
[ 0.712231] pci_bus 0000:00: root bus resource [mem 0x100000000-0x17fffffff window]
[ 0.712460] pci_bus 0000:00: root bus resource [bus 00-ff]
[ 0.713332] pci 0000:00:00.0: [8086:1237] type 00 class 0x060000 conventional PCI endpoint
[ 0.719885] pci 0000:00:01.0: [8086:7000] type 00 class 0x060100 conventional PCI endpoint
[ 0.722529] pci 0000:00:01.1: [8086:7010] type 00 class 0x010180 conventional PCI endpoint
[ 0.723038] pci 0000:00:01.1: BAR 4 [io 0xc040-0xc04f]
[ 0.723193] pci 0000:00:01.1: BAR 0 [io 0x01f0-0x01f7]: legacy IDE quirk
[ 0.723336] pci 0000:00:01.1: BAR 1 [io 0x03f6]: legacy IDE quirk
[ 0.723474] pci 0000:00:01.1: BAR 2 [io 0x0170-0x0177]: legacy IDE quirk
[ 0.723612] pci 0000:00:01.1: BAR 3 [io 0x0376]: legacy IDE quirk
[ 0.726287] pci 0000:00:01.3: [8086:7113] type 00 class 0x068000 conventional PCI endpoint
[ 0.726646] pci 0000:00:01.3: quirk: [io 0x0600-0x063f] claimed by PIIX4 ACPI
[ 0.726806] pci 0000:00:01.3: quirk: [io 0x0700-0x070f] claimed by PIIX4 SMB
[ 0.727216] pci 0000:00:02.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint
[ 0.729917] pci 0000:00:02.0: BAR 0 [mem 0xfd000000-0xfdffffff pref]
[ 0.730096] pci 0000:00:02.0: BAR 2 [mem 0xfebb0000-0xfebb0fff]
[ 0.730215] pci 0000:00:02.0: ROM [mem 0xfeba0000-0xfebaffff pref]
[ 0.730487] pci 0000:00:02.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff]
[ 0.731018] pci 0000:00:03.0: [8086:100e] type 00 class 0x020000 conventional PCI endpoint
[ 0.731742] pci 0000:00:03.0: BAR 0 [mem 0xfeb80000-0xfeb9ffff]
[ 0.731878] pci 0000:00:03.0: BAR 1 [io 0xc000-0xc03f]
[ 0.733916] pci 0000:00:03.0: ROM [mem 0xfeb00000-0xfeb7ffff pref]
[ 0.746347] ACPI: PCI: Interrupt link LNKA configured for IRQ 10
[ 0.746999] ACPI: PCI: Interrupt link LNKB configured for IRQ 10
[ 0.747436] ACPI: PCI: Interrupt link LNKC configured for IRQ 11
[ 0.747848] ACPI: PCI: Interrupt link LNKD configured for IRQ 11
[ 0.750066] ACPI: PCI: Interrupt link LNKS configured for IRQ 9
[ 0.754143] iommu: Default domain type: Translated
[ 0.754267] iommu: DMA domain TLB invalidation policy: lazy mode
[ 0.755281] SCSI subsystem initialized
[ 0.756351] ACPI: bus type USB registered
[ 0.756697] usbcore: registered new interface driver usbfs
[ 0.756991] usbcore: registered new interface driver hub
[ 0.757173] usbcore: registered new device driver usb
[ 0.757462] pps_core: LinuxPPS API ver. 1 registered
[ 0.757566] pps_core: Software ver. 5.3.6 - Copyright 2005-2007 Rodolfo Giometti <giometti@linux.it>
[ 0.757760] PTP clock support registered
[ 0.763048] Advanced Linux Sound Architecture Driver Initialized.
[ 0.771499] NetLabel: Initializing
[ 0.771586] NetLabel: domain hash size = 128
[ 0.771675] NetLabel: protocols = UNLABELED CIPSOv4 CALIPSO
[ 0.772188] NetLabel: unlabeled traffic allowed by default
[ 0.780519] PCI: Using ACPI for IRQ routing
[ 0.780901] e820: register RAM buffer resource [mem 0x0009fc00-0x0009ffff]
[ 0.783021] e820: register RAM buffer resource [mem 0x3ffe0000-0x3fffffff]
[ 0.784206] pci 0000:00:02.0: vgaarb: setting as boot VGA device
[ 0.784369] pci 0000:00:02.0: vgaarb: bridge control possible
[ 0.784505] pci 0000:00:02.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none
[ 0.784684] vgaarb: loaded
[ 0.785448] hpet: 3 channels of 0 reserved for per-cpu timers
[ 0.785701] hpet0: at MMIO 0xfed00000, IRQs 2, 8, 0
[ 0.785861] hpet0: 3 comparators, 64-bit 100.000000 MHz counter
[ 0.795421] clocksource: Switched to clocksource tsc-early
[ 0.797247] VFS: Disk quotas dquot_6.6.0
[ 0.797438] VFS: Dquot-cache hash table entries: 512 (order 0, 4096 bytes)
[ 0.813762] pnp: PnP ACPI init
[ 0.818683] pnp: PnP ACPI: found 6 devices
[ 0.859200] clocksource: acpi_pm: mask: 0xffffff max_cycles: 0xffffff, max_idle_ns: 2085701024 ns
[ 0.861802] NET: Registered PF_INET protocol family
[ 0.862657] IP idents hash table entries: 16384 (order: 5, 131072 bytes, linear)
[ 0.868129] tcp_listen_portaddr_hash hash table entries: 512 (order: 1, 8192 bytes, linear)
[ 0.868392] Table-perturb hash table entries: 65536 (order: 6, 262144 bytes, linear)
[ 0.870598] TCP established hash table entries: 8192 (order: 4, 65536 bytes, linear)
[ 0.870891] TCP bind hash table entries: 8192 (order: 6, 262144 bytes, linear)
[ 0.871172] TCP: Hash tables configured (established 8192 bind 8192)
[ 0.871712] UDP hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.871985] UDP-Lite hash table entries: 512 (order: 3, 32768 bytes, linear)
[ 0.874871] NET: Registered PF_UNIX/PF_LOCAL protocol family
[ 0.878312] RPC: Registered named UNIX socket transport module.
[ 0.878526] RPC: Registered udp transport module.
[ 0.878625] RPC: Registered tcp transport module.
[ 0.878721] RPC: Registered tcp-with-tls transport module.
[ 0.878828] RPC: Registered tcp NFSv4.1 backchannel transport module.
[ 0.883103] pci_bus 0000:00: resource 4 [io 0x0000-0x0cf7 window]
[ 0.883249] pci_bus 0000:00: resource 5 [io 0x0d00-0xffff window]
[ 0.883376] pci_bus 0000:00: resource 6 [mem 0x000a0000-0x000bffff window]
[ 0.885477] pci_bus 0000:00: resource 7 [mem 0x40000000-0xfebfffff window]
[ 0.885619] pci_bus 0000:00: resource 8 [mem 0x100000000-0x17fffffff window]
[ 0.886084] pci 0000:00:01.0: PIIX3: Enabling Passive Release
[ 0.886245] pci 0000:00:00.0: Limiting direct PCI/PCI transfers
[ 0.886471] PCI: CLS 0 bytes, default 64
[ 0.898609] Initialise system trusted keyrings
[ 0.901468] Unpacking initramfs...
[ 0.903582] workingset: timestamp_bits=56 max_order=18 bucket_order=0
[ 0.911623] NFS: Registering the id_resolver key type
[ 0.911945] Key type id_resolver registered
[ 0.912044] Key type id_legacy registered
[ 0.912168] nfs4filelayout_init: NFSv4 File Layout Driver Registering...
[ 0.912460] nfs4flexfilelayout_init: NFSv4 Flexfile Layout Driver Registering...
[ 0.913695] Freeing initrd memory: 812K
[ 0.916665] 9p: Installing v9fs 9p2000 file system support
[ 1.016482] Key type asymmetric registered
[ 1.016619] Asymmetric key parser 'x509' registered
[ 1.016890] Block layer SCSI generic (bsg) driver version 0.4 loaded (major 251)
[ 1.017255] io scheduler mq-deadline registered
[ 1.017382] io scheduler kyber registered
[ 1.021001] input: Power Button as /devices/platform/LNXPWRBN:00/input/input0
[ 1.023749] ACPI: button: Power Button [PWRF]
[ 1.029049] Serial: 8250/16550 driver, 4 ports, IRQ sharing enabled
[ 1.035147] 00:04: ttyS0 at I/O 0x3f8 (irq = 4, base_baud = 115200) is a 16550A
[ 1.043450] Non-volatile memory driver v1.3
[ 1.043582] Linux agpgart interface v0.103
[ 1.044804] ACPI: bus type drm_connector registered
[ 1.065113] loop: module loaded
[ 1.073987] scsi host0: ata_piix
[ 1.077567] scsi host1: ata_piix
[ 1.077866] ata1: PATA max MWDMA2 cmd 0x1f0 ctl 0x3f6 bmdma 0xc040 irq 14 lpm-pol 0
[ 1.078033] ata2: PATA max MWDMA2 cmd 0x170 ctl 0x376 bmdma 0xc048 irq 15 lpm-pol 0
[ 1.081829] e100: Intel(R) PRO/100 Network Driver
[ 1.081944] e100: Copyright(c) 1999-2006 Intel Corporation
[ 1.082095] e1000: Intel(R) PRO/1000 Network Driver
[ 1.082194] e1000: Copyright (c) 1999-2006 Intel Corporation.
[ 1.229255] ata2: found unknown device (class 0)
[ 1.237034] ata2.00: ATAPI: QEMU DVD-ROM, 2.5+, max UDMA/100
[ 1.251715] scsi 1:0:0:0: CD-ROM QEMU QEMU DVD-ROM 2.5+ PQ: 0 ANSI: 5
[ 1.275007] sr 1:0:0:0: [sr0] scsi3-mmc drive: 4x/4x cd/rw xa/form2 tray
[ 1.275278] cdrom: Uniform CD-ROM driver Revision: 3.20
[ 1.289625] ACPI: \_SB_.LNKC: Enabled at IRQ 11
[ 1.296055] sr 1:0:0:0: Attached scsi generic sg0 type 5
[ 1.733062] e1000 0000:00:03.0 eth0: (PCI:33MHz:32-bit) 52:54:00:12:34:56
[ 1.733476] e1000 0000:00:03.0 eth0: Intel(R) PRO/1000 Network Connection
[ 1.733773] e1000e: Intel(R) PRO/1000 Network Driver
[ 1.733879] e1000e: Copyright(c) 1999 - 2015 Intel Corporation.
[ 1.734339] sky2: driver version 1.30
[ 1.734584] PPP generic driver version 2.4.2
[ 1.736095] usbcore: registered new interface driver usblp
[ 1.736299] usbcore: registered new interface driver usb-storage
[ 1.736819] i8042: PNP: PS/2 Controller [PNP0303:KBD,PNP0f13:MOU] at 0x60,0x64 irq 1,12
[ 1.738820] serio: i8042 KBD port at 0x60,0x64 irq 1
[ 1.739060] serio: i8042 AUX port at 0x60,0x64 irq 12
[ 1.740386] rtc_cmos 00:05: RTC can wake from S4
[ 1.742152] input: AT Translated Set 2 keyboard as /devices/platform/i8042/serio0/input/input1
[ 1.746735] rtc_cmos 00:05: registered as rtc0
[ 1.747334] rtc_cmos 00:05: alarms up to one day, y3k, 242 bytes nvram, hpet irqs
[ 1.749107] device-mapper: ioctl: 4.50.0-ioctl (2025-04-28) initialised: dm-devel@lists.linux.dev
[ 1.749448] amd_pstate: the _CPC object is not present in SBIOS or ACPI disabled
[ 1.749736] hid: raw HID events driver (C) Jiri Kosina
[ 1.750724] usbcore: registered new interface driver usbhid
[ 1.750850] usbhid: USB HID core driver
[ 1.754469] Initializing XFRM netlink socket
[ 1.754749] NET: Registered PF_INET6 protocol family
[ 1.760913] Segment Routing with IPv6
[ 1.761299] In-situ OAM (IOAM) with IPv6
[ 1.761840] sit: IPv6, IPv4 and MPLS over IPv4 tunneling driver
[ 1.763431] NET: Registered PF_PACKET protocol family
[ 1.764332] 9pnet: Installing 9P2000 support
[ 1.764572] Key type dns_resolver registered
[ 1.765750] IPI shorthand broadcast: enabled
[ 1.779393] sched_clock: Marking stable (1754019400, 24952567)->(1797996967, -19025000)
[ 1.781040] registered taskstats version 1
[ 1.781174] Loading compiled-in X.509 certificates
[ 1.788180] Demotion targets for Node 0: null
[ 1.790030] PM: Magic number: 6:739:973
[ 1.790379] netconsole: network logging started
[ 1.791041] cfg80211: Loading compiled-in X.509 certificates for regulatory database
[ 1.798826] kworker/u4:1 (53) used greatest stack depth: 15064 bytes left
[ 1.804701] Loaded X.509 cert 'sforshee: 00b28ddf47aef9cea7'
[ 1.805208] Loaded X.509 cert 'wens: 61c038651aabdcf94bd0ac7ff06c7248db18c600'
[ 1.805841] ALSA device list:
[ 1.805941] No soundcards found.
[ 1.806864] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -2
[ 1.807208] cfg80211: failed to load regulatory.db
[ 1.857494] Freeing unused kernel image (initmem) memory: 2932K
[ 1.857858] Write protecting the kernel read-only data: 28672k
[ 1.859321] Freeing unused kernel image (text/rodata gap) memory: 1364K
[ 1.859739] Freeing unused kernel image (rodata/data gap) memory: 548K
[ 1.903063] tsc: Refined TSC clocksource calibration: 3792.948 MHz
[ 1.903386] clocksource: tsc: mask: 0xffffffffffffffff max_cycles: 0x6d58a4c4524, max_idle_ns: 881590912659 ns
[ 1.903659] clocksource: Switched to clocksource tsc
[ 1.958248] x86/mm: Checked W+X mappings: passed, no W+X pages found.
[ 1.958577] Run /init as init process
[*] initial netns ino=4026531833
[*] dropped to uid=65534 gid=65534 before userns
[*] open(/dev/ppp) before userns failed as expected: Operation not permitted
[*] after userns-only unshare netns ino=4026531833
[*] now uid=0 gid=65534 in new userns
[*] open(/dev/ppp) after userns succeeded
ioctl(PPPIOCNEWUNIT): Operation not permitted
[ 2.002904] Kernel panic - not syncing: Attempted to kill init! exitcode=0x00000100
[ 2.003364] CPU: 0 UID: 65534 PID: 1 Comm: init Not tainted 7.0.0-rc6-00005-g48278fa03093-dirty #3 PREEMPT(lazy)
[ 2.003572] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
[ 2.003846] Call Trace:
[ 2.004229] <TASK>
[ 2.004380] vpanic+0x32a/0x4b0
[ 2.004617] panic+0x5e/0x60
[ 2.004685] do_exit+0x99f/0xb40
[ 2.004751] do_group_exit+0x2b/0x80
[ 2.004820] __x64_sys_exit_group+0x13/0x20
[ 2.004907] x64_sys_call+0x12e2/0x1880
[ 2.004982] do_syscall_64+0xf1/0x530
[ 2.005056] entry_SYSCALL_64_after_hwframe+0x77/0x7f
[ 2.005230] RIP: 0033:0x41ac2d
[ 2.005418] Code: ff ff ff 64 c7 00 26 00 00 00 eb ea 90 f3 0f 1e fa 48 c7 c6 c0 ff ff ff ba e7 00 00 00 eb 07 66 0f 1f 44 00 00 f4 89 d0 0f 05 <48> 3d 00 f0 ff ff 76 f3 f7 d8 64 89 06 eb ec 0f 1f 40 00 f3 0f 1e
[ 2.005774] RSP: 002b:00007ffd9b362588 EFLAGS: 00000213 ORIG_RAX: 00000000000000e7
[ 2.005926] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 000000000041ac2d
[ 2.006054] RDX: 00000000000000e7 RSI: ffffffffffffffc0 RDI: 0000000000000001
[ 2.006179] RBP: 000000000000fffe R08: 0000000000000000 R09: 0000000000000007
[ 2.006306] R10: 000000003c6658f0 R11: 0000000000000213 R12: 0000000000487146
[ 2.006439] R13: 00007ffd9b3626e8 R14: 00000000004ae868 R15: 0000000000000001
[ 2.006596] </TASK>
[ 2.006901] Kernel Offset: 0x38600000 from 0xffffffff81000000 (relocation range: 0xffffffff80000000-0xffffffffbfffffff)
[-- Attachment #3: ppp_poc_init_v3.c --]
[-- Type: application/octet-stream, Size: 3036 bytes --]
#define _GNU_SOURCE
#include <errno.h>
#include <fcntl.h>
#include <sched.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <sys/ioctl.h>
#include <sys/mount.h>
#include <sys/prctl.h>
#include <sys/reboot.h>
#include <sys/stat.h>
#include <sys/sysmacros.h>
#include <sys/types.h>
#include <unistd.h>
#include <linux/if_ppp.h>
#include <linux/reboot.h>
static void die(const char *msg)
{
perror(msg);
fflush(stdout);
reboot(LINUX_REBOOT_CMD_POWER_OFF);
_exit(1);
}
static void write_file(const char *path, const char *buf)
{
int fd = open(path, O_WRONLY);
size_t len = strlen(buf);
if (fd < 0)
die(path);
if (write(fd, buf, len) != (ssize_t)len)
die(path);
close(fd);
}
static unsigned long long netns_ino(void)
{
struct stat st;
if (stat("/proc/self/ns/net", &st) < 0)
die("stat(/proc/self/ns/net)");
return (unsigned long long)st.st_ino;
}
int main(void)
{
unsigned long long before, after;
int fd, unit = -1;
if (mkdir("/proc", 0555) < 0 && errno != EEXIST)
die("mkdir(/proc)");
if (mkdir("/sys", 0555) < 0 && errno != EEXIST)
die("mkdir(/sys)");
if (mkdir("/dev", 0755) < 0 && errno != EEXIST)
die("mkdir(/dev)");
if (mount("proc", "/proc", "proc", 0, NULL) < 0)
die("mount(proc)");
if (mount("sysfs", "/sys", "sysfs", 0, NULL) < 0)
die("mount(sysfs)");
if (mount("devtmpfs", "/dev", "devtmpfs", 0, "mode=0755") < 0)
die("mount(devtmpfs)");
if (access("/dev/ppp", F_OK) < 0 &&
mknod("/dev/ppp", S_IFCHR | 0666, makedev(108, 0)) < 0 &&
errno != EEXIST)
die("mknod(/dev/ppp)");
if (chmod("/dev/ppp", 0666) < 0)
die("chmod(/dev/ppp)");
before = netns_ino();
printf("[*] initial netns ino=%llu\n", before);
if (setresgid(65534, 65534, 65534) < 0)
die("setresgid(65534)");
if (setresuid(65534, 65534, 65534) < 0)
die("setresuid(65534)");
if (prctl(PR_SET_DUMPABLE, 1) < 0)
die("prctl(PR_SET_DUMPABLE)");
printf("[*] dropped to uid=%d gid=%d before userns\n", getuid(), getgid());
fd = open("/dev/ppp", O_RDWR);
if (fd >= 0) {
printf("[!] open(/dev/ppp) unexpectedly succeeded before userns\n");
fflush(stdout);
reboot(LINUX_REBOOT_CMD_POWER_OFF);
return 1;
}
printf("[*] open(/dev/ppp) before userns failed as expected: %s\n",
strerror(errno));
if (unshare(CLONE_NEWUSER) < 0)
die("unshare(CLONE_NEWUSER)");
write_file("/proc/self/uid_map", "0 65534 1\n");
if (setresuid(0, 0, 0) < 0)
die("setresuid(0)");
after = netns_ino();
printf("[*] after userns-only unshare netns ino=%llu\n", after);
printf("[*] now uid=%d gid=%d in new userns\n", getuid(), getgid());
fd = open("/dev/ppp", O_RDWR);
if (fd < 0)
die("open(/dev/ppp) after userns");
printf("[*] open(/dev/ppp) after userns succeeded\n");
if (ioctl(fd, PPPIOCNEWUNIT, &unit) < 0)
die("ioctl(PPPIOCNEWUNIT)");
printf("[+] PPPIOCNEWUNIT succeeded, unit=%d\n", unit);
printf("[+] Unprivileged caller gained PPP admin over the inherited netns via userns-only unshare\n");
fflush(stdout);
reboot(LINUX_REBOOT_CMD_POWER_OFF);
return 0;
}
^ permalink raw reply
* Re: [PATCH] nfc: hci: fix OOB heap read on short HCP frames.
From: Eric Dumazet @ 2026-04-09 7:14 UTC (permalink / raw)
To: ashutosh desai; +Cc: netdev, davem, kuba, pabeni, horms, linux-kernel
In-Reply-To: <CAKapqNnOF6BO2zE0MwNeM2_Hchp_d-qDQffywCg7Bk-pMcFKpw@mail.gmail.com>
On Wed, Apr 8, 2026 at 3:15 PM ashutosh desai
<ashutoshdesai993@gmail.com> wrote:
>
> Both nfc_hci_recv_from_llc() and nfc_hci_msg_rx_work() read byte 1 of
> an sk_buff (the HCP message header field) without first verifying the
> buffer contains at least NFC_HCI_HCP_HEADER_LEN (2) bytes.
>
> The SHDLC LLC layer only filters zero-length frames; a single-byte
> I-frame from a malicious NFC peer therefore reaches the HCI reassembly
> path where packet->message.header is read one byte past the valid data.
> The same issue is present in the NCI HCI implementation (nci/hci.c)
> via nci_hci_data_received_cb() and nci_hci_msg_rx_work().
>
> Add an explicit length check before accessing the message header at
> all four locations, freeing the skb on malformed input.
>
> Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
> ---
Same answer: Testing skb->len alone is not enough.
skbs can have fragments, pskb_may_pull() or skb_linearize() would be needed.
^ permalink raw reply
* Re: [PATCH] nfc: hci: fix OOB heap read on short HCP frames.
From: Eric Dumazet @ 2026-04-09 7:14 UTC (permalink / raw)
To: Ashutosh Desai; +Cc: netdev, davem, kuba, pabeni, horms, linux-kernel
In-Reply-To: <20260408223113.2009304-1-ashutoshdesai993@gmail.com>
On Wed, Apr 8, 2026 at 3:31 PM Ashutosh Desai
<ashutoshdesai993@gmail.com> wrote:
>
> Both nfc_hci_recv_from_llc() and nfc_hci_msg_rx_work() read byte 1 of
> an sk_buff (the HCP message header field) without first verifying the
> buffer contains at least NFC_HCI_HCP_HEADER_LEN (2) bytes.
>
> The SHDLC LLC layer only filters zero-length frames; a single-byte
> I-frame from a malicious NFC peer therefore reaches the HCI reassembly
> path where packet->message.header is read one byte past the valid data.
> The same issue is present in the NCI HCI implementation (nci/hci.c)
> via nci_hci_data_received_cb() and nci_hci_msg_rx_work().
>
> Add an explicit length check before accessing the message header at
> all four locations, freeing the skb on malformed input.
>
> Signed-off-by: Ashutosh Desai <ashutoshdesai993@gmail.com>
> ---
Same answer: Testing skb->len alone is not enough.
skbs can have fragments, pskb_may_pull() or skb_linearize() would be needed.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox