* [PATCH net-next 0/5] net: reduce sk_filter() (and friends) bloat
From: Eric Dumazet @ 2026-04-09 14:56 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, netdev, eric.dumazet, Eric Dumazet
Some functions return an error by value, and a drop_reason
by an output parameter. This extra parameter can force stack canaries.
A drop_reason is enough and more efficient.
This series reduces bloat by 678 bytes on x86_64:
$ scripts/bloat-o-meter -t vmlinux.old vmlinux.final
add/remove: 0/0 grow/shrink: 3/18 up/down: 79/-757 (-678)
Function old new delta
vsock_queue_rcv_skb 50 79 +29
ipmr_cache_report 1290 1315 +25
ip6mr_cache_report 1322 1347 +25
tcp_v6_rcv 3169 3167 -2
packet_rcv_spkt 329 327 -2
unix_dgram_sendmsg 1731 1726 -5
netlink_unicast 957 945 -12
netlink_dump 1372 1359 -13
sk_filter_trim_cap 889 858 -31
netlink_broadcast_filtered 1633 1595 -38
tcp_v4_rcv 3152 3111 -41
raw_rcv_skb 122 80 -42
ping_queue_rcv_skb 109 61 -48
ping_rcv 215 162 -53
rawv6_rcv_skb 278 224 -54
__sk_receive_skb 690 632 -58
raw_rcv 591 527 -64
udpv6_queue_rcv_one_skb 935 869 -66
udp_queue_rcv_one_skb 919 853 -66
tun_net_xmit 1146 1074 -72
sock_queue_rcv_skb_reason 166 76 -90
Total: Before=29722890, After=29722212, chg -0.00%
Future conversions from sock_queue_rcv_skb() to sock_queue_rcv_skb_reason()
can be done later.
Eric Dumazet (5):
net: change sock_queue_rcv_skb_reason() to return a drop_reason
net: always set reason in sk_filter_trim_cap()
net: change sk_filter_reason() to return the reason by value
tcp: change tcp_filter() to return the reason by value
net: change sk_filter_trim_cap() to return a drop_reason by value
drivers/net/tun.c | 8 +++++---
include/linux/filter.h | 15 ++++++++-------
include/net/sock.h | 17 ++++++++++++++---
include/net/tcp.h | 6 +++---
net/can/bcm.c | 5 ++---
net/can/isotp.c | 3 ++-
net/can/j1939/socket.c | 3 ++-
net/can/raw.c | 3 ++-
net/core/filter.c | 30 +++++++++++++-----------------
net/core/sock.c | 29 +++++++++++------------------
net/ipv4/ping.c | 3 ++-
net/ipv4/raw.c | 3 ++-
net/ipv4/tcp_ipv4.c | 6 ++++--
net/ipv4/udp.c | 3 ++-
net/ipv6/raw.c | 3 ++-
net/ipv6/tcp_ipv6.c | 6 ++++--
net/ipv6/udp.c | 3 ++-
net/rose/rose_in.c | 3 +--
18 files changed, 81 insertions(+), 68 deletions(-)
--
2.53.0.1213.gd9a14994de-goog
^ permalink raw reply
* Re: [PATCH net-next] selftests: net: py: add test case filtering and listing
From: Jakub Kicinski @ 2026-04-09 14:56 UTC (permalink / raw)
To: Breno Leitao
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, shuah,
petrm, willemb, linux-kselftest
In-Reply-To: <adedNCKW0WE_FqZK@gmail.com>
On Thu, 9 Apr 2026 05:41:59 -0700 Breno Leitao wrote:
> > + print(f"Usage: {sys.argv[0]} [-h|-l] [-t|-T name]\n"
> > + f"\t-h print help\n"
> > + f"\t-l list all tests\n"
>
> I initially expected the help text to mention "(all or filtered)" based
> on the commit message, but since this option lists all tests
> unconditionally, the current wording is correct.
Ugh, good catch. Not sure how I lost this. It does display a filtered
list. I wanted the filtering to take effect so that one can see what
tests would have been executed with the filters without running them.
Sort of like a --dry-run.
LMK if you have any thoughts on this, otherwise I'll rephrase as:
f"\t-l list tests (filtered, if filters were specified)\n"
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next 0/7] tcp: restrict rcv_wnd and window_clamp to representable window
From: Eric Dumazet @ 2026-04-09 14:52 UTC (permalink / raw)
To: gmbnomis
Cc: Neal Cardwell, Kuniyuki Iwashima, David S. Miller, David Ahern,
Jakub Kicinski, Paolo Abeni, Simon Horman, Shuah Khan, netdev,
linux-kernel, linux-kselftest
In-Reply-To: <20260408-tcp_rcv_exact_clamp_and_wnd-v1-0-76a6f212e153@gmail.com>
On Wed, Apr 8, 2026 at 2:50 PM Simon Baatz via B4 Relay
<devnull+gmbnomis.gmail.com@kernel.org> wrote:
>
> Hi,
>
> this series ensures that rcv_wnd and window_clamp do not exceed the
> maximum window size representable for the connection's window scale
> factor.
>
> This is most visible when TCP window scaling is not used for a
> connection. In that case, the advertised window is limited to 65535
> bytes, but rcv_wnd or window_clamp can still grow beyond 65535 when
> large receive buffers are used. The resulting mismatch breaks
> calculations that depend on the advertised window, such as the ACK
> decision in __tcp_ack_snd_check(), and can prevent immediate ACKs.
>
> Similar effects may also occur when window scaling is in use, e.g. if
> the application dynamically adjusts SO_RCVBUF in unusual ways or when
> the rmem sysctl parameters change during a connection’s lifetime.
>
> Summary:
>
> - Patch 1 keeps rcv_wnd capped by the (window scale-limited)
> window_clamp at connection start.
> - Patch 3 and 6 ensure that window_clamp is limited to the
> representable window when it is updated.
> - The other patches add packetdrill tests to verify the new behavior.
>
> A simple iperf test on a virtme-ng VM (Intel i5-7500, 4 cores,
> loopback) shows a noticeable improvement with window scaling disabled:
Explain why we should spend time reviewing patches trying to help
stacks from 2 decades ago,
risking breaking other usages.
Almost every time we change the rcvbuf logic, we introduce bugs.
Not using window scaling in 2026 and expecting "iperf improvement" is
quite something!
Out of curiosity, which legacy product is stuck in the 20th century?
^ permalink raw reply
* Re: [PATCH net-next v11 03/14] net: Add lease info to queue-get response
From: Jakub Kicinski @ 2026-04-09 14:46 UTC (permalink / raw)
To: Daniel Borkmann
Cc: netdev, bpf, davem, razor, pabeni, willemb, sdf, john.fastabend,
martin.lau, jordan, maciej.fijalkowski, magnus.karlsson, dw, toke,
yangzhenze, wangdongdong.6
In-Reply-To: <5a5feea9-7675-4ccf-aa8e-3a2e476ce8f5@iogearbox.net>
On Thu, 9 Apr 2026 15:52:42 +0200 Daniel Borkmann wrote:
> >> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> > Thanks for looking into it! That looks good to me. I've also retested that
> > it still works.
> >
> > Maybe small nits could be below to move the netif_is_queue_leasee into the
> > netdev_rx_queue.h header since its used outside of core and it might be
> > worth to also have the lock assertion in netdev_queue_get_dma_dev.
I suspected it may irk you :) No strong preference on the placement.
We do include the ../core/dev.h in a couple of places but agreed that
it is slightly ugly.
> > Do you want me to add your patch on top for a v12 of the series?
Yes, please. Let's get it into 7.1.
I think the test has to be reworked but of the available options seems
like merging it as is and following up quickly is the best. I've only
set up the container testing in our CI yesterday anyway so there may
be more things that need changing in the test as we gain experience :S
^ permalink raw reply
* Re: [PATCH net] l2tp: take a session reference in pppol2tp_ioctl()
From: Simon Horman @ 2026-04-09 14:46 UTC (permalink / raw)
To: Yiqi Sun; +Cc: jchapman, davem, edumazet, kuba, pabeni, netdev
In-Reply-To: <20260404133245.2391409-1-sunyiqixm@gmail.com>
On Sat, Apr 04, 2026 at 09:32:45PM +0800, Yiqi Sun wrote:
> pppol2tp_ioctl() reads sock->sk->sk_user_data and dereferences the
> returned l2tp_session without taking a reference on it.
>
> Since the ppp socket/session lifetime rework, session teardown runs
> asynchronously and can clear sk_user_data and drop the last session
> reference in parallel with ioctl(). This leaves ioctl() with a stale
> session pointer and can trigger a use-after-free.
>
> Fix this by using pppol2tp_sock_to_session() in pppol2tp_ioctl() and
> dropping the session reference before returning. This matches the
> existing getsockopt/setsockopt paths.
>
> Fixes: c5cbaef992d64 ("l2tp: refactor ppp socket/session relationship")
> Signed-off-by: Yiqi Sun <sunyiqixm@gmail.com>
> ---
> net/l2tp/l2tp_ppp.c | 88 +++++++++++++++++++++++++++------------------
> 1 file changed, 54 insertions(+), 34 deletions(-)
>
> diff --git a/net/l2tp/l2tp_ppp.c b/net/l2tp/l2tp_ppp.c
> index ae4543d5597b..e6d7d3537180 100644
> --- a/net/l2tp/l2tp_ppp.c
> +++ b/net/l2tp/l2tp_ppp.c
> @@ -1042,66 +1042,79 @@ static int pppol2tp_tunnel_copy_stats(struct pppol2tp_ioc_stats *stats,
> static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
> unsigned long arg)
> {
> + struct sock *sk = sock->sk;
> struct pppol2tp_ioc_stats stats;
> struct l2tp_session *session;
> + int err;
> +
> + err = -ENOTCONN;
> + if (!sk->sk_user_data)
> + goto end;
I think it would be cleaner to simply:
return -ENOTCONN;
> +
> + err = -EBADF;
> + session = pppol2tp_sock_to_session(sk);
> + if (!session)
> + goto end;
And, similarly here.
...
> @@ -1111,15 +1124,22 @@ static int pppol2tp_ioctl(struct socket *sock, unsigned int cmd,
> stats.tunnel_id = session->tunnel->tunnel_id;
> stats.using_ipsec = l2tp_tunnel_uses_xfrm(session->tunnel);
>
> - if (copy_to_user((void __user *)arg, &stats, sizeof(stats)))
> - return -EFAULT;
> + if (copy_to_user((void __user *)arg, &stats, sizeof(stats))) {
> + err = -EFAULT;
> + goto end_put_sess;
> + }
> + err = 0;
> break;
>
> default:
> - return -ENOIOCTLCMD;
> + err = -ENOIOCTLCMD;
I would suggest a goto here.
> + break;
> }
>
And setting err = 0 here, rather than in multiple places above.
> - return 0;
> +end_put_sess:
I think "out_put_session" would be a slightly better name for this label.
> + l2tp_session_put(session);
> +end:
> + return err;
> }
>
> /*****************************************************************************
> --
> 2.34.1
>
^ permalink raw reply
* [GIT PULL] Networking for v7.0-rc8
From: Paolo Abeni @ 2026-04-09 14:32 UTC (permalink / raw)
To: torvalds; +Cc: kuba, davem, netdev, linux-kernel
Hi Linus!
The following changes since commit f8f5627a8aeab15183eef8930bf75ba88a51622f:
Merge tag 'net-7.0-rc7' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-04-02 09:57:06 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git net-7.0-rc8
for you to fetch changes up to b4afe3fa76a88ee7d3d8802b43fde89aa02f8e0d:
Merge branch 'net-lan966x-fix-page_pool-error-handling-and-error-paths' (2026-04-09 15:17:25 +0200)
----------------------------------------------------------------
Including fixes from netfilter, IPsec and wireless. This is again
considerably bigger than the old average. No known outstanding
regressions.
Current release - regressions:
- net: increase IP_TUNNEL_RECURSION_LIMIT to 5
- eth: ice: fix PTP timestamping broken by SyncE code on E825C
Current release - new code bugs:
- eth: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure
Previous releases - regressions:
- core: fix cross-cache free of KFENCE-allocated skb head
- sched: act_csum: validate nested VLAN headers
- rxrpc: fix call removal to use RCU safe deletion
- xfrm:
- wait for RCU readers during policy netns exit
- fix refcount leak in xfrm_migrate_policy_find
- wifi: rt2x00usb: fix devres lifetime
- mptcp: fix slab-use-after-free in __inet_lookup_established
- ipvs: fix NULL deref in ip_vs_add_service error path
- eth: airoha: fix memory leak in airoha_qdma_rx_process()
- eth: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
Previous releases - always broken:
- ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
- ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
- bridge: guard local VLAN-0 FDB helpers against NULL vlan group
- xsk: tailroom reservation and MTU validation
- rxrpc:
- fix to request an ack if window is limited
- fix RESPONSE authenticator parser OOB read
- netfilter: nft_ct: fix use-after-free in timeout object destroy
- batman-adv: hold claim backbone gateways by reference
- eth: stmmac: fix PTP ref clock for Tegra234
- eth: idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
- eth: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
----------------------------------------------------------------
Agalakov Daniil (1):
e1000: check return value of e1000_read_eeprom
Aleksandr Loktionov (1):
ixgbe: stop re-reading flash on every get_drvinfo for e610
Alex Dvoretsky (1):
igb: remove napi_synchronize() in igb_down()
Alexander Koskovich (2):
net: ipa: fix GENERIC_CMD register field masks for IPA v5.0+
net: ipa: fix event ring index not programmed for IPA v5.0+
Alice Mikityanska (1):
l2tp: Drop large packets with UDP encap
Allison Henderson (1):
MAINTAINERS: Update email for Allison Henderson
Alok Tiwari (2):
rxrpc: Fix use of wrong skb when comparing queued RESP challenge serial
rxrpc: Fix rack timer warning to report unexpected mode
Anderson Nascimento (1):
rxrpc: Fix key reference count leak from call->key
Andrea Mayer (2):
seg6: separate dst_cache for input and output paths in seg6 lwtunnel
selftests: seg6: add test for dst_cache isolation in seg6 lwtunnel
Arnd Bergmann (1):
net: fec: make FIXED_PHY dependency unconditional
Chris J Arges (1):
net: increase IP_TUNNEL_RECURSION_LIMIT to 5
Daniel Golle (1):
selftests: net: bridge_vlan_mcast: wait for h1 before querier check
David Carlier (4):
net: altera-tse: fix skb leak on DMA mapping error in tse_start_xmit()
net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
net: lan966x: fix page pool leak in error paths
net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
David Howells (9):
rxrpc: Fix key quota calculation for multitoken keys
rxrpc: Fix key parsing memleak
rxrpc: Fix anonymous key handling
rxrpc: Fix call removal to use RCU safe deletion
rxrpc: Fix key/keyring checks in setsockopt(RXRPC_SECURITY_KEY/KEYRING)
rxrpc: Fix missing error checks for rxkad encryption/decryption failure
rxrpc: Fix integer overflow in rxgk_verify_response()
rxrpc: Fix leak of rxgk context in rxgk_verify_response()
rxrpc: Fix buffer overread in rxgk_do_verify_authenticator()
Douya Le (1):
rxrpc: Only put the call ref if one was acquired
Emil Tantilov (3):
idpf: fix PREEMPT_RT raw/bh spinlock nesting for async VC handling
idpf: improve locking around idpf_vc_xn_push_free()
idpf: set the payload size before calling the async handler
Eric Dumazet (2):
net: lapbether: handle NETDEV_PRE_TYPE_CHANGE
ipv6: ioam: fix potential NULL dereferences in __ioam6_fill_trace_data()
Fabio Baltieri (1):
net: txgbe: leave space for null terminators on property_entry
Felix Gu (1):
net: mdio: realtek-rtl9300: use scoped device_for_each_child_node loop
Fernando Fernandez Mancera (3):
ipv4: nexthop: avoid duplicate NHA_HW_STATS_ENABLE on nexthop group dump
ipv4: nexthop: allocate skb dynamically in rtm_get_nexthop()
selftests: nft_queue.sh: add a parallel stress test
Florian Westphal (1):
netfilter: nfnetlink_queue: make hash table per queue
Greg Kroah-Hartman (3):
xfrm_user: fix info leak in build_mapping()
xfrm_user: fix info leak in build_report()
net: rfkill: prevent unlimited numbers of rfkill events from being created
Haoze Xie (1):
batman-adv: hold claim backbone gateways by reference
Jakub Kicinski (10):
Merge branch 'net-stmmac-fix-tegra234-mgbe-clock'
Merge branch 'xsk-tailroom-reservation-and-mtu-validation'
net: avoid nul-deref trying to bind mp to incapable device
Merge branch 'seg6-fix-dst_cache-sharing-in-seg6-lwtunnel'
Merge branch 'rxrpc-miscellaneous-fixes'
Merge tag 'nf-26-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge tag 'batadv-net-pullrequest-20260408' of https://git.open-mesh.org/linux-merge
Merge tag 'ipsec-2026-04-08' of git://git.kernel.org/pub/scm/linux/kernel/git/klassert/ipsec
Merge tag 'wireless-2026-04-08' of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless
Merge branch '200GbE' of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue
Jiayuan Chen (2):
net: skb: fix cross-cache free of KFENCE-allocated skb head
mptcp: fix slab-use-after-free in __inet_lookup_established
Jiexun Wang (1):
af_unix: read UNIX_DIAG_VFS data under unix_state_lock
Johan Alvarado (1):
net: stmmac: dwmac-motorcomm: fix eFUSE MAC address read failure
Johan Hovold (1):
wifi: rt2x00usb: fix devres lifetime
John Pavlick (1):
net: sfp: add quirks for Hisense and HSGQ GPON ONT SFP modules
Jon Hunter (2):
net: stmmac: Fix PTP ref clock for Tegra234
dt-bindings: net: Fix Tegra234 MGBE PTP clock
Justin Iurman (1):
net: ioam6: fix OOB and missing lock
Keenan Dong (3):
xfrm: account XFRMA_IF_ID in aevent size calculation
rxrpc: fix RESPONSE authenticator parser OOB read
rxrpc: fix oversized RESPONSE authenticator length check
Kohei Enju (1):
ice: ptp: don't WARN when controlling PF is unavailable
Kotlyarov Mihail (1):
xfrm: fix refcount leak in xfrm_migrate_policy_find
Li RongQing (1):
devlink: Fix incorrect skb socket family dumping
Lorenzo Bianconi (1):
net: airoha: Fix memory leak in airoha_qdma_rx_process()
Luxiao Xu (1):
rxrpc: fix reference count leak in rxrpc_server_keyring()
Maciej Fijalkowski (8):
xsk: tighten UMEM headroom validation to account for tailroom and min frame
xsk: respect tailroom for ZC setups
xsk: fix XDP_UMEM_SG_FLAG issues
xsk: validate MTU against usable frame size on bind
selftests: bpf: introduce a common routine for reading procfs
selftests: bpf: fix pkt grow tests
selftests: bpf: have a separate variable for drop test
selftests: bpf: adjust rx_dropped xskxceiver's test to respect tailroom
Marc Dionne (1):
rxrpc: Fix to request an ack if window is limited
Matthieu Baerts (NGI0) (1):
Revert "mptcp: add needs_id for netlink appending addr"
Michael Guralnik (1):
net/mlx5: Update the list of the PCI supported devices
Michal Schmidt (1):
ixgbevf: add missing negotiate_features op to Hyper-V ops table
Muhammad Alifa Ramdhan (1):
net/tls: fix use-after-free in -EBUSY error path of tls_do_encryption
Nikolaos Gkarlis (1):
rtnetlink: add missing netlink_ns_capable() check for peer netns
Oleh Konko (2):
tipc: fix bc_ackers underflow on duplicate GRP_ACK_MSG
rxrpc: Fix RxGK token loading to check bounds
Paolo Abeni (1):
Merge branch 'net-lan966x-fix-page_pool-error-handling-and-error-paths'
Pengpeng Hou (5):
net: qualcomm: qca_uart: report the consumed byte on RX skb allocation failure
nfc: s3fwrn5: allocate rx skb before consuming bytes
wifi: brcmfmac: validate bsscfg indices in IF events
rxrpc: proc: size address buffers for %pISpc output
nfc: pn533: allocate rx skb before consuming bytes
Petr Oros (1):
ice: fix PTP timestamping broken by SyncE code on E825C
Qi Tang (1):
xfrm: hold dev ref until after transport_finish NF_HOOK
Qingfang Deng (1):
MAINTAINERS: orphan PPP over Ethernet driver
Raju Rangoju (1):
MAINTAINERS: Add Prashanth as additional maintainer for amd-xgbe driver
Ren Wei (1):
netfilter: xt_multiport: validate range encoding in checkentry
Ruide Cao (2):
batman-adv: reject oversized global TT response buffers
net: sched: act_csum: validate nested VLAN headers
Stefano Garzarella (1):
vsock/test: fix send_buf()/recv_buf() EINTR handling
Steffen Klassert (1):
xfrm: Wait for RCU readers during policy netns exit
Thomas Fourier (1):
wifi: brcmsmac: Fix dma_free_coherent() size
Tuan Do (1):
netfilter: nft_ct: fix use-after-free in timeout object destroy
Tyllis Xu (1):
net: stmmac: fix integer underflow in chain mode
Wang Jie (1):
rxrpc: only handle RESPONSE during service challenge
Weiming Shi (1):
ipvs: fix NULL deref in ip_vs_add_service error path
Xiang Mei (1):
netfilter: nfnetlink_log: initialize nfgenmsg in NLMSG_DONE terminator
Yasuaki Torimaru (1):
xfrm: clear trailing padding in build_polexpire()
Yiqi Sun (1):
ipv4: icmp: fix null-ptr-deref in icmp_build_probe()
Yuqi Xu (1):
rxrpc: reject undecryptable rxkad response tickets
Zhengchuan Liang (2):
net: af_key: zero aligned sockaddr tail in PF_KEY exports
netfilter: ip6t_eui64: reject invalid MAC header for all packets
Zijing Yin (1):
bridge: guard local VLAN-0 FDB helpers against NULL vlan group
.../bindings/net/nvidia,tegra234-mgbe.yaml | 4 +-
MAINTAINERS | 6 +-
drivers/net/ethernet/airoha/airoha_eth.c | 3 +-
drivers/net/ethernet/altera/altera_tse_main.c | 1 +
drivers/net/ethernet/freescale/Kconfig | 2 +-
drivers/net/ethernet/intel/e1000/e1000_ethtool.c | 8 +-
drivers/net/ethernet/intel/ice/ice_ptp.c | 30 ++--
drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 20 ++-
drivers/net/ethernet/intel/idpf/idpf_virtchnl.h | 5 +-
drivers/net/ethernet/intel/igb/igb_main.c | 3 +-
drivers/net/ethernet/intel/ixgbe/devlink/devlink.c | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe.h | 2 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 13 +-
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 10 ++
drivers/net/ethernet/intel/ixgbevf/vf.c | 7 +
drivers/net/ethernet/mellanox/mlx5/core/main.c | 1 +
.../net/ethernet/microchip/lan966x/lan966x_fdma.c | 28 ++-
drivers/net/ethernet/qualcomm/qca_uart.c | 2 +-
drivers/net/ethernet/stmicro/stmmac/chain_mode.c | 11 +-
.../net/ethernet/stmicro/stmmac/dwmac-motorcomm.c | 8 +
drivers/net/ethernet/stmicro/stmmac/dwmac-tegra.c | 19 +-
drivers/net/ethernet/wangxun/txgbe/txgbe_type.h | 8 +-
drivers/net/ipa/reg/gsi_reg-v5.0.c | 9 +-
drivers/net/mdio/mdio-realtek-rtl9300.c | 3 +-
drivers/net/phy/sfp.c | 16 ++
drivers/net/wan/lapbether.c | 13 +-
.../wireless/broadcom/brcm80211/brcmfmac/fweh.c | 5 +
.../net/wireless/broadcom/brcm80211/brcmsmac/dma.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00usb.c | 2 +-
drivers/nfc/pn533/uart.c | 11 +-
drivers/nfc/s3fwrn5/uart.c | 10 +-
include/net/ip_tunnels.h | 2 +-
include/net/netfilter/nf_conntrack_timeout.h | 1 +
include/net/netfilter/nf_queue.h | 1 -
include/net/xdp_sock.h | 2 +-
include/net/xdp_sock_drv.h | 23 ++-
include/trace/events/rxrpc.h | 4 +-
net/batman-adv/bridge_loop_avoidance.c | 27 ++-
net/batman-adv/translation-table.c | 9 +-
net/bridge/br_fdb.c | 6 +
net/core/netdev_rx_queue.c | 2 +-
net/core/rtnetlink.c | 40 +++--
net/core/skbuff.c | 5 +-
net/devlink/health.c | 2 +-
net/ipv4/icmp.c | 7 +
net/ipv4/nexthop.c | 41 +++--
net/ipv4/xfrm4_input.c | 5 +-
net/ipv6/ioam6.c | 33 ++--
net/ipv6/netfilter/ip6t_eui64.c | 3 +-
net/ipv6/seg6_iptunnel.c | 34 ++--
net/ipv6/xfrm6_input.c | 5 +-
net/key/af_key.c | 52 ++++--
net/l2tp/l2tp_core.c | 5 +
net/mptcp/pm_kernel.c | 24 +--
net/mptcp/protocol.c | 2 +
net/mptcp/protocol.h | 1 +
net/mptcp/subflow.c | 15 +-
net/netfilter/ipvs/ip_vs_ctl.c | 1 -
net/netfilter/nfnetlink_log.c | 8 +-
net/netfilter/nfnetlink_queue.c | 139 +++++----------
net/netfilter/nft_ct.c | 2 +-
net/netfilter/xt_multiport.c | 34 +++-
net/rfkill/core.c | 35 ++--
net/rxrpc/af_rxrpc.c | 6 -
net/rxrpc/ar-internal.h | 2 +-
net/rxrpc/call_object.c | 25 ++-
net/rxrpc/conn_event.c | 19 +-
net/rxrpc/input_rack.c | 2 +-
net/rxrpc/io_thread.c | 3 +-
net/rxrpc/key.c | 40 +++--
net/rxrpc/output.c | 2 +
net/rxrpc/proc.c | 37 ++--
net/rxrpc/rxgk.c | 19 +-
net/rxrpc/rxkad.c | 63 ++++---
net/rxrpc/sendmsg.c | 2 +-
net/rxrpc/server_key.c | 3 +
net/sched/act_csum.c | 6 +-
net/tipc/group.c | 6 +-
net/tls/tls_sw.c | 10 ++
net/unix/diag.c | 21 ++-
net/xdp/xdp_umem.c | 3 +-
net/xdp/xsk.c | 4 +-
net/xdp/xsk_buff_pool.c | 32 +++-
net/xfrm/xfrm_input.c | 18 +-
net/xfrm/xfrm_policy.c | 5 +-
net/xfrm/xfrm_user.c | 14 +-
tools/testing/selftests/bpf/prog_tests/test_xsk.c | 55 +++---
tools/testing/selftests/bpf/prog_tests/test_xsk.h | 23 +++
tools/testing/selftests/bpf/prog_tests/xsk.c | 19 ++
tools/testing/selftests/bpf/progs/xsk_xdp_progs.c | 4 +-
tools/testing/selftests/bpf/xskxceiver.c | 23 +++
tools/testing/selftests/net/Makefile | 1 +
.../selftests/net/forwarding/bridge_vlan_mcast.sh | 1 +
tools/testing/selftests/net/netfilter/nf_queue.c | 50 +++++-
tools/testing/selftests/net/netfilter/nft_queue.sh | 83 +++++++--
tools/testing/selftests/net/srv6_iptunnel_cache.sh | 197 +++++++++++++++++++++
tools/testing/vsock/util.c | 8 +-
97 files changed, 1172 insertions(+), 468 deletions(-)
create mode 100755 tools/testing/selftests/net/srv6_iptunnel_cache.sh
^ permalink raw reply
* Re: [PATCH v2] bpf: guard sock_ops rtt_min access with is_locked_tcp_sock
From: Alexei Starovoitov @ 2026-04-09 14:29 UTC (permalink / raw)
To: Werner Kasselman
Cc: Martin KaFai Lau, Alexei Starovoitov, Daniel Borkmann,
Andrii Nakryiko, John Fastabend, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, bpf@vger.kernel.org,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-kselftest@vger.kernel.org, stable@vger.kernel.org
In-Reply-To: <20260409061026.3926858-1-werner@verivus.com>
On Wed, Apr 8, 2026 at 11:10 PM Werner Kasselman <werner@verivus.ai> wrote:
>
> sock_ops_convert_ctx_access() emits guarded reads for tcp_sock-backed
> bpf_sock_ops fields such as snd_cwnd, srtt_us, snd_ssthresh, rcv_nxt,
> snd_nxt, snd_una, mss_cache, ecn_flags, rate_delivered, and
> rate_interval_us. Those accesses go through SOCK_OPS_GET_TCP_SOCK_FIELD(),
> which checks is_locked_tcp_sock before dereferencing sock_ops.sk.
>
> The rtt_min case is different. Because it reads a subfield of
> struct minmax, it uses a custom open-coded load sequence instead of the
> usual helper macro, and that sequence currently dereferences sock_ops.sk
> without checking is_locked_tcp_sock first.
>
> This is unsafe when sock_ops.sk points to a request_sock-backed object
> instead of a locked full tcp_sock. That is reachable not only from the
> SYNACK header option callbacks, but also from other request_sock-backed
> sock_ops callbacks such as BPF_SOCK_OPS_TIMEOUT_INIT,
> BPF_SOCK_OPS_RWND_INIT, and BPF_SOCK_OPS_NEEDS_ECN. In those cases,
> reading ctx->rtt_min makes the generated code treat a request_sock as a
> tcp_sock and read beyond the end of the request_sock allocation.
>
> Fix the rtt_min conversion by adding the same is_locked_tcp_sock guard
> used for the other tcp_sock field reads. Also make the accessed subfield
> explicit by using offsetof(struct minmax_sample, v).
>
> Add a selftest that verifies request_sock-backed sock_ops callbacks see
> ctx->rtt_min as zero after the fix.
>
> Found via AST-based call-graph analysis using sqry.
>
> Fixes: 44f0e43037d3 ("bpf: Add support for reading sk_state and more")
> Cc: stable@vger.kernel.org
> Signed-off-by: Werner Kasselman <werner@verivus.com>
> ---
> net/core/filter.c | 53 +++++++++++++++----
> .../selftests/bpf/prog_tests/tcpbpf_user.c | 9 ++++
> .../selftests/bpf/progs/test_tcpbpf_kern.c | 21 ++++++++
> tools/testing/selftests/bpf/test_tcpbpf.h | 6 +++
> 4 files changed, 79 insertions(+), 10 deletions(-)
>
> diff --git a/net/core/filter.c b/net/core/filter.c
> index 78b548158..5040bf7e4 100644
> --- a/net/core/filter.c
> +++ b/net/core/filter.c
> @@ -10827,16 +10827,49 @@ static u32 sock_ops_convert_ctx_access(enum bpf_access_type type,
> case offsetof(struct bpf_sock_ops, rtt_min):
> BUILD_BUG_ON(sizeof_field(struct tcp_sock, rtt_min) !=
> sizeof(struct minmax));
> - BUILD_BUG_ON(sizeof(struct minmax) <
> - sizeof(struct minmax_sample));
> -
> - *insn++ = BPF_LDX_MEM(BPF_FIELD_SIZEOF(
> - struct bpf_sock_ops_kern, sk),
> - si->dst_reg, si->src_reg,
> - offsetof(struct bpf_sock_ops_kern, sk));
> - *insn++ = BPF_LDX_MEM(BPF_W, si->dst_reg, si->dst_reg,
> - offsetof(struct tcp_sock, rtt_min) +
> - sizeof_field(struct minmax_sample, t));
> + BUILD_BUG_ON(sizeof_field(struct bpf_sock_ops, rtt_min) !=
> + sizeof_field(struct minmax_sample, v));
> + off = offsetof(struct tcp_sock, rtt_min) +
> + offsetof(struct minmax_sample, v);
> +
> + {
> + int fullsock_reg = si->dst_reg, reg = BPF_REG_9, jmp = 2;
> +
please de-claude your patches before posting.
pw-bot: cr
^ permalink raw reply
* Re: [PATCH RFC net-next 0/4] improve hw flow offload byte accounting
From: Daniel Golle @ 2026-04-09 14:21 UTC (permalink / raw)
To: Pablo Neira Ayuso
Cc: Felix Fietkau, John Crispin, Lorenzo Bianconi, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Matthias Brugger, AngeloGioacchino Del Regno, Simon Horman,
Florian Westphal, Phil Sutter, netdev, linux-kernel,
linux-arm-kernel, linux-mediatek, netfilter-devel, coreteam
In-Reply-To: <adevKeasLkEB5zZ4@chamomile>
On Thu, Apr 09, 2026 at 03:52:41PM +0200, Pablo Neira Ayuso wrote:
> On Thu, Apr 09, 2026 at 02:07:22PM +0100, Daniel Golle wrote:
> > Hardware flow counters report raw byte counts whose semantics
> > vary by vendor -- some count ingress L2 frames, others egress
> > L2, others L3. The nf_flow_table framework currently passes
> > these bytes straight to conntrack without conversion, and
> > sub-interfaces (VLAN, PPPoE) that are bypassed by hw offload
> > never see any counter updates at all.
>
> I see, but that is part of the feature itself? Why pretend that these
> interface are really seeing traffic while they don't. This aspiration
> of trying to do all hardware offload fully transparent (when it is not
> the case, not mentioning semantic changes in how packet handling is
> done compared to the software plane) does not sound convincing to me.
Please explain what you mean by offloading not being fully
transparent. If the MAC hardware offloads VLAN encap/decap, for
example, we also maintain the counters correctly (it just so happens),
just the flow-offloading case results in a weird overall picture:
hardware interface counters keep increasing, encap interfaces (802.1Q,
PPPoE) don't. That makes it confusing and hard to understand what's
happening when only looking at the interface counters (ie. "what is
all that traffic on my physical WAN interface which isn't PPPoE? Can't
be that all of that is the modems management interface, SNMP, ...")
>
> On top of this, this issue also exists in the software plane: Devices
> that are bypasses do not get their counters bumped.
>
> Maybe if this is really a requirement, then this should address the
> issue for software too, but is it worth the effort to add
> infrastructure for this purpose?
To me it would feel more correct to see counters increasing also
for offloaded traffic on software interfaces such as PPPoE or VLAN.
I honestly didn't think about the software fastpath, and yes, I think
it should be addressed there too.
> > This series lets drivers declare what their counters represent,
> > so the framework can normalize to L3 for conntrack and
> > propagate per-layer stats to encap sub-interfaces.
This part could also been seen as an independent fix as currently
conntrack stats for the same traffic differ in case of software
offloading (pure L3 bytes) and hardware offloading (L2 ingress bytes
in case of mtk_ppe).
^ permalink raw reply
* Re: [PATCH net v2] net: phy: fix a return path in get_phy_c45_ids()
From: Russell King (Oracle) @ 2026-04-09 14:18 UTC (permalink / raw)
To: Charles Perry
Cc: netdev, Andrew Lunn, Heiner Kallweit, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Florian Fainelli,
linux-kernel
In-Reply-To: <20260409133654.3203336-1-charles.perry@microchip.com>
On Thu, Apr 09, 2026 at 06:36:54AM -0700, Charles Perry wrote:
> The return value of phy_c45_probe_present() is stored in "ret", not
> "phy_reg", fix this. "phy_reg" always has a positive value if we reach
> this return path (since it would have returned earlier otherwise), which
> means that the original goal of the patch of not considering -ENODEV
> fatal wasn't achieved.
>
> Fixes: 17b447539408 ("net: phy: c45 scanning: Don't consider -ENODEV fatal")
> Signed-off-by: Charles Perry <charles.perry@microchip.com>
> Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Reviewed-by: Russell King (Oracle) <rmk+kernel@armlinux.org.uk>
Thanks!
Note: you don't need to resend just because you've received another r-b.
--
RMK's Patch system: https://www.armlinux.org.uk/developer/patches/
FTTP is here! 80Mbps down 10Mbps up. Decent connectivity at last!
^ permalink raw reply
* Re: [PATCH v2] net/mlx5: Fix OOB access and stack information leak in PTP event handling
From: Carolina Jubran @ 2026-04-09 14:16 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: leon, linux-kernel, linux-rdma, mbloch, netdev, richardcochran,
saeedm, tariqt
In-Reply-To: <20260402003047.24684-1-prathameshdeshpande7@gmail.com>
Hi Prathamesh, thanks for the patch!
On 02/04/2026 3:30, Prathamesh Deshpande wrote:
> In mlx5_pps_event(), several critical issues were identified during
> review by Sashiko:
>
> 1. The 'pin' index from the hardware event was used without bounds
> checking to index 'pin_config' and 'pps_info->start', leading to
> potential out-of-bounds memory access.
> 2. 'ptp_event' was not zero-initialized. Since it contains a union,
> assigning a timestamp partially leaves the 'ts_raw' field with
> uninitialized stack memory, which can leak kernel data or
> corrupt time sync logic in hardpps().
> 3. A NULL 'pin_config' could be dereferenced if initialization failed.
> 4. 'clock->ptp' could be NULL if ptp_clock_register() failed.
>
> Fix these by zero-initializing the event struct, adding a bounds
> check against MAX_PIN_NUM, and adding appropriate NULL guards.
>
> Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section")
>
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> v2:
> - Zero-initialize ptp_event to prevent stack information leak [Sashiko].
> - Add bounds check for hardware pin index to prevent OOB access [Sashiko].
> - Add NULL guard for pin_config to handle initialization failures [Sashiko].
> - Add NULL check for clock->ptp as originally intended.
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> index bd4e042077af..a4d8c5c39abc 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> @@ -1164,12 +1164,18 @@ static int mlx5_pps_event(struct notifier_block *nb,
> pps_nb);
> struct mlx5_core_dev *mdev = clock_state->mdev;
> struct mlx5_clock *clock = mdev->clock;
> - struct ptp_clock_event ptp_event;
> + struct ptp_clock_event ptp_event = {};
> struct mlx5_eqe *eqe = data;
> int pin = eqe->data.pps.pin;
> unsigned long flags;
> u64 ns;
>
> + if (!clock->ptp_info.pin_config)
> + return NOTIFY_OK;
> +
> + if (pin < 0 || pin >= MAX_PIN_NUM)
> + return NOTIFY_OK;
pin is defined as u8 in struct mlx5_eqe_pps, so pin < 0 is dead code.
As for the upper bound: in order to receive a PPS event on a pin, the
user must
first configure it via mlx5_ptp_enable, which already validates the index
(rq->extts.index >= clock->ptp_info.n_pins returns -EINVAL) and since
the mtpps
register only defines capabilities for 8 pins, so n_pins cannot exceed
MAX_PIN_NUM.
Maybe wrap it with WARN_ON_ONCE instead of silently returning, so if future
hardware adds support for more pins we would notice rather than silently
dropping
events.
> +
> switch (clock->ptp_info.pin_config[pin].func) {
> case PTP_PF_EXTTS:
> ptp_event.index = pin;
> @@ -1185,8 +1191,8 @@ static int mlx5_pps_event(struct notifier_block *nb,
> } else {
> ptp_event.type = PTP_CLOCK_EXTTS;
> }
> - /* TODOL clock->ptp can be NULL if ptp_clock_register fails */
> - ptp_clock_event(clock->ptp, &ptp_event);
> + if (clock->ptp)
> + ptp_clock_event(clock->ptp, &ptp_event);
> break;
> case PTP_PF_PEROUT:
> if (clock->shared) {
^ permalink raw reply
* Re: [PATCH v2] net/mlx5: Fix OOB access and stack information leak in PTP event handling
From: Carolina Jubran @ 2026-04-09 14:10 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: leon, linux-kernel, linux-rdma, mbloch, netdev, richardcochran,
saeedm, tariqt
In-Reply-To: <20260402003047.24684-1-prathameshdeshpande7@gmail.com>
Hi Prathamesh, thanks for the patch!
On 02/04/2026 3:30, Prathamesh Deshpande wrote:
> In mlx5_pps_event(), several critical issues were identified during
> review by Sashiko:
>
> 1. The 'pin' index from the hardware event was used without bounds
> checking to index 'pin_config' and 'pps_info->start', leading to
> potential out-of-bounds memory access.
> 2. 'ptp_event' was not zero-initialized. Since it contains a union,
> assigning a timestamp partially leaves the 'ts_raw' field with
> uninitialized stack memory, which can leak kernel data or
> corrupt time sync logic in hardpps().
> 3. A NULL 'pin_config' could be dereferenced if initialization failed.
> 4. 'clock->ptp' could be NULL if ptp_clock_register() failed.
>
> Fix these by zero-initializing the event struct, adding a bounds
> check against MAX_PIN_NUM, and adding appropriate NULL guards.
>
> Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section")
>
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> v2:
> - Zero-initialize ptp_event to prevent stack information leak [Sashiko].
> - Add bounds check for hardware pin index to prevent OOB access [Sashiko].
> - Add NULL guard for pin_config to handle initialization failures [Sashiko].
> - Add NULL check for clock->ptp as originally intended.
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> index bd4e042077af..a4d8c5c39abc 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> @@ -1164,12 +1164,18 @@ static int mlx5_pps_event(struct notifier_block *nb,
> pps_nb);
> struct mlx5_core_dev *mdev = clock_state->mdev;
> struct mlx5_clock *clock = mdev->clock;
> - struct ptp_clock_event ptp_event;
> + struct ptp_clock_event ptp_event = {};
> struct mlx5_eqe *eqe = data;
> int pin = eqe->data.pps.pin;
> unsigned long flags;
> u64 ns;
>
> + if (!clock->ptp_info.pin_config)
> + return NOTIFY_OK;
> +
> + if (pin < 0 || pin >= MAX_PIN_NUM)
> + return NOTIFY_OK;
pin is defined as u8 in struct mlx5_eqe_pps, so pin < 0 is dead code.
As for the upper bound: in order to receive a PPS event on a pin, the
user must
first configure it via mlx5_ptp_enable, which already validates the index
(rq->extts.index >= clock->ptp_info.n_pins returns -EINVAL) and since
the mtpps
register only defines capabilities for 8 pins, so n_pins cannot exceed
MAX_PIN_NUM.
Maybe wrap it with WARN_ON_ONCE instead of silently returning, so if future
hardware adds support for more pins we would notice rather than silently
dropping
events.
> +
> switch (clock->ptp_info.pin_config[pin].func) {
> case PTP_PF_EXTTS:
> ptp_event.index = pin;
> @@ -1185,8 +1191,8 @@ static int mlx5_pps_event(struct notifier_block *nb,
> } else {
> ptp_event.type = PTP_CLOCK_EXTTS;
> }
> - /* TODOL clock->ptp can be NULL if ptp_clock_register fails */
> - ptp_clock_event(clock->ptp, &ptp_event);
> + if (clock->ptp)
> + ptp_clock_event(clock->ptp, &ptp_event);
> break;
> case PTP_PF_PEROUT:
> if (clock->shared) {
^ permalink raw reply
* Re: [PATCH v2] net/mlx5: Fix OOB access and stack information leak in PTP event handling
From: Carolina Jubran @ 2026-04-09 14:07 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: leon, linux-kernel, linux-rdma, mbloch, netdev, richardcochran,
saeedm, tariqt
In-Reply-To: <20260402003047.24684-1-prathameshdeshpande7@gmail.com>
Hi Prathamesh, thanks for the patch!
On 02/04/2026 3:30, Prathamesh Deshpande wrote:
> In mlx5_pps_event(), several critical issues were identified during
> review by Sashiko:
>
> 1. The 'pin' index from the hardware event was used without bounds
> checking to index 'pin_config' and 'pps_info->start', leading to
> potential out-of-bounds memory access.
> 2. 'ptp_event' was not zero-initialized. Since it contains a union,
> assigning a timestamp partially leaves the 'ts_raw' field with
> uninitialized stack memory, which can leak kernel data or
> corrupt time sync logic in hardpps().
> 3. A NULL 'pin_config' could be dereferenced if initialization failed.
> 4. 'clock->ptp' could be NULL if ptp_clock_register() failed.
>
> Fix these by zero-initializing the event struct, adding a bounds
> check against MAX_PIN_NUM, and adding appropriate NULL guards.
>
> Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section")
>
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> v2:
> - Zero-initialize ptp_event to prevent stack information leak [Sashiko].
> - Add bounds check for hardware pin index to prevent OOB access [Sashiko].
> - Add NULL guard for pin_config to handle initialization failures [Sashiko].
> - Add NULL check for clock->ptp as originally intended.
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> index bd4e042077af..a4d8c5c39abc 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> @@ -1164,12 +1164,18 @@ static int mlx5_pps_event(struct notifier_block *nb,
> pps_nb);
> struct mlx5_core_dev *mdev = clock_state->mdev;
> struct mlx5_clock *clock = mdev->clock;
> - struct ptp_clock_event ptp_event;
> + struct ptp_clock_event ptp_event = {};
> struct mlx5_eqe *eqe = data;
> int pin = eqe->data.pps.pin;
> unsigned long flags;
> u64 ns;
>
> + if (!clock->ptp_info.pin_config)
> + return NOTIFY_OK;
> +
> + if (pin < 0 || pin >= MAX_PIN_NUM)
> + return NOTIFY_OK;
pin is defined as u8 in struct mlx5_eqe_pps, so pin < 0 is dead code.
As for the upper bound: in order to receive a PPS event on a pin, the
user must
first configure it via mlx5_ptp_enable, which already validates the index
(rq->extts.index >= clock->ptp_info.n_pins returns -EINVAL) and since
the mtpps
register only defines capabilities for 8 pins, so n_pins cannot exceed
MAX_PIN_NUM.
Maybe wrap it with WARN_ON_ONCE instead of silently returning, so if future
hardware adds support for more pins we would notice rather than silently
dropping
events.
> +
> switch (clock->ptp_info.pin_config[pin].func) {
> case PTP_PF_EXTTS:
> ptp_event.index = pin;
> @@ -1185,8 +1191,8 @@ static int mlx5_pps_event(struct notifier_block *nb,
> } else {
> ptp_event.type = PTP_CLOCK_EXTTS;
> }
> - /* TODOL clock->ptp can be NULL if ptp_clock_register fails */
> - ptp_clock_event(clock->ptp, &ptp_event);
> + if (clock->ptp)
> + ptp_clock_event(clock->ptp, &ptp_event);
> break;
> case PTP_PF_PEROUT:
> if (clock->shared) {
^ permalink raw reply
* Re: [PATCH v2] net/mlx5: Fix OOB access and stack information leak in PTP event handling
From: Carolina Jubran @ 2026-04-09 13:58 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: leon, linux-kernel, linux-rdma, mbloch, netdev, richardcochran,
saeedm, tariqt
In-Reply-To: <20260402003047.24684-1-prathameshdeshpande7@gmail.com>
Hi Prathamesh, thanks for the patch!
On 02/04/2026 3:30, Prathamesh Deshpande wrote:
> In mlx5_pps_event(), several critical issues were identified during
> review by Sashiko:
>
> 1. The 'pin' index from the hardware event was used without bounds
> checking to index 'pin_config' and 'pps_info->start', leading to
> potential out-of-bounds memory access.
> 2. 'ptp_event' was not zero-initialized. Since it contains a union,
> assigning a timestamp partially leaves the 'ts_raw' field with
> uninitialized stack memory, which can leak kernel data or
> corrupt time sync logic in hardpps().
> 3. A NULL 'pin_config' could be dereferenced if initialization failed.
> 4. 'clock->ptp' could be NULL if ptp_clock_register() failed.
>
> Fix these by zero-initializing the event struct, adding a bounds
> check against MAX_PIN_NUM, and adding appropriate NULL guards.
>
> Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section")
>
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> v2:
> - Zero-initialize ptp_event to prevent stack information leak [Sashiko].
> - Add bounds check for hardware pin index to prevent OOB access [Sashiko].
> - Add NULL guard for pin_config to handle initialization failures [Sashiko].
> - Add NULL check for clock->ptp as originally intended.
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> index bd4e042077af..a4d8c5c39abc 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> @@ -1164,12 +1164,18 @@ static int mlx5_pps_event(struct notifier_block *nb,
> pps_nb);
> struct mlx5_core_dev *mdev = clock_state->mdev;
> struct mlx5_clock *clock = mdev->clock;
> - struct ptp_clock_event ptp_event;
> + struct ptp_clock_event ptp_event = {};
> struct mlx5_eqe *eqe = data;
> int pin = eqe->data.pps.pin;
> unsigned long flags;
> u64 ns;
>
> + if (!clock->ptp_info.pin_config)
> + return NOTIFY_OK;
> +
> + if (pin < 0 || pin >= MAX_PIN_NUM)
> + return NOTIFY_OK;
pin is defined as u8 in struct mlx5_eqe_pps, so pin < 0 is dead code.
As for the upper bound: in order to receive a PPS event on a pin, the
user must
first configure it via mlx5_ptp_enable, which already validates the index
(rq->extts.index >= clock->ptp_info.n_pins returns -EINVAL) and since
the mtpps
register only defines capabilities for 8 pins, so n_pins cannot exceed
MAX_PIN_NUM.
Maybe wrap it with WARN_ON_ONCE instead of silently returning, so if future
hardware adds support for more pins we would notice rather than silently
dropping
events.
> +
> switch (clock->ptp_info.pin_config[pin].func) {
> case PTP_PF_EXTTS:
> ptp_event.index = pin;
> @@ -1185,8 +1191,8 @@ static int mlx5_pps_event(struct notifier_block *nb,
> } else {
> ptp_event.type = PTP_CLOCK_EXTTS;
> }
> - /* TODOL clock->ptp can be NULL if ptp_clock_register fails */
> - ptp_clock_event(clock->ptp, &ptp_event);
> + if (clock->ptp)
> + ptp_clock_event(clock->ptp, &ptp_event);
> break;
> case PTP_PF_PEROUT:
> if (clock->shared) {
^ permalink raw reply
* Re: [PATCH v2] net/mlx5: Fix OOB access and stack information leak in PTP event handling
From: Carolina Jubran @ 2026-04-09 13:54 UTC (permalink / raw)
To: Prathamesh Deshpande
Cc: leon, linux-kernel, linux-rdma, mbloch, netdev, richardcochran,
saeedm, tariqt
In-Reply-To: <20260402003047.24684-1-prathameshdeshpande7@gmail.com>
Hi Prathamesh, thanks for the pacth!
On 02/04/2026 3:30, Prathamesh Deshpande wrote:
> In mlx5_pps_event(), several critical issues were identified during
> review by Sashiko:
>
> 1. The 'pin' index from the hardware event was used without bounds
> checking to index 'pin_config' and 'pps_info->start', leading to
> potential out-of-bounds memory access.
> 2. 'ptp_event' was not zero-initialized. Since it contains a union,
> assigning a timestamp partially leaves the 'ts_raw' field with
> uninitialized stack memory, which can leak kernel data or
> corrupt time sync logic in hardpps().
> 3. A NULL 'pin_config' could be dereferenced if initialization failed.
> 4. 'clock->ptp' could be NULL if ptp_clock_register() failed.
>
> Fix these by zero-initializing the event struct, adding a bounds
> check against MAX_PIN_NUM, and adding appropriate NULL guards.
>
> Fixes: 7c39afb394c7 ("net/mlx5: PTP code migration to driver core section")
>
> Signed-off-by: Prathamesh Deshpande <prathameshdeshpande7@gmail.com>
> ---
> v2:
> - Zero-initialize ptp_event to prevent stack information leak [Sashiko].
> - Add bounds check for hardware pin index to prevent OOB access [Sashiko].
> - Add NULL guard for pin_config to handle initialization failures [Sashiko].
> - Add NULL check for clock->ptp as originally intended.
>
> drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c | 12 +++++++++---
> 1 file changed, 9 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> index bd4e042077af..a4d8c5c39abc 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/clock.c
> @@ -1164,12 +1164,18 @@ static int mlx5_pps_event(struct notifier_block *nb,
> pps_nb);
> struct mlx5_core_dev *mdev = clock_state->mdev;
> struct mlx5_clock *clock = mdev->clock;
> - struct ptp_clock_event ptp_event;
> + struct ptp_clock_event ptp_event = {};
> struct mlx5_eqe *eqe = data;
> int pin = eqe->data.pps.pin;
> unsigned long flags;
> u64 ns;
>
> + if (!clock->ptp_info.pin_config)
> + return NOTIFY_OK;
> +
> + if (pin < 0 || pin >= MAX_PIN_NUM)
> + return NOTIFY_OK;
pin is defined as u8 in struct mlx5_eqe_pps, so pin < 0 is dead code.
As for the upper bound: in order to receive a PPS event on a pin, the
user must first configure it via mlx5_ptp_enable, which already
validates the index (rq->extts.index >= clock->ptp_info.n_pins returns
-EINVAL) and since the mtpps register only defines capabilities for 8
pins, so n_pins cannot exceed MAX_PIN_NUM.
Maybe wrap it with WARN_ON_ONCE instead of silently returning, so if
future hardware adds support for more pins we would notice rather than
silently dropping events.
> +
> switch (clock->ptp_info.pin_config[pin].func) {
> case PTP_PF_EXTTS:
> ptp_event.index = pin;
> @@ -1185,8 +1191,8 @@ static int mlx5_pps_event(struct notifier_block *nb,
> } else {
> ptp_event.type = PTP_CLOCK_EXTTS;
> }
> - /* TODOL clock->ptp can be NULL if ptp_clock_register fails */
> - ptp_clock_event(clock->ptp, &ptp_event);
> + if (clock->ptp)
> + ptp_clock_event(clock->ptp, &ptp_event);
> break;
> case PTP_PF_PEROUT:
> if (clock->shared) {
^ permalink raw reply
* Re: [PATCH net-next v11 03/14] net: Add lease info to queue-get response
From: Daniel Borkmann @ 2026-04-09 13:52 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, bpf, davem, razor, pabeni, willemb, sdf, john.fastabend,
martin.lau, jordan, maciej.fijalkowski, magnus.karlsson, dw, toke,
yangzhenze, wangdongdong.6
In-Reply-To: <731d2749-abf6-403c-a1f4-ffe9c8d1e8ad@iogearbox.net>
On 4/9/26 3:43 PM, Daniel Borkmann wrote:
> On 4/9/26 12:12 AM, Jakub Kicinski wrote:
>> On Wed, 8 Apr 2026 11:09:34 +0200 Daniel Borkmann wrote:
>>>>> +void netif_put_rx_queue_lease_locked(struct net_device *orig_dev,
>>>>> + struct net_device *dev)
>>>>> +{
>>>>> + if (orig_dev != dev)
>>>>> + netdev_unlock(dev);
>>>>> +}
>>>>
>>>> Pretty sure I already complained about these ugly helpers.
>>>> I'll try to find the time tomorrow to come up with something better.
>>>
>>> Ok, sounds good. Happy to adapt if you find something better and then I'll
>>> work this into the series, and also integrate the things mentioned in my
>>> cover letter reply (netkit nl dump + additional tests).
>>
>> Hi! How would you feel about something like the following on top?
>>
>> --->8----------
>>
>> net: remove the netif_get_rx_queue_lease_locked() helpers
>>
>> The netif_get_rx_queue_lease_locked() API hides the locking
>> and the descend onto the leased queue. Making the code
>> harder to follow (at least to me). Remove the API and open
>> code the descend a bit. Most of the code now looks like:
>>
>> if (!leased)
>> return __helper(x);
>>
>> hw_rxq = ..
>> netdev_lock(hw_rxq->dev);
>> ret = __helper(x);
>> netdev_unlock(hw_rxq->dev);
>>
>> return ret;
>>
>> Of course if we have more code paths that need the wrapping
>> we may need to revisit. For now, IMHO, having to know what
>> netif_get_rx_queue_lease_locked() does is not worth the 20LoC
>> it saves.
>>
>> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> Thanks for looking into it! That looks good to me. I've also retested that
> it still works.
>
> Maybe small nits could be below to move the netif_is_queue_leasee into the
> netdev_rx_queue.h header since its used outside of core and it might be
> worth to also have the lock assertion in netdev_queue_get_dma_dev.
>
> Do you want me to add your patch on top for a v12 of the series?
>
> Thanks,
> Daniel
>
> include/net/netdev_rx_queue.h | 2 ++
> net/core/dev.h | 1 -
> net/core/netdev_queues.c | 2 ++
> net/xdp/xsk.c | 2 --
> 4 files changed, 4 insertions(+), 3 deletions(-)
>
> diff --git a/include/net/netdev_rx_queue.h b/include/net/netdev_rx_queue.h
> index 9415a94d333d..e9f7f098609b 100644
> --- a/include/net/netdev_rx_queue.h
> +++ b/include/net/netdev_rx_queue.h
> @@ -76,6 +76,8 @@ struct netdev_rx_queue *
> __netif_get_rx_queue_lease(struct net_device **dev, unsigned int *rxq,
> enum netif_lease_dir dir);
>
> +bool netif_is_queue_leasee(const struct net_device *dev);
> +
> int netdev_rx_queue_restart(struct net_device *dev, unsigned int rxq);
> void netdev_rx_queue_lease(struct netdev_rx_queue *rxq_dst,
> struct netdev_rx_queue *rxq_src);
> diff --git a/net/core/dev.h b/net/core/dev.h
> index 376bac4a82da..95edb2d4eff8 100644
> --- a/net/core/dev.h
> +++ b/net/core/dev.h
> @@ -101,7 +101,6 @@ int netdev_queue_config_validate(struct net_device *dev, int rxq_idx,
>
> bool netif_rxq_has_mp(struct net_device *dev, unsigned int rxq_idx);
> bool netif_rxq_is_leased(struct net_device *dev, unsigned int rxq_idx);
> -bool netif_is_queue_leasee(const struct net_device *dev);
(Ok, if so then netif_rxq_is_leased would have to move too..
maybe its fine as-is then.)
Thanks,
Daniel
^ permalink raw reply
* Re: [PATCH RFC net-next 0/4] improve hw flow offload byte accounting
From: Pablo Neira Ayuso @ 2026-04-09 13:52 UTC (permalink / raw)
To: Daniel Golle
Cc: Felix Fietkau, John Crispin, Lorenzo Bianconi, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Matthias Brugger, AngeloGioacchino Del Regno, Simon Horman,
Florian Westphal, Phil Sutter, netdev, linux-kernel,
linux-arm-kernel, linux-mediatek, netfilter-devel, coreteam
In-Reply-To: <cover.1775739840.git.daniel@makrotopia.org>
On Thu, Apr 09, 2026 at 02:07:22PM +0100, Daniel Golle wrote:
> Hardware flow counters report raw byte counts whose semantics
> vary by vendor -- some count ingress L2 frames, others egress
> L2, others L3. The nf_flow_table framework currently passes
> these bytes straight to conntrack without conversion, and
> sub-interfaces (VLAN, PPPoE) that are bypassed by hw offload
> never see any counter updates at all.
I see, but that is part of the feature itself? Why pretend that these
interface are really seeing traffic while they don't. This aspiration
of trying to do all hardware offload fully transparent (when it is not
the case, not mentioning semantic changes in how packet handling is
done compared to the software plane) does not sound convincing to me.
On top of this, this issue also exists in the software plane: Devices
that are bypasses do not get their counters bumped.
Maybe if this is really a requirement, then this should address the
issue for software too, but is it worth the effort to add
infrastructure for this purpose?
> This series lets drivers declare what their counters represent,
> so the framework can normalize to L3 for conntrack and
> propagate per-layer stats to encap sub-interfaces.
>
> Questions:
> - Sub-interface stats accesses vlan_dev_priv() directly --
> should there be a generic netdev callback instead?
> - Are there hw offload drivers whose counters do not fit the
> ingress-L2 / egress-L2 / L3 model?
>
> Daniel Golle (4):
> net: flow_offload: let drivers report byte counter semantics
> nf_flow_table: track sub-interface and bridge ifindex in flow tuple
> nf_flow_table: convert hw byte counts and update sub-interface stats
> net: ethernet: mtk_eth_soc: report INGRESS_L2 byte_type in flow stats
>
> .../net/ethernet/mediatek/mtk_ppe_offload.c | 1 +
> include/net/flow_offload.h | 7 +
> include/net/netfilter/nf_flow_table.h | 5 +
> net/netfilter/nf_flow_table_core.c | 2 +
> net/netfilter/nf_flow_table_offload.c | 174 +++++++++++++++++-
> net/netfilter/nf_flow_table_path.c | 8 +
> 6 files changed, 195 insertions(+), 2 deletions(-)
>
> --
> 2.53.0
^ permalink raw reply
* RE: [PATCH net-next v3 04/13] net: renesas: rswitch: add register definitions for vlan support
From: Michael Dege @ 2026-04-09 13:45 UTC (permalink / raw)
To: Paolo Abeni, Yoshihiro Shimoda, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, niklas.soderlund, Paul Barker
Cc: netdev@vger.kernel.org, linux-renesas-soc@vger.kernel.org,
linux-kernel@vger.kernel.org
In-Reply-To: <9c101981-4a85-48c3-ad0c-c16a362929eb@redhat.com>
Hello Paolo,
Thank you for your comment.
> -----Original Message-----
> From: Paolo Abeni <pabeni@redhat.com>
> Sent: Thursday, April 2, 2026 3:03 PM
> To: Michael Dege <michael.dege@renesas.com>; Yoshihiro Shimoda <yoshihiro.shimoda.uh@renesas.com>;
> Andrew Lunn <andrew+netdev@lunn.ch>; David S. Miller <davem@davemloft.net>; Eric Dumazet
> <edumazet@google.com>; Jakub Kicinski <kuba@kernel.org>; niklas.soderlund
> <niklas.soderlund@ragnatech.se>; Paul Barker <paul@pbarker.dev>
> Cc: netdev@vger.kernel.org; linux-renesas-soc@vger.kernel.org; linux-kernel@vger.kernel.org
> Subject: Re: [PATCH net-next v3 04/13] net: renesas: rswitch: add register definitions for vlan
> support
>
> On 3/31/26 12:03 PM, Michael Dege wrote:
> @@ -847,6 +903,98 @@ enum rswitch_gwca_mode {
> > #define FWMACAGC_MACAGOG BIT(28)
> > #define FWMACAGC_MACDESOG BIT(29)
> >
> > +//FWMACTL0
>
> Please always use /* */ for comments
Unfortunately ,I missed this. Will be fixed in the next version.
Best regards,
Michael
>
> /P
^ permalink raw reply
* RE: [net-next,v3,04/13] net: renesas: rswitch: add register definitions for vlan support
From: Michael Dege @ 2026-04-09 13:43 UTC (permalink / raw)
To: Paolo Abeni
Cc: paul@pbarker.dev, niklas.soderlund, kuba@kernel.org,
Yoshihiro Shimoda, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, edumazet@google.com,
linux-renesas-soc@vger.kernel.org, andrew+netdev@lunn.ch,
davem@davemloft.net
In-Reply-To: <20260402125919.234448-1-pabeni@redhat.com>
Hello Paolo,
Thank you for the review comments.
> -----Original Message-----
> From: Paolo Abeni <pabeni@redhat.com>
> Sent: Thursday, April 2, 2026 2:59 PM
> To: Michael Dege <michael.dege@renesas.com>
> Cc: paul@pbarker.dev; niklas.soderlund <niklas.soderlund@ragnatech.se>; kuba@kernel.org; Yoshihiro
> Shimoda <yoshihiro.shimoda.uh@renesas.com>; netdev@vger.kernel.org; linux-kernel@vger.kernel.org;
> edumazet@google.com; pabeni@redhat.com; linux-renesas-soc@vger.kernel.org; andrew+netdev@lunn.ch;
> davem@davemloft.net
> Subject: Re: [net-next,v3,04/13] net: renesas: rswitch: add register definitions for vlan support
>
> This is an AI-generated review of your patch. The human sending this email has considered the AI
> review valid, or at least plausible.
>
> For local reproduction steps see
> https://netdev-ai.bots.linux.dev/ai-
> local.html&data=05%7C02%7Cmichael.dege%40renesas.com%7Caf9485ccd5524c5f84e908de90b7afa0%7C53d82571da19
> 47e49cb4625a166a4a2a%7C0%7C0%7C639107315768063102%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYi
> OiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C&sdata=K9VAYytiJjTcdyrv98
> jVvkUrYLDTdRFL3HPzVLwEm1s%3D&reserved=0
> ---
> net: renesas: rswitch: add register definitions for vlan support
>
> This commit adds missing register and bit definitions for vlan support in the Renesas R-Switch driver.
>
> > diff --git a/drivers/net/ethernet/renesas/rswitch.h
> > b/drivers/net/ethernet/renesas/rswitch.h
> > index 340524d995ac..15d3fa48b0e3 100644
> > --- a/drivers/net/ethernet/renesas/rswitch.h
> > +++ b/drivers/net/ethernet/renesas/rswitch.h
>
> [ ... ]
>
> > @@ -847,6 +903,98 @@ enum rswitch_gwca_mode {
> > #define FWMACAGC_MACAGOG BIT(28)
> > #define FWMACAGC_MACDESOG BIT(29)
> >
> > +//FWMACTL0
>
> [ ... ]
>
> > +// FWVLANTEM
> > +#define VLANTUEN GENMASK(28, 16)
> > +#define VLANTEN GENAMSK(12, 0)
> ^^^^^^^^
>
> Is GENAMSK a typo? The correct macro is GENMASK, as used on the line immediately above for VLANTUEN.
> GENAMSK is not defined in the kernel and will cause compilation errors if VLANTEN is used.
Yes, this was a typo. Will be fixed in the next version
Best regards,
Michael
>
> > +
> > +// FWVLANTS
>
> [ ... ]
^ permalink raw reply
* Re: [PATCH net-next v11 03/14] net: Add lease info to queue-get response
From: Daniel Borkmann @ 2026-04-09 13:43 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, bpf, davem, razor, pabeni, willemb, sdf, john.fastabend,
martin.lau, jordan, maciej.fijalkowski, magnus.karlsson, dw, toke,
yangzhenze, wangdongdong.6
In-Reply-To: <20260408151251.72bd2482@kernel.org>
On 4/9/26 12:12 AM, Jakub Kicinski wrote:
> On Wed, 8 Apr 2026 11:09:34 +0200 Daniel Borkmann wrote:
>>>> +void netif_put_rx_queue_lease_locked(struct net_device *orig_dev,
>>>> + struct net_device *dev)
>>>> +{
>>>> + if (orig_dev != dev)
>>>> + netdev_unlock(dev);
>>>> +}
>>>
>>> Pretty sure I already complained about these ugly helpers.
>>> I'll try to find the time tomorrow to come up with something better.
>>
>> Ok, sounds good. Happy to adapt if you find something better and then I'll
>> work this into the series, and also integrate the things mentioned in my
>> cover letter reply (netkit nl dump + additional tests).
>
> Hi! How would you feel about something like the following on top?
>
> --->8----------
>
> net: remove the netif_get_rx_queue_lease_locked() helpers
>
> The netif_get_rx_queue_lease_locked() API hides the locking
> and the descend onto the leased queue. Making the code
> harder to follow (at least to me). Remove the API and open
> code the descend a bit. Most of the code now looks like:
>
> if (!leased)
> return __helper(x);
>
> hw_rxq = ..
> netdev_lock(hw_rxq->dev);
> ret = __helper(x);
> netdev_unlock(hw_rxq->dev);
>
> return ret;
>
> Of course if we have more code paths that need the wrapping
> we may need to revisit. For now, IMHO, having to know what
> netif_get_rx_queue_lease_locked() does is not worth the 20LoC
> it saves.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
Thanks for looking into it! That looks good to me. I've also retested that
it still works.
Maybe small nits could be below to move the netif_is_queue_leasee into the
netdev_rx_queue.h header since its used outside of core and it might be
worth to also have the lock assertion in netdev_queue_get_dma_dev.
Do you want me to add your patch on top for a v12 of the series?
Thanks,
Daniel
include/net/netdev_rx_queue.h | 2 ++
net/core/dev.h | 1 -
net/core/netdev_queues.c | 2 ++
net/xdp/xsk.c | 2 --
4 files changed, 4 insertions(+), 3 deletions(-)
diff --git a/include/net/netdev_rx_queue.h b/include/net/netdev_rx_queue.h
index 9415a94d333d..e9f7f098609b 100644
--- a/include/net/netdev_rx_queue.h
+++ b/include/net/netdev_rx_queue.h
@@ -76,6 +76,8 @@ struct netdev_rx_queue *
__netif_get_rx_queue_lease(struct net_device **dev, unsigned int *rxq,
enum netif_lease_dir dir);
+bool netif_is_queue_leasee(const struct net_device *dev);
+
int netdev_rx_queue_restart(struct net_device *dev, unsigned int rxq);
void netdev_rx_queue_lease(struct netdev_rx_queue *rxq_dst,
struct netdev_rx_queue *rxq_src);
diff --git a/net/core/dev.h b/net/core/dev.h
index 376bac4a82da..95edb2d4eff8 100644
--- a/net/core/dev.h
+++ b/net/core/dev.h
@@ -101,7 +101,6 @@ int netdev_queue_config_validate(struct net_device *dev, int rxq_idx,
bool netif_rxq_has_mp(struct net_device *dev, unsigned int rxq_idx);
bool netif_rxq_is_leased(struct net_device *dev, unsigned int rxq_idx);
-bool netif_is_queue_leasee(const struct net_device *dev);
void __netif_mp_uninstall_rxq(struct netdev_rx_queue *rxq,
const struct pp_memory_provider_params *p);
diff --git a/net/core/netdev_queues.c b/net/core/netdev_queues.c
index 5597af86591b..73fb28087a93 100644
--- a/net/core/netdev_queues.c
+++ b/net/core/netdev_queues.c
@@ -40,6 +40,8 @@ struct device *netdev_queue_get_dma_dev(struct net_device *dev,
struct netdev_rx_queue *hw_rxq;
struct device *dma_dev;
+ netdev_ops_assert_locked(dev);
+
/* Only RX side supports queue leasing today. */
if (type != NETDEV_QUEUE_TYPE_RX || !netif_rxq_is_leased(dev, idx))
return __netdev_queue_get_dma_dev(dev, idx);
diff --git a/net/xdp/xsk.c b/net/xdp/xsk.c
index 616cd7b42502..7da620aa11d6 100644
--- a/net/xdp/xsk.c
+++ b/net/xdp/xsk.c
@@ -31,8 +31,6 @@
#include <net/netdev_rx_queue.h>
#include <net/xdp.h>
-#include "../core/dev.h"
-
#include "xsk_queue.h"
#include "xdp_umem.h"
#include "xsk.h"
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v2 1/2] drm/drm_ras: Add clear-error-counter netlink command to drm_ras
From: Rodrigo Vivi @ 2026-04-09 13:37 UTC (permalink / raw)
To: Tauro, Riana
Cc: intel-xe, dri-devel, netdev, Zack McKevitt, joonas.lahtinen,
aravind.iddamsetty, anshuman.gupta, simona.vetter, airlied,
pratik.bari, joshua.santosh.ranjan, ashwin.kumar.kulkarni,
shubham.kumar, ravi.kishore.koppuravuri, raag.jadav,
anvesh.bakwad, maarten.lankhorst, Jakub Kicinski, Lijo Lazar,
Hawking Zhang, David S. Miller, Paolo Abeni, Eric Dumazet
In-Reply-To: <e7978696-eff6-4c1f-ab0f-047dccb18b59@intel.com>
On Thu, Apr 09, 2026 at 12:51:44PM +0530, Tauro, Riana wrote:
> Hi Zack
>
> Could you please take a look at this patch if applicable to your usecase.
> Please let me know if any
> changes are required
>
> @Rodrigo This is already reviewed by Jakub and Raag.
> If there are no opens, can this be merged via drm_misc
if we push this to drm-misc-next, it might take a few weeks to propagate
back to drm-xe-next. With other work from you and Raag going fast pace
on drm-xe-next around this area, I'm afraid it could cause some conflicts.
It is definitely fine by me, but another option is to get ack from
drm-misc maintainers to get this through drm-xe-next.
so, really okay with drm-misc-next?
>
> Thanks
> Riana
>
> On 4/9/2026 1:03 PM, Riana Tauro wrote:
> > Introduce a new 'clear-error-counter' drm_ras command to reset the counter
> > value for a specific error counter of a given node.
> >
> > The command is a 'do' netlink request with 'node-id' and 'error-id'
> > as parameters with no response payload.
> >
> > Usage:
> >
> > $ sudo ynl --family drm_ras --do clear-error-counter --json \
> > '{"node-id":1, "error-id":1}'
> > None
> >
> > Cc: Jakub Kicinski <kuba@kernel.org>
> > Cc: Zack McKevitt <zachary.mckevitt@oss.qualcomm.com>
> > Cc: Lijo Lazar <lijo.lazar@amd.com>
> > Cc: Hawking Zhang <Hawking.Zhang@amd.com>
> > Cc: David S. Miller <davem@davemloft.net>
> > Cc: Paolo Abeni <pabeni@redhat.com>
> > Cc: Eric Dumazet <edumazet@google.com>
> > Signed-off-by: Riana Tauro <riana.tauro@intel.com>
> > Reviewed-by: Jakub Kicinski <kuba@kernel.org>
> > Reviewed-by: Raag Jadav <raag.jadav@intel.com>
> > ---
> > Documentation/gpu/drm-ras.rst | 8 +++++
> > Documentation/netlink/specs/drm_ras.yaml | 13 ++++++-
> > drivers/gpu/drm/drm_ras.c | 43 +++++++++++++++++++++++-
> > drivers/gpu/drm/drm_ras_nl.c | 13 +++++++
> > drivers/gpu/drm/drm_ras_nl.h | 2 ++
> > include/drm/drm_ras.h | 11 ++++++
> > include/uapi/drm/drm_ras.h | 1 +
> > 7 files changed, 89 insertions(+), 2 deletions(-)
> >
> > diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
> > index 70b246a78fc8..4636e68f5678 100644
> > --- a/Documentation/gpu/drm-ras.rst
> > +++ b/Documentation/gpu/drm-ras.rst
> > @@ -52,6 +52,8 @@ User space tools can:
> > as a parameter.
> > * Query specific error counter values with the ``get-error-counter`` command, using both
> > ``node-id`` and ``error-id`` as parameters.
> > +* Clear specific error counters with the ``clear-error-counter`` command, using both
> > + ``node-id`` and ``error-id`` as parameters.
> > YAML-based Interface
> > --------------------
> > @@ -101,3 +103,9 @@ Example: Query an error counter for a given node
> > sudo ynl --family drm_ras --do get-error-counter --json '{"node-id":0, "error-id":1}'
> > {'error-id': 1, 'error-name': 'error_name1', 'error-value': 0}
> > +Example: Clear an error counter for a given node
> > +
> > +.. code-block:: bash
> > +
> > + sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
> > + None
> > diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
> > index 79af25dac3c5..e113056f8c01 100644
> > --- a/Documentation/netlink/specs/drm_ras.yaml
> > +++ b/Documentation/netlink/specs/drm_ras.yaml
> > @@ -99,7 +99,7 @@ operations:
> > flags: [admin-perm]
> > do:
> > request:
> > - attributes:
> > + attributes: &id-attrs
> > - node-id
> > - error-id
> > reply:
> > @@ -113,3 +113,14 @@ operations:
> > - node-id
> > reply:
> > attributes: *errorinfo
> > + -
> > + name: clear-error-counter
> > + doc: >-
> > + Clear error counter for a given node.
> > + The request includes the error-id and node-id of the
> > + counter to be cleared.
> > + attribute-set: error-counter-attrs
> > + flags: [admin-perm]
> > + do:
> > + request:
> > + attributes: *id-attrs
> > diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
> > index b2fa5ab86d87..d6eab29a1394 100644
> > --- a/drivers/gpu/drm/drm_ras.c
> > +++ b/drivers/gpu/drm/drm_ras.c
> > @@ -26,7 +26,7 @@
> > * efficient lookup by ID. Nodes can be registered or unregistered
> > * dynamically at runtime.
> > *
> > - * A Generic Netlink family `drm_ras` exposes two main operations to
> > + * A Generic Netlink family `drm_ras` exposes the below operations to
> > * userspace:
> > *
> > * 1. LIST_NODES: Dump all currently registered RAS nodes.
> > @@ -37,6 +37,10 @@
> > * Returns all counters of a node if only Node ID is provided or specific
> > * error counters.
> > *
> > + * 3. CLEAR_ERROR_COUNTER: Clear error counter of a given node.
> > + * Userspace must provide Node ID, Error ID.
> > + * Clears specific error counter of a node if supported.
> > + *
> > * Node registration:
> > *
> > * - drm_ras_node_register(): Registers a new node and assigns
> > @@ -66,6 +70,8 @@
> > * operation, fetching all counters from a specific node.
> > * - drm_ras_nl_get_error_counter_doit(): Implements the GET_ERROR_COUNTER doit
> > * operation, fetching a counter value from a specific node.
> > + * - drm_ras_nl_clear_error_counter_doit(): Implements the CLEAR_ERROR_COUNTER doit
> > + * operation, clearing a counter value from a specific node.
> > */
> > static DEFINE_XARRAY_ALLOC(drm_ras_xa);
> > @@ -314,6 +320,41 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
> > return doit_reply_value(info, node_id, error_id);
> > }
> > +/**
> > + * drm_ras_nl_clear_error_counter_doit() - Clear an error counter of a node
> > + * @skb: Netlink message buffer
> > + * @info: Generic Netlink info containing attributes of the request
> > + *
> > + * Extracts the node ID and error ID from the netlink attributes and
> > + * clears the current value.
> > + *
> > + * Return: 0 on success, or negative errno on failure.
> > + */
> > +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> > + struct genl_info *info)
> > +{
> > + struct drm_ras_node *node;
> > + u32 node_id, error_id;
> > +
> > + if (!info->attrs ||
> > + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
> > + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID))
> > + return -EINVAL;
> > +
> > + node_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
> > + error_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
> > +
> > + node = xa_load(&drm_ras_xa, node_id);
> > + if (!node || !node->clear_error_counter)
> > + return -ENOENT;
> > +
> > + if (error_id < node->error_counter_range.first ||
> > + error_id > node->error_counter_range.last)
> > + return -EINVAL;
> > +
> > + return node->clear_error_counter(node, error_id);
> > +}
> > +
> > /**
> > * drm_ras_node_register() - Register a new RAS node
> > * @node: Node structure to register
> > diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
> > index 16803d0c4a44..dea1c1b2494e 100644
> > --- a/drivers/gpu/drm/drm_ras_nl.c
> > +++ b/drivers/gpu/drm/drm_ras_nl.c
> > @@ -22,6 +22,12 @@ static const struct nla_policy drm_ras_get_error_counter_dump_nl_policy[DRM_RAS_
> > [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> > };
> > +/* DRM_RAS_CMD_CLEAR_ERROR_COUNTER - do */
> > +static const struct nla_policy drm_ras_clear_error_counter_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID + 1] = {
> > + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
> > + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
> > +};
> > +
> > /* Ops table for drm_ras */
> > static const struct genl_split_ops drm_ras_nl_ops[] = {
> > {
> > @@ -43,6 +49,13 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
> > .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID,
> > .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DUMP,
> > },
> > + {
> > + .cmd = DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
> > + .doit = drm_ras_nl_clear_error_counter_doit,
> > + .policy = drm_ras_clear_error_counter_nl_policy,
> > + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
> > + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
> > + },
> > };
> > struct genl_family drm_ras_nl_family __ro_after_init = {
> > diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
> > index 06ccd9342773..a398643572a5 100644
> > --- a/drivers/gpu/drm/drm_ras_nl.h
> > +++ b/drivers/gpu/drm/drm_ras_nl.h
> > @@ -18,6 +18,8 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
> > struct genl_info *info);
> > int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
> > struct netlink_callback *cb);
> > +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
> > + struct genl_info *info);
> > extern struct genl_family drm_ras_nl_family;
> > diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
> > index 5d50209e51db..f2a787bc4f64 100644
> > --- a/include/drm/drm_ras.h
> > +++ b/include/drm/drm_ras.h
> > @@ -58,6 +58,17 @@ struct drm_ras_node {
> > int (*query_error_counter)(struct drm_ras_node *node, u32 error_id,
> > const char **name, u32 *val);
> > + /**
> > + * @clear_error_counter:
> > + *
> > + * This callback is used by drm_ras to clear a specific error counter.
> > + * Driver should implement this callback to support clearing error counters
> > + * of a node.
> > + *
> > + * Returns: 0 on success, negative error code on failure.
> > + */
> > + int (*clear_error_counter)(struct drm_ras_node *node, u32 error_id);
> > +
> > /** @priv: Driver private data */
> > void *priv;
> > };
> > diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
> > index 5f40fa5b869d..218a3ee86805 100644
> > --- a/include/uapi/drm/drm_ras.h
> > +++ b/include/uapi/drm/drm_ras.h
> > @@ -41,6 +41,7 @@ enum {
> > enum {
> > DRM_RAS_CMD_LIST_NODES = 1,
> > DRM_RAS_CMD_GET_ERROR_COUNTER,
> > + DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
> > __DRM_RAS_CMD_MAX,
> > DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
^ permalink raw reply
* [PATCH net v2] net: phy: fix a return path in get_phy_c45_ids()
From: Charles Perry @ 2026-04-09 13:36 UTC (permalink / raw)
To: netdev
Cc: Charles Perry, Andrew Lunn, Heiner Kallweit, Russell King,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Florian Fainelli, linux-kernel
The return value of phy_c45_probe_present() is stored in "ret", not
"phy_reg", fix this. "phy_reg" always has a positive value if we reach
this return path (since it would have returned earlier otherwise), which
means that the original goal of the patch of not considering -ENODEV
fatal wasn't achieved.
Fixes: 17b447539408 ("net: phy: c45 scanning: Don't consider -ENODEV fatal")
Signed-off-by: Charles Perry <charles.perry@microchip.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
---
Notes:
Changes in v2:
- Collect Andrew's Reviewed-by
- Send to net instead of net-next
- fix one typo in the commit message
drivers/net/phy/phy_device.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/phy/phy_device.c b/drivers/net/phy/phy_device.c
index 81984d4ebb7c..810327fa886a 100644
--- a/drivers/net/phy/phy_device.c
+++ b/drivers/net/phy/phy_device.c
@@ -973,8 +973,8 @@ static int get_phy_c45_ids(struct mii_bus *bus, int addr,
/* returning -ENODEV doesn't stop bus
* scanning
*/
- return (phy_reg == -EIO ||
- phy_reg == -ENODEV) ? -ENODEV : -EIO;
+ return (ret == -EIO ||
+ ret == -ENODEV) ? -ENODEV : -EIO;
if (!ret)
continue;
--
2.47.3
^ permalink raw reply related
* RE: [Intel-wired-lan] [PATCH iwl-next v2 08/10] ice: program ACL entry
From: Loktionov, Aleksandr @ 2026-04-09 13:35 UTC (permalink / raw)
To: Marcin Szycik, intel-wired-lan@lists.osuosl.org
Cc: netdev@vger.kernel.org, Penigalapati, Sandeep, S, Ananth,
alexander.duyck@gmail.com, Cao, Chinh T, Nguyen, Anthony L
In-Reply-To: <20260409120003.2719-9-marcin.szycik@linux.intel.com>
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Marcin Szycik
> Sent: Thursday, April 9, 2026 2:00 PM
> To: intel-wired-lan@lists.osuosl.org
> Cc: netdev@vger.kernel.org; Penigalapati, Sandeep
> <sandeep.penigalapati@intel.com>; S, Ananth <ananth.s@intel.com>;
> alexander.duyck@gmail.com; Marcin Szycik
> <marcin.szycik@linux.intel.com>; Cao, Chinh T <chinh.t.cao@intel.com>;
> Nguyen, Anthony L <anthony.l.nguyen@intel.com>
> Subject: [Intel-wired-lan] [PATCH iwl-next v2 08/10] ice: program ACL
> entry
>
> From: Real Valiquette <real.valiquette@intel.com>
>
> Complete the filter programming process; set the flow entry and action
> into the scenario and write it to hardware. Configure the VSI for ACL
> filters.
>
> Co-developed-by: Chinh Cao <chinh.t.cao@intel.com>
> Signed-off-by: Chinh Cao <chinh.t.cao@intel.com>
> Signed-off-by: Real Valiquette <real.valiquette@intel.com>
> Co-developed-by: Tony Nguyen <anthony.l.nguyen@intel.com>
> Signed-off-by: Tony Nguyen <anthony.l.nguyen@intel.com>
> Signed-off-by: Marcin Szycik <marcin.szycik@linux.intel.com>
> ---
> v2:
> * Use plain alloc instead of devm_ for ice_flow_entry::acts
> * Use FIELD_PREP_CONST() for ICE_ACL_RX_*_MISS_CNTR
> * Fix wrong struct ice_acl_act_entry alloc count in
> ice_flow_acl_add_scen_entry_sync() - was e->entry_sz, which is an
> unrelated value
> * Only set acts_cnt after successful allocation in
> ice_flow_acl_add_scen_entry_sync()
> * Return -EINVAL instead of -ENOSPC on wrong index in
> ice_acl_scen_free_entry_idx()
> ---
> drivers/net/ethernet/intel/ice/ice.h | 2 +
> drivers/net/ethernet/intel/ice/ice_acl.h | 21 +
> .../net/ethernet/intel/ice/ice_adminq_cmd.h | 2 +
> drivers/net/ethernet/intel/ice/ice_flow.h | 3 +
> drivers/net/ethernet/intel/ice/ice_acl.c | 53 ++-
> drivers/net/ethernet/intel/ice/ice_acl_ctrl.c | 251 +++++++++++
> drivers/net/ethernet/intel/ice/ice_acl_main.c | 4 +
> .../ethernet/intel/ice/ice_ethtool_ntuple.c | 48 ++-
> drivers/net/ethernet/intel/ice/ice_flow.c | 395
> ++++++++++++++++++
> drivers/net/ethernet/intel/ice/ice_lib.c | 10 +-
> 10 files changed, 782 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/ice/ice.h
> b/drivers/net/ethernet/intel/ice/ice.h
> index 9e6643931022..f9a43daf04fe 100644
> --- a/drivers/net/ethernet/intel/ice/ice.h
> +++ b/drivers/net/ethernet/intel/ice/ice.h
> @@ -1061,6 +1061,8 @@ void ice_aq_prep_for_event(struct ice_pf *pf,
> struct ice_aq_task *task,
> u16 opcode);
> int ice_aq_wait_for_event(struct ice_pf *pf, struct ice_aq_task
> *task,
> unsigned long timeout);
> +int ice_ntuple_update_list_entry(struct ice_pf *pf,
> + struct ice_ntuple_fltr *input, int
> fltr_idx);
> int ice_open(struct net_device *netdev); int
> ice_open_internal(struct net_device *netdev); int ice_stop(struct
> net_device *netdev); diff --git
> a/drivers/net/ethernet/intel/ice/ice_acl.h
> b/drivers/net/ethernet/intel/ice/ice_acl.h
> index 3a4adcf368cf..0b5651401eb7 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl.h
> +++ b/drivers/net/ethernet/intel/ice/ice_acl.h
> @@ -39,6 +39,7 @@ struct ice_acl_tbl {
> DECLARE_BITMAP(avail, ICE_AQC_ACL_ALLOC_UNITS); };
>
> +#define ICE_MAX_ACL_TCAM_ENTRY (ICE_AQC_ACL_TCAM_DEPTH *
> +ICE_AQC_ACL_SLICES)
> enum ice_acl_entry_prio {
> ICE_ACL_PRIO_LOW = 0,
> ICE_ACL_PRIO_NORMAL,
> @@ -65,6 +66,11 @@ struct ice_acl_scen {
> * participate in this scenario
> */
> DECLARE_BITMAP(act_mem_bitmap, ICE_AQC_MAX_ACTION_MEMORIES);
...
> + /* Determine number of cascaded TCAMs */
> + num_cscd = DIV_ROUND_UP(scen->width,
> ICE_AQC_ACL_KEY_WIDTH_BYTES);
> +
> + entry_tcam = ICE_ACL_TBL_TCAM_IDX(scen->start);
> + idx = ICE_ACL_TBL_TCAM_ENTRY_IDX(scen->start + *entry_idx);
> +
> + for (u8 i = 0; i < num_cscd; i++) {
> + /* If the key spans more than one TCAM in the case of
> cascaded
> + * TCAMs, the key and key inverts need to be properly
> split
> + * among TCAMs.E.g.bytes 0 - 4 go to an index in the
> first TCAM
"E.g.bytes" -> "E.g. bytes"
> + * and bytes 5 - 9 go to the same index in the next
> TCAM, etc.
> + * If the entry spans more than one TCAM in a cascaded
> TCAM
> + * mode, the programming of the entries in the TCAMs
> must be in
> + * reversed order - the TCAM entry of the rightmost TCAM
> should
> + * be programmed first; the TCAM entry of the leftmost
> TCAM
> + * should be programmed last.
> + */
> + offset = num_cscd - i - 1;
> + memcpy(&buf.entry_key.val,
> + &keys[offset * sizeof(buf.entry_key.val)],
> + sizeof(buf.entry_key.val));
> + memcpy(&buf.entry_key_invert.val,
> + &inverts[offset *
> sizeof(buf.entry_key_invert.val)],
> + sizeof(buf.entry_key_invert.val));
> + err = ice_aq_program_acl_entry(hw, entry_tcam + offset,
> idx,
> + &buf, NULL);
> + if (err) {
> + ice_debug(hw, ICE_DBG_ACL, "aq program acl entry
> failed status: %d\n",
> + err);
> + goto out;
> + }
> + }
> +
> + err = ice_acl_prog_act(hw, scen, acts, acts_cnt, *entry_idx);
> +
> +out:
> + if (err) {
> + ice_acl_rem_entry(hw, scen, *entry_idx);
> + *entry_idx = 0;
> + }
> +
> + return err;
> +}
> +
> +/**
> + * ice_acl_prog_act - Program a scenario's action memory
> + * @hw: pointer to the HW struct
> + * @scen: scenario to add the entry to
> + * @acts: pointer to a buffer containing formatted actions
> + * @acts_cnt: indicates the number of actions stored in "acts"
> + * @entry_idx: scenario relative index of the added flow entry
> + *
> + * Return: 0 on success, negative on error */ int
> +ice_acl_prog_act(struct ice_hw *hw, struct ice_acl_scen *scen,
> + struct ice_acl_act_entry *acts, u8 acts_cnt, u16
> entry_idx) {
> + u8 entry_tcam, num_cscd, i, actx_idx = 0;
> + struct ice_aqc_actpair act_buf = {};
> + int err = 0;
> + u16 idx;
> +
> + if (entry_idx >= scen->num_entry)
> + return -ENOSPC;
> +
> + /* Determine number of cascaded TCAMs */
> + num_cscd = DIV_ROUND_UP(scen->width,
> ICE_AQC_ACL_KEY_WIDTH_BYTES);
> +
> + entry_tcam = ICE_ACL_TBL_TCAM_IDX(scen->start);
> + idx = ICE_ACL_TBL_TCAM_ENTRY_IDX(scen->start + entry_idx);
> +
> + for_each_set_bit(i, scen->act_mem_bitmap,
> ICE_AQC_MAX_ACTION_MEMORIES) {
> + struct ice_acl_act_mem *mem = &hw->acl_tbl->act_mems[i];
> +
> + if (actx_idx >= acts_cnt)
> + break;
> + if (mem->member_of_tcam >= entry_tcam &&
> + mem->member_of_tcam < entry_tcam + num_cscd) {
> + memcpy(&act_buf.act[0], &acts[actx_idx],
> + sizeof(struct ice_acl_act_entry));
> +
> + if (++actx_idx < acts_cnt) {
> + memcpy(&act_buf.act[1], &acts[actx_idx],
> + sizeof(struct ice_acl_act_entry));
> + }
> +
> + err = ice_aq_program_actpair(hw, i, idx,
> &act_buf,
> + NULL);
> + if (err) {
> + ice_debug(hw, ICE_DBG_ACL, "program actpair
> failed status: %d\n",
> + err);
> + break;
> + }
> + actx_idx++;
> + }
> + }
> +
> + if (!err && actx_idx < acts_cnt)
> + err = -ENOSPC;
> +
> + return err;
> +}
> +
> +/**
> + * ice_acl_rem_entry - Remove a flow entry from an ACL scenario
> + * @hw: pointer to the HW struct
> + * @scen: scenario to remove the entry from
> + * @entry_idx: the scenario-relative index of the flow entry being
> +removed
> + *
> + * Return: 0 on success, negative on error */ int
> +ice_acl_rem_entry(struct ice_hw *hw, struct ice_acl_scen *scen,
> + u16 entry_idx)
> +{
> + struct ice_aqc_actpair act_buf = {};
> + struct ice_aqc_acl_data buf;
> + u8 entry_tcam, num_cscd, i;
> + int err = 0;
> + u16 idx;
> +
> + if (!scen)
> + return -ENOENT;
> +
> + if (entry_idx >= scen->num_entry)
> + return -ENOSPC;
> +
> + if (!test_bit(entry_idx, scen->entry_bitmap))
> + return -ENOENT;
> +
> + /* Determine number of cascaded TCAMs */
> + num_cscd = DIV_ROUND_UP(scen->width,
> ICE_AQC_ACL_KEY_WIDTH_BYTES);
> +
> + entry_tcam = ICE_ACL_TBL_TCAM_IDX(scen->start);
> + idx = ICE_ACL_TBL_TCAM_ENTRY_IDX(scen->start + entry_idx);
> +
> + /* invalidate the flow entry */
> + memset(&buf, 0, sizeof(buf));
> + for (i = 0; i < num_cscd; i++) {
> + err = ice_aq_program_acl_entry(hw, entry_tcam + i, idx,
> &buf,
> + NULL);
> + if (err)
> + ice_debug(hw, ICE_DBG_ACL, "AQ program ACL entry
> failed status: %d\n",
> + err);
> + }
> +
> + for_each_set_bit(i, scen->act_mem_bitmap,
> ICE_AQC_MAX_ACTION_MEMORIES) {
> + struct ice_acl_act_mem *mem = &hw->acl_tbl->act_mems[i];
> +
> + if (mem->member_of_tcam >= entry_tcam &&
> + mem->member_of_tcam < entry_tcam + num_cscd) {
> + /* Invalidate allocated action pairs */
> + err = ice_aq_program_actpair(hw, i, idx,
> &act_buf,
> + NULL);
> + if (err)
> + ice_debug(hw, ICE_DBG_ACL, "program actpair
> failed status: %d\n",
> + err);
> + }
> + }
> +
> + ice_acl_scen_free_entry_idx(scen, entry_idx);
> +
> + return err;
> +}
> diff --git a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> index 53cca0526756..16228be574ed 100644
> --- a/drivers/net/ethernet/intel/ice/ice_acl_main.c
> +++ b/drivers/net/ethernet/intel/ice/ice_acl_main.c
> @@ -280,6 +280,10 @@ int ice_acl_add_rule_ethtool(struct ice_vsi *vsi,
> struct ethtool_rxnfc *cmd)
> hw_prof->entry_h[hw_prof->cnt++][0] = entry_h;
> }
>
> + input->acl_fltr = true;
> + /* input struct is added to the HW filter list */
> + ice_ntuple_update_list_entry(pf, input, fsp->location);
> +
> return 0;
>
> free_input:
> diff --git a/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c
> b/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c
> index 3e79c0bf40f4..21d4f4e3a1d0 100644
> --- a/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c
> +++ b/drivers/net/ethernet/intel/ice/ice_ethtool_ntuple.c
> @@ -1791,6 +1791,21 @@ void ice_vsi_manage_fdir(struct ice_vsi *vsi,
> bool ena)
> mutex_unlock(&hw->fdir_fltr_lock);
> }
>
> +/**
> + * ice_del_acl_ethtool - delete an ACL rule entry
> + * @hw: pointer to HW instance
> + * @fltr: filter structure
> + *
> + * Return: 0 on success, negative on error */ static int
> +ice_del_acl_ethtool(struct ice_hw *hw, struct ice_ntuple_fltr *fltr)
> {
> + u64 entry;
> +
> + entry = ice_flow_find_entry(hw, ICE_BLK_ACL, fltr->fltr_id);
> + return ice_flow_rem_entry(hw, ICE_BLK_ACL, entry); }
> +
> /**
> * ice_fdir_do_rem_flow - delete flow and possibly add perfect flow
> * @pf: PF structure
> @@ -1824,7 +1839,7 @@ ice_fdir_do_rem_flow(struct ice_pf *pf, enum
> ice_fltr_ptype flow_type)
> *
> * Return: 0 on success and negative on errors
> */
> -static int
> +int
> ice_ntuple_update_list_entry(struct ice_pf *pf, struct
> ice_ntuple_fltr *input,
> int fltr_idx)
> {
> @@ -1843,13 +1858,36 @@ ice_ntuple_update_list_entry(struct ice_pf
> *pf, struct ice_ntuple_fltr *input,
>
> old_fltr = ice_fdir_find_fltr_by_idx(hw, fltr_idx);
> if (old_fltr) {
> - err = ice_fdir_write_all_fltr(pf, old_fltr, false);
> - if (err)
> - return err;
> + if (old_fltr->acl_fltr) {
> + /* ACL filter - if the input buffer is present
> + * then this is an update and we don't want to
> + * delete the filter from the HW. We've already
> + * written the change to the HW at this point, so
> + * just update the SW structures to make sure
> + * everything is hunky-dory. If no input then
> this
> + * is a delete so we should delete the filter
> from
> + * the HW and clean up our SW structures.
> + */
> + if (!input) {
> + err = ice_del_acl_ethtool(hw, old_fltr);
> + if (err)
> + return err;
> + }
> + } else {
> + /* FD filter */
> + err = ice_fdir_write_all_fltr(pf, old_fltr,
> false);
> + if (err)
> + return err;
> + }
> +
> ice_fdir_update_cntrs(hw, old_fltr->flow_type, false,
> false);
> /* update sb-filters count, specific to ring->channel */
> ice_update_per_q_fltr(vsi, old_fltr->orig_q_index,
> false);
> - if (!input && !hw->fdir_fltr_cnt[old_fltr->flow_type])
> + /* Also delete the HW filter info if we have just
> deleted the
> + * last filter of flow_type.
> + */
> + if (!old_fltr->acl_fltr && !input &&
> + !hw->fdir_fltr_cnt[old_fltr->flow_type])
> /* we just deleted the last filter of flow_type
> so we
> * should also delete the HW filter info.
> */
> diff --git a/drivers/net/ethernet/intel/ice/ice_flow.c
> b/drivers/net/ethernet/intel/ice/ice_flow.c
> index dce6d2ffcb15..144d8326d4f9 100644
> --- a/drivers/net/ethernet/intel/ice/ice_flow.c
> +++ b/drivers/net/ethernet/intel/ice/ice_flow.c
> @@ -1744,6 +1744,16 @@ static int ice_flow_rem_entry_sync(struct
> ice_hw *hw, enum ice_block blk,
> return -EINVAL;
>
> if (blk == ICE_BLK_ACL) {
> + int err;
> +
> + if (!entry->prof)
> + return -EINVAL;
> +
> + err = ice_acl_rem_entry(hw, entry->prof->cfg.scen,
> + entry->scen_entry_idx);
> + if (err)
> + return err;
> +
> if (entry->acts_cnt && entry->acts)
> ice_flow_acl_free_act_cntr(hw, entry->acts,
> entry->acts_cnt);
> @@ -1879,10 +1889,34 @@ ice_flow_rem_prof_sync(struct ice_hw *hw, enum
> ice_block blk,
> }
>
> if (blk == ICE_BLK_ACL) {
> + struct ice_aqc_acl_prof_generic_frmt buf;
> + u8 prof_id = 0;
> +
> /* Disassociate the scenario from the profile for the PF
> */
> status = ice_flow_acl_disassoc_scen(hw, prof);
> if (status)
> return status;
> +
> + status = ice_flow_get_hw_prof(hw, blk, prof->id,
> &prof_id);
> + if (status)
> + return status;
> +
> + status = ice_query_acl_prof(hw, prof_id, &buf, NULL);
> + if (status)
> + return status;
> +
> + /* Clear the range-checker if the profile ID is no
> longer
> + * used by any PF
> + */
> + if (!ice_flow_acl_is_prof_in_use(&buf)) {
> + /* Clear the range-checker value for profile ID
> */
> + struct ice_aqc_acl_profile_ranges query_rng_buf =
> {};
> +
> + status = ice_prog_acl_prof_ranges(hw, prof_id,
> + &query_rng_buf,
> NULL);
> + if (status)
> + return status;
> + }
> }
>
> /* Remove all hardware profiles associated with this flow
> profile */ @@ -2214,6 +2248,44 @@ int ice_flow_rem_prof(struct ice_hw
> *hw, enum ice_block blk, u64 prof_id)
> return status;
> }
>
> +/**
> + * ice_flow_find_entry - look for a flow entry using its unique ID
> + * @hw: pointer to the HW struct
> + * @blk: classification stage
> + * @entry_id: unique ID to identify this flow entry
> + *
> + * Look for the flow entry with the specified unique ID in all flow
> +profiles of
> + * the specified classification stage.
> + *
> + * Return: flow entry handle if entry found, ICE_FLOW_ENTRY_ID_INVAL
> +otherwise */
> +u64 ice_flow_find_entry(struct ice_hw *hw, enum ice_block blk, u64
> +entry_id) {
> + struct ice_flow_entry *found = NULL;
> + struct ice_flow_prof *p;
> +
> + mutex_lock(&hw->fl_profs_locks[blk]);
> +
> + list_for_each_entry(p, &hw->fl_profs[blk], l_entry) {
> + struct ice_flow_entry *e;
> +
> + mutex_lock(&p->entries_lock);
> + list_for_each_entry(e, &p->entries, l_entry)
> + if (e->id == entry_id) {
> + found = e;
> + break;
> + }
> + mutex_unlock(&p->entries_lock);
> +
> + if (found)
> + break;
> + }
> +
> + mutex_unlock(&hw->fl_profs_locks[blk]);
> +
> + return found ? ICE_FLOW_ENTRY_HNDL(found) :
> +ICE_FLOW_ENTRY_HANDLE_INVAL; }
> +
> /**
> * ice_flow_acl_check_actions - Checks the ACL rule's actions
> * @hw: pointer to the hardware structure @@ -2541,6 +2613,325 @@
> static int ice_flow_acl_frmt_entry(struct ice_hw *hw,
>
> return err;
> }
> +
> +/**
> + * ice_flow_acl_find_scen_entry_cond - Find an ACL scenario entry
> that matches
> + * the compared data
> + * @prof: pointer to flow profile
> + * @e: pointer to the comparing flow entry
> + * @do_chg_action: decide if we want to change the ACL action
> + * @do_add_entry: decide if we want to add the new ACL entry
> + * @do_rem_entry: decide if we want to remove the current ACL entry
> + *
> + * Find an ACL scenario entry that matches the compared data. Also
> figure out:
> + * a) If we want to change the ACL action
> + * b) If we want to add the new ACL entry
> + * c) If we want to remove the current ACL entry
> + *
> + * Return: ACL scenario entry, or NULL if not found */ static struct
> +ice_flow_entry * ice_flow_acl_find_scen_entry_cond(struct
> ice_flow_prof
> +*prof,
> + struct ice_flow_entry *e, bool
> *do_chg_action,
> + bool *do_add_entry, bool *do_rem_entry) {
> + struct ice_flow_entry *p, *return_entry = NULL;
> +
> + /* Check if:
> + * a) There exists an entry with same matching data, but
> different
> + * priority, then we remove this existing ACL entry. Then,
> we
> + * will add the new entry to the ACL scenario.
> + * b) There exists an entry with same matching data, priority,
> and
> + * result action, then we do nothing
> + * c) There exists an entry with same matching data, priority,
> but
> + * different, action, then do only change the action's
> entry.
Too much of commas, please reduce the number.
> + * d) Else, we add this new entry to the ACL scenario.
> + */
> + *do_chg_action = false;
> + *do_add_entry = true;
> + *do_rem_entry = false;
> + list_for_each_entry(p, &prof->entries, l_entry) {
> + if (memcmp(p->entry, e->entry, p->entry_sz))
> + continue;
> +
> + /* From this point, we have the same matching_data. */
> + *do_add_entry = false;
> + return_entry = p;
> +
> + if (p->priority != e->priority) {
> + /* matching data && !priority */
> + *do_add_entry = true;
> + *do_rem_entry = true;
> + break;
> + }
> +
> + /* From this point, we will have matching_data &&
> priority */
> + if (p->acts_cnt != e->acts_cnt)
> + *do_chg_action = true;
> + for (int i = 0; i < p->acts_cnt; i++) {
> + bool found_not_match = false;
> +
> + for (int j = 0; j < e->acts_cnt; j++)
> + if (memcmp(&p->acts[i], &e->acts[j],
> + sizeof(struct ice_flow_action)))
Due to comment above it should be if (!memcmp(&p->acts[i], &e->acts[j],
Please fix the comment or code.
Otherwise, it looks good.
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> {
> + found_not_match = true;
> + break;
...
> }
>
> /**
> --
> 2.49.0
^ permalink raw reply
* [RFC net PATCH v1] net: pcs: pcs-mtk-lynxi: fix bpi-r3 serdes configuration
From: Frank Wunderlich @ 2026-04-09 13:33 UTC (permalink / raw)
To: Alexander Couzens, Daniel Golle, Andrew Lunn, Heiner Kallweit,
Russell King, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Matthias Brugger, AngeloGioacchino Del Regno,
Vladimir Oltean
Cc: Frank Wunderlich, netdev, linux-kernel, linux-arm-kernel,
linux-mediatek
From: Frank Wunderlich <frank-w@public-files.de>
Commit 8871389da151 introduces common pcs dts properties which writes
rx=normal,tx=normal polarity to register SGMSYS_QPHY_WRAP_CTRL of switch.
This is initialized with tx-bit set and so change inverts polarity
compared to before.
It looks like mt7531 has tx polarity inverted in hardware and set tx-bit
by default to restore the normal polarity.
Till this patch the register write was only called when mediatek,pnswap
property was set which cannot be done for switch because the fw-node param
was always NULL from switch driver in the mtk_pcs_lynxi_create call.
Do not configure switch side like it's done before.
Fixes: 8871389da151 ("net: pcs: pcs-mtk-lynxi: deprecate "mediatek,pnswap"")
Signed-off-by: Frank Wunderlich <frank-w@public-files.de>
---
drivers/net/pcs/pcs-mtk-lynxi.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/drivers/net/pcs/pcs-mtk-lynxi.c b/drivers/net/pcs/pcs-mtk-lynxi.c
index c12f8087af9b..a753bd88cbc2 100644
--- a/drivers/net/pcs/pcs-mtk-lynxi.c
+++ b/drivers/net/pcs/pcs-mtk-lynxi.c
@@ -129,6 +129,9 @@ static int mtk_pcs_config_polarity(struct mtk_pcs_lynxi *mpcs,
unsigned int val = 0;
int ret;
+ if (!fwnode)
+ return 0;
+
if (fwnode_property_read_bool(fwnode, "mediatek,pnswap"))
default_pol = PHY_POL_INVERT;
--
2.43.0
^ permalink raw reply related
* RE: [PATCH net v2 2/2] net: phy: micrel: remove ksz9131_resume()
From: Biju Das @ 2026-04-09 13:25 UTC (permalink / raw)
To: Andrew Lunn, Russell King (Oracle)
Cc: Ovidiu Panait, hkallweit1@gmail.com, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
linux-renesas-soc@vger.kernel.org
In-Reply-To: <31b1e474-4b87-4a75-93fa-1bcf3a41221a@lunn.ch>
Hi Andrew/Russell,
> -----Original Message-----
> From: Andrew Lunn <andrew@lunn.ch>
> Sent: 09 April 2026 13:44
> Subject: Re: [PATCH net v2 2/2] net: phy: micrel: remove ksz9131_resume()
>
> > I think we need a simple solution for 7.0, but subject to Andrew's
> > agreement, I think we should consider having phy_init_hw() inside
> > phy_resume(), and a series of cleanup patches that result from that
> > change, including getting rid of unnecessary code in micrel.c for the
> > next kernel cycle. As I say, subject to Andrew's agreement, please can
> > you look into this. Thanks.
>
> It does seem reasonable, and it would impose some uniformity on drivers.
Yes sure, we can send cleanup patches for the next kernel cycle.
Cheers,
Biju
^ permalink raw reply
* Re: [PATCH net v3 0/3] net: lan966x: fix page_pool error handling and error paths
From: patchwork-bot+netdevbpf @ 2026-04-09 13:20 UTC (permalink / raw)
To: David CARLIER
Cc: horatiu.vultur, UNGLinuxDriver, andrew+netdev, davem, edumazet,
kuba, pabeni, netdev, linux-kernel, stable
In-Reply-To: <20260405055241.35767-1-devnexen@gmail.com>
Hello:
This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Sun, 5 Apr 2026 06:52:38 +0100 you wrote:
> This series fixes error handling around the lan966x page pool:
>
> 1/3 adds the missing IS_ERR check after page_pool_create(), preventing
> a kernel oops when the error pointer flows into
> xdp_rxq_info_reg_mem_model().
>
> 2/3 plugs page pool leaks in the lan966x_fdma_rx_alloc() and
> lan966x_fdma_init() error paths, now reachable after 1/3.
>
> [...]
Here is the summary with links:
- [net,v3,v3,1/3] net: lan966x: fix page_pool error handling in lan966x_fdma_rx_alloc_page_pool()
https://git.kernel.org/netdev/net/c/3fd0da4fd885
- [net,v3,v3,2/3] net: lan966x: fix page pool leak in error paths
https://git.kernel.org/netdev/net/c/076344a6ad9d
- [net,v3,v3,3/3] net: lan966x: fix use-after-free and leak in lan966x_fdma_reload()
https://git.kernel.org/netdev/net/c/59c3d55a946c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox