* [PATCH net v4 2/2] pppoe: drop PFC frames
From: Qingfang Deng @ 2026-04-10 3:36 UTC (permalink / raw)
To: linux-ppp, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Qingfang Deng, Guillaume Nault,
Breno Leitao, Kuniyuki Iwashima, Kees Cook,
Sebastian Andrzej Siewior, Eric Woudstra, Sam Protsenko, netdev,
linux-kernel
Cc: Paul Mackerras, Jaco Kroon, James Carlson, Wojciech Drewek,
Marcin Szycik
In-Reply-To: <20260410033627.93786-1-qingfang.deng@linux.dev>
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the current PPPoE driver assumes an
uncompressed (2-byte) protocol field. However, the generic PPP layer
function ppp_input() is not aware of the negotiation result, and still
accepts PFC frames.
If a peer with a broken implementation or an attacker sends a frame with
a compressed (1-byte) protocol field, the subsequent PPP payload is
shifted by one byte. This causes the network header to be 4-byte
misaligned, which may trigger unaligned access exceptions on some
architectures.
To reduce the attack surface, drop PPPoE PFC frames. Introduce
ppp_skb_is_compressed_proto() helper function to be used in both
ppp_generic.c and pppoe.c to avoid open-coding.
Fixes: 7fb1b8ca8fa1 ("ppp: Move PFC decompression to PPP generic layer")
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
Changes in v4:
Update Fixes tag as suggested by AI review
Link to v3: https://lore.kernel.org/r/20260409031107.616630-2-qingfang.deng@linux.dev
Changes in v3:
Fix kdoc warning
Link to v2: https://lore.kernel.org/r/20260408024245.312732-1-qingfang.deng@linux.dev
drivers/net/ppp/ppp_generic.c | 2 +-
drivers/net/ppp/pppoe.c | 8 +++++++-
include/linux/ppp_defs.h | 16 ++++++++++++++++
3 files changed, 24 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ppp/ppp_generic.c b/drivers/net/ppp/ppp_generic.c
index b097d1b38ac9..853da966ad46 100644
--- a/drivers/net/ppp/ppp_generic.c
+++ b/drivers/net/ppp/ppp_generic.c
@@ -2242,7 +2242,7 @@ ppp_do_recv(struct ppp *ppp, struct sk_buff *skb, struct channel *pch)
*/
static void __ppp_decompress_proto(struct sk_buff *skb)
{
- if (skb->data[0] & 0x01)
+ if (ppp_skb_is_compressed_proto(skb))
*(u8 *)skb_push(skb, 1) = 0x00;
}
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1ac61c273b28..4cd10c908711 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -393,7 +393,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
if (skb_mac_header_len(skb) < ETH_HLEN)
goto drop;
- if (!pskb_may_pull(skb, sizeof(struct pppoe_hdr)))
+ if (!pskb_may_pull(skb, PPPOE_SES_HLEN))
goto drop;
ph = pppoe_hdr(skb);
@@ -403,6 +403,12 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
if (skb->len < len)
goto drop;
+ /* skb->data points to the PPP protocol header after skb_pull_rcsum.
+ * Drop PFC frames.
+ */
+ if (ppp_skb_is_compressed_proto(skb))
+ goto drop;
+
if (pskb_trim_rcsum(skb, len))
goto drop;
diff --git a/include/linux/ppp_defs.h b/include/linux/ppp_defs.h
index 45c0947fa404..6e9587ce651c 100644
--- a/include/linux/ppp_defs.h
+++ b/include/linux/ppp_defs.h
@@ -8,8 +8,24 @@
#define _PPP_DEFS_H_
#include <linux/crc-ccitt.h>
+#include <linux/skbuff.h>
#include <uapi/linux/ppp_defs.h>
#define PPP_FCS(fcs, c) crc_ccitt_byte(fcs, c)
+/**
+ * ppp_skb_is_compressed_proto - checks if PPP protocol in a skb is compressed
+ * @skb: skb to check
+ *
+ * Check if the PPP protocol field is compressed (the least significant
+ * bit of the most significant octet is 1). skb->data must point to the PPP
+ * protocol header.
+ *
+ * Return: Whether the PPP protocol field is compressed.
+ */
+static inline bool ppp_skb_is_compressed_proto(const struct sk_buff *skb)
+{
+ return unlikely(skb->data[0] & 0x01);
+}
+
#endif /* _PPP_DEFS_H_ */
--
2.43.0
^ permalink raw reply related
* [PATCH net v4 1/2] flow_dissector: do not dissect PPPoE PFC frames
From: Qingfang Deng @ 2026-04-10 3:36 UTC (permalink / raw)
To: linux-ppp, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Qingfang Deng, Guillaume Nault,
Wojciech Drewek, Tony Nguyen, linux-kernel, netdev
Cc: Paul Mackerras, Jaco Kroon, James Carlson, Marcin Szycik
RFC 2516 Section 7 states that Protocol Field Compression (PFC) is NOT
RECOMMENDED for PPPoE. In practice, pppd does not support negotiating
PFC for PPPoE sessions, and the flow dissector driver has assumed an
uncompressed frame until the blamed commit.
During the review process of that commit [1], support for PFC is
suggested. However, having a compressed (1-byte) protocol field means
the subsequent PPP payload is shifted by one byte, causing 4-byte
misalignment for the network header and an unaligned access exception
on some architectures.
The exception can be reproduced by sending a PPPoE PFC frame to an
ethernet interface of a MIPS board, with RPS enabled, even if no PPPoE
session is active on that interface:
$ 0 : 00000000 80c40000 00000000 85144817
$ 4 : 00000008 00000100 80a75758 81dc9bb8
$ 8 : 00000010 8087ae2c 0000003d 00000000
$12 : 000000e0 00000039 00000000 00000000
$16 : 85043240 80a75758 81dc9bb8 00006488
$20 : 0000002f 00000007 85144810 80a70000
$24 : 81d1bda0 00000000
$28 : 81dc8000 81dc9aa8 00000000 805ead08
Hi : 00009d51
Lo : 2163358a
epc : 805e91f0 __skb_flow_dissect+0x1b0/0x1b50
ra : 805ead08 __skb_get_hash_net+0x74/0x12c
Status: 11000403 KERNEL EXL IE
Cause : 40800010 (ExcCode 04)
BadVA : 85144817
PrId : 0001992f (MIPS 1004Kc)
Call Trace:
[<805e91f0>] __skb_flow_dissect+0x1b0/0x1b50
[<805ead08>] __skb_get_hash_net+0x74/0x12c
[<805ef330>] get_rps_cpu+0x1b8/0x3fc
[<805fca70>] netif_receive_skb_list_internal+0x324/0x364
[<805fd120>] napi_complete_done+0x68/0x2a4
[<8058de5c>] mtk_napi_rx+0x228/0xfec
[<805fd398>] __napi_poll+0x3c/0x1c4
[<805fd754>] napi_threaded_poll_loop+0x234/0x29c
[<805fd848>] napi_threaded_poll+0x8c/0xb0
[<80053544>] kthread+0x104/0x12c
[<80002bd8>] ret_from_kernel_thread+0x14/0x1c
Code: 02d51821 1060045b 00000000 <8c640000> 3084000f 2c820005 144001a2 00042080 8e220000
To reduce the attack surface and maintain performance, do not process
PPPoE PFC frames. While at it, avoid byte-swapping at runtime, restoring
the original behavior.
[1] https://patch.msgid.link/20220630231016.GA392@debian.home
Fixes: 46126db9c861 ("flow_dissector: Add PPPoE dissectors")
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
Changes in v4: no new changes
Link to v3: https://lore.kernel.org/r/20260409031107.616630-1-qingfang.deng@linux.dev
Changes in v3:
Make ppp_proto_is_valid() private and fix kdoc warning, avoiding
gotchas if some out-of-tree modules use this function.
Link to v1: https://lore.kernel.org/r/20260407045743.174446-1-qingfang.deng@linux.dev
include/linux/ppp_defs.h | 13 -------------
net/core/flow_dissector.c | 39 +++++++++++++++++++++++----------------
2 files changed, 23 insertions(+), 29 deletions(-)
diff --git a/include/linux/ppp_defs.h b/include/linux/ppp_defs.h
index b7e57fdbd413..45c0947fa404 100644
--- a/include/linux/ppp_defs.h
+++ b/include/linux/ppp_defs.h
@@ -12,17 +12,4 @@
#define PPP_FCS(fcs, c) crc_ccitt_byte(fcs, c)
-/**
- * ppp_proto_is_valid - checks if PPP protocol is valid
- * @proto: PPP protocol
- *
- * Assumes proto is not compressed.
- * Protocol is valid if the value is odd and the least significant bit of the
- * most significant octet is 0 (see RFC 1661, section 2).
- */
-static inline bool ppp_proto_is_valid(u16 proto)
-{
- return !!((proto & 0x0101) == 0x0001);
-}
-
#endif /* _PPP_DEFS_H_ */
diff --git a/net/core/flow_dissector.c b/net/core/flow_dissector.c
index 1b61bb25ba0e..64b843800370 100644
--- a/net/core/flow_dissector.c
+++ b/net/core/flow_dissector.c
@@ -1035,6 +1035,21 @@ static bool is_pppoe_ses_hdr_valid(const struct pppoe_hdr *hdr)
return hdr->ver == 1 && hdr->type == 1 && hdr->code == 0;
}
+/**
+ * ppp_proto_is_valid - checks if PPP protocol is valid
+ * @proto: PPP protocol
+ *
+ * Assumes proto is not compressed.
+ * Protocol is valid if the value is odd and the least significant bit of the
+ * most significant octet is 0 (see RFC 1661, section 2).
+ *
+ * Return: Whether the PPP protocol is valid.
+ */
+static bool ppp_proto_is_valid(__be16 proto)
+{
+ return (proto & htons(0x0101)) == htons(0x0001);
+}
+
/**
* __skb_flow_dissect - extract the flow_keys struct and return it
* @net: associated network namespace, derived from @skb if NULL
@@ -1361,7 +1376,7 @@ bool __skb_flow_dissect(const struct net *net,
struct pppoe_hdr hdr;
__be16 proto;
} *hdr, _hdr;
- u16 ppp_proto;
+ __be16 ppp_proto;
hdr = __skb_header_pointer(skb, nhoff, sizeof(_hdr), data, hlen, &_hdr);
if (!hdr) {
@@ -1374,27 +1389,19 @@ bool __skb_flow_dissect(const struct net *net,
break;
}
- /* least significant bit of the most significant octet
- * indicates if protocol field was compressed
- */
- ppp_proto = ntohs(hdr->proto);
- if (ppp_proto & 0x0100) {
- ppp_proto = ppp_proto >> 8;
- nhoff += PPPOE_SES_HLEN - 1;
- } else {
- nhoff += PPPOE_SES_HLEN;
- }
+ ppp_proto = hdr->proto;
+ nhoff += PPPOE_SES_HLEN;
- if (ppp_proto == PPP_IP) {
+ if (ppp_proto == htons(PPP_IP)) {
proto = htons(ETH_P_IP);
fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
- } else if (ppp_proto == PPP_IPV6) {
+ } else if (ppp_proto == htons(PPP_IPV6)) {
proto = htons(ETH_P_IPV6);
fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
- } else if (ppp_proto == PPP_MPLS_UC) {
+ } else if (ppp_proto == htons(PPP_MPLS_UC)) {
proto = htons(ETH_P_MPLS_UC);
fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
- } else if (ppp_proto == PPP_MPLS_MC) {
+ } else if (ppp_proto == htons(PPP_MPLS_MC)) {
proto = htons(ETH_P_MPLS_MC);
fdret = FLOW_DISSECT_RET_PROTO_AGAIN;
} else if (ppp_proto_is_valid(ppp_proto)) {
@@ -1412,7 +1419,7 @@ bool __skb_flow_dissect(const struct net *net,
FLOW_DISSECTOR_KEY_PPPOE,
target_container);
key_pppoe->session_id = hdr->hdr.sid;
- key_pppoe->ppp_proto = htons(ppp_proto);
+ key_pppoe->ppp_proto = ppp_proto;
key_pppoe->type = htons(ETH_P_PPP_SES);
}
break;
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net v3 0/3] net: bcmgenet: fix queue lock up
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Justin Chen
Cc: netdev, pabeni, kuba, edumazet, davem, andrew+netdev,
bcm-kernel-feedback-list, florian.fainelli, opendmb, nb
In-Reply-To: <20260406175756.134567-1-justin.chen@broadcom.com>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 6 Apr 2026 10:57:53 -0700 you wrote:
> We have been seeing reports of logs like this.
> # [ 39.713199] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 7991 ms
> [ 41.761198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 10039 ms
> [ 43.745198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 12023 ms
> [ 45.729198] bcmgenet 1001300000.ethernet eth0: NETDEV WATCHDOG: CPU: 0: transmit queue 2 timed out 14007 ms
>
> We have two issues. The persistent queue timeouts and the eventual lock up of the entire transmit.
>
> [...]
Here is the summary with links:
- [net,v3,1/3] net: bcmgenet: fix off-by-one in bcmgenet_put_txcb
https://git.kernel.org/netdev/net/c/57f3f53d2c9c
- [net,v3,2/3] net: bcmgenet: fix leaking free_bds
https://git.kernel.org/netdev/net/c/3f3168300efb
- [net,v3,3/3] net: bcmgenet: fix racing timeout handler
https://git.kernel.org/netdev/net/c/5393b2b5bee2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v3] net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, xuegang.lu, horms,
linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260407-airoha_qdma_rx_process-fix-reordering-v3-1-91c36e9da31f@kernel.org>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 07 Apr 2026 08:48:04 +0200 you wrote:
> Add missing dma_rmb() in airoha_qdma_rx_process routine to make sure the
> DMA read operations are completed when the NIC reports the processing on
> the current descriptor is done. Moreover, add missing READ_ONCE() in
> airoha_qdma_rx_process() for DMA descriptor control fields in order to
> avoid any compiler reordering.
>
> Fixes: 23020f0493270 ("net: airoha: Introduce ethernet support for EN7581 SoC")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
>
> [...]
Here is the summary with links:
- [net,v3] net: airoha: Add dma_rmb() and READ_ONCE() in airoha_qdma_rx_process()
https://git.kernel.org/netdev/net/c/4ae0604a0673
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] eth: fbnic: Use wake instead of start
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Mohsin Bashir
Cc: netdev, alexanderduyck, alok.a.tiwari, andrew+netdev, davem,
dg573847474, edumazet, horms, jacob.e.keller, kernel-team, kuba,
lee, linux-kernel, pabeni
In-Reply-To: <20260408002415.2963915-1-mohsin.bashr@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Apr 2026 17:24:15 -0700 you wrote:
> From: Mohsin Bashir <hmohsin@meta.com>
>
> fbnic_up() calls netif_tx_start_all_queues(), which only clears
> __QUEUE_STATE_DRV_XOFF. If qdisc backlog has accumulated on any TX
> queue before the reconfiguration (e.g. ring resize via ethtool -G),
> start does not call __netif_schedule() to kick the qdisc, so the
> pending backlog is never drained and the queue stalls.
>
> [...]
Here is the summary with links:
- [net] eth: fbnic: Use wake instead of start
https://git.kernel.org/netdev/net/c/12ff2a4aee6c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v2] net: txgbe: fix RTNL assertion warning when remove module
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Jiawen Wu
Cc: netdev, linux, andrew+netdev, davem, edumazet, kuba, pabeni,
horms, mengyuanlou, stable
In-Reply-To: <8B47A5872884147D+20260407094041.4646-1-jiawenwu@trustnetic.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Apr 2026 17:40:41 +0800 you wrote:
> For the copper NIC with external PHY, the driver called
> phylink_connect_phy() during probe and phylink_disconnect_phy() during
> remove. It caused an RTNL assertion warning in phylink_disconnect_phy()
> upon module remove.
>
> To fix this, add rtnl_lock() and rtnl_unlock() around the
> phylink_disconnect_phy() in remove function.
>
> [...]
Here is the summary with links:
- [net,v2] net: txgbe: fix RTNL assertion warning when remove module
https://git.kernel.org/netdev/net/c/e159f05e12cc
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] net: macb: Use napi_schedule_irqoff() in IRQ handler
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Kevin Hao
Cc: nicolas.ferre, claudiu.beznea, andrew+netdev, davem, edumazet,
kuba, pabeni, bigeasy, clrkwllms, rostedt, netdev, linux-rt-devel
In-Reply-To: <20260407-macb-napi-irqoff-v1-1-61bec60047d7@gmail.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 07 Apr 2026 08:45:39 +0800 you wrote:
> For non-PREEMPT_RT kernels, the IRQ handler runs with interrupts
> disabled, allowing the use of napi_schedule_irqoff() to save a pair of
> local_irq_{save,restore} operations. For PREEMPT_RT kernels,
> napi_schedule_irqoff() behaves identically to napi_schedule().
>
> Signed-off-by: Kevin Hao <haokexin@gmail.com>
>
> [...]
Here is the summary with links:
- [net-next] net: macb: Use napi_schedule_irqoff() in IRQ handler
https://git.kernel.org/netdev/net-next/c/a17d3c3d0cb2
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 net-next] ipv6: sit: remove redundant ret = 0 assignment
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Yue Haibing
Cc: davem, dsahern, edumazet, kuba, pabeni, horms, netdev,
linux-kernel
In-Reply-To: <20260408032051.3096449-1-yuehaibing@huawei.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 8 Apr 2026 11:20:51 +0800 you wrote:
> The variable ret is assigned a value at all places where it is used;
> There is no need to assign a value when it is initially defined.
>
> Signed-off-by: Yue Haibing <yuehaibing@huawei.com>
> ---
> v2: Remove redundant init during definition instead of init before copy_to_user
>
> [...]
Here is the summary with links:
- [v2,net-next] ipv6: sit: remove redundant ret = 0 assignment
https://git.kernel.org/netdev/net-next/c/3c6132ccc58e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] selftests: net: py: explicitly forbid multiple ksft_run() calls
From: patchwork-bot+netdevbpf @ 2026-04-10 3:40 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, shuah,
petrm, willemb, linux-kselftest
In-Reply-To: <20260408221952.819822-1-kuba@kernel.org>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 8 Apr 2026 15:19:52 -0700 you wrote:
> People (do people still write code or is it all AI?) seem to not
> get that ksft_run() can only be called once. If we call it
> multiple times KTAP parsers will likely cut off after the first
> batch has finished.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
>
> [...]
Here is the summary with links:
- [net-next] selftests: net: py: explicitly forbid multiple ksft_run() calls
https://git.kernel.org/netdev/net-next/c/3d2c3d2eea9a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next v6 00/14] net: sleepable ndo_set_rx_mode
From: Jakub Kicinski @ 2026-04-10 3:44 UTC (permalink / raw)
To: Stanislav Fomichev; +Cc: netdev, davem, edumazet, pabeni
In-Reply-To: <20260407153101.3694714-1-sdf@fomichev.me>
On Tue, 7 Apr 2026 08:30:47 -0700 Stanislav Fomichev wrote:
> This series adds a new ndo_set_rx_mode_async callback that enables
> drivers to handle address list updates in a sleepable context. The
> current ndo_set_rx_mode is called under the netif_addr_lock spinlock
> with BHs disabled, which prevents drivers from sleeping. This is
> problematic for ops-locked drivers that need to sleep.
I merged the queue leasing, now netkit warns :(
^ permalink raw reply
* [PATCH net-next] net: skb: clean up dead code after skb_kfree_head() simplification
From: Jiayuan Chen @ 2026-04-10 3:47 UTC (permalink / raw)
To: netdev
Cc: Jiayuan Chen, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Jason Xing, Kuniyuki Iwashima,
Michal Luczaj, Mina Almasry, Eric Biggers,
Toke Høiland-Jørgensen, linux-kernel
Since commit 0f42e3f4fe2a ("net: skb: fix cross-cache free of
KFENCE-allocated skb head"), skb_kfree_head() always calls kfree()
and no longer uses end_offset to distinguish between skb_small_head_cache
and generic kmalloc caches.
Clean up the leftovers:
- Remove the unused end_offset parameter from skb_kfree_head() and
update all callers.
- Remove the SKB_SMALL_HEAD_HEADROOM guard in __skb_unclone_keeptruesize()
which was protecting the old skb_kfree_head() logic.
- Update the SKB_SMALL_HEAD_CACHE_SIZE comment to reflect that the
non-power-of-2 sizing is no longer used for free-path disambiguation.
No functional change.
Signed-off-by: Jiayuan Chen <jiayuan.chen@linux.dev>
---
net/core/skbuff.c | 33 +++++++++------------------------
1 file changed, 9 insertions(+), 24 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e50f2d4867c1..c5441154795c 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -106,10 +106,9 @@ static struct kmem_cache *skbuff_ext_cache __ro_after_init;
#define SKB_SMALL_HEAD_SIZE SKB_HEAD_ALIGN(max(MAX_TCP_HEADER, \
GRO_MAX_HEAD_PAD))
-/* We want SKB_SMALL_HEAD_CACHE_SIZE to not be a power of two.
- * This should ensure that SKB_SMALL_HEAD_HEADROOM is a unique
- * size, and we can differentiate heads from skb_small_head_cache
- * vs system slabs by looking at their size (skb_end_offset()).
+/* SKB_SMALL_HEAD_CACHE_SIZE is the size used for the skbuff_small_head
+ * kmem_cache. The non-power-of-2 padding is kept for historical reasons and
+ * to avoid potential collisions with generic kmalloc bucket sizes.
*/
#define SKB_SMALL_HEAD_CACHE_SIZE \
(is_power_of_2(SKB_SMALL_HEAD_SIZE) ? \
@@ -1071,7 +1070,7 @@ static int skb_pp_frag_ref(struct sk_buff *skb)
return 0;
}
-static void skb_kfree_head(void *head, unsigned int end_offset)
+static void skb_kfree_head(void *head)
{
kfree(head);
}
@@ -1085,7 +1084,7 @@ static void skb_free_head(struct sk_buff *skb)
return;
skb_free_frag(head);
} else {
- skb_kfree_head(head, skb_end_offset(skb));
+ skb_kfree_head(head);
}
}
@@ -2361,7 +2360,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
return 0;
nofrags:
- skb_kfree_head(data, size);
+ skb_kfree_head(data);
nodata:
return -ENOMEM;
}
@@ -2407,20 +2406,6 @@ int __skb_unclone_keeptruesize(struct sk_buff *skb, gfp_t pri)
if (likely(skb_end_offset(skb) == saved_end_offset))
return 0;
- /* We can not change skb->end if the original or new value
- * is SKB_SMALL_HEAD_HEADROOM, as it might break skb_kfree_head().
- */
- if (saved_end_offset == SKB_SMALL_HEAD_HEADROOM ||
- skb_end_offset(skb) == SKB_SMALL_HEAD_HEADROOM) {
- /* We think this path should not be taken.
- * Add a temporary trace to warn us just in case.
- */
- pr_err_once("__skb_unclone_keeptruesize() skb_end_offset() %u -> %u\n",
- saved_end_offset, skb_end_offset(skb));
- WARN_ON_ONCE(1);
- return 0;
- }
-
shinfo = skb_shinfo(skb);
/* We are about to change back skb->end,
@@ -6815,7 +6800,7 @@ static int pskb_carve_inside_header(struct sk_buff *skb, const u32 off,
if (skb_cloned(skb)) {
/* drop the old head gracefully */
if (skb_orphan_frags(skb, gfp_mask)) {
- skb_kfree_head(data, size);
+ skb_kfree_head(data);
return -ENOMEM;
}
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
@@ -6922,7 +6907,7 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off,
memcpy((struct skb_shared_info *)(data + size),
skb_shinfo(skb), offsetof(struct skb_shared_info, frags[0]));
if (skb_orphan_frags(skb, gfp_mask)) {
- skb_kfree_head(data, size);
+ skb_kfree_head(data);
return -ENOMEM;
}
shinfo = (struct skb_shared_info *)(data + size);
@@ -6958,7 +6943,7 @@ static int pskb_carve_inside_nonlinear(struct sk_buff *skb, const u32 off,
/* skb_frag_unref() is not needed here as shinfo->nr_frags = 0. */
if (skb_has_frag_list(skb))
kfree_skb_list(skb_shinfo(skb)->frag_list);
- skb_kfree_head(data, size);
+ skb_kfree_head(data);
return -ENOMEM;
}
skb_release_data(skb, SKB_CONSUMED);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net-next] tools: ynl: tests: fix leading space on Makefile target
From: patchwork-bot+netdevbpf @ 2026-04-10 3:50 UTC (permalink / raw)
To: Hangbin Liu
Cc: donald.hunter, kuba, davem, edumazet, pabeni, horms, netdev,
linux-kernel
In-Reply-To: <20260408-ynl_makefile-v1-1-f9624acc2ad9@gmail.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 08 Apr 2026 15:19:05 +0800 you wrote:
> The ../generated/protos.a rule had a spurious leading space before the
> target name. In make, target rules must start at column 0; only recipe
> lines are indented with a tab. The extra space caused make to misparse
> the rule.
>
> Remove the leading space to match the style of the adjacent
> ../lib/ynl.a rule.
>
> [...]
Here is the summary with links:
- [net-next] tools: ynl: tests: fix leading space on Makefile target
https://git.kernel.org/netdev/net-next/c/42f9b4c6ef19
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH v2] selftests: vsock: avoid races creating Unix socket paths
From: Cao Ruichuang @ 2026-04-10 3:52 UTC (permalink / raw)
To: stefano.garzarella
Cc: sgarzare, shuah, virtualization, netdev, linux-kselftest,
linux-kernel, horms, Cao Ruichuang
In-Reply-To: <20260405195733.86043-1-create0818@163.com>
Signed-off-by: Cao Ruichuang <create0818@163.com>
---
v2:
- retitle the patch to describe the race being fixed
- replace rm -rf with explicit rm and rmdir cleanup
tools/testing/selftests/vsock/vmtest.sh | 16 ++++++++++++----
1 file changed, 12 insertions(+), 4 deletions(-)
diff --git a/tools/testing/selftests/vsock/vmtest.sh b/tools/testing/selftests/vsock/vmtest.sh
index 86e338886b3..c345fa539d3 100755
--- a/tools/testing/selftests/vsock/vmtest.sh
+++ b/tools/testing/selftests/vsock/vmtest.sh
@@ -718,6 +718,7 @@ test_ns_diff_global_host_connect_to_global_vm_ok() {
local pids pid pidfile
local ns0 ns1 port
declare -a pids
+ local unixdir
local unixfile
ns0="global0"
ns1="global1"
@@ -736,7 +737,8 @@ test_ns_diff_global_host_connect_to_global_vm_ok() {
oops_before=$(vm_dmesg_oops_count "${ns0}")
warn_before=$(vm_dmesg_warn_count "${ns0}")
- unixfile=$(mktemp -u /tmp/XXXX.sock)
+ unixdir=$(mktemp -d /tmp/vsock_vmtest_XXXXXX)
+ unixfile="${unixdir}/sock"
ip netns exec "${ns1}" \
socat TCP-LISTEN:"${TEST_HOST_PORT}",fork \
UNIX-CONNECT:"${unixfile}" &
@@ -758,6 +760,8 @@ test_ns_diff_global_host_connect_to_global_vm_ok() {
terminate_pids "${pids[@]}"
terminate_pidfiles "${pidfile}"
+ rm "${unixfile}"
+ rmdir "${unixdir}"
if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then
return "${KSFT_FAIL}"
@@ -814,6 +818,7 @@ test_ns_diff_global_vm_connect_to_global_host_ok() {
local ns0="global0"
local ns1="global1"
local port=12345
+ local unixdir
local unixfile
local dmesg_rc
local pidfile
@@ -826,7 +831,8 @@ test_ns_diff_global_vm_connect_to_global_host_ok() {
log_host "Setup socat bridge from ns ${ns0} to ns ${ns1} over port ${port}"
- unixfile=$(mktemp -u /tmp/XXXX.sock)
+ unixdir=$(mktemp -d /tmp/vsock_vmtest_XXXXXX)
+ unixfile="${unixdir}/sock"
ip netns exec "${ns0}" \
socat TCP-LISTEN:"${port}" UNIX-CONNECT:"${unixfile}" &
@@ -845,7 +851,8 @@ test_ns_diff_global_vm_connect_to_global_host_ok() {
if ! vm_start "${pidfile}" "${ns0}"; then
log_host "failed to start vm (cid=${cid}, ns=${ns0})"
terminate_pids "${pids[@]}"
- rm -f "${unixfile}"
+ rm "${unixfile}"
+ rmdir "${unixdir}"
return "${KSFT_FAIL}"
fi
@@ -862,7 +869,8 @@ test_ns_diff_global_vm_connect_to_global_host_ok() {
terminate_pidfiles "${pidfile}"
terminate_pids "${pids[@]}"
- rm -f "${unixfile}"
+ rm "${unixfile}"
+ rmdir "${unixdir}"
if [[ "${rc}" -ne 0 ]] || [[ "${dmesg_rc}" -ne 0 ]]; then
return "${KSFT_FAIL}"
--
2.39.5 (Apple Git-154)
^ permalink raw reply related
* Re: [PATCH net v2] net: netrom: fix lock order inversion in nr_add_node, nr_del_node and nr_dec_obs
From: Mashiro Chen @ 2026-04-10 5:04 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, linux-hams, davem, edumazet, pabeni, horms, linux-kernel,
syzbot+6eb7834837cf6a8db75b
In-Reply-To: <20260409195436.3d021e7f@kernel.org>
On Mon, 6 Apr 2026 Jakub Kicinski wrote:
> Can we please merge nr_node_list_lock and nr_neigh_list_lock
> into one instead?
This makes more sense, thanks for the suggestion.
I'll rework the patch to merge the two locks into one and
repost next week.
On 4/10/26 10:54, Jakub Kicinski wrote:
> On Mon, 6 Apr 2026 19:49:04 +0800 Mashiro Chen wrote:
>> nr_del_node() and nr_dec_obs() acquire nr_node_list_lock first, then
>> call nr_remove_neigh() which internally acquires nr_neigh_list_lock.
>> nr_add_node() acquires node_lock first, then calls nr_remove_neigh()
>> which acquires nr_neigh_list_lock.
> Can we please merge nr_node_list_lock and nr_neigh_list_lock
> into one instead?
>
> Lets try to simplify this code as much as possible.
> It's a maintenance nightmare and has fewer users than syzbot reports
> (i'm not joking).
^ permalink raw reply
* Re: [PATCH net v3] net: rose: defer rose_neigh cleanup to workqueue to fix UAF
From: Mashiro Chen @ 2026-04-10 5:08 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, linux-hams, davem, edumazet, pabeni, horms, linux-kernel,
syzbot+abd2b69348e2d9b107a1
In-Reply-To: <20260409194957.5465e98b@kernel.org>
On Tue, 7 Apr 2026 Jakub Kicinski wrote:
> What if ROSE is built as a module and gets unloaded?
> Please don't post the next version until next week
Got it, I will not post any patches until next week.
I've never thought about the module unload path, this is
the point I missed in my previous patch. I will deep analysis
if the timers are properly stopped before the module is
removed. I will address this in v4 next week.
Sorry for low quality and simple analysis without auditing.
73s,
Mashiro Chen
On 4/10/26 10:49, Jakub Kicinski wrote:
> On Tue, 7 Apr 2026 01:01:25 +0800 Mashiro Chen wrote:
>> rose_neigh_put() frees the rose_neigh object when the reference count
>> reaches zero, but does not stop the t0timer and ftimer beforehand.
>> If a timer has been scheduled and fires after the object is freed,
>> the callback will access already-freed memory, leading to a
>> use-after-free.
> What if ROSE is built as a module and gets unloaded?
>
> Please don't post the next version until next week, we're drowning in
> these AI generated patches.
^ permalink raw reply
* Re: [PATCH net-next] net: mana: hardening: Reject zero max_num_queues from MANA_QUERY_VPORT_CONFIG
From: Erni Sri Satya Vennela @ 2026-04-10 5:16 UTC (permalink / raw)
To: kys, haiyangz, wei.liu, decui, longli, andrew+netdev, davem,
edumazet, kuba, pabeni, ssengar, dipayanroy, gargaditya,
shirazsaleem, kees, linux-hyperv, netdev, linux-kernel
In-Reply-To: <20260326174815.2012137-1-ernis@linux.microsoft.com>
On Thu, Mar 26, 2026 at 10:48:10AM -0700, Erni Sri Satya Vennela wrote:
> As a part of MANA hardening for CVM, validate that max_num_sq and
> max_num_rq returned by MANA_QUERY_VPORT_CONFIG are not zero. These
> values flow into apc->num_queues, which is used as an allocation count
> and loop bound. A zero value would result in zero-size allocations and
> incorrect driver behavior.
>
> Return -EPROTO if either value is zero.
>
> Signed-off-by: Erni Sri Satya Vennela <ernis@linux.microsoft.com>
> ---
> drivers/net/ethernet/microsoft/mana/mana_en.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
> index b39e8b920791..a4197b4b0597 100644
> --- a/drivers/net/ethernet/microsoft/mana/mana_en.c
> +++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
> @@ -1249,6 +1249,12 @@ static int mana_query_vport_cfg(struct mana_port_context *apc, u32 vport_index,
>
> *max_sq = resp.max_num_sq;
> *max_rq = resp.max_num_rq;
> +
> + if (*max_sq == 0 || *max_rq == 0) {
> + netdev_err(apc->ndev, "Invalid max queues from vPort config\n");
> + return -EPROTO;
> + }
> +
> if (resp.num_indirection_ent > 0 &&
> resp.num_indirection_ent <= MANA_INDIRECT_TABLE_MAX_SIZE &&
> is_power_of_2(resp.num_indirection_ent)) {
> --
> 2.34.1
Hi,
Gentle reminder regarding this patch.
I would really appreciate any feedback whenever you get a chance.
Please let me know if any changes are required from my side.
Thanks for your time.
Regards,
Vennela
^ permalink raw reply
* Re: [PATCH net-next 2/9] r8152: Add support for RTL8157 SRAM access and ADV indirect access
From: kernel test robot @ 2026-04-10 5:17 UTC (permalink / raw)
To: Birger Koblitz, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni
Cc: llvm, oe-kbuild-all, netdev, linux-usb, linux-kernel,
Birger Koblitz
In-Reply-To: <20260314-rtl8157_next-v1-2-9ba77b428afd@birger-koblitz.de>
Hi Birger,
kernel test robot noticed the following build warnings:
[auto build test WARNING on 5c9e55fecf9365890c64f14761a80f9413a3b1d1]
url: https://github.com/intel-lab-lkp/linux/commits/Birger-Koblitz/r8152-Add-support-for-RTL8157-RX-TX-descriptor-format/20260315-014044
base: 5c9e55fecf9365890c64f14761a80f9413a3b1d1
patch link: https://lore.kernel.org/r/20260314-rtl8157_next-v1-2-9ba77b428afd%40birger-koblitz.de
patch subject: [PATCH net-next 2/9] r8152: Add support for RTL8157 SRAM access and ADV indirect access
config: sparc64-allmodconfig (https://download.01.org/0day-ci/archive/20260410/202604101309.B9mdviRN-lkp@intel.com/config)
compiler: clang version 23.0.0git (https://github.com/llvm/llvm-project c80443cd37b2e2788cba67ffa180a6331e5f0791)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260410/202604101309.B9mdviRN-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604101309.B9mdviRN-lkp@intel.com/
All warnings (new ones prefixed by >>):
>> drivers/net/usb/r8152.c:1682:6: warning: variable 'ret' is used uninitialized whenever 'if' condition is false [-Wsometimes-uninitialized]
1682 | if (i == 10)
| ^~~~~~~
drivers/net/usb/r8152.c:1685:9: note: uninitialized use occurs here
1685 | return ret;
| ^~~
drivers/net/usb/r8152.c:1682:2: note: remove the 'if' if its condition is always true
1682 | if (i == 10)
| ^~~~~~~~~~~~
1683 | ret = -ETIMEDOUT;
drivers/net/usb/r8152.c:1672:12: note: initialize the variable 'ret' to silence this warning
1672 | int i, ret;
| ^
| = 0
drivers/net/usb/r8152.c:1757:12: warning: unused function 'rtl_bmu_clr_bits' [-Wunused-function]
1757 | static int rtl_bmu_clr_bits(struct r8152 *tp, u16 addr, u32 clear)
| ^~~~~~~~~~~~~~~~
drivers/net/usb/r8152.c:1788:12: warning: unused function 'rtl_ip_clr_bits' [-Wunused-function]
1788 | static int rtl_ip_clr_bits(struct r8152 *tp, u16 addr, u32 clear)
| ^~~~~~~~~~~~~~~
drivers/net/usb/r8152.c:1793:12: warning: unused function 'rtl_ip_set_bits' [-Wunused-function]
1793 | static int rtl_ip_set_bits(struct r8152 *tp, u16 addr, u32 set)
| ^~~~~~~~~~~~~~~
drivers/net/usb/r8152.c:1810:13: warning: unused function 'sram_write_w0w1' [-Wunused-function]
1810 | static void sram_write_w0w1(struct r8152 *tp, u16 addr, u16 clear, u16 set)
| ^~~~~~~~~~~~~~~
drivers/net/usb/r8152.c:1824:13: warning: unused function 'sram2_write_w0w1' [-Wunused-function]
1824 | static void sram2_write_w0w1(struct r8152 *tp, u16 addr, u16 clear, u16 set)
| ^~~~~~~~~~~~~~~~
drivers/net/usb/r8152.c:9807:12: warning: unused function 'r8157_desc_init' [-Wunused-function]
9807 | static int r8157_desc_init(struct r8152 *tp)
| ^~~~~~~~~~~~~~~
7 warnings generated.
vim +1682 drivers/net/usb/r8152.c
1669
1670 static int wait_cmd_ready(struct r8152 *tp, u16 cmd)
1671 {
1672 int i, ret;
1673
1674 for (i = 0; i < 10; i++) {
1675 u16 ocp_data = ocp_read_word(tp, MCU_TYPE_USB, cmd);
1676
1677 if (!(ocp_data & ADV_CMD_BUSY))
1678 break;
1679 usleep_range(1000, 2000);
1680 }
1681
> 1682 if (i == 10)
1683 ret = -ETIMEDOUT;
1684
1685 return ret;
1686 }
1687
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH v2 1/2] drm/drm_ras: Add clear-error-counter netlink command to drm_ras
From: Tauro, Riana @ 2026-04-10 5:21 UTC (permalink / raw)
To: Rodrigo Vivi, maarten.lankhorst
Cc: intel-xe, dri-devel, netdev, Zack McKevitt, joonas.lahtinen,
aravind.iddamsetty, anshuman.gupta, simona.vetter, airlied,
pratik.bari, joshua.santosh.ranjan, ashwin.kumar.kulkarni,
shubham.kumar, ravi.kishore.koppuravuri, raag.jadav,
anvesh.bakwad, Jakub Kicinski, Lijo Lazar, Hawking Zhang,
David S. Miller, Paolo Abeni, Eric Dumazet
In-Reply-To: <aderpXuhLoiUoxcT@intel.com>
Hi Rodrigo
On 4/9/2026 7:07 PM, Rodrigo Vivi wrote:
> On Thu, Apr 09, 2026 at 12:51:44PM +0530, Tauro, Riana wrote:
>> Hi Zack
>>
>> Could you please take a look at this patch if applicable to your usecase.
>> Please let me know if any
>> changes are required
>>
>> @Rodrigo This is already reviewed by Jakub and Raag.
>> If there are no opens, can this be merged via drm_misc
> if we push this to drm-misc-next, it might take a few weeks to propagate
> back to drm-xe-next. With other work from you and Raag going fast pace
> on drm-xe-next around this area, I'm afraid it could cause some conflicts.
>
> It is definitely fine by me, but another option is to get ack from
> drm-misc maintainers to get this through drm-xe-next.
>
Yeah this would be better with the other RAS patches close to merge.
@Maarten Can you please help with an ack if this patch looks good to you?
This has been reviewed by Jakub from netdev and Raag from intel-xe
There are no other opens.
Thanks
Riana
>
> so, really okay with drm-misc-next?
>
>> Thanks
>> Riana
>>
>> On 4/9/2026 1:03 PM, Riana Tauro wrote:
>>> Introduce a new 'clear-error-counter' drm_ras command to reset the counter
>>> value for a specific error counter of a given node.
>>>
>>> The command is a 'do' netlink request with 'node-id' and 'error-id'
>>> as parameters with no response payload.
>>>
>>> Usage:
>>>
>>> $ sudo ynl --family drm_ras --do clear-error-counter --json \
>>> '{"node-id":1, "error-id":1}'
>>> None
>>>
>>> Cc: Jakub Kicinski <kuba@kernel.org>
>>> Cc: Zack McKevitt <zachary.mckevitt@oss.qualcomm.com>
>>> Cc: Lijo Lazar <lijo.lazar@amd.com>
>>> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
>>> Cc: David S. Miller <davem@davemloft.net>
>>> Cc: Paolo Abeni <pabeni@redhat.com>
>>> Cc: Eric Dumazet <edumazet@google.com>
>>> Signed-off-by: Riana Tauro <riana.tauro@intel.com>
>>> Reviewed-by: Jakub Kicinski <kuba@kernel.org>
>>> Reviewed-by: Raag Jadav <raag.jadav@intel.com>
>>> ---
>>> Documentation/gpu/drm-ras.rst | 8 +++++
>>> Documentation/netlink/specs/drm_ras.yaml | 13 ++++++-
>>> drivers/gpu/drm/drm_ras.c | 43 +++++++++++++++++++++++-
>>> drivers/gpu/drm/drm_ras_nl.c | 13 +++++++
>>> drivers/gpu/drm/drm_ras_nl.h | 2 ++
>>> include/drm/drm_ras.h | 11 ++++++
>>> include/uapi/drm/drm_ras.h | 1 +
>>> 7 files changed, 89 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-ras.rst
>>> index 70b246a78fc8..4636e68f5678 100644
>>> --- a/Documentation/gpu/drm-ras.rst
>>> +++ b/Documentation/gpu/drm-ras.rst
>>> @@ -52,6 +52,8 @@ User space tools can:
>>> as a parameter.
>>> * Query specific error counter values with the ``get-error-counter`` command, using both
>>> ``node-id`` and ``error-id`` as parameters.
>>> +* Clear specific error counters with the ``clear-error-counter`` command, using both
>>> + ``node-id`` and ``error-id`` as parameters.
>>> YAML-based Interface
>>> --------------------
>>> @@ -101,3 +103,9 @@ Example: Query an error counter for a given node
>>> sudo ynl --family drm_ras --do get-error-counter --json '{"node-id":0, "error-id":1}'
>>> {'error-id': 1, 'error-name': 'error_name1', 'error-value': 0}
>>> +Example: Clear an error counter for a given node
>>> +
>>> +.. code-block:: bash
>>> +
>>> + sudo ynl --family drm_ras --do clear-error-counter --json '{"node-id":0, "error-id":1}'
>>> + None
>>> diff --git a/Documentation/netlink/specs/drm_ras.yaml b/Documentation/netlink/specs/drm_ras.yaml
>>> index 79af25dac3c5..e113056f8c01 100644
>>> --- a/Documentation/netlink/specs/drm_ras.yaml
>>> +++ b/Documentation/netlink/specs/drm_ras.yaml
>>> @@ -99,7 +99,7 @@ operations:
>>> flags: [admin-perm]
>>> do:
>>> request:
>>> - attributes:
>>> + attributes: &id-attrs
>>> - node-id
>>> - error-id
>>> reply:
>>> @@ -113,3 +113,14 @@ operations:
>>> - node-id
>>> reply:
>>> attributes: *errorinfo
>>> + -
>>> + name: clear-error-counter
>>> + doc: >-
>>> + Clear error counter for a given node.
>>> + The request includes the error-id and node-id of the
>>> + counter to be cleared.
>>> + attribute-set: error-counter-attrs
>>> + flags: [admin-perm]
>>> + do:
>>> + request:
>>> + attributes: *id-attrs
>>> diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
>>> index b2fa5ab86d87..d6eab29a1394 100644
>>> --- a/drivers/gpu/drm/drm_ras.c
>>> +++ b/drivers/gpu/drm/drm_ras.c
>>> @@ -26,7 +26,7 @@
>>> * efficient lookup by ID. Nodes can be registered or unregistered
>>> * dynamically at runtime.
>>> *
>>> - * A Generic Netlink family `drm_ras` exposes two main operations to
>>> + * A Generic Netlink family `drm_ras` exposes the below operations to
>>> * userspace:
>>> *
>>> * 1. LIST_NODES: Dump all currently registered RAS nodes.
>>> @@ -37,6 +37,10 @@
>>> * Returns all counters of a node if only Node ID is provided or specific
>>> * error counters.
>>> *
>>> + * 3. CLEAR_ERROR_COUNTER: Clear error counter of a given node.
>>> + * Userspace must provide Node ID, Error ID.
>>> + * Clears specific error counter of a node if supported.
>>> + *
>>> * Node registration:
>>> *
>>> * - drm_ras_node_register(): Registers a new node and assigns
>>> @@ -66,6 +70,8 @@
>>> * operation, fetching all counters from a specific node.
>>> * - drm_ras_nl_get_error_counter_doit(): Implements the GET_ERROR_COUNTER doit
>>> * operation, fetching a counter value from a specific node.
>>> + * - drm_ras_nl_clear_error_counter_doit(): Implements the CLEAR_ERROR_COUNTER doit
>>> + * operation, clearing a counter value from a specific node.
>>> */
>>> static DEFINE_XARRAY_ALLOC(drm_ras_xa);
>>> @@ -314,6 +320,41 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
>>> return doit_reply_value(info, node_id, error_id);
>>> }
>>> +/**
>>> + * drm_ras_nl_clear_error_counter_doit() - Clear an error counter of a node
>>> + * @skb: Netlink message buffer
>>> + * @info: Generic Netlink info containing attributes of the request
>>> + *
>>> + * Extracts the node ID and error ID from the netlink attributes and
>>> + * clears the current value.
>>> + *
>>> + * Return: 0 on success, or negative errno on failure.
>>> + */
>>> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
>>> + struct genl_info *info)
>>> +{
>>> + struct drm_ras_node *node;
>>> + u32 node_id, error_id;
>>> +
>>> + if (!info->attrs ||
>>> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
>>> + GENL_REQ_ATTR_CHECK(info, DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID))
>>> + return -EINVAL;
>>> +
>>> + node_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
>>> + error_id = nla_get_u32(info->attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
>>> +
>>> + node = xa_load(&drm_ras_xa, node_id);
>>> + if (!node || !node->clear_error_counter)
>>> + return -ENOENT;
>>> +
>>> + if (error_id < node->error_counter_range.first ||
>>> + error_id > node->error_counter_range.last)
>>> + return -EINVAL;
>>> +
>>> + return node->clear_error_counter(node, error_id);
>>> +}
>>> +
>>> /**
>>> * drm_ras_node_register() - Register a new RAS node
>>> * @node: Node structure to register
>>> diff --git a/drivers/gpu/drm/drm_ras_nl.c b/drivers/gpu/drm/drm_ras_nl.c
>>> index 16803d0c4a44..dea1c1b2494e 100644
>>> --- a/drivers/gpu/drm/drm_ras_nl.c
>>> +++ b/drivers/gpu/drm/drm_ras_nl.c
>>> @@ -22,6 +22,12 @@ static const struct nla_policy drm_ras_get_error_counter_dump_nl_policy[DRM_RAS_
>>> [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
>>> };
>>> +/* DRM_RAS_CMD_CLEAR_ERROR_COUNTER - do */
>>> +static const struct nla_policy drm_ras_clear_error_counter_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID + 1] = {
>>> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
>>> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
>>> +};
>>> +
>>> /* Ops table for drm_ras */
>>> static const struct genl_split_ops drm_ras_nl_ops[] = {
>>> {
>>> @@ -43,6 +49,13 @@ static const struct genl_split_ops drm_ras_nl_ops[] = {
>>> .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID,
>>> .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DUMP,
>>> },
>>> + {
>>> + .cmd = DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
>>> + .doit = drm_ras_nl_clear_error_counter_doit,
>>> + .policy = drm_ras_clear_error_counter_nl_policy,
>>> + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
>>> + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
>>> + },
>>> };
>>> struct genl_family drm_ras_nl_family __ro_after_init = {
>>> diff --git a/drivers/gpu/drm/drm_ras_nl.h b/drivers/gpu/drm/drm_ras_nl.h
>>> index 06ccd9342773..a398643572a5 100644
>>> --- a/drivers/gpu/drm/drm_ras_nl.h
>>> +++ b/drivers/gpu/drm/drm_ras_nl.h
>>> @@ -18,6 +18,8 @@ int drm_ras_nl_get_error_counter_doit(struct sk_buff *skb,
>>> struct genl_info *info);
>>> int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
>>> struct netlink_callback *cb);
>>> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
>>> + struct genl_info *info);
>>> extern struct genl_family drm_ras_nl_family;
>>> diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
>>> index 5d50209e51db..f2a787bc4f64 100644
>>> --- a/include/drm/drm_ras.h
>>> +++ b/include/drm/drm_ras.h
>>> @@ -58,6 +58,17 @@ struct drm_ras_node {
>>> int (*query_error_counter)(struct drm_ras_node *node, u32 error_id,
>>> const char **name, u32 *val);
>>> + /**
>>> + * @clear_error_counter:
>>> + *
>>> + * This callback is used by drm_ras to clear a specific error counter.
>>> + * Driver should implement this callback to support clearing error counters
>>> + * of a node.
>>> + *
>>> + * Returns: 0 on success, negative error code on failure.
>>> + */
>>> + int (*clear_error_counter)(struct drm_ras_node *node, u32 error_id);
>>> +
>>> /** @priv: Driver private data */
>>> void *priv;
>>> };
>>> diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
>>> index 5f40fa5b869d..218a3ee86805 100644
>>> --- a/include/uapi/drm/drm_ras.h
>>> +++ b/include/uapi/drm/drm_ras.h
>>> @@ -41,6 +41,7 @@ enum {
>>> enum {
>>> DRM_RAS_CMD_LIST_NODES = 1,
>>> DRM_RAS_CMD_GET_ERROR_COUNTER,
>>> + DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
>>> __DRM_RAS_CMD_MAX,
>>> DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
^ permalink raw reply
* Re: [PATCH net] netrom: do some basic forms of validation on incoming frames
From: Greg Kroah-Hartman @ 2026-04-10 5:24 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Simon Horman, netdev, linux-kernel, David S. Miller, Eric Dumazet,
Paolo Abeni, linux-hams, Yizhe Zhuang, stable
In-Reply-To: <20260409203235.6b9329f0@kernel.org>
On Thu, Apr 09, 2026 at 08:32:35PM -0700, Jakub Kicinski wrote:
> On Thu, 9 Apr 2026 20:03:28 +0100 Simon Horman wrote:
> > I expect that checking skb->len isn't sufficient here
> > and pskb_may_pull needs to be used to ensure that
> > the data is also available in the linear section of the skb.
>
> Or for simplicity we could also be testing against skb_headlen()
> since we don't expect any legit non-linear frames here? Dunno.
I'll be glad to change this either way, your call. Given that this is
an obsolete protocol that seems to only be a target for drive-by fuzzers
to attack, whatever the simplest thing to do to quiet them up I'll be
glad to implement.
Or can we just delete this stuff entirely? :)
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH v2 1/2] drm/drm_ras: Add clear-error-counter netlink command to drm_ras
From: Tauro, Riana @ 2026-04-10 5:25 UTC (permalink / raw)
To: Zack McKevitt, intel-xe, dri-devel, netdev, rodrigo.vivi,
joonas.lahtinen, aravind.iddamsetty
Cc: anshuman.gupta, simona.vetter, airlied, pratik.bari,
joshua.santosh.ranjan, ashwin.kumar.kulkarni, shubham.kumar,
ravi.kishore.koppuravuri, raag.jadav, anvesh.bakwad,
maarten.lankhorst, Jakub Kicinski, Lijo Lazar, Hawking Zhang,
David S. Miller, Paolo Abeni, Eric Dumazet
In-Reply-To: <413e8508-5f29-4a5a-a583-8360f9e48712@oss.qualcomm.com>
On 4/10/2026 4:31 AM, Zack McKevitt wrote:
>
> On 4/9/2026 1:21 AM, Tauro, Riana wrote:
>> Hi Zack
>>
>> Could you please take a look at this patch if applicable to your
>> usecase. Please let me know if any
>> changes are required
>>
>
> From a quick glance, I think this looks good from our end.
Thank you Zack for taking a look.
>
> Thanks,
> Zack
>
>> @Rodrigo This is already reviewed by Jakub and Raag.
>> If there are no opens, can this be merged via drm_misc
>>
>> Thanks
>> Riana
>>
>> On 4/9/2026 1:03 PM, Riana Tauro wrote:
>>> Introduce a new 'clear-error-counter' drm_ras command to reset the
>>> counter
>>> value for a specific error counter of a given node.
>>>
>>> The command is a 'do' netlink request with 'node-id' and 'error-id'
>>> as parameters with no response payload.
>>>
>>> Usage:
>>>
>>> $ sudo ynl --family drm_ras --do clear-error-counter --json \
>>> '{"node-id":1, "error-id":1}'
>>> None
>>>
>>> Cc: Jakub Kicinski <kuba@kernel.org>
>>> Cc: Zack McKevitt <zachary.mckevitt@oss.qualcomm.com>
>>> Cc: Lijo Lazar <lijo.lazar@amd.com>
>>> Cc: Hawking Zhang <Hawking.Zhang@amd.com>
>>> Cc: David S. Miller <davem@davemloft.net>
>>> Cc: Paolo Abeni <pabeni@redhat.com>
>>> Cc: Eric Dumazet <edumazet@google.com>
>>> Signed-off-by: Riana Tauro <riana.tauro@intel.com>
>>> Reviewed-by: Jakub Kicinski <kuba@kernel.org>
>>> Reviewed-by: Raag Jadav <raag.jadav@intel.com>
>>> ---
>>> Documentation/gpu/drm-ras.rst | 8 +++++
>>> Documentation/netlink/specs/drm_ras.yaml | 13 ++++++-
>>> drivers/gpu/drm/drm_ras.c | 43
>>> +++++++++++++++++++++++-
>>> drivers/gpu/drm/drm_ras_nl.c | 13 +++++++
>>> drivers/gpu/drm/drm_ras_nl.h | 2 ++
>>> include/drm/drm_ras.h | 11 ++++++
>>> include/uapi/drm/drm_ras.h | 1 +
>>> 7 files changed, 89 insertions(+), 2 deletions(-)
>>>
>>> diff --git a/Documentation/gpu/drm-ras.rst b/Documentation/gpu/drm-
>>> ras.rst
>>> index 70b246a78fc8..4636e68f5678 100644
>>> --- a/Documentation/gpu/drm-ras.rst
>>> +++ b/Documentation/gpu/drm-ras.rst
>>> @@ -52,6 +52,8 @@ User space tools can:
>>> as a parameter.
>>> * Query specific error counter values with the
>>> ``get-error-counter`` command, using both
>>> ``node-id`` and ``error-id`` as parameters.
>>> +* Clear specific error counters with the ``clear-error-counter``
>>> command, using both
>>> + ``node-id`` and ``error-id`` as parameters.
>>> YAML-based Interface
>>> --------------------
>>> @@ -101,3 +103,9 @@ Example: Query an error counter for a given node
>>> sudo ynl --family drm_ras --do get-error-counter --json
>>> '{"node- id":0, "error-id":1}'
>>> {'error-id': 1, 'error-name': 'error_name1', 'error-value': 0}
>>> +Example: Clear an error counter for a given node
>>> +
>>> +.. code-block:: bash
>>> +
>>> + sudo ynl --family drm_ras --do clear-error-counter --json
>>> '{"node-id":0, "error-id":1}'
>>> + None
>>> diff --git a/Documentation/netlink/specs/drm_ras.yaml
>>> b/Documentation/ netlink/specs/drm_ras.yaml
>>> index 79af25dac3c5..e113056f8c01 100644
>>> --- a/Documentation/netlink/specs/drm_ras.yaml
>>> +++ b/Documentation/netlink/specs/drm_ras.yaml
>>> @@ -99,7 +99,7 @@ operations:
>>> flags: [admin-perm]
>>> do:
>>> request:
>>> - attributes:
>>> + attributes: &id-attrs
>>> - node-id
>>> - error-id
>>> reply:
>>> @@ -113,3 +113,14 @@ operations:
>>> - node-id
>>> reply:
>>> attributes: *errorinfo
>>> + -
>>> + name: clear-error-counter
>>> + doc: >-
>>> + Clear error counter for a given node.
>>> + The request includes the error-id and node-id of the
>>> + counter to be cleared.
>>> + attribute-set: error-counter-attrs
>>> + flags: [admin-perm]
>>> + do:
>>> + request:
>>> + attributes: *id-attrs
>>> diff --git a/drivers/gpu/drm/drm_ras.c b/drivers/gpu/drm/drm_ras.c
>>> index b2fa5ab86d87..d6eab29a1394 100644
>>> --- a/drivers/gpu/drm/drm_ras.c
>>> +++ b/drivers/gpu/drm/drm_ras.c
>>> @@ -26,7 +26,7 @@
>>> * efficient lookup by ID. Nodes can be registered or unregistered
>>> * dynamically at runtime.
>>> *
>>> - * A Generic Netlink family `drm_ras` exposes two main operations to
>>> + * A Generic Netlink family `drm_ras` exposes the below operations to
>>> * userspace:
>>> *
>>> * 1. LIST_NODES: Dump all currently registered RAS nodes.
>>> @@ -37,6 +37,10 @@
>>> * Returns all counters of a node if only Node ID is provided
>>> or specific
>>> * error counters.
>>> *
>>> + * 3. CLEAR_ERROR_COUNTER: Clear error counter of a given node.
>>> + * Userspace must provide Node ID, Error ID.
>>> + * Clears specific error counter of a node if supported.
>>> + *
>>> * Node registration:
>>> *
>>> * - drm_ras_node_register(): Registers a new node and assigns
>>> @@ -66,6 +70,8 @@
>>> * operation, fetching all counters from a specific node.
>>> * - drm_ras_nl_get_error_counter_doit(): Implements the
>>> GET_ERROR_COUNTER doit
>>> * operation, fetching a counter value from a specific node.
>>> + * - drm_ras_nl_clear_error_counter_doit(): Implements the
>>> CLEAR_ERROR_COUNTER doit
>>> + * operation, clearing a counter value from a specific node.
>>> */
>>> static DEFINE_XARRAY_ALLOC(drm_ras_xa);
>>> @@ -314,6 +320,41 @@ int drm_ras_nl_get_error_counter_doit(struct
>>> sk_buff *skb,
>>> return doit_reply_value(info, node_id, error_id);
>>> }
>>> +/**
>>> + * drm_ras_nl_clear_error_counter_doit() - Clear an error counter
>>> of a node
>>> + * @skb: Netlink message buffer
>>> + * @info: Generic Netlink info containing attributes of the request
>>> + *
>>> + * Extracts the node ID and error ID from the netlink attributes and
>>> + * clears the current value.
>>> + *
>>> + * Return: 0 on success, or negative errno on failure.
>>> + */
>>> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
>>> + struct genl_info *info)
>>> +{
>>> + struct drm_ras_node *node;
>>> + u32 node_id, error_id;
>>> +
>>> + if (!info->attrs ||
>>> + GENL_REQ_ATTR_CHECK(info,
>>> DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID) ||
>>> + GENL_REQ_ATTR_CHECK(info,
>>> DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID))
>>> + return -EINVAL;
>>> +
>>> + node_id = nla_get_u32(info-
>>> >attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID]);
>>> + error_id = nla_get_u32(info-
>>> >attrs[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID]);
>>> +
>>> + node = xa_load(&drm_ras_xa, node_id);
>>> + if (!node || !node->clear_error_counter)
>>> + return -ENOENT;
>>> +
>>> + if (error_id < node->error_counter_range.first ||
>>> + error_id > node->error_counter_range.last)
>>> + return -EINVAL;
>>> +
>>> + return node->clear_error_counter(node, error_id);
>>> +}
>>> +
>>> /**
>>> * drm_ras_node_register() - Register a new RAS node
>>> * @node: Node structure to register
>>> diff --git a/drivers/gpu/drm/drm_ras_nl.c
>>> b/drivers/gpu/drm/drm_ras_nl.c
>>> index 16803d0c4a44..dea1c1b2494e 100644
>>> --- a/drivers/gpu/drm/drm_ras_nl.c
>>> +++ b/drivers/gpu/drm/drm_ras_nl.c
>>> @@ -22,6 +22,12 @@ static const struct nla_policy
>>> drm_ras_get_error_counter_dump_nl_policy[DRM_RAS_
>>> [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
>>> };
>>> +/* DRM_RAS_CMD_CLEAR_ERROR_COUNTER - do */
>>> +static const struct nla_policy
>>> drm_ras_clear_error_counter_nl_policy[DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID
>>> + 1] = {
>>> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID] = { .type = NLA_U32, },
>>> + [DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID] = { .type = NLA_U32, },
>>> +};
>>> +
>>> /* Ops table for drm_ras */
>>> static const struct genl_split_ops drm_ras_nl_ops[] = {
>>> {
>>> @@ -43,6 +49,13 @@ static const struct genl_split_ops
>>> drm_ras_nl_ops[] = {
>>> .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_NODE_ID,
>>> .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DUMP,
>>> },
>>> + {
>>> + .cmd = DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
>>> + .doit = drm_ras_nl_clear_error_counter_doit,
>>> + .policy = drm_ras_clear_error_counter_nl_policy,
>>> + .maxattr = DRM_RAS_A_ERROR_COUNTER_ATTRS_ERROR_ID,
>>> + .flags = GENL_ADMIN_PERM | GENL_CMD_CAP_DO,
>>> + },
>>> };
>>> struct genl_family drm_ras_nl_family __ro_after_init = {
>>> diff --git a/drivers/gpu/drm/drm_ras_nl.h
>>> b/drivers/gpu/drm/drm_ras_nl.h
>>> index 06ccd9342773..a398643572a5 100644
>>> --- a/drivers/gpu/drm/drm_ras_nl.h
>>> +++ b/drivers/gpu/drm/drm_ras_nl.h
>>> @@ -18,6 +18,8 @@ int drm_ras_nl_get_error_counter_doit(struct
>>> sk_buff *skb,
>>> struct genl_info *info);
>>> int drm_ras_nl_get_error_counter_dumpit(struct sk_buff *skb,
>>> struct netlink_callback *cb);
>>> +int drm_ras_nl_clear_error_counter_doit(struct sk_buff *skb,
>>> + struct genl_info *info);
>>> extern struct genl_family drm_ras_nl_family;
>>> diff --git a/include/drm/drm_ras.h b/include/drm/drm_ras.h
>>> index 5d50209e51db..f2a787bc4f64 100644
>>> --- a/include/drm/drm_ras.h
>>> +++ b/include/drm/drm_ras.h
>>> @@ -58,6 +58,17 @@ struct drm_ras_node {
>>> int (*query_error_counter)(struct drm_ras_node *node, u32
>>> error_id,
>>> const char **name, u32 *val);
>>> + /**
>>> + * @clear_error_counter:
>>> + *
>>> + * This callback is used by drm_ras to clear a specific error
>>> counter.
>>> + * Driver should implement this callback to support clearing
>>> error counters
>>> + * of a node.
>>> + *
>>> + * Returns: 0 on success, negative error code on failure.
>>> + */
>>> + int (*clear_error_counter)(struct drm_ras_node *node, u32
>>> error_id);
>>> +
>>> /** @priv: Driver private data */
>>> void *priv;
>>> };
>>> diff --git a/include/uapi/drm/drm_ras.h b/include/uapi/drm/drm_ras.h
>>> index 5f40fa5b869d..218a3ee86805 100644
>>> --- a/include/uapi/drm/drm_ras.h
>>> +++ b/include/uapi/drm/drm_ras.h
>>> @@ -41,6 +41,7 @@ enum {
>>> enum {
>>> DRM_RAS_CMD_LIST_NODES = 1,
>>> DRM_RAS_CMD_GET_ERROR_COUNTER,
>>> + DRM_RAS_CMD_CLEAR_ERROR_COUNTER,
>>> __DRM_RAS_CMD_MAX,
>>> DRM_RAS_CMD_MAX = (__DRM_RAS_CMD_MAX - 1)
>
^ permalink raw reply
* Re: [PATCH v2 1/4] rust: netlink: add raw netlink abstraction
From: Alice Ryhl @ 2026-04-10 5:42 UTC (permalink / raw)
To: Andrew Lunn
Cc: Miguel Ojeda, Boqun Feng, Gary Guo, Björn Roy Baron,
Benno Lossin, Andreas Hindborg, Trevor Gross, Danilo Krummrich,
Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Greg Kroah-Hartman,
Arve Hjønnevåg, Todd Kjos, Christian Brauner,
Carlos Llamas, linux-kernel, rust-for-linux, netdev
In-Reply-To: <a12cc023-629e-457d-af02-4c481024dda0@lunn.ch>
On Thu, Apr 9, 2026 at 11:50 PM Andrew Lunn <andrew@lunn.ch> wrote:
>
> > +__rust_helper void rust_helper_genlmsg_cancel(struct sk_buff *skb, void *hdr)
> > +{
> > + return genlmsg_cancel(skb, hdr);
> > +}
> > +
> > +__rust_helper void rust_helper_genlmsg_end(struct sk_buff *skb, void *hdr)
> > +{
> > + return genlmsg_end(skb, hdr);
> > +}
> > +
> > +__rust_helper void rust_helper_nlmsg_free(struct sk_buff *skb)
> > +{
> > + return nlmsg_free(skb);
> > +}
>
> It is a bit odd for a void function to call return like this,
> especially when the functions they are calling are also void
> functions.
Oh you're right. I think that's what we call a copy-paste mistake.
I'll fix it up in the next version.
Alice
^ permalink raw reply
* [PATCH net-next v2 2/2] pppox: convert pppox_sk() to use container_of()
From: Qingfang Deng @ 2026-04-10 5:49 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel
Cc: linux-ppp, Qingfang Deng
In-Reply-To: <20260410054954.114031-1-qingfang.deng@linux.dev>
Use container_of() macro instead of direct pointer casting to get the
pppox_sock from a sock pointer.
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
Changes in v2:
Do not remove the comment, as the struct is allocated from sk_alloc and
still require sock to be the first member.
Link to v1: https://lore.kernel.org/r/20260408015138.280687-2-qingfang.deng@linux.dev
include/linux/if_pppox.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 636772693f9a..594d6dc3f4c9 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -54,7 +54,7 @@ struct pppox_sock {
static inline struct pppox_sock *pppox_sk(struct sock *sk)
{
- return (struct pppox_sock *)sk;
+ return container_of(sk, struct pppox_sock, sk);
}
struct module;
--
2.43.0
^ permalink raw reply related
* [PATCH net-next v2 1/2] pppox: remove sk_pppox() helper
From: Qingfang Deng @ 2026-04-10 5:49 UTC (permalink / raw)
To: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Qingfang Deng, Kees Cook, Guillaume Nault,
Eric Woudstra, Dawid Osuchowski, netdev, linux-kernel
Cc: linux-ppp
The sk member can be directly accessed from struct pppox_sock without
relying on type casting. Remove the sk_pppox() helper and update all
call sites to use po->sk directly.
Signed-off-by: Qingfang Deng <qingfang.deng@linux.dev>
---
Changes in v2: none
Link to v1: https://lore.kernel.org/r/20260408015138.280687-1-qingfang.deng@linux.dev
drivers/net/ppp/pppoe.c | 10 +++++-----
drivers/net/ppp/pptp.c | 6 +++---
include/linux/if_pppox.h | 5 -----
3 files changed, 8 insertions(+), 13 deletions(-)
diff --git a/drivers/net/ppp/pppoe.c b/drivers/net/ppp/pppoe.c
index 1ac61c273b28..d546a7af0d54 100644
--- a/drivers/net/ppp/pppoe.c
+++ b/drivers/net/ppp/pppoe.c
@@ -231,7 +231,7 @@ static inline struct pppox_sock *get_item(struct pppoe_net *pn, __be16 sid,
struct pppox_sock *po;
po = __get_item(pn, sid, addr, ifindex);
- if (po && !refcount_inc_not_zero(&sk_pppox(po)->sk_refcnt))
+ if (po && !refcount_inc_not_zero(&po->sk.sk_refcnt))
po = NULL;
return po;
@@ -273,7 +273,7 @@ static void pppoe_flush_dev(struct net_device *dev)
if (!po)
break;
- sk = sk_pppox(po);
+ sk = &po->sk;
/* We always grab the socket lock, followed by the
* hash_lock, in that order. Since we should hold the
@@ -413,7 +413,7 @@ static int pppoe_rcv(struct sk_buff *skb, struct net_device *dev,
if (!po)
goto drop;
- return __sk_receive_skb(sk_pppox(po), skb, 0, 1, false);
+ return __sk_receive_skb(&po->sk, skb, 0, 1, false);
drop:
kfree_skb(skb);
@@ -425,7 +425,7 @@ static void pppoe_unbind_sock_work(struct work_struct *work)
{
struct pppox_sock *po = container_of(work, struct pppox_sock,
proto.pppoe.padt_work);
- struct sock *sk = sk_pppox(po);
+ struct sock *sk = &po->sk;
lock_sock(sk);
if (po->pppoe_dev) {
@@ -469,7 +469,7 @@ static int pppoe_disc_rcv(struct sk_buff *skb, struct net_device *dev,
po = get_item(pn, ph->sid, eth_hdr(skb)->h_source, dev->ifindex);
if (po)
if (!schedule_work(&po->proto.pppoe.padt_work))
- sock_put(sk_pppox(po));
+ sock_put(&po->sk);
abort:
kfree_skb(skb);
diff --git a/drivers/net/ppp/pptp.c b/drivers/net/ppp/pptp.c
index b18acd810561..cc8c102122d8 100644
--- a/drivers/net/ppp/pptp.c
+++ b/drivers/net/ppp/pptp.c
@@ -62,7 +62,7 @@ static struct pppox_sock *lookup_chan(u16 call_id, __be32 s_addr)
if (opt->dst_addr.sin_addr.s_addr != s_addr)
sock = NULL;
else
- sock_hold(sk_pppox(sock));
+ sock_hold(&sock->sk);
}
rcu_read_unlock();
@@ -164,7 +164,7 @@ static int pptp_xmit(struct ppp_channel *chan, struct sk_buff *skb)
struct iphdr *iph;
int max_headroom;
- if (sk_pppox(po)->sk_state & PPPOX_DEAD)
+ if (po->sk.sk_state & PPPOX_DEAD)
goto tx_drop;
rt = pptp_route_output(po, &fl4);
@@ -375,7 +375,7 @@ static int pptp_rcv(struct sk_buff *skb)
if (po) {
skb_dst_drop(skb);
nf_reset_ct(skb);
- return sk_receive_skb(sk_pppox(po), skb, 0);
+ return sk_receive_skb(&po->sk, skb, 0);
}
drop:
kfree_skb(skb);
diff --git a/include/linux/if_pppox.h b/include/linux/if_pppox.h
index 8bbf676c2a85..636772693f9a 100644
--- a/include/linux/if_pppox.h
+++ b/include/linux/if_pppox.h
@@ -57,11 +57,6 @@ static inline struct pppox_sock *pppox_sk(struct sock *sk)
return (struct pppox_sock *)sk;
}
-static inline struct sock *sk_pppox(struct pppox_sock *po)
-{
- return (struct sock *)po;
-}
-
struct module;
struct pppox_proto {
--
2.43.0
^ permalink raw reply related
* [bug report] octeontx2-af: npc: cn20k: Use common APIs
From: Dan Carpenter @ 2026-04-10 5:52 UTC (permalink / raw)
To: Suman Ghosh; +Cc: Ratheesh Kannoth, Suman Ghosh, netdev
Hello Suman Ghosh,
Commit 6d1e70282f76 ("octeontx2-af: npc: cn20k: Use common APIs")
from Feb 24, 2026 (linux-next), leads to the following Smatch static
checker warning:
drivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c:1065 npc_cn20k_config_mcam_entry()
error: uninitialized symbol 'kw_type'.
drivers/net/ethernet/marvell/octeontx2/af/cn20k/npc.c
1045 void npc_cn20k_config_mcam_entry(struct rvu *rvu, int blkaddr, int index,
1046 u8 intf, struct cn20k_mcam_entry *entry,
1047 bool enable, u8 hw_prio, u8 req_kw_type)
1048 {
1049 struct npc_mcam *mcam = &rvu->hw->mcam;
1050 int mcam_idx = index % mcam->banksize;
1051 int bank = index / mcam->banksize;
1052 int kw = 0;
1053 u8 kw_type;
1054
1055 /* Disable before mcam entry update */
1056 npc_cn20k_enable_mcam_entry(rvu, blkaddr, index, false);
1057
1058 npc_mcam_idx_2_key_type(rvu, index, &kw_type);
No error checking?
1059 /* CAM1 takes the comparison value and
1060 * CAM0 specifies match for a bit in key being '0' or '1' or 'dontcare'.
1061 * CAM1<n> = 0 & CAM0<n> = 1 => match if key<n> = 0
1062 * CAM1<n> = 1 & CAM0<n> = 0 => match if key<n> = 1
1063 * CAM1<n> = 0 & CAM0<n> = 0 => always match i.e dontcare.
1064 */
--> 1065 if (kw_type == NPC_MCAM_KEY_X2) {
^^^^^^^
Uninitialized
1066 /* Clear mcam entry to avoid writes being suppressed by NPC */
1067 npc_cn20k_clear_mcam_entry(rvu, blkaddr, bank, mcam_idx);
1068 npc_cn20k_config_kw_x2(rvu, mcam, blkaddr,
This email is a free service from the Smatch-CI project [smatch.sf.net].
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH net-next v7 01/10] net: team: Annotate reads and writes for mixed lock accessed values
From: Kuniyuki Iwashima @ 2026-04-10 5:55 UTC (permalink / raw)
To: Marc Harvey
Cc: Jiri Pirko, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Shuah Khan, Simon Horman, netdev,
linux-kernel, linux-kselftest
In-Reply-To: <20260409-teaming-driver-internal-v7-1-f47e7589685d@google.com>
On Wed, Apr 8, 2026 at 7:59 PM Marc Harvey <marcharvey@google.com> wrote:
>
> The team_port's "index" and the team's "en_port_count" are read in
> the hot transmit path, but are only written to when holding the rtnl
> lock.
>
> Use READ_ONCE() for all lockless reads of these values, and use
> WRITE_ONCE() for all writes.
>
> Reviewed-by: Jiri Pirko <jiri@nvidia.com>
> Signed-off-by: Marc Harvey <marcharvey@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
fwiw, Sashiko's review is orthogonal to this patch;
the comments are for the existing code before this patch.
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox