* [PATCH net] net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels
From: Andrea Mayer @ 2026-04-21 9:47 UTC (permalink / raw)
To: davem, dsahern, edumazet, kuba, pabeni, horms
Cc: bigeasy, clrkwllms, rostedt, david.lebrun, alex.aring,
stefano.salsano, andrea.mayer, netdev, linux-rt-devel,
linux-kernel, stable
seg6_input_core() and rpl_input() call ip6_route_input() which sets a
NOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking
dst_hold() unconditionally.
On PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can
release the underlying pcpu_rt between the lookup and the caching
through a concurrent FIB lookup on a shared nexthop.
Simplified race sequence:
ksoftirqd/X higher-prio task (same CPU X)
----------- --------------------------------
seg6_input_core(,skb)/rpl_input(skb)
dst_cache_get()
-> miss
ip6_route_input(skb)
-> ip6_pol_route(,skb,flags)
[RT6_LOOKUP_F_DST_NOREF in flags]
-> FIB lookup resolves fib6_nh
[nhid=N route]
-> rt6_make_pcpu_route()
[creates pcpu_rt, refcount=1]
pcpu_rt->sernum = fib6_sernum
[fib6_sernum=W]
-> cmpxchg(fib6_nh.rt6i_pcpu,
NULL, pcpu_rt)
[slot was empty, store succeeds]
-> skb_dst_set_noref(skb, dst)
[dst is pcpu_rt, refcount still 1]
rt_genid_bump_ipv6()
-> bumps fib6_sernum
[fib6_sernum from W to Z]
ip6_route_output()
-> ip6_pol_route()
-> FIB lookup resolves fib6_nh
[nhid=N]
-> rt6_get_pcpu_route()
pcpu_rt->sernum != fib6_sernum
[W <> Z, stale]
-> prev = xchg(rt6i_pcpu, NULL)
-> dst_release(prev)
[prev is pcpu_rt,
refcount 1->0, dead]
dst = skb_dst(skb)
[dst is the dead pcpu_rt]
dst_cache_set_ip6(dst)
-> dst_hold() on dead dst
-> WARN / use-after-free
For the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without
PREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release
the pcpu_rt. Shared nexthop objects provide such a path, as two routes
pointing to the same nhid share the same fib6_nh and its rt6i_pcpu
entry.
Fix seg6_input_core() and rpl_input() by calling skb_dst_force() after
ip6_route_input() to force the NOREF dst into a refcounted one before
caching.
The output path is not affected as ip6_route_output() already returns a
refcounted dst.
Fixes: af4a2209b134 ("ipv6: sr: use dst_cache in seg6_input")
Fixes: a7a29f9c361f ("net: ipv6: add rpl sr tunnel")
Cc: stable@vger.kernel.org
Signed-off-by: Andrea Mayer <andrea.mayer@uniroma2.it>
---
net/ipv6/rpl_iptunnel.c | 9 +++++++++
net/ipv6/seg6_iptunnel.c | 9 +++++++++
2 files changed, 18 insertions(+)
diff --git a/net/ipv6/rpl_iptunnel.c b/net/ipv6/rpl_iptunnel.c
index c7942cf65567..4e10adcd70e8 100644
--- a/net/ipv6/rpl_iptunnel.c
+++ b/net/ipv6/rpl_iptunnel.c
@@ -287,7 +287,16 @@ static int rpl_input(struct sk_buff *skb)
if (!dst) {
ip6_route_input(skb);
+
+ /* ip6_route_input() sets a NOREF dst; force a refcount on it
+ * before caching or further use.
+ */
+ skb_dst_force(skb);
dst = skb_dst(skb);
+ if (unlikely(!dst)) {
+ err = -ENETUNREACH;
+ goto drop;
+ }
/* cache only if we don't create a dst reference loop */
if (!dst->error && lwtst != dst->lwtstate) {
diff --git a/net/ipv6/seg6_iptunnel.c b/net/ipv6/seg6_iptunnel.c
index 97b50d9b1365..94284b483be0 100644
--- a/net/ipv6/seg6_iptunnel.c
+++ b/net/ipv6/seg6_iptunnel.c
@@ -515,7 +515,16 @@ static int seg6_input_core(struct net *net, struct sock *sk,
if (!dst) {
ip6_route_input(skb);
+
+ /* ip6_route_input() sets a NOREF dst; force a refcount on it
+ * before caching or further use.
+ */
+ skb_dst_force(skb);
dst = skb_dst(skb);
+ if (unlikely(!dst)) {
+ err = -ENETUNREACH;
+ goto drop;
+ }
/* cache only if we don't create a dst reference loop */
if (!dst->error && lwtst != dst->lwtstate) {
--
2.20.1
^ permalink raw reply related
* Re: [PATCH net v8 03/15] net: cache snapshot entries for ndo_set_rx_mode_async
From: Paolo Abeni @ 2026-04-21 9:52 UTC (permalink / raw)
To: Stanislav Fomichev, netdev; +Cc: davem, edumazet, kuba
In-Reply-To: <20260416185712.2155425-4-sdf@fomichev.me>
On 4/16/26 8:57 PM, Stanislav Fomichev wrote:
> Add a per-device netdev_hw_addr_list cache (rx_mode_addr_cache) that
> allows __hw_addr_list_snapshot() and __hw_addr_list_reconcile() to
> reuse previously allocated entries instead of hitting GFP_ATOMIC on
> every snapshot cycle.
>
> snapshot pops entries from the cache when available, falling back to
> __hw_addr_create(). reconcile splices both snapshot lists back into
> the cache via __hw_addr_splice(). The cache is flushed in
> free_netdev().
>
> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
> (cherry picked from commit ba3ab1832a511f660fdc6231245b14bf610c05bd)
Are you backporting from 7.2 via time machine??? :-P
> @@ -611,8 +633,8 @@ void __hw_addr_list_reconcile(struct netdev_hw_addr_list *real_list,
> }
> }
>
> - __hw_addr_flush(work);
> - __hw_addr_flush(ref);
> + __hw_addr_splice(cache, work);
> + __hw_addr_splice(cache, ref);
I think here sashiko has a point, with the cache size being unbounded. I
guess syzkaller or the like will find a way to make it grow too much.
What about hard-limit it to some reasonable value?!?
/P
^ permalink raw reply
* [PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets
From: Shardul Bankar @ 2026-04-21 9:56 UTC (permalink / raw)
To: matttbe, martineau
Cc: geliang, davem, edumazet, kuba, pabeni, horms, netdev, mptcp,
linux-kernel, janak, kalpan.jani, shardulsb08, Shardul Bankar
MPTCP_RST_EMPTCP (reset reason 1) is used as a catch-all for seven
distinct error conditions across subflow setup, authentication, and
data path validation. The existing MPRstTx/MPRstRx counters only
track aggregate reset volume, making it difficult to diagnose which
code path is triggering subflow resets in production.
Add per-reason MIB counters for each MPTCP_RST_EMPTCP use site:
MPRstMD5SIG - MD5SIG on listener, incompatible with MPTCP
MPRstNoToken - JOIN token lookup failed, no matching conn
MPRstNoMPJ - SYN/ACK missing MP_JOIN option
MPRstHMAC - HMAC validation failed during subflow join
MPRstFatalFallback - fatal fallback during child socket creation
MPRstBadMap - invalid data mapping on established subflow
MPRstNotEstablished - JOIN on not-fully-established msk
These counters are incremented alongside the existing reset_reason
assignment and are visible via nstat as MPTcpExtMPRst*. The
aggregate MPRstTx/MPRstRx counters remain unchanged.
Closes: https://github.com/multipath-tcp/mptcp_net-next/issues/511
Signed-off-by: Shardul Bankar <shardul.b@mpiricsoftware.com>
---
net/mptcp/mib.c | 7 +++++++
net/mptcp/mib.h | 7 +++++++
net/mptcp/protocol.c | 1 +
net/mptcp/subflow.c | 14 +++++++++++---
4 files changed, 26 insertions(+), 3 deletions(-)
diff --git a/net/mptcp/mib.c b/net/mptcp/mib.c
index f23fda0c55a7..ec42583c59cf 100644
--- a/net/mptcp/mib.c
+++ b/net/mptcp/mib.c
@@ -71,6 +71,13 @@ static const struct snmp_mib mptcp_snmp_list[] = {
SNMP_MIB_ITEM("MPFastcloseRx", MPTCP_MIB_MPFASTCLOSERX),
SNMP_MIB_ITEM("MPRstTx", MPTCP_MIB_MPRSTTX),
SNMP_MIB_ITEM("MPRstRx", MPTCP_MIB_MPRSTRX),
+ SNMP_MIB_ITEM("MPRstMD5SIG", MPTCP_MIB_MPRSTMD5SIG),
+ SNMP_MIB_ITEM("MPRstNoToken", MPTCP_MIB_MPRSTNOTOKEN),
+ SNMP_MIB_ITEM("MPRstNoMPJ", MPTCP_MIB_MPRSTNOMPJ),
+ SNMP_MIB_ITEM("MPRstHMAC", MPTCP_MIB_MPRSTHMAC),
+ SNMP_MIB_ITEM("MPRstFatalFallback", MPTCP_MIB_MPRSTFATALFALLBACK),
+ SNMP_MIB_ITEM("MPRstBadMap", MPTCP_MIB_MPRSTBADMAP),
+ SNMP_MIB_ITEM("MPRstNotEstablished", MPTCP_MIB_MPRSTNOTESTABLISHED),
SNMP_MIB_ITEM("SubflowStale", MPTCP_MIB_SUBFLOWSTALE),
SNMP_MIB_ITEM("SubflowRecover", MPTCP_MIB_SUBFLOWRECOVER),
SNMP_MIB_ITEM("SndWndShared", MPTCP_MIB_SNDWNDSHARED),
diff --git a/net/mptcp/mib.h b/net/mptcp/mib.h
index 812218b5ed2b..0ac109b52d35 100644
--- a/net/mptcp/mib.h
+++ b/net/mptcp/mib.h
@@ -70,6 +70,13 @@ enum linux_mptcp_mib_field {
MPTCP_MIB_MPFASTCLOSERX, /* Received a MP_FASTCLOSE */
MPTCP_MIB_MPRSTTX, /* Transmit a MP_RST */
MPTCP_MIB_MPRSTRX, /* Received a MP_RST */
+ MPTCP_MIB_MPRSTMD5SIG, /* MP_RST: MD5SIG enabled on listener */
+ MPTCP_MIB_MPRSTNOTOKEN, /* MP_RST: JOIN token not found */
+ MPTCP_MIB_MPRSTNOMPJ, /* MP_RST: missing MPJ in SYN/ACK */
+ MPTCP_MIB_MPRSTHMAC, /* MP_RST: HMAC validation failed */
+ MPTCP_MIB_MPRSTFATALFALLBACK, /* MP_RST: fatal fallback on child */
+ MPTCP_MIB_MPRSTBADMAP, /* MP_RST: bad data mapping */
+ MPTCP_MIB_MPRSTNOTESTABLISHED, /* MP_RST: JOIN on not-established msk */
MPTCP_MIB_SUBFLOWSTALE, /* Subflows entered 'stale' status */
MPTCP_MIB_SUBFLOWRECOVER, /* Subflows returned to active status after being stale */
MPTCP_MIB_SNDWNDSHARED, /* Subflow snd wnd is overridden by msk's one */
diff --git a/net/mptcp/protocol.c b/net/mptcp/protocol.c
index 17b9a8c13ebf..b06cbcf983f4 100644
--- a/net/mptcp/protocol.c
+++ b/net/mptcp/protocol.c
@@ -3836,6 +3836,7 @@ bool mptcp_finish_join(struct sock *ssk)
/* mptcp socket already closing? */
if (!mptcp_is_fully_established(parent)) {
+ MPTCP_INC_STATS(sock_net(parent), MPTCP_MIB_MPRSTNOTESTABLISHED);
subflow->reset_reason = MPTCP_RST_EMPTCP;
return false;
}
diff --git a/net/mptcp/subflow.c b/net/mptcp/subflow.c
index e2cb9d23e4a0..71bffcda0138 100644
--- a/net/mptcp/subflow.c
+++ b/net/mptcp/subflow.c
@@ -160,6 +160,7 @@ static int subflow_check_req(struct request_sock *req,
* TCP option space.
*/
if (rcu_access_pointer(tcp_sk(sk_listener)->md5sig_info)) {
+ MPTCP_INC_STATS(sock_net(sk_listener), MPTCP_MIB_MPRSTMD5SIG);
subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
return -EINVAL;
}
@@ -227,6 +228,7 @@ static int subflow_check_req(struct request_sock *req,
/* Can't fall back to TCP in this case. */
if (!subflow_req->msk) {
+ MPTCP_INC_STATS(sock_net(sk_listener), MPTCP_MIB_MPRSTNOTOKEN);
subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
return -EPERM;
}
@@ -568,6 +570,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
u8 hmac[SHA256_DIGEST_SIZE];
if (!(mp_opt.suboptions & OPTION_MPTCP_MPJ_SYNACK)) {
+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTNOMPJ);
subflow->reset_reason = MPTCP_RST_EMPTCP;
goto do_reset;
}
@@ -582,6 +585,7 @@ static void subflow_finish_connect(struct sock *sk, const struct sk_buff *skb)
if (!subflow_thmac_valid(subflow)) {
MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_JOINACKMAC);
+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTHMAC);
subflow->reset_reason = MPTCP_RST_EMPTCP;
goto do_reset;
}
@@ -870,6 +874,7 @@ static struct sock *subflow_syn_recv_sock(const struct sock *sk,
*/
if (!ctx || fallback) {
if (fallback_is_fatal) {
+ MPTCP_INC_STATS(sock_net(sk), MPTCP_MIB_MPRSTFATALFALLBACK);
subflow_add_reset_reason(skb, MPTCP_RST_EMPTCP);
goto dispose_child;
}
@@ -1421,9 +1426,12 @@ static bool subflow_check_data_avail(struct sock *ssk)
* subflow_error_report() will introduce the appropriate barriers
*/
subflow->reset_transient = 0;
- subflow->reset_reason = status == MAPPING_NODSS ?
- MPTCP_RST_EMIDDLEBOX :
- MPTCP_RST_EMPTCP;
+ if (status == MAPPING_NODSS) {
+ subflow->reset_reason = MPTCP_RST_EMIDDLEBOX;
+ } else {
+ MPTCP_INC_STATS(sock_net(ssk), MPTCP_MIB_MPRSTBADMAP);
+ subflow->reset_reason = MPTCP_RST_EMPTCP;
+ }
reset:
WRITE_ONCE(ssk->sk_err, EBADMSG);
--
2.34.1
^ permalink raw reply related
* [PATCH net] iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
From: Corinna Vinschen @ 2026-04-21 9:59 UTC (permalink / raw)
To: intel-wired-lan, netdev
Cc: Jose Ignacio Tornos Martinez, Michal Schmidt, Corinna Vinschen
This is just a simple cleanup fix. Commit 35a2443d0910f ("iavf: Add
waiting for response from PF in set mac") introduced a duplicate
ether_addr_equal() check, so the current code tests the new MAC twice
against the former MAC.
Remove the outer ether_addr_equal() test, remnant of commit c5c922b3e09b
("iavf: fix MAC address setting for VFs when filter is rejected")
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Fixes: 35a2443d0910f ("iavf: Add waiting for response from PF in set mac")
---
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
index a52c100dcbc5..9b8e7e4376c2 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
@@ -2579,13 +2579,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
case VIRTCHNL_OP_ADD_ETH_ADDR:
if (!v_retval)
iavf_mac_add_ok(adapter);
- if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr))
- if (!ether_addr_equal(netdev->dev_addr,
- adapter->hw.mac.addr)) {
- netif_addr_lock_bh(netdev);
- eth_hw_addr_set(netdev, adapter->hw.mac.addr);
- netif_addr_unlock_bh(netdev);
- }
+ if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) {
+ netif_addr_lock_bh(netdev);
+ eth_hw_addr_set(netdev, adapter->hw.mac.addr);
+ netif_addr_unlock_bh(netdev);
+ }
wake_up(&adapter->vc_waitqueue);
break;
case VIRTCHNL_OP_GET_STATS: {
--
2.53.0
^ permalink raw reply related
* Re: [PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets
From: Matthieu Baerts @ 2026-04-21 10:14 UTC (permalink / raw)
To: Shardul Bankar, martineau
Cc: geliang, davem, edumazet, kuba, pabeni, horms, netdev, mptcp,
linux-kernel, janak, kalpan.jani, Shardul Bankar
In-Reply-To: <20260421095646.3741956-1-shardul.b@mpiricsoftware.com>
Hi Shardul,
On 21/04/2026 11:56, Shardul Bankar wrote:
> MPTCP_RST_EMPTCP (reset reason 1) is used as a catch-all for seven
> distinct error conditions across subflow setup, authentication, and
> data path validation. The existing MPRstTx/MPRstRx counters only
> track aggregate reset volume, making it difficult to diagnose which
> code path is triggering subflow resets in production.
>
> Add per-reason MIB counters for each MPTCP_RST_EMPTCP use site:
>
> MPRstMD5SIG - MD5SIG on listener, incompatible with MPTCP
> MPRstNoToken - JOIN token lookup failed, no matching conn
> MPRstNoMPJ - SYN/ACK missing MP_JOIN option
> MPRstHMAC - HMAC validation failed during subflow join
> MPRstFatalFallback - fatal fallback during child socket creation
> MPRstBadMap - invalid data mapping on established subflow
> MPRstNotEstablished - JOIN on not-fully-established msk
>
> These counters are incremented alongside the existing reset_reason
> assignment and are visible via nstat as MPTcpExtMPRst*. The
> aggregate MPRstTx/MPRstRx counters remain unchanged.
Thank you for this patch.
Even if the patch looks globally good, net-next is currently closed, and
only bug fixes are accepted, see:
https://docs.kernel.org/process/maintainer-netdev.html
pw-bot: defer
Instead, I suggest switching the discussions only on the MPTCP ML: I
will try to review this patch and only send a reply to you and the MPTCP
list, if that's OK.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* RE: [Intel-wired-lan] [PATCH net] iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
From: Loktionov, Aleksandr @ 2026-04-21 10:20 UTC (permalink / raw)
To: Vinschen, Corinna, intel-wired-lan@osuosl.org,
netdev@vger.kernel.org
Cc: Vinschen, Corinna, Jose Ignacio Tornos Martinez
In-Reply-To: <20260421095947.868695-1-vinschen@redhat.com>
> -----Original Message-----
> From: Intel-wired-lan <intel-wired-lan-bounces@osuosl.org> On Behalf
> Of Corinna Vinschen
> Sent: Tuesday, April 21, 2026 12:00 PM
> To: intel-wired-lan@osuosl.org; netdev@vger.kernel.org
> Cc: Vinschen, Corinna <vinschen@redhat.com>; Jose Ignacio Tornos
> Martinez <jtornosm@redhat.com>
> Subject: [Intel-wired-lan] [PATCH net] iavf: iavf_virtchnl_completion:
> drop duplicate ether_addr_equal() test
>
> This is just a simple cleanup fix. Commit 35a2443d0910f ("iavf: Add
> waiting for response from PF in set mac") introduced a duplicate
> ether_addr_equal() check, so the current code tests the new MAC twice
> against the former MAC.
>
> Remove the outer ether_addr_equal() test, remnant of commit
> c5c922b3e09b
> ("iavf: fix MAC address setting for VFs when filter is rejected")
>
> Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
> Fixes: 35a2443d0910f ("iavf: Add waiting for response from PF in set
> mac")
I think Cc: stable@vger.kernel.org should be added.
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
> ---
> drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 12 +++++-------
> 1 file changed, 5 insertions(+), 7 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
> b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
> index a52c100dcbc5..9b8e7e4376c2 100644
> --- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
> @@ -2579,13 +2579,11 @@ void iavf_virtchnl_completion(struct
> iavf_adapter *adapter,
> case VIRTCHNL_OP_ADD_ETH_ADDR:
> if (!v_retval)
> iavf_mac_add_ok(adapter);
> - if (!ether_addr_equal(netdev->dev_addr, adapter-
> >hw.mac.addr))
> - if (!ether_addr_equal(netdev->dev_addr,
> - adapter->hw.mac.addr)) {
> - netif_addr_lock_bh(netdev);
> - eth_hw_addr_set(netdev, adapter-
> >hw.mac.addr);
> - netif_addr_unlock_bh(netdev);
> - }
> + if (!ether_addr_equal(netdev->dev_addr, adapter-
> >hw.mac.addr)) {
> + netif_addr_lock_bh(netdev);
> + eth_hw_addr_set(netdev, adapter->hw.mac.addr);
> + netif_addr_unlock_bh(netdev);
> + }
> wake_up(&adapter->vc_waitqueue);
> break;
> case VIRTCHNL_OP_GET_STATS: {
> --
> 2.53.0
^ permalink raw reply
* Re: [PATCH] mptcp: add per-reason MIB counters for MPTCP_RST_EMPTCP resets
From: Shardul Bankar @ 2026-04-21 10:24 UTC (permalink / raw)
To: Matthieu Baerts, martineau
Cc: geliang, davem, edumazet, kuba, pabeni, horms, netdev, mptcp,
linux-kernel, janak, kalpan.jani
In-Reply-To: <3dbda2d2-c7e5-4a12-90c0-d1f98e3d89ee@kernel.org>
On Tue, 2026-04-21 at 12:14 +0200, Matthieu Baerts wrote:
> Hi Shardul,
>
>
> Even if the patch looks globally good, net-next is currently closed,
> and
> only bug fixes are accepted, see:
>
> https://docs.kernel.org/process/maintainer-netdev.html
>
> pw-bot: defer
>
> Instead, I suggest switching the discussions only on the MPTCP ML: I
> will try to review this patch and only send a reply to you and the
> MPTCP
> list, if that's OK.
>
> Cheers,
> Matt
Hi Matt,
Thanks for looking at this. Happy to continue on the MPTCP list.
Thanks,
Shardul
^ permalink raw reply
* Re: [PATCH 1/1] tipc: fix double-free in tipc_buf_append()
From: Lee Jones @ 2026-04-21 10:35 UTC (permalink / raw)
To: Tung Quang Nguyen
Cc: Jon Maloy, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netdev@vger.kernel.org,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
In-Reply-To: <20260420151040.GF3202366@google.com>
On Mon, 20 Apr 2026, Lee Jones wrote:
> On Mon, 20 Apr 2026, Tung Quang Nguyen wrote:
>
> > >> Subject: [PATCH 1/1] tipc: fix double-free in tipc_buf_append()
> > >> >
> > >> >The tipc_msg_validate() function can potentially reallocate the skb
> > >> >it is validating, freeing the old one. In tipc_buf_append(), it was
> > >> >being called with a pointer to a local variable which was a copy of the
> > >caller's skb pointer.
> > >> >
> > >> >If the skb was reallocated and validation subsequently failed, the
> > >> >error handling path would free the original skb pointer, which had
> > >> >already been freed, leading to double-free.
> > >> >
> > >> >Fix this by passing the caller's skb pointer-pointer directly to
> > >> >tipc_msg_validate(), ensuring any modification is reflected correctly.
> > >> >The local skb pointer is then updated from the (possibly modified)
> > >> >caller's pointer.
> > >> >
> > >> >Fixes: d618d09a68e4 ("tipc: enforce valid ratio between skb truesize
> > >> >and
> > >> >contents")
> > >> >Assisted-by: Gemini:gemini-3.1-pro-preview
> > >> >Signed-off-by: Lee Jones <lee@kernel.org>
> > >> >---
> > >> > net/tipc/msg.c | 3 ++-
> > >> > 1 file changed, 2 insertions(+), 1 deletion(-)
> > >> >
> > >> >diff --git a/net/tipc/msg.c b/net/tipc/msg.c index
> > >> >76284fc538eb..9f4f612ee027
> > >> >100644
> > >> >--- a/net/tipc/msg.c
> > >> >+++ b/net/tipc/msg.c
> > >> >@@ -177,8 +177,9 @@ int tipc_buf_append(struct sk_buff **headbuf,
> > >> >struct sk_buff **buf)
> > >> >
> > >> > if (fragid == LAST_FRAGMENT) {
> > >> > TIPC_SKB_CB(head)->validated = 0;
> > >> >- if (unlikely(!tipc_msg_validate(&head)))
> > >> >+ if (unlikely(!tipc_msg_validate(headbuf)))
> > >> > goto err;
> > >> >+ head = *headbuf;
> > >> This is a known issue and was reported via
> > >> https://patchwork.kernel.org/project/netdevbpf/patch/20260330205313.24
> > >> 33372-1-nicholas@carlini.com/ The author did not respond to my
> > >> comment.
> > >> Can you improve the fix by applying my patch?
> > >
> > >I'd be happy to make any required changes.
> > >
> > >However, is this approach superior to simply passing a reference?
> > >
> > >v1 appears to be simpler, easier to read and avoids the explanation.
> > >
> > As I explained, your fix adds extra overhead to normal path while the error path is corner case and it rarely happens.
> > Whatever approach is applied, we need to add explanation to understand more easily the logic and hidden trick in tipc_msg_validate().
>
> Very well. I have made the recommended changes.
>
> The patch is currently in my build-test environment.
>
> I will post v2, when everything has been satisfied.
Okay, I genuinely tried to apply your patch. It builds just fine, but
Gemini (the AI I use to pre-review patches before submission) has some
doubts that this is the correct approach:
> @@ -177,8 +177,20 @@ int tipc_buf_append(struct sk_buff **headbuf, struct sk_buff **buf)
>
> if (fragid == LAST_FRAGMENT) {
> TIPC_SKB_CB(head)->validated = 0;
> - if (unlikely(!tipc_msg_validate(&head)))
> +
> + /* If the reassembled skb has been freed in
> + * tipc_msg_validate() because of an invalid truesize,
> + * then head will point to a newly allocated reassembled
> + * skb, while *headbuf points to freed reassembled skb.
> + * In such cases, correct *headbuf for freeing the newly
> + * allocated reassembled skb later.
> + *
> + * Note: It's done this way instead of passing &head // I added this part to give
> + * to avoid slowing down the happy path since this failure // the reviewer some additoinal
> + * is a rare event. // context
> + */
> + if (unlikely(!tipc_msg_validate(headbuf))) {
> + if (head != *headbuf)
> + *headbuf = head;
> goto err;
> + }
> +
"It looks like this logic might re-introduce the double-free bug.
The call to `tipc_msg_validate(headbuf)` is correct, as it passes the
pointer-to-pointer and allows the callee to update `*headbuf` if the skb
is reallocated.
However, the subsequent check seems to undo this. If a reallocation
happens, `head` will hold the pointer to the old, freed skb, while
`*headbuf` will hold the new one. The condition `head != *headbuf` will
be true, and the assignment `*headbuf = head` will restore the stale
pointer, leading to a double-free on the `err` path.
The preceding comment also appears to have the pointer roles reversed.
Would it be simpler and more correct to remove the `if (head != *headbuf)`
check and the large comment block? The change from `&head` to `headbuf`
in the function call seems to be the only change required to fix the bug.
Also, please update the commit message to reflect the corrected logic."
I suggest that we go with the original patch. Although I find it admirable
that you are thinking about and attempting to protect the more common
happy-path, I think the resultant single additional variable assignment
is negligible and that the simplicity of the previous fix has greater
benefits in terms of code readability and maintainability.
If you like, I can add a small comment, but I doubt even that is necessary.
--
Lee Jones [李琼斯]
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH net v3 3/5] iavf: send MAC change request synchronously
From: Jose Ignacio Tornos Martinez @ 2026-04-21 10:45 UTC (permalink / raw)
To: przemyslaw.kitszel
Cc: anthony.l.nguyen, davem, edumazet, intel-wired-lan, jtornosm,
kuba, netdev, pabeni, stable, horms
In-Reply-To: <d04d7827-f990-45ac-aadb-4079ab270159@intel.com>
Hello Przemek,
Thank you again for your comments, I appreciate your help.
I will try to include the new ones too in the next version.
I am also trying to analyze the comments from Simon with his AI review
tool.
Thanks
Best regards
Jose Ignacio
^ permalink raw reply
* Re: [PATCH net v8 03/15] net: cache snapshot entries for ndo_set_rx_mode_async
From: Paolo Abeni @ 2026-04-21 10:48 UTC (permalink / raw)
To: Stanislav Fomichev, netdev; +Cc: davem, edumazet, kuba
In-Reply-To: <1d871492-2da5-44b0-b6fe-860966dff55a@redhat.com>
On 4/21/26 11:52 AM, Paolo Abeni wrote:
> On 4/16/26 8:57 PM, Stanislav Fomichev wrote:
>> Add a per-device netdev_hw_addr_list cache (rx_mode_addr_cache) that
>> allows __hw_addr_list_snapshot() and __hw_addr_list_reconcile() to
>> reuse previously allocated entries instead of hitting GFP_ATOMIC on
>> every snapshot cycle.
>>
>> snapshot pops entries from the cache when available, falling back to
>> __hw_addr_create(). reconcile splices both snapshot lists back into
>> the cache via __hw_addr_splice(). The cache is flushed in
>> free_netdev().
>>
>> Signed-off-by: Stanislav Fomichev <sdf@fomichev.me>
>> (cherry picked from commit ba3ab1832a511f660fdc6231245b14bf610c05bd)
>
> Are you backporting from 7.2 via time machine??? :-P
>
>> @@ -611,8 +633,8 @@ void __hw_addr_list_reconcile(struct netdev_hw_addr_list *real_list,
>> }
>> }
>>
>> - __hw_addr_flush(work);
>> - __hw_addr_flush(ref);
>> + __hw_addr_splice(cache, work);
>> + __hw_addr_splice(cache, ref);
>
> I think here sashiko has a point, with the cache size being unbounded. I
> guess syzkaller or the like will find a way to make it grow too much.
>
> What about hard-limit it to some reasonable value?!?
There are a few more remarks from sashiko at the driver level, but
AFAICS are all pre-existing issues.
I think even the above one it's better handled as a follow-up, so I'm
applying the series as-is (I'll just drop the cherry-pick statement above).
/P
^ permalink raw reply
* [PATCH v2] usb: rtl8150: avoid using uninitialized CSCR value
From: Morduan Zang @ 2026-04-21 10:51 UTC (permalink / raw)
To: zhangdandan
Cc: andrew+netdev, davem, edumazet, kuba, linux-kernel, linux-usb,
netdev, pabeni, petkan, syzbot+9db6c624635564ad813c, Simon Horman,
Andrew Lunn, Michal Pecio
In-Reply-To: <93FF85BB9F33CD2B+20260402070743.20641-1-zhangdandan@uniontech.com>
set_carrier() reads CSCR via get_registers() (a USB control transfer)
without checking the return value, so a transient control transfer
failure would leave the on-stack "tmp" uninitialized and then be used
to decide the netif carrier state.
Check the return value of get_registers() and bail out on error,
leaving the previously known carrier state untouched. A failed USB
control transfer here may be transient (e.g. EMI, flaky cable, retries
exhausted), so it is wrong to force the link down on such failures and
cause the carrier state to toggle unnecessarily.
This only addresses the uninitialized-value usage and does not change
link-state policy.
Reported-by: syzbot+9db6c624635564ad813c@syzkaller.appspotmail.com
Closes: https://syzkaller.appspot.com/bug?extid=9db6c624635564ad813c
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: Petko Manolov <petkan@nucleusys.com>
Cc: Simon Horman <horms@kernel.org>
Cc: Andrew Lunn <andrew@lunn.ch>
Cc: Michal Pecio <michal.pecio@gmail.com>
Signed-off-by: Morduan Zang <zhangdandan@uniontech.com>
---
Changes in v2:
- Do not force netif_carrier_off() on get_registers() failure; instead
return and keep the previous carrier state. A transient USB control
transfer failure should not cause carrier to toggle.
(based on review feedback from Simon Horman, Petko Manolov,
Andrew Lunn and Michal Pecio.)
- Minimal change: only avoid the uninitialized read; no link-state
policy change. Petko's Ack on v1 is not carried over because v2
changes the error-handling behavior.
Changes in v1:
- Initial submission: on get_registers() failure call
netif_carrier_off() and return.
---
drivers/net/usb/rtl8150.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 4cda0643afb6..816759ced56c 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -722,7 +722,8 @@ static void set_carrier(struct net_device *netdev)
rtl8150_t *dev = netdev_priv(netdev);
short tmp;
- get_registers(dev, CSCR, 2, &tmp);
+ if (get_registers(dev, CSCR, 2, &tmp) < 0)
+ return;
if (tmp & CSCR_LINK_STATUS)
netif_carrier_on(netdev);
else
--
2.50.1
^ permalink raw reply related
* Re: [PATCH net v8 00/15] net: sleepable ndo_set_rx_mode
From: patchwork-bot+netdevbpf @ 2026-04-21 11:00 UTC (permalink / raw)
To: Stanislav Fomichev; +Cc: netdev, davem, edumazet, kuba, pabeni
In-Reply-To: <20260416185712.2155425-1-sdf@fomichev.me>
Hello:
This series was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Thu, 16 Apr 2026 11:56:57 -0700 you wrote:
> This series adds a new ndo_set_rx_mode_async callback that enables
> drivers to handle address list updates in a sleepable context. The
> current ndo_set_rx_mode is called under the netif_addr_lock spinlock
> with BHs disabled, which prevents drivers from sleeping. This is
> problematic for ops-locked drivers that need to sleep.
>
> The approach:
> 1. Add snapshot/reconcile infrastructure for address lists
> 2. Introduce dev_rx_mode_work that takes snapshots under the lock,
> drops the lock, calls the driver, then reconciles changes back
> 3. Move promiscuity handling into the scheduled work as well
> 4. Convert existing ops-locked drivers to ndo_set_rx_mode_async
> 5. Add a warning for ops-locked drivers still using ndo_set_rx_mode
> 6. Add a selftest exercising the team+bridge+macvlan topology that
> triggers the addr_lock -> ops_lock ordering issue
>
> [...]
Here is the summary with links:
- [net,v8,01/15] net: add address list snapshot and reconciliation infrastructure
https://git.kernel.org/netdev/net/c/db9e726525e4
- [net,v8,02/15] net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work
https://git.kernel.org/netdev/net/c/3554b4345d85
- [net,v8,03/15] net: cache snapshot entries for ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/a4c833278144
- [net,v8,04/15] net: move promiscuity handling into netdev_rx_mode_work
https://git.kernel.org/netdev/net/c/7ef83bf1712b
- [net,v8,05/15] fbnic: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/60dd9781e9b8
- [net,v8,06/15] mlx5: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/5cf06fbdaf02
- [net,v8,07/15] bnxt: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/f6c53cfa1217
- [net,v8,08/15] bnxt: use snapshot in bnxt_cfg_rx_mode
https://git.kernel.org/netdev/net/c/a453b5d9b3ed
- [net,v8,09/15] iavf: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/d071c15b43e9
- [net,v8,10/15] netdevsim: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/8a5df09e70c2
- [net,v8,11/15] dummy: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/4d157e89bde4
- [net,v8,12/15] netkit: convert to ndo_set_rx_mode_async
https://git.kernel.org/netdev/net/c/754b7e1169a7
- [net,v8,13/15] net: warn ops-locked drivers still using ndo_set_rx_mode
https://git.kernel.org/netdev/net/c/3cbd22938877
- [net,v8,14/15] selftests: net: add team_bridge_macvlan rx_mode test
https://git.kernel.org/netdev/net/c/ee514cdb07b3
- [net,v8,15/15] selftests: net: use ip commands instead of teamd in team rx_mode test
https://git.kernel.org/netdev/net/c/c4dde411bc36
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH] net: usb: rtl8150: fix use-after-free in rtl8150_start_xmit()
From: Morduan Zang @ 2026-04-21 11:04 UTC (permalink / raw)
To: petkan
Cc: davem, edumazet, kuba, pabeni, andrew+netdev, linux-usb, netdev,
linux-kernel, syzkaller-bugs, Zhan Jun,
syzbot+3f46c095ac0ca048cb71
From: Zhan Jun <zhanjun@uniontech.com>
syzbot reported a KASAN slab-use-after-free read in rtl8150_start_xmit()
when accessing skb->len for tx statistics after usb_submit_urb() has
been called:
BUG: KASAN: slab-use-after-free in rtl8150_start_xmit+0x71f/0x760
drivers/net/usb/rtl8150.c:712
Read of size 4 at addr ffff88810eb7a930 by task kworker/0:4/5226
The URB completion handler write_bulk_callback() frees the skb via
dev_kfree_skb_irq(dev->tx_skb). The URB may complete on another CPU
in softirq context before usb_submit_urb() returns in the submitter,
so by the time the submitter reads skb->len the skb has already been
queued to the per-CPU completion_queue and freed by net_tx_action():
CPU A (xmit) CPU B (USB completion softirq)
------------ ------------------------------
dev->tx_skb = skb;
usb_submit_urb() --+
|-------> write_bulk_callback()
| dev_kfree_skb_irq(dev->tx_skb)
| net_tx_action()
| napi_skb_cache_put() <-- free
netdev->stats.tx_bytes |
+= skb->len; <-- UAF read
Fix it by caching skb->len before submitting the URB and using the
cached value when updating the tx_bytes counter. This mirrors the
fix pattern used by other USB network drivers.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Reported-by: syzbot+3f46c095ac0ca048cb71@syzkaller.appspotmail.com
Closes: https://lore.kernel.org/all/69e69ee7.050a0220.24bfd3.002b.GAE@google.com/
Closes: https://syzkaller.appspot.com/bug?extid=3f46c095ac0ca048cb71
Signed-off-by: Zhan Jun <zhanjun@uniontech.com>
---
drivers/net/usb/rtl8150.c | 11 ++++++++++-
1 file changed, 10 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index 4cda0643afb6..6fc6be0cced6 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -683,6 +683,7 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
struct net_device *netdev)
{
rtl8150_t *dev = netdev_priv(netdev);
+ unsigned int skb_len;
int count, res;
/* pad the frame and ensure terminating USB packet, datasheet 9.2.3 */
@@ -694,6 +695,14 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
return NETDEV_TX_OK;
}
+ /*
+ * Cache skb->len before submitting the URB: the URB completion
+ * handler (write_bulk_callback) frees the skb, and it may run
+ * on another CPU before usb_submit_urb() returns, which would
+ * leave skb dangling here.
+ */
+ skb_len = skb->len;
+
netif_stop_queue(netdev);
dev->tx_skb = skb;
usb_fill_bulk_urb(dev->tx_urb, dev->udev, usb_sndbulkpipe(dev->udev, 2),
@@ -709,7 +718,7 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
}
} else {
netdev->stats.tx_packets++;
- netdev->stats.tx_bytes += skb->len;
+ netdev->stats.tx_bytes += skb_len;
netif_trans_update(netdev);
}
--
2.51.0
^ permalink raw reply related
* [PATCH] net: usb: rtl8150: free skb on usb_submit_urb() failure in xmit
From: Morduan Zang @ 2026-04-21 11:10 UTC (permalink / raw)
To: Petko Manolov
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, linux-usb, netdev, linux-kernel, Morduan Zang
When rtl8150_start_xmit() fails to submit the tx URB, the URB is never
handed to the USB core and write_bulk_callback() will not run. The
driver returns NETDEV_TX_OK, which tells the networking stack that the
skb has been consumed, but nothing actually frees the skb on this
error path:
dev->tx_skb = skb;
...
if ((res = usb_submit_urb(dev->tx_urb, GFP_ATOMIC))) {
...
/* no kfree_skb here */
}
return NETDEV_TX_OK;
This leaks the skb on every submit failure and also leaves dev->tx_skb
pointing at memory that the driver itself may later free, which is
fragile.
Free the skb with dev_kfree_skb_any() in the error path and clear
dev->tx_skb so no stale pointer is left behind.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Signed-off-by: Morduan Zang <zhangdandan@uniontech.com>
---
drivers/net/usb/rtl8150.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/drivers/net/usb/rtl8150.c b/drivers/net/usb/rtl8150.c
index a0f790a368ba..d358b6d41a53 100644
--- a/drivers/net/usb/rtl8150.c
+++ b/drivers/net/usb/rtl8150.c
@@ -716,6 +716,13 @@ static netdev_tx_t rtl8150_start_xmit(struct sk_buff *skb,
netdev->stats.tx_errors++;
netif_start_queue(netdev);
}
+ /*
+ * The URB was not submitted, so write_bulk_callback() will
+ * never run to free dev->tx_skb. Drop the skb here and
+ * clear tx_skb to avoid leaving a stale pointer.
+ */
+ dev->tx_skb = NULL;
+ dev_kfree_skb_any(skb);
} else {
netdev->stats.tx_packets++;
netdev->stats.tx_bytes += skb_len;
--
2.50.1
^ permalink raw reply related
* [PATCH net] iavf: iavf_virtchnl_completion: drop duplicate ether_addr_equal() test
From: Corinna Vinschen @ 2026-04-21 11:12 UTC (permalink / raw)
To: intel-wired-lan, netdev
Cc: Jose Ignacio Tornos Martinez, Michal Schmidt, Corinna Vinschen,
stable
In-Reply-To: <IA3PR11MB898664A49E614F197D4FED6EE52C2@IA3PR11MB8986.namprd11.prod.outlook.com>
This is just a simple cleanup fix. Commit 35a2443d0910f ("iavf: Add
waiting for response from PF in set mac") introduced a duplicate
ether_addr_equal() check, so the current code tests the new MAC twice
against the former MAC.
Remove the outer ether_addr_equal() test, remnant of commit c5c922b3e09b
("iavf: fix MAC address setting for VFs when filter is rejected")
Signed-off-by: Corinna Vinschen <vinschen@redhat.com>
Fixes: 35a2443d0910f ("iavf: Add waiting for response from PF in set mac")
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
---
Added CC: stable@vger.kernel.org
drivers/net/ethernet/intel/iavf/iavf_virtchnl.c | 12 +++++-------
1 file changed, 5 insertions(+), 7 deletions(-)
diff --git a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
index a52c100dcbc5..9b8e7e4376c2 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_virtchnl.c
@@ -2579,13 +2579,11 @@ void iavf_virtchnl_completion(struct iavf_adapter *adapter,
case VIRTCHNL_OP_ADD_ETH_ADDR:
if (!v_retval)
iavf_mac_add_ok(adapter);
- if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr))
- if (!ether_addr_equal(netdev->dev_addr,
- adapter->hw.mac.addr)) {
- netif_addr_lock_bh(netdev);
- eth_hw_addr_set(netdev, adapter->hw.mac.addr);
- netif_addr_unlock_bh(netdev);
- }
+ if (!ether_addr_equal(netdev->dev_addr, adapter->hw.mac.addr)) {
+ netif_addr_lock_bh(netdev);
+ eth_hw_addr_set(netdev, adapter->hw.mac.addr);
+ netif_addr_unlock_bh(netdev);
+ }
wake_up(&adapter->vc_waitqueue);
break;
case VIRTCHNL_OP_GET_STATS: {
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net v2 2/2] selftests/bpf: check epoll readiness after reuseport migration
From: Zhenzhong Wu @ 2026-04-21 11:16 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: davem, dsahern, edumazet, horms, kuba, linux-kernel,
linux-kselftest, ncardwell, netdev, pabeni, shuah, tamird
In-Reply-To: <20260421072017.1653163-1-kuniyu@google.com>
Thanks Kuniyuki, will fold this into v3.
Your approach of checking epoll right around shutdown() is much
better. I didn't think to put the check inside migrate_dance(). With
my original placement, the test still passed without patch 1 — I
should have called this out in the cover letter instead of settling
for what was effectively just a smoke test.
On Tue, Apr 21, 2026 at 3:20 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> From: Zhenzhong Wu <jt26wzz@gmail.com>
> Date: Sun, 19 Apr 2026 02:13:33 +0800
> > After migrate_dance() moves established children to the target
> > listener, add it to an epoll set and verify that epoll_wait(..., 0)
> > reports it ready before accept().
> >
> > This adds epoll coverage for the TCP_ESTABLISHED reuseport migration
> > case in migrate_reuseport.
> >
> > Keep the check limited to TCP_ESTABLISHED cases. TCP_SYN_RECV and
> > TCP_NEW_SYN_RECV still depend on asynchronous handshake completion,
> > so a zero-timeout epoll_wait() would race there.
> >
> > Signed-off-by: Zhenzhong Wu <jt26wzz@gmail.com>
> > ---
> > .../bpf/prog_tests/migrate_reuseport.c | 32 ++++++++++++++++++-
> > 1 file changed, 31 insertions(+), 1 deletion(-)
> >
> > diff --git a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> > index 653b0a20f..580a53424 100644
> > --- a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> > +++ b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> > @@ -18,13 +18,16 @@
> > * 9. call shutdown() for the second server
> > * and migrate the requests in the accept queue
> > * to the last server socket.
> > - * 10. call accept() for the last server socket.
> > + * 10. for TCP_ESTABLISHED cases, call epoll_wait(..., 0)
> > + * for the last server socket.
> > + * 11. call accept() for the last server socket.
> > *
> > * Author: Kuniyuki Iwashima <kuniyu@amazon.co.jp>
> > */
> >
> > #include <bpf/bpf.h>
> > #include <bpf/libbpf.h>
> > +#include <sys/epoll.h>
> >
> > #include "test_progs.h"
> > #include "test_migrate_reuseport.skel.h"
> > @@ -522,6 +525,33 @@ static void run_test(struct migrate_reuseport_test_case *test_case,
> > goto close_clients;
> > }
> >
> > + /* Only TCP_ESTABLISHED has already-migrated accept-queue entries
> > + * here. Later states still depend on follow-up handshake work.
> > + */
> > + if (test_case->state == BPF_TCP_ESTABLISHED) {
> > + struct epoll_event ev = {
> > + .events = EPOLLIN,
> > + };
> > + int epfd;
> > + int nfds;
> > +
> > + epfd = epoll_create1(EPOLL_CLOEXEC);
> > + if (!ASSERT_NEQ(epfd, -1, "epoll_create1"))
> > + goto close_clients;
> > +
> > + ev.data.fd = test_case->servers[MIGRATED_TO];
> > + if (!ASSERT_OK(epoll_ctl(epfd, EPOLL_CTL_ADD,
> > + test_case->servers[MIGRATED_TO], &ev),
> > + "epoll_ctl"))
> > + goto close_epfd;
> > +
> > + nfds = epoll_wait(epfd, &ev, 1, 0);
> > + ASSERT_EQ(nfds, 1, "epoll_wait");
>
> Thanks for the update, but the test passes without patch 1.
>
> I think it would be best to test just after shutdown()
> where migration happens.
>
> Also, TCP_SYN_RECV should be covered in the same way.
>
> ---8<---
> diff --git a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> index 580a534249a7..66fea936649e 100644
> --- a/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> +++ b/tools/testing/selftests/bpf/prog_tests/migrate_reuseport.c
> @@ -353,8 +353,29 @@ static int update_maps(struct migrate_reuseport_test_case *test_case,
>
> static int migrate_dance(struct migrate_reuseport_test_case *test_case)
> {
> + struct epoll_event ev = {
> + .events = EPOLLIN,
> + };
> + int epoll, nfds;
> int i, err;
>
> + if (test_case->state != BPF_TCP_NEW_SYN_RECV) {
> + epoll = epoll_create1(0);
> + if (!ASSERT_NEQ(epoll, -1, "epoll_create1"))
> + return -1;
> +
> + ev.data.fd = test_case->servers[MIGRATED_TO];
> + if (!ASSERT_OK(epoll_ctl(epoll, EPOLL_CTL_ADD,
> + test_case->servers[MIGRATED_TO], &ev),
> + "epoll_ctl")) {
> + goto close_epoll;
> + }
> +
> + nfds = epoll_wait(epoll, &ev, 1, 0);
> + if (!ASSERT_EQ(nfds, 0, "epoll_wait 1"))
> + goto close_epoll;
> + }
> +
> /* Migrate TCP_ESTABLISHED and TCP_SYN_RECV requests
> * to the last listener based on eBPF.
> */
> @@ -368,6 +389,15 @@ static int migrate_dance(struct migrate_reuseport_test_case *test_case)
> if (test_case->state == BPF_TCP_NEW_SYN_RECV)
> return 0;
>
> + nfds = epoll_wait(epoll, &ev, 1, 0);
> + if (!ASSERT_EQ(nfds, 1, "epoll_wait 2")) {
> +close_epoll:
> + close(epoll);
> + return -1;
> + }
> +
> + close(epoll);
> +
> /* Note that we use the second listener instead of the
> * first one here.
> *
> @@ -525,33 +555,6 @@ static void run_test(struct migrate_reuseport_test_case *test_case,
> goto close_clients;
> }
>
> - /* Only TCP_ESTABLISHED has already-migrated accept-queue entries
> - * here. Later states still depend on follow-up handshake work.
> - */
> - if (test_case->state == BPF_TCP_ESTABLISHED) {
> - struct epoll_event ev = {
> - .events = EPOLLIN,
> - };
> - int epfd;
> - int nfds;
> -
> - epfd = epoll_create1(EPOLL_CLOEXEC);
> - if (!ASSERT_NEQ(epfd, -1, "epoll_create1"))
> - goto close_clients;
> -
> - ev.data.fd = test_case->servers[MIGRATED_TO];
> - if (!ASSERT_OK(epoll_ctl(epfd, EPOLL_CTL_ADD,
> - test_case->servers[MIGRATED_TO], &ev),
> - "epoll_ctl"))
> - goto close_epfd;
> -
> - nfds = epoll_wait(epfd, &ev, 1, 0);
> - ASSERT_EQ(nfds, 1, "epoll_wait");
> -
> -close_epfd:
> - close(epfd);
> - }
> -
> count_requests(test_case, skel);
>
> close_clients:
> ---8<---
^ permalink raw reply
* Re: [PATCH net v4 2/2] net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
From: Paolo Abeni @ 2026-04-21 11:20 UTC (permalink / raw)
To: Lorenzo Bianconi, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Simon Horman
Cc: linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260417-airoha_qdma_cleanup_tx_queue-fix-net-v4-2-e04bcc2c9642@kernel.org>
On 4/17/26 8:36 AM, Lorenzo Bianconi wrote:
> @@ -1055,8 +1058,33 @@ static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
> e->dma_addr = 0;
> e->skb = NULL;
> list_add_tail(&e->list, &q->tx_list);
> +
> + /* Reset DMA descriptor */
> + WRITE_ONCE(desc->ctrl, 0);
> + WRITE_ONCE(desc->addr, 0);
> + WRITE_ONCE(desc->data, 0);
> + WRITE_ONCE(desc->msg0, 0);
> + WRITE_ONCE(desc->msg1, 0);
> + WRITE_ONCE(desc->msg2, 0);
Sashiko has some complains on this patch that look legit to me.
Also the pre-existing issues mentioned WRT patch 1/2 makes such patch
IMHO almost ineffective, I think you should address them in the same series.
Note that you should have commented on sashiko review on the ML, it
would have saved a significant amount of time on us.
/P
^ permalink raw reply
* Re: [patch 33/38] powerpc: Select ARCH_HAS_RANDOM_ENTROPY
From: Mukesh Kumar Chaurasiya @ 2026-04-21 11:22 UTC (permalink / raw)
To: Thomas Gleixner
Cc: LKML, Michael Ellerman, linuxppc-dev, Arnd Bergmann, x86,
Lu Baolu, iommu, Michael Grzeschik, netdev, linux-wireless,
Herbert Xu, linux-crypto, Vlastimil Babka, linux-mm,
David Woodhouse, Bernie Thompson, linux-fbdev, Theodore Tso,
linux-ext4, Andrew Morton, Uladzislau Rezki, Marco Elver,
Dmitry Vyukov, kasan-dev, Andrey Ryabinin, Thomas Sailer,
linux-hams, Jason A. Donenfeld, Richard Henderson, linux-alpha,
Russell King, linux-arm-kernel, Catalin Marinas, Huacai Chen,
loongarch, Geert Uytterhoeven, linux-m68k, Dinh Nguyen,
Jonas Bonn, linux-openrisc, Helge Deller, linux-parisc,
Paul Walmsley, linux-riscv, Heiko Carstens, linux-s390,
David S. Miller, sparclinux
In-Reply-To: <20260410120319.789114053@kernel.org>
On Fri, Apr 10, 2026 at 02:21:09PM +0200, Thomas Gleixner wrote:
> The only remaining usage of get_cycles() is to provide random_get_entropy().
>
> Switch powerpc over to the new scheme of selecting ARCH_HAS_RANDOM_ENTROPY
> and providing random_get_entropy() in asm/random.h.
>
> Remove asm/timex.h as it has no functionality anymore.
>
> Signed-off-by: Thomas Gleixner <tglx@kernel.org>
> Cc: Michael Ellerman <mpe@ellerman.id.au>
> Cc: linuxppc-dev@lists.ozlabs.org
> ---
> arch/powerpc/Kconfig | 1 +
> arch/powerpc/include/asm/random.h | 13 +++++++++++++
> arch/powerpc/include/asm/timex.h | 21 ---------------------
> 3 files changed, 14 insertions(+), 21 deletions(-)
>
> --- a/arch/powerpc/Kconfig
> +++ b/arch/powerpc/Kconfig
> @@ -150,6 +150,7 @@ config PPC
> select ARCH_HAS_PREEMPT_LAZY
> select ARCH_HAS_PTDUMP
> select ARCH_HAS_PTE_SPECIAL
> + select ARCH_HAS_RANDOM_ENTROPY
> select ARCH_HAS_SCALED_CPUTIME if VIRT_CPU_ACCOUNTING_NATIVE && PPC_BOOK3S_64
> select ARCH_HAS_SET_MEMORY
> select ARCH_HAS_STRICT_KERNEL_RWX if (PPC_BOOK3S || PPC_8xx) && !HIBERNATION
> --- /dev/null
> +++ b/arch/powerpc/include/asm/random.h
> @@ -0,0 +1,13 @@
> +/* SPDX-License-Identifier: GPL-2.0 */
> +#ifndef _ASM_POWERPC_RANDOM_H
> +#define _ASM_POWERPC_RANDOM_H
> +
> +#include <asm/cputable.h>
> +#include <asm/vdso/timebase.h>
> +
> +static inline unsigned long random_get_entropy(void)
> +{
> + return mftb();
> +}
> +
> +#endif /* _ASM_POWERPC_RANDOM_H */
> --- a/arch/powerpc/include/asm/timex.h
> +++ b/arch/powerpc/include/asm/timex.h
> @@ -1,21 +0,0 @@
> -/* SPDX-License-Identifier: GPL-2.0 */
> -#ifndef _ASM_POWERPC_TIMEX_H
> -#define _ASM_POWERPC_TIMEX_H
> -
> -#ifdef __KERNEL__
> -
> -/*
> - * PowerPC architecture timex specifications
> - */
> -
> -#include <asm/cputable.h>
> -#include <asm/vdso/timebase.h>
> -
> -ostatic inline cycles_t get_cycles(void)
> -{
R> - return mftb();
> -}
> -#define get_cycles get_cycles
> -
> -#endif /* __KERNEL__ */
> -#endif /* _ASM_POWERPC_TIMEX_H */
>
Build tested for this series with allmodconfig and allyesconfig on ppc64le
machine for ppc64le.
tree: git://git.kernel.org/pub/scm/linux/kernel/git/tglx/devel.git getcycles-v1
Boot tested for this series on powernv9 qemu, powernv10 qemu and pSeries
power11 hardware.
Tested-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
Reviewed-by: Mukesh Kumar Chaurasiya (IBM) <mkchauras@gmail.com>
^ permalink raw reply
* Re: [PATCH net 1/1] net/rose: hold listener socket during call request handling
From: Paolo Abeni @ 2026-04-21 11:23 UTC (permalink / raw)
To: Ren Wei, linux-hams, netdev
Cc: davem, edumazet, kuba, horms, kees, takamitz, kuniyu,
jiayuan.chen, mingo, stanksal, jlayton, yifanwucs, tomapufckgml,
bird, yuantan098, tonanli66
In-Reply-To: <52776256bf0fc38de92fe3edf39434538b672b69.1776327338.git.tonanli66@gmail.com>
On 4/17/26 1:01 PM, Ren Wei wrote:
> From: Nan Li <tonanli66@gmail.com>
>
> The call request receive path keeps using the listener socket after the
> lookup lock has been dropped. Keep the listener alive across the
> remaining validation and child socket setup by taking a reference in the
> lookup path and releasing it once request handling is finished.
>
> This makes listener lifetime handling explicit and avoids races with
> concurrent socket teardown.
>
> Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
> Cc: stable@kernel.org
> Reported-by: Yifan Wu <yifanwucs@gmail.com>
> Reported-by: Juefei Pu <tomapufckgml@gmail.com>
> Reported-by: Xin Liu <bird@lzu.edu.cn>
> Co-developed-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Yuan Tan <yuantan098@gmail.com>
> Signed-off-by: Nan Li <tonanli66@gmail.com>
> Signed-off-by: Ren Wei <n05ec@lzu.edu.cn>
we are moving rose out of tree:
https://lore.kernel.org/netdev/20260421021824.1293976-1-kuba@kernel.org/
please hold off until Thursday (after that our net PR will land into
mainline), and eventually resend if the code still exists in Linus's
tree at that point.
Thanks,
Paolo
^ permalink raw reply
* [PATCH] net/intel/e100: Make read-only param_range struct static const
From: Jakub Raczynski @ 2026-04-21 11:41 UTC (permalink / raw)
To: netdev
Cc: kuba, przemyslaw.kitszel, anthony.l.nguyen, kernel-janitors,
Jakub Raczynski
In-Reply-To: <CGME20260421114124eucas1p1198b3e8dd272702a5f717b818729a978@eucas1p1.samsung.com>
No need to use stack for single use read-only struct,
just make it static const.
Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com>
---
drivers/net/ethernet/intel/e100.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/e100.c b/drivers/net/ethernet/intel/e100.c
index 9074b558de35..6bce22e15a97 100644
--- a/drivers/net/ethernet/intel/e100.c
+++ b/drivers/net/ethernet/intel/e100.c
@@ -1034,8 +1034,8 @@ static inline int e100_phy_supports_mii(struct nic *nic)
static void e100_get_defaults(struct nic *nic)
{
- struct param_range rfds = { .min = 16, .max = 256, .count = 256 };
- struct param_range cbs = { .min = 64, .max = 256, .count = 128 };
+ static const struct param_range rfds = { .min = 16, .max = 256, .count = 256 };
+ static const struct param_range cbs = { .min = 64, .max = 256, .count = 128 };
/* MAC type is encoded as rev ID; exception: ICH is treated as 82559 */
nic->mac = (nic->flags & ich) ? mac_82559_D101M : nic->pdev->revision;
--
2.34.1
^ permalink raw reply related
* Re: [PATCH net v4 2/2] net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
From: Lorenzo Bianconi @ 2026-04-21 11:42 UTC (permalink / raw)
To: Paolo Abeni
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Simon Horman, linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <210f5d0b-6232-4c0f-adff-3a97d54159b3@redhat.com>
[-- Attachment #1: Type: text/plain, Size: 1670 bytes --]
On Apr 21, Paolo Abeni wrote:
> On 4/17/26 8:36 AM, Lorenzo Bianconi wrote:
> > @@ -1055,8 +1058,33 @@ static void airoha_qdma_cleanup_tx_queue(struct airoha_queue *q)
> > e->dma_addr = 0;
> > e->skb = NULL;
> > list_add_tail(&e->list, &q->tx_list);
> > +
> > + /* Reset DMA descriptor */
> > + WRITE_ONCE(desc->ctrl, 0);
> > + WRITE_ONCE(desc->addr, 0);
> > + WRITE_ONCE(desc->data, 0);
> > + WRITE_ONCE(desc->msg0, 0);
> > + WRITE_ONCE(desc->msg1, 0);
> > + WRITE_ONCE(desc->msg2, 0);
>
> Sashiko has some complains on this patch that look legit to me.
Hi Paolo,
I looked at the issue reported by Sashiko for patch 2/2 and I will send
a dedicated patch to address it but I guess this problem is not strictly
related to this patch since we already have the reported issue upstream
even without this patch (please consider dma_unmap_single() in
airoha_qdma_cleanup_tx_queue()).
Moreover, in this patch I want to just add missing bits in
airoha_qdma_cleanup_tx_queue().
>
> Also the pre-existing issues mentioned WRT patch 1/2 makes such patch
> IMHO almost ineffective, I think you should address them in the same series.
The issue reported by Sashiko for patch 1/2 are already addressed in the
following upstream series:
https://patchwork.kernel.org/project/netdevbpf/cover/20260420-airoha_qdma_init_rx_queue-fix-v2-0-d99347e5c18d@kernel.org/
>
> Note that you should have commented on sashiko review on the ML, it
> would have saved a significant amount of time on us.
I guess the main issue here is Sashiko is not currently sending the feedbacks
on the ML, right?
Regards,
Lorenzo
>
> /P
>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 228 bytes --]
^ permalink raw reply
* Re: [PATCH net] netdevsim: Initialize all fields of ip header when building dummy sk_buff
From: Nikola Z. Ivanov @ 2026-04-21 11:44 UTC (permalink / raw)
To: Breno Leitao
Cc: kuba, andrew+netdev, davem, edumazet, pabeni, netdev,
linux-kernel
In-Reply-To: <aec-UcPm5pRZjcSL@gmail.com>
On 4/21/26 12:12 PM, Breno Leitao wrote:
> On Tue, Apr 21, 2026 at 11:54:19AM +0300, Nikola Z. Ivanov wrote:
>> On 4/21/26 11:19 AM, Breno Leitao wrote:
>>> On Tue, Apr 21, 2026 at 10:37:38AM +0300, Nikola Z. Ivanov wrote:
>>>> Closes: https://syzkaller.appspot.com/bug?extid=23d7fcd204e3837866ff
>>> How do you check in the report above that the missig un-initialized
>>> fields are "tos" and "id"?
>> I don't think it is visible here, my guess would
>> be because the checksum calculator walks the
>> header in small chunks instead of referencing
>> its fields.
>>
>> The whole "KMSAN: uninit-value in irqentry_exit_to_kernel_mode_preempt"
>> doesn't really sound quite right.
> That's precisely my question - how does this fix relate to that specific
> report?
The fact that the 2 call traces from the allocation and usage
have a common origin in nsim_dev_trap_skb_build sort of gives it away.
Just to be clear, I saw the syzbot report and started investigating from
there, not the other way around.
> Were you able to reproduce the KMSAN report?
>
> Thanks for the quick answer,
> --breno
Yes, but it is a bit inconsistent.
Just booting the disk from the report and adding a device
is enough to trigger it, but we have to wait for some time:
syzkaller
syzkaller login: root
# echo "1 1" > /sys/bus/netdevsim/new_device
# [ 726.477183][ T5462] 8021q: adding VLAN 0 to HW filter on device eth1
# [ 1845.100611][ T80]
=====================================================
[ 1845.102363][ T80] BUG: KMSAN: uninit-value in
irqentry_exit_to_kernel_mode_preempt+0x8f/0xa0
[ 1845.104209][ T80] irqentry_exit_to_kernel_mode_preempt+0x8f/0xa0
[ 1845.105594][ T80] irqentry_exit+0x7c/0x7b0
[ 1845.106629][ T80] sysvec_apic_timer_interrupt+0x52/0x90
[ 1845.107829][ T80] asm_sysvec_apic_timer_interrupt+0x1f/0x30
[ 1845.108959][ T80] srso_alias_safe_ret+0x0/0x7
[ 1845.108959][ T80] __msan_metadata_ptr_for_load_4+0x24/0x40
[ 1845.108959][ T80] ip_fast_csum+0x1e6/0x3f0
[ 1845.108959][ T80] nsim_dev_trap_report_work+0x8c0/0x1430
[ 1845.108959][ T80] process_scheduled_works+0xbdb/0x1e20
[ 1845.108959][ T80] worker_thread+0xee5/0x1590
[ 1845.108959][ T80] kthread+0x540/0x600
[ 1845.108959][ T80] ret_from_fork+0x210/0x8f0
[ 1845.108959][ T80] ret_from_fork_asm+0x1a/0x30
[ 1845.108959][ T80]
[ 1845.108959][ T80] Uninit was created at:
[ 1845.108959][ T80] __kmalloc_node_track_caller_noprof+0x4fb/0x1770
[ 1845.108959][ T80] __alloc_skb+0x90d/0x1190
[ 1845.108959][ T80] nsim_dev_trap_report_work+0x3f2/0x1430
[ 1845.108959][ T80] process_scheduled_works+0xbdb/0x1e20
[ 1845.108959][ T80] worker_thread+0xee5/0x1590
[ 1845.108959][ T80] kthread+0x540/0x600
[ 1845.108959][ T80] ret_from_fork+0x210/0x8f0
[ 1845.108959][ T80] ret_from_fork_asm+0x1a/0x30
[ 1845.108959][ T80]
Thank you,
Nikola
^ permalink raw reply
* [PATCH] net/sun: Fix multiple typos in comments
From: Jakub Raczynski @ 2026-04-21 11:45 UTC (permalink / raw)
To: netdev
Cc: linux-kernel, kuba, davem, andrew+netdev, kernel-janitors,
Jakub Raczynski
In-Reply-To: <CGME20260421114526eucas1p29a73b6c60123beb164975e931347f1a4@eucas1p2.samsung.com>
There are some typos in comments and while they are harmless and not visible,
there is no reason not to fix them. Fix the ones that are not register related,
which might have intentional naming convention.
Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com>
---
drivers/net/ethernet/sun/cassini.c | 8 ++++----
drivers/net/ethernet/sun/cassini.h | 16 ++++++++--------
drivers/net/ethernet/sun/sunbmac.h | 2 +-
drivers/net/ethernet/sun/sungem.c | 4 ++--
drivers/net/ethernet/sun/sungem.h | 4 ++--
drivers/net/ethernet/sun/sunhme.c | 2 +-
6 files changed, 18 insertions(+), 18 deletions(-)
diff --git a/drivers/net/ethernet/sun/cassini.c b/drivers/net/ethernet/sun/cassini.c
index fe00e7dd3fe4..74fb0de12d21 100644
--- a/drivers/net/ethernet/sun/cassini.c
+++ b/drivers/net/ethernet/sun/cassini.c
@@ -1029,7 +1029,7 @@ static int cas_pcs_link_check(struct cas *cp)
* point a bit earlier in the sequence. If we had
* generated a reset a short time ago, we'll wait for
* the link timer to check the status until a
- * timer expires (link_transistion_jiffies_valid is
+ * timer expires (link_transition_jiffies_valid is
* true when the timer is running.) Instead of using
* a system timer, we just do a check whenever the
* link timer is running - this clears the flag after
@@ -4547,7 +4547,7 @@ static int cas_get_link_ksettings(struct net_device *dev,
}
if (linkstate != link_up) {
/* Force these to "unknown" if the link is not up and
- * autonogotiation in enabled. We can set the link
+ * autonegotiation in enabled. We can set the link
* speed to 0, but not cmd->duplex,
* because its legal values are 0 and 1. Ethtool will
* print the value reported in parentheses after the
@@ -4799,7 +4799,7 @@ static void cas_program_bridge(struct pci_dev *cas_pdev)
*/
pci_write_config_word(pdev, 0x50, (5 << 10) | 0x3ff);
- /* The Read Prefecth Policy register is 16-bit and sits at
+ /* The Read Prefetch Policy register is 16-bit and sits at
* offset 0x52. It enables a "smart" pre-fetch policy. We
* enable it and max out all of the settings since only one
* device is sitting underneath and thus bandwidth sharing is
@@ -4906,7 +4906,7 @@ static int cas_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
/*
* On some architectures, the default cache line size set
- * by pci_try_set_mwi reduces perforamnce. We have to increase
+ * by pci_try_set_mwi reduces performance. We have to increase
* it for this case. To start, we'll print some configuration
* data.
*/
diff --git a/drivers/net/ethernet/sun/cassini.h b/drivers/net/ethernet/sun/cassini.h
index 2d91f4936d52..0c24547a4534 100644
--- a/drivers/net/ethernet/sun/cassini.h
+++ b/drivers/net/ethernet/sun/cassini.h
@@ -259,7 +259,7 @@
/* output enables are provided for each device's chip select and for the rest
* of the outputs from cassini to its local bus devices. two sw programmable
- * bits are connected to general purpus control/status bits.
+ * bits are connected to general purpose control/status bits.
* DEFAULT: 0x7
*/
#define REG_BIM_LOCAL_DEV_EN 0x1020 /* BIM local device
@@ -404,7 +404,7 @@
GMII on SERDES pins for
monitoring. */
#define SATURN_PCFG_FSI 0x00000200 /* 1 = freeze serdes/gmii. all
- pins configed as outputs.
+ pins configured as outputs.
for power saving when using
internal phy. */
#define SATURN_PCFG_LAD 0x00000800 /* 0 = mac core led ctrl
@@ -622,7 +622,7 @@
enabled */
#define RX_CFG_SWIVEL_MASK 0x00001C00 /* byte offset of the 1st
data byte of the packet
- w/in 8 byte boundares.
+ w/in 8 byte boundaries.
this swivels the data
DMA'ed to header
buffers, jumbo buffers
@@ -1248,7 +1248,7 @@
*/
#define REG_MAC_TX_STATUS 0x6010 /* TX MAC status reg */
#define MAC_TX_FRAME_XMIT 0x0001 /* successful frame
- transmision */
+ transmission */
#define MAC_TX_UNDERRUN 0x0002 /* terminated frame
transmission due to
data starvation in the
@@ -1414,7 +1414,7 @@
* when passed to the host. to ensure proper operation, need to wait 3.2ms
* after clearing RX_CFG_EN before writing to any other RX MAC registers
* or other MAC parameters. alternatively, poll RX_CFG_EN until it clears
- * to 0. similary, HASH_FILTER_EN and ADDR_FILTER_EN have the same
+ * to 0. Similarly, HASH_FILTER_EN and ADDR_FILTER_EN have the same
* restrictions as CFG_EN.
*/
#define REG_MAC_RX_CFG 0x6034 /* RX MAC config reg */
@@ -1670,7 +1670,7 @@
* programmed in frame mode. load this register w/ a valid instruction
* (as per IEEE 802.3u MII spec). poll this register to check for instruction
* execution completion. during a read operation, this register will also
- * contain the 16-bit data returned by the tranceiver. unless specified
+ * contain the 16-bit data returned by the transceiver. unless specified
* otherwise, fields are considered "don't care" when polling for
* completion.
*/
@@ -1734,7 +1734,7 @@
#define MIF_CFG_POLL_REG_SHIFT 3
#define MIF_CFG_MDIO_0 0x0100 /* (ro) dual purpose.
when MDIO_0 is idle,
- 1 -> tranceiver is
+ 1 -> transceiver is
connected to MDIO_0.
when MIF is communicating
w/ MDIO_0 in bit-bang
@@ -1750,7 +1750,7 @@
mode, this bit indicates
the incoming bit stream
during a read op */
-#define MIF_CFG_POLL_PHY_MASK 0x7C00 /* tranceiver address to
+#define MIF_CFG_POLL_PHY_MASK 0x7C00 /* transceiver address to
be polled */
#define MIF_CFG_POLL_PHY_SHIFT 10
diff --git a/drivers/net/ethernet/sun/sunbmac.h b/drivers/net/ethernet/sun/sunbmac.h
index d379bd407eca..85778edcf8dc 100644
--- a/drivers/net/ethernet/sun/sunbmac.h
+++ b/drivers/net/ethernet/sun/sunbmac.h
@@ -205,7 +205,7 @@
#define FRAME_WRITE 0x50020000
#define FRAME_READ 0x60020000
-/* Tranceiver registers. */
+/* Transceiver registers. */
#define TCVR_PAL_SERIAL 0x00000001 /* Enable serial mode */
#define TCVR_PAL_EXTLBACK 0x00000002 /* Enable external loopback */
#define TCVR_PAL_MSENSE 0x00000004 /* Media sense */
diff --git a/drivers/net/ethernet/sun/sungem.c b/drivers/net/ethernet/sun/sungem.c
index 8e69d917d827..35c3226ce719 100644
--- a/drivers/net/ethernet/sun/sungem.c
+++ b/drivers/net/ethernet/sun/sungem.c
@@ -2187,7 +2187,7 @@ static void gem_do_stop(struct net_device *dev, int wol)
* if we did. This is not an issue however as the reset
* task is synchronized vs. us (rtnl_lock) and will do
* nothing if the device is down or suspended. We do
- * still clear reset_task_pending to avoid a spurrious
+ * still clear reset_task_pending to avoid a spurious
* reset later on in case we do resume before it gets
* scheduled.
*/
@@ -2370,7 +2370,7 @@ static int __maybe_unused gem_resume(struct device *dev_d)
gem_do_start(dev);
/* If we had WOL enabled, the cell clock was never turned off during
- * sleep, so we end up beeing unbalanced. Fix that here
+ * sleep, so we end up being unbalanced. Fix that here
*/
if (gp->asleep_wol)
gem_put_cell(gp);
diff --git a/drivers/net/ethernet/sun/sungem.h b/drivers/net/ethernet/sun/sungem.h
index 626302a9bc89..b921d3074017 100644
--- a/drivers/net/ethernet/sun/sungem.h
+++ b/drivers/net/ethernet/sun/sungem.h
@@ -352,7 +352,7 @@
#define MAC_HASH14 0x60F8UL /* Hash Table 14 Register */
#define MAC_HASH15 0x60FCUL /* Hash Table 15 Register */
#define MAC_NCOLL 0x6100UL /* Normal Collision Counter */
-#define MAC_FASUCC 0x6104UL /* First Attmpt. Succ Coll Ctr. */
+#define MAC_FASUCC 0x6104UL /* First Attempt. Succ Coll Ctr.*/
#define MAC_ECOLL 0x6108UL /* Excessive Collision Counter */
#define MAC_LCOLL 0x610CUL /* Late Collision Counter */
#define MAC_DTIMER 0x6110UL /* Defer Timer */
@@ -657,7 +657,7 @@
/* MIF Frame/Output Register. This 32-bit register allows the host to
* communicate with a transceiver in frame mode (as opposed to big-bang
- * mode). Writes by the host specify an instrution. After being issued
+ * mode). Writes by the host specify an instruction. After being issued
* the host must poll this register for completion. Also, after
* completion this register holds the data returned by the transceiver
* if applicable.
diff --git a/drivers/net/ethernet/sun/sunhme.c b/drivers/net/ethernet/sun/sunhme.c
index 4c9d5d4dd8a0..efbf042e9352 100644
--- a/drivers/net/ethernet/sun/sunhme.c
+++ b/drivers/net/ethernet/sun/sunhme.c
@@ -1118,7 +1118,7 @@ static void happy_meal_transceiver_check(struct happy_meal *hp, void __iomem *tr
*
* We use skb_reserve() to align the data block we get in the skb. We
* also program the etxregs->cfg register to use an offset of 2. This
- * imperical constant plus the ethernet header size will always leave
+ * emperical constant plus the ethernet header size will always leave
* us with a nicely aligned ip header once we pass things up to the
* protocol layers.
*
--
2.34.1
^ permalink raw reply related
* [PATCH] net/intel: Replace manual array size calculation with ARRAY_SIZE
From: Jakub Raczynski @ 2026-04-21 11:40 UTC (permalink / raw)
To: netdev
Cc: kuba, przemyslaw.kitszel, anthony.l.nguyen, kernel-janitors,
Jakub Raczynski
In-Reply-To: <CGME20260421114034eucas1p1d746ffe32b49aeb57f10e729d1331124@eucas1p1.samsung.com>
There are still places in the code where manual calculation of array size
exist, but it is good to enforce usage of single macro through the whole
code as it makes code bit more readable.
Signed-off-by: Jakub Raczynski <j.raczynski@samsung.com>
---
drivers/net/ethernet/intel/i40e/i40e_adminq.h | 2 +-
drivers/net/ethernet/intel/iavf/iavf_adminq.h | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/drivers/net/ethernet/intel/i40e/i40e_adminq.h b/drivers/net/ethernet/intel/i40e/i40e_adminq.h
index 1be97a3a86ce..0e7cecd00169 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_adminq.h
+++ b/drivers/net/ethernet/intel/i40e/i40e_adminq.h
@@ -109,7 +109,7 @@ static inline int i40e_aq_rc_to_posix(int aq_ret, int aq_rc)
-EFBIG, /* I40E_AQ_RC_EFBIG */
};
- if (!((u32)aq_rc < (sizeof(aq_to_posix) / sizeof((aq_to_posix)[0]))))
+ if (!((u32)aq_rc < ARRAY_SIZE(aq_to_posix)))
return -ERANGE;
return aq_to_posix[aq_rc];
diff --git a/drivers/net/ethernet/intel/iavf/iavf_adminq.h b/drivers/net/ethernet/intel/iavf/iavf_adminq.h
index bbf5c4b3a2ae..eb0257c86058 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_adminq.h
+++ b/drivers/net/ethernet/intel/iavf/iavf_adminq.h
@@ -113,7 +113,7 @@ static inline int iavf_aq_rc_to_posix(int aq_ret, int aq_rc)
if (aq_ret == IAVF_ERR_ADMIN_QUEUE_TIMEOUT)
return -EAGAIN;
- if (!((u32)aq_rc < (sizeof(aq_to_posix) / sizeof((aq_to_posix)[0]))))
+ if (!((u32)aq_rc < ARRAY_SIZE(aq_to_posix)))
return -ERANGE;
return aq_to_posix[aq_rc];
--
2.34.1
^ permalink raw reply related
* Re: [PATCH] netfilter: xt_HL: add pr_fmt, default case and NULL checks
From: kernel test robot @ 2026-04-21 11:48 UTC (permalink / raw)
To: Marino Dzalto, pablo, fw
Cc: oe-kbuild-all, netfilter-devel, coreteam, netdev, linux-kernel,
Marino Dzalto
In-Reply-To: <20260403193929.89449-1-marino.dzalto@gmail.com>
Hi Marino,
kernel test robot noticed the following build errors:
[auto build test ERROR on netfilter-nf/main]
[also build test ERROR on nf-next/master horms-ipvs/master linus/master v7.0 next-20260420]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Marino-Dzalto/netfilter-xt_HL-add-pr_fmt-default-case-and-NULL-checks/20260420-185652
base: https://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf.git main
patch link: https://lore.kernel.org/r/20260403193929.89449-1-marino.dzalto%40gmail.com
patch subject: [PATCH] netfilter: xt_HL: add pr_fmt, default case and NULL checks
config: m68k-allmodconfig (https://download.01.org/0day-ci/archive/20260421/202604211905.6ZPE3dFs-lkp@intel.com/config)
compiler: m68k-linux-gcc (GCC) 15.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260421/202604211905.6ZPE3dFs-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604211905.6ZPE3dFs-lkp@intel.com/
All errors (new ones prefixed by >>):
net/netfilter/xt_hl.c: In function 'ttl_mt':
>> net/netfilter/xt_hl.c:34:13: error: assignment of read-only variable 'ttl'
34 | ttl = ip_hdr(skb)->ttl;
| ^
vim +/ttl +34 net/netfilter/xt_hl.c
25
26 static bool ttl_mt(const struct sk_buff *skb, struct xt_action_param *par)
27 {
28 const struct ipt_ttl_info *info = par->matchinfo;
29 const u8 ttl;
30
31 if (!skb)
32 return false;
33
> 34 ttl = ip_hdr(skb)->ttl;
35
36 switch (info->mode) {
37 case IPT_TTL_EQ:
38 return ttl == info->ttl;
39 case IPT_TTL_NE:
40 return ttl != info->ttl;
41 case IPT_TTL_LT:
42 return ttl < info->ttl;
43 case IPT_TTL_GT:
44 return ttl > info->ttl;
45 default:
46 pr_warn("Unknown TTL match mode: %d\n", info->mode);
47 return false;
48 }
49 }
50
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox