* Re: [PATCH net 6/6] net/ncsi: validate GP payload lengths before parsing
From: Jakub Kicinski @ 2026-04-23 19:12 UTC (permalink / raw)
To: michael.bommarito
Cc: Jakub Kicinski, sam, fercerpav, netdev, davem, edumazet, pabeni,
horms, linux-kernel, stable
In-Reply-To: <20260422160342.1975093-7-michael.bommarito@gmail.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/ncsi: validate GP payload lengths before parsing
This commit bounds MAC and VLAN counts to software and GC-reported limits.
It adds validation to ensure the declared GP payload covers the fixed GP
prefix, consumed entries, and the checksum before parsing filter tables.
> diff --git a/net/ncsi/ncsi-rsp.c b/net/ncsi/ncsi-rsp.c
> index 94354dca23eac..565d38fd4b92d 100644
> --- a/net/ncsi/ncsi-rsp.c
> +++ b/net/ncsi/ncsi-rsp.c
[ ... ]
> @@ -924,6 +926,14 @@ static int ncsi_rsp_handler_gp(struct ncsi_request *nr)
> if (rsp->mac_cnt > mac_nbits || rsp->vlan_cnt > ncvf->n_vids)
> return -ERANGE;
Does this code read rsp->mac_cnt and rsp->vlan_cnt before validating the
payload length?
If a malformed packet with a payload length of 0 is received,
ncsi_validate_rsp_pkt() guarantees only 20 bytes (the common response
header) are pulled into the skb linear data area.
Since rsp->mac_cnt and rsp->vlan_cnt are at offsets 20 and 24 respectively,
could accessing them prior to the payload length check trigger an
out-of-bounds read?
> + payload = ncsi_rsp_payload(nr->rsp);
> + needed = offsetof(struct ncsi_rsp_gp_pkt, mac) - sizeof(rsp->rsp);
> + needed += mac_cnt * ETH_ALEN;
> + needed += vlan_cnt * sizeof(__be16);
> + needed += sizeof(rsp->checksum);
> + if (payload < needed)
> + return -EINVAL;
Are there missing timer cancellations during NCSI device unregistration
that could lead to a use-after-free regression?
ncsi_register_dev() initializes timers for 256 NCSI requests. If an NCSI
request is pending when the device is unregistered, and
ncsi_unregister_dev() calls kfree(ndp) without a prior timer_delete_sync(),
could the timer fire later and cause ncsi_request_timeout() to dereference
the freed memory?
Is there a synchronization issue between the workqueue teardown order and
device unregistration?
ncsi_unregister_dev() frees all packages and their channels via
ncsi_remove_package() before calling disable_work_sync(&ndp->work).
If the background task ncsi_dev_work() executes concurrently during this
teardown, could it attempt to suspend or configure the active channel
(e.g., in ncsi_suspend_channel()) and access ndp->active_package and
ndp->active_channel after they have already been freed?
Does the RCU synchronization in the package and channel removal paths properly
prevent use-after-free regressions during receive?
ncsi_remove_channel() and ncsi_remove_package() unlink elements from
RCU-protected lists (list_del_rcu(&nc->node)) and immediately call kfree()
without invoking synchronize_rcu() or using kfree_rcu().
Since the Rx path in ncsi_rcv_rsp() concurrently searches these lists using
list_for_each_entry_rcu(), could an incoming packet cause the Rx handler to
traverse and dereference recently freed package or channel memory?
Does ncsi_rsp_handler_gc() leak the MAC and VLAN filter arrays on repeated Get
Capabilities (GC) responses?
The handler unconditionally allocates memory for nc->mac_filter.addrs and
nc->vlan_filter.vids using kzalloc() and kcalloc(), but does not appear to
check for or free any previously allocated memory.
If a channel goes through a reset cycle via ncsi_reset_dev(), or if a GC
command is explicitly injected via Netlink, could the handler execute again
and overwrite the pointers, leaking the previous allocations?
^ permalink raw reply
* Re: [PATCH net] net: mana: hardening: Validate SHM offset from BAR0 register to prevent crash due to alignment fault
From: Dipayaan Roy @ 2026-04-23 19:14 UTC (permalink / raw)
To: Andrew Lunn
Cc: kys, haiyangz, wei.liu, decui, andrew+netdev, davem, edumazet,
kuba, pabeni, leon, longli, kotaranov, horms, shradhagupta,
ssengar, ernis, shirazsaleem, linux-hyperv, netdev, linux-kernel,
linux-rdma, stephen, jacob.e.keller, dipayanroy, leitao, kees,
john.fastabend, hawk, bpf, daniel, ast, sdf, yury.norov
In-Reply-To: <edccaafd-73f3-421d-a48e-a6cb704d39e6@lunn.ch>
On Thu, Apr 23, 2026 at 06:37:04PM +0200, Andrew Lunn wrote:
> > The root cause is in mana_gd_init_vf_regs(), which computes:
> >
> > gc->shm_base = gc->bar0_va + mana_gd_r64(gc, GDMA_REG_SHM_OFFSET);
> >
> > without validating the offset read from hardware. If the register
> > returns a garbage value that is neither within bar 0 bounds nor aligned
> > to the 4-byte granularity, thus causing the alignment fault.
>
> Is GDMA_REG_SHM_OFFSET special?
Hi Andrew,
GDMA_REG_SHM_OFFSET is not special. It was simply the only register
read that had no validation at all. The other two registers
(GDMA_REG_DB_PAGE_SIZE, GDMA_REG_DB_PAGE_OFFSET) already have checks
in place. Also shm_off becomes gc->shm_base (bar0_va + shm_off) and
gc->shm_base is dereferenced via readl() (ldr w1, [x20]) in
mana_smc_poll_register(), which is why it requires 4-byte alignment on arm64
device memory. Or else a misaligned shm_off propagates directly into a
misaligned shm_base, causing an alignment fault (FSC=0x21).
>
> What if GDMA_REG_DB_PAGE_SIZE or GDMA_REG_DB_PAGE_OFFSET have returned
> garbage? Are you going to die a horrible death as well?
Those two already have validation in the current code:
- GDMA_REG_DB_PAGE_SIZE is checked for < SZ_4K (returns -EPROTO)
- GDMA_REG_DB_PAGE_OFFSET is checked for >= bar0_size (returns -EPROTO)
The same checks exist for the PF equivalents (GDMA_PF_REG_DB_PAGE_SIZE
and GDMA_PF_REG_DB_PAGE_OFF) as well.
>
> Isn't there a way you can poll the firmware to ask it if it is ready?
Unfortunately no, as there is no separate readiness register to
poll.
The existing recovery flow already waits MANA_SERVICE_PERIOD (10
seconds) after suspend before attempting resume. If the registers are
still invalid after that, the -EPROTO triggers a PCI remove/rescan,
which re-probes the device.
>
> And what about the PF case. Can GDMA_PF_REG_SHM_OFF also be garbage?
Yes. This patch also adds bounds and alignment validation for the PF path:
both GDMA_SRIOV_REG_CFG_BASE_OFF and the SHM offset read via
(sriov_base_off + GDMA_PF_REG_SHM_OFF) are validated before use.
>
> Andrew
Regards
Dipayaan Roy
^ permalink raw reply
* Re: Help with PCIe THP on ConnectX-7
From: Bruce Merry @ 2026-04-23 19:17 UTC (permalink / raw)
To: Yishai Hadas; +Cc: netdev
In-Reply-To: <58a85178-c00f-4705-aa20-61e668bb9216@nvidia.com>
On Thu, Apr 23, 2026 at 05:55:53PM +0300, Yishai Hadas wrote:
> On 22/04/2026 18:22, Bruce Merry wrote:
> > Hello
> >
> > I'm hoping someone from NVIDIA Networking can help with this; I wasn't
> > sure of the best way to get in contact with the engineers working on
> > mlx5 kernel code so thought I'd try here. I'm trying to write some
> > (userspace) code using ibv_reg_mr_ex to register a memory region using
> > TLP Processing Hints (THP) to improve performance on an Epyc Turin
...
> It's supported only on CX8 for now.
Thanks. Does "for now" mean that you expect it to become available on
CX7 in future, and if so, are you able to say anything about timelines?
Thanks
Bruce
--
Dr Bruce Merry
bmerry <@> gmail <.> com
http://www.brucemerry.org.za/
http://blog.brucemerry.org.za/
^ permalink raw reply
* Re: [PATCH v1 1/2] vfio: add callback to get tph info for dma-buf
From: Alex Williamson @ 2026-04-23 19:20 UTC (permalink / raw)
To: Jason Gunthorpe
Cc: Zhiping Zhang, Stanislav Fomichev, Keith Busch, Leon Romanovsky,
Bjorn Helgaas, linux-rdma, linux-pci, netdev, dri-devel,
Yochai Cohen, Yishai Hadas, alex
In-Reply-To: <20260423142828.GQ3611611@ziepe.ca>
On Thu, 23 Apr 2026 11:28:28 -0300
Jason Gunthorpe <jgg@ziepe.ca> wrote:
> On Wed, Apr 22, 2026 at 01:27:40PM -0600, Alex Williamson wrote:
>
> > So why does vfio need to be involved in any of the sequence proposed
> > here? It seems like it would be a much cleaner design, avoiding
> > overloading the existing vfio feature and questionable array semantics,
> > if there were a set-tph ioctl on the resulting dma-buf instead of
> > making some vfio specific interface bundling creation with tph
> > hints.
>
> Realistically only VFIO dmabufs will have this property that user
> space can set any TPH.
>
> Other in-kernel drivers should accept some kind of hint from userspace
> when creating their dmabuf that makes sense for their device, not a
> raw TPH value. Like a GPU might accept a hint that specifies which
> dielet or something like that.
>
> So I don't see a generality here from that perspective. The generality
> is that exporting drivers that can use TPH now have the option to tell
> the importing driver to send them.
Ok, if dma_buf_ops.get_tph serves the common case of the driver
presenting TPH values and vfio's case of the driver being only a
conduit of user specified TPH values is unique, let's work on the vfio
uAPI.
Why do we need to bundle dma-buf creation and TPH setting into a single
ioctl? That's what the proposal here does and it results in a really
ugly extension with an off-by-one baked into it.
My suggestion would be that we leave VFIO_DEVICE_FEATURE_DMA_BUF
unchanged and add a VFIO_DEVICE_FEATURE_DMA_BUF_TPH ioctl which takes
the fd from VFIO_DEVICE_FEATURE_DMA_BUF, along with a steering tag and
processing hint. It would fdget() the dmabuf fd, validate it's a
dmabuf via f_ops, validate it's a vfio exported dmabuf via dmabuf->ops,
find the matching vfio_pci_dma_buf via priv under memory_lock, and
stuff the provided TPH values into the object. It would be left to the
user to sequence setting the TPH values on the dmabuf before the dmabuf
is consumed by the importer.
Is that a more reasonable uAPI? Thanks,
Alex
^ permalink raw reply
* Re: [PATCH net-deletions v2] net: remove unused ATM protocols and legacy ATM device drivers
From: Jakub Kicinski @ 2026-04-23 19:22 UTC (permalink / raw)
To: Andy Shevchenko
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, corbet,
skhan, linux, tsbogend, maddy, mpe, npiggin, chleroy, 3chas3,
razor, idosch, jani.nikula, mchehab+huawei, tytso, herbert, geert,
ebiggers, johannes.berg, jonathan.cameron, kees, kuniyu,
fourier.thomas, rdunlap, akpm, linux-doc, linux-mips,
linuxppc-dev, bridge, dwmw2
In-Reply-To: <aeh0CV3UQw1quCXv@ashevche-desk.local>
On Wed, 22 Apr 2026 10:08:57 +0300 Andy Shevchenko wrote:
> Since it's almost removal and it will go via netdev tree (same tree you are
> maintaining, I suppose) the -D would have a big help to review the changes
> (and not see removals at all, as 32k lines of one email is too much).
Good point, I'll remember for the future deletions
^ permalink raw reply
* Re: [PATCH net 1/1] net: rds: fix MR cleanup on copy error
From: patchwork-bot+netdevbpf @ 2026-04-23 19:30 UTC (permalink / raw)
To: Ren Wei
Cc: netdev, linux-rdma, rds-devel, achender, davem, edumazet, kuba,
pabeni, horms, leon, santosh.shilimkar, jhubbard, yuantan098,
yifanwucs, tomapufckgml, bird, draw51280
In-Reply-To: <79c8ef73ec8e5844d71038983940cc2943099baf.1776764247.git.draw51280@163.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 22 Apr 2026 22:52:07 +0800 you wrote:
> From: Ao Zhou <draw51280@163.com>
>
> __rds_rdma_map() hands sg/pages ownership to the transport after
> get_mr() succeeds. If copying the generated cookie back to user space
> fails after that point, the error path must not free those resources
> again before dropping the MR reference.
>
> [...]
Here is the summary with links:
- [net,1/1] net: rds: fix MR cleanup on copy error
https://git.kernel.org/netdev/net/c/8141a2dc7008
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v2 0/6] rxrpc: Miscellaneous fixes
From: Jakub Kicinski @ 2026-04-23 19:39 UTC (permalink / raw)
To: David Howells
Cc: netdev, Marc Dionne, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Anderson Nascimento, linux-afs, linux-kernel
In-Reply-To: <20260423115853.59273351@kernel.org>
On Thu, 23 Apr 2026 11:58:53 -0700 Jakub Kicinski wrote:
> On Thu, 23 Apr 2026 19:47:22 +0100 David Howells wrote:
> > Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > > Have you had a chance to look thru sashiko run for this?
> > >
> > > https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
> >
> > It wasn't available this morning when I looked. I know there are a couple of
> > things to fix from other checks.
>
> It is now :) May I offer the following menu of options
> - all the complaints are already taken into account / intentional /
> will be addressed later
> - I need more time, let's wait until tomorrow
> - some of it looks legit, apply patches ${list} only
> - let me respin completely
I've been hacking up Sashiko on top of Claude in these past few days,
and it's far less nit picky. For this series it doesn't flag a thing.
I'll just pull this in, if you could LMK whether any of the "real
Sashiko" reports are actually valid commentary on the current patches
I'd greatly appreciate.
^ permalink raw reply
* Re: [PATCH net] net: mana: hardening: Validate SHM offset from BAR0 register to prevent crash due to alignment fault
From: Andrew Lunn @ 2026-04-23 19:44 UTC (permalink / raw)
To: Dipayaan Roy
Cc: kys, haiyangz, wei.liu, decui, andrew+netdev, davem, edumazet,
kuba, pabeni, leon, longli, kotaranov, horms, shradhagupta,
ssengar, ernis, shirazsaleem, linux-hyperv, netdev, linux-kernel,
linux-rdma, stephen, jacob.e.keller, dipayanroy, leitao, kees,
john.fastabend, hawk, bpf, daniel, ast, sdf, yury.norov
In-Reply-To: <aepviNMszMBtiB/H@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net>
On Thu, Apr 23, 2026 at 12:14:16PM -0700, Dipayaan Roy wrote:
> On Thu, Apr 23, 2026 at 06:37:04PM +0200, Andrew Lunn wrote:
> > > The root cause is in mana_gd_init_vf_regs(), which computes:
> > >
> > > gc->shm_base = gc->bar0_va + mana_gd_r64(gc, GDMA_REG_SHM_OFFSET);
> > >
> > > without validating the offset read from hardware. If the register
> > > returns a garbage value that is neither within bar 0 bounds nor aligned
> > > to the 4-byte granularity, thus causing the alignment fault.
> >
> > Is GDMA_REG_SHM_OFFSET special?
> Hi Andrew,
> GDMA_REG_SHM_OFFSET is not special. It was simply the only register
> read that had no validation at all. The other two registers
> (GDMA_REG_DB_PAGE_SIZE, GDMA_REG_DB_PAGE_OFFSET) already have checks
> in place.
I must be missing something:
grep page_size *
gdma_main.c: gc->db_page_size = mana_gd_r32(gc, GDMA_PF_REG_DB_PAGE_SIZE) & 0xFFFF;
gdma_main.c: gc->db_page_size = mana_gd_r32(gc, GDMA_REG_DB_PAGE_SIZE) & 0xFFFF;
gdma_main.c: void __iomem *addr = gc->db_page_base + gc->db_page_size * db_index;
So if GDMA_REG_DB_PAGE_SIZE returns garbage, it is at least masked,
but it is still a random number.
mana_gd_ring_doorbell() takes this random number, multiples by
db_index, adds, gc->db_page_base and then does:
writeq(e.as_uint64, addr);
So you write to a random address.
I don't see any sanity checks here. Cannot you check that db_page_size
is at least one of the expected page sizes?
Andrew
^ permalink raw reply
* Re: [PATCH net v2 0/6] rxrpc: Miscellaneous fixes
From: patchwork-bot+netdevbpf @ 2026-04-23 19:50 UTC (permalink / raw)
To: David Howells
Cc: netdev, marc.dionne, kuba, davem, edumazet, pabeni, horms,
anderson, linux-afs, linux-kernel
In-Reply-To: <20260422161438.2593376-1-dhowells@redhat.com>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 22 Apr 2026 17:14:29 +0100 you wrote:
> Here are some fixes for rxrpc, as found by Sashiko[1]:
>
> (1) Fix leaks in rxkad_verify_response().
>
> (2) Fix handling of rxkad-encrypted packets with crypto-misaligned
> lengths.
>
> [...]
Here is the summary with links:
- [net,v2,1/6] rxrpc: Fix memory leaks in rxkad_verify_response()
https://git.kernel.org/netdev/net/c/34f61a07e0cd
- [net,v2,2/6] rxrpc: Fix rxkad crypto unalignment handling
https://git.kernel.org/netdev/net/c/def304aae2ed
- [net,v2,3/6] rxrpc: Fix potential UAF after skb_unshare() failure
https://git.kernel.org/netdev/net/c/1f2740150f90
- [net,v2,4/6] rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
https://git.kernel.org/netdev/net/c/24481a7f5733
- [net,v2,5/6] rxgk: Fix potential integer overflow in length check
https://git.kernel.org/netdev/net/c/6929350080f4
- [net,v2,6/6] rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
https://git.kernel.org/netdev/net/c/ac33733b10b4
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v2 0/6] rxrpc: Miscellaneous fixes
From: David Howells @ 2026-04-23 19:56 UTC (permalink / raw)
To: Jakub Kicinski
Cc: dhowells, netdev, Marc Dionne, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Anderson Nascimento, linux-afs,
linux-kernel
In-Reply-To: <20260423123947.156ce741@kernel.org>
Jakub Kicinski <kuba@kernel.org> wrote:
> I've been hacking up Sashiko on top of Claude in these past few days,
> and it's far less nit picky. For this series it doesn't flag a thing.
> I'll just pull this in, if you could LMK whether any of the "real
> Sashiko" reports are actually valid commentary on the current patches
> I'd greatly appreciate.
They're all valid comments. I've expanded my series by two further patches
and modified two others (one just a trivial missing space) and will post a v3
shortly.
David
^ permalink raw reply
* Re: [PATCH net v4 3/4] bonding: 3ad: fix mux port state on oper down
From: Jay Vosburgh @ 2026-04-23 20:00 UTC (permalink / raw)
To: Louis Scalbert
Cc: netdev, stephen, andrew+netdev, edumazet, kuba, pabeni, fbl, andy,
shemminger, maheshb
In-Reply-To: <20260417140505.3860237-4-louis.scalbert@6wind.com>
Louis Scalbert <louis.scalbert@6wind.com> wrote:
>When the bonding interface has carrier down due to the absence of
>usable slaves and a slave transitions from down to up, the bonding
>interface briefly goes carrier up, then down again, and finally up
>once LACP negotiates collecting and distributing on the port.
>
>When lacp_strict mode is on, the interface should not transition to
>carrier up until LACP negotiation is complete.
>
>This happens because the actor and partner port states remain in
>Collecting_Distributing when the port goes down. When the port
>comes back up, it temporarily remains in this state until LACP
>renegotiation occurs.
>
>Previously this was mostly cosmetic, but since the bonding carrier
>state may depend on the LACP negotiation state, it causes the
>interface to flap.
>
>Move an operationally down port to the Mux WAITING state and clear the
>Synchronization, Collecting, and Distributing states, in accordance with
>the 802.1AX Mux state machine diagram.
>
>Fixes: 655f8919d549 ("bonding: add min links parameter to 802.3ad")
>Signed-off-by: Louis Scalbert <louis.scalbert@6wind.com>
>---
> drivers/net/bonding/bond_3ad.c | 7 +++++++
> 1 file changed, 7 insertions(+)
>
>diff --git a/drivers/net/bonding/bond_3ad.c b/drivers/net/bonding/bond_3ad.c
>index 9cf064243d58..bc2964ea11f5 100644
>--- a/drivers/net/bonding/bond_3ad.c
>+++ b/drivers/net/bonding/bond_3ad.c
>@@ -1053,6 +1053,8 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
>
> if (port->sm_vars & AD_PORT_BEGIN) {
> port->sm_mux_state = AD_MUX_DETACHED;
>+ } else if (!port->is_enabled && port->sm_mux_state != AD_MUX_DETACHED) {
>+ port->sm_mux_state = AD_MUX_WAITING;
Technically, this is not exactly following the state machines.
The mux machine should transition to WAITING from DETACHED when
Selected == SELECTED or STANDBY, not for !is_enabled ("port_enabled" in
the standard). The check for !is_enabled happens in the receive
machine, and it would transition to PORT_DISABLED state (which clears
Synchronization).
I'm not sure if this is actually an issue or not; I need to read
the relevant bits again to make sure I understand how it's supposed to
work.
-J
> } else {
> switch (port->sm_mux_state) {
> case AD_MUX_DETACHED:
>@@ -1200,6 +1202,11 @@ static void ad_mux_machine(struct port *port, bool *update_slave_arr)
> break;
> case AD_MUX_WAITING:
> port->sm_mux_timer_counter = __ad_timer_to_ticks(AD_WAIT_WHILE_TIMER, 0);
>+ port->actor_oper_port_state &= ~LACP_STATE_SYNCHRONIZATION;
>+ ad_disable_collecting_distributing(port,
>+ update_slave_arr);
>+ port->actor_oper_port_state &= ~LACP_STATE_COLLECTING;
>+ port->actor_oper_port_state &= ~LACP_STATE_DISTRIBUTING;
> break;
> case AD_MUX_ATTACHED:
> if (port->aggregator->is_active)
>--
>2.39.2
>
---
-Jay Vosburgh, jv@jvosburgh.net
^ permalink raw reply
* Re: [PATCH net v2 0/6] rxrpc: Miscellaneous fixes
From: David Howells @ 2026-04-23 19:59 UTC (permalink / raw)
To: Jakub Kicinski
Cc: dhowells, netdev, Marc Dionne, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Anderson Nascimento, linux-afs,
linux-kernel
In-Reply-To: <3047316.1776974185@warthog.procyon.org.uk>
Okay, I can rebase on net/main.
David
^ permalink raw reply
* [PATCH net 0/3] rxrpc: Miscellaneous fixes
From: David Howells @ 2026-04-23 20:09 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, Anderson Nascimento,
linux-afs, linux-kernel
Here are some fixes for rxrpc, as found by Sashiko[1]:
(1) Fix rxrpc_input_call_event() to only unshare DATA packets.
(2) Fix re-decryption of RESPONSE packets where a partially decrypted
skbuff gets requeued if there was a failure due to ENOMEM.
(3) Fix error handling in rxgk_extract_token() where the ENOMEM case is
unhandled.
David
The patches can be found here also:
http://git.kernel.org/cgit/linux/kernel/git/dhowells/linux-fs.git/log/?h=rxrpc-fixes
Link: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com [1]
David Howells (3):
rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
rxrpc: Fix re-decryption of RESPONSE packets
rxrpc: Fix error handling in rxgk_extract_token()
include/trace/events/rxrpc.h | 1 -
net/rxrpc/call_event.c | 3 ++-
net/rxrpc/conn_event.c | 14 ++------------
net/rxrpc/rxgk_app.c | 1 +
4 files changed, 5 insertions(+), 14 deletions(-)
^ permalink raw reply
* [PATCH net 1/3] rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
From: David Howells @ 2026-04-23 20:09 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, Anderson Nascimento,
linux-afs, linux-kernel, Jeffrey Altman, stable
In-Reply-To: <20260423200909.3049438-1-dhowells@redhat.com>
Fix rxrpc_input_call_event() to only unshare DATA packets and not ACK,
ABORT, etc..
And with that, rxrpc_input_packet() doesn't need to take a pointer to the
pointer to the packet, so change that to just a pointer.
Fixes: 1f2740150f90 ("rxrpc: Fix potential UAF after skb_unshare() failure")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/call_event.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/rxrpc/call_event.c b/net/rxrpc/call_event.c
index cc8f9dfa44e8..fdd683261226 100644
--- a/net/rxrpc/call_event.c
+++ b/net/rxrpc/call_event.c
@@ -332,7 +332,8 @@ bool rxrpc_input_call_event(struct rxrpc_call *call)
saw_ack |= sp->hdr.type == RXRPC_PACKET_TYPE_ACK;
- if (sp->hdr.securityIndex != 0 &&
+ if (sp->hdr.type == RXRPC_PACKET_TYPE_DATA &&
+ sp->hdr.securityIndex != 0 &&
skb_cloned(skb)) {
/* Unshare the packet so that it can be
* modified by in-place decryption.
^ permalink raw reply related
* [PATCH net 2/3] rxrpc: Fix re-decryption of RESPONSE packets
From: David Howells @ 2026-04-23 20:09 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, Anderson Nascimento,
linux-afs, linux-kernel, Jeffrey Altman, stable
In-Reply-To: <20260423200909.3049438-1-dhowells@redhat.com>
If a RESPONSE packet gets a temporary failure during processing, it may end
up in a partially decrypted state - and then get requeued for a retry.
Fix this by just discarding the packet; we will send another CHALLENGE
packet and thereby elicit a further response. Similarly, discard an
incoming CHALLENGE packet if we get an error whilst generating a RESPONSE;
the server will send another CHALLENGE.
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
include/trace/events/rxrpc.h | 1 -
net/rxrpc/conn_event.c | 14 ++------------
2 files changed, 2 insertions(+), 13 deletions(-)
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 13b9d017f8e1..573f2df3a2c9 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -285,7 +285,6 @@
EM(rxrpc_conn_put_unidle, "PUT unidle ") \
EM(rxrpc_conn_put_work, "PUT work ") \
EM(rxrpc_conn_queue_challenge, "QUE chall ") \
- EM(rxrpc_conn_queue_retry_work, "QUE retry-wk") \
EM(rxrpc_conn_queue_rx_work, "QUE rx-work ") \
EM(rxrpc_conn_see_new_service_conn, "SEE new-svc ") \
EM(rxrpc_conn_see_reap_service, "SEE reap-svc") \
diff --git a/net/rxrpc/conn_event.c b/net/rxrpc/conn_event.c
index aee977291d90..a2130d25aaa9 100644
--- a/net/rxrpc/conn_event.c
+++ b/net/rxrpc/conn_event.c
@@ -389,7 +389,6 @@ void rxrpc_process_delayed_final_acks(struct rxrpc_connection *conn, bool force)
static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
{
struct sk_buff *skb;
- int ret;
if (test_and_clear_bit(RXRPC_CONN_EV_CHALLENGE, &conn->events))
rxrpc_secure_connection(conn);
@@ -398,17 +397,8 @@ static void rxrpc_do_process_connection(struct rxrpc_connection *conn)
* connection that each one has when we've finished with it */
while ((skb = skb_dequeue(&conn->rx_queue))) {
rxrpc_see_skb(skb, rxrpc_skb_see_conn_work);
- ret = rxrpc_process_event(conn, skb);
- switch (ret) {
- case -ENOMEM:
- case -EAGAIN:
- skb_queue_head(&conn->rx_queue, skb);
- rxrpc_queue_conn(conn, rxrpc_conn_queue_retry_work);
- break;
- default:
- rxrpc_free_skb(skb, rxrpc_skb_put_conn_work);
- break;
- }
+ rxrpc_process_event(conn, skb);
+ rxrpc_free_skb(skb, rxrpc_skb_put_conn_work);
}
}
^ permalink raw reply related
* [PATCH net 3/3] rxrpc: Fix error handling in rxgk_extract_token()
From: David Howells @ 2026-04-23 20:09 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, Anderson Nascimento,
linux-afs, linux-kernel, Jeffrey Altman, stable
In-Reply-To: <20260423200909.3049438-1-dhowells@redhat.com>
Fix a missing bit of error handling in rxgk_extract_token(): in the event
that rxgk_decrypt_skb() returns -ENOMEM, it should just return that rather
than continuing on (for anything else, it generates an abort).
Fixes: 64863f4ca494 ("rxrpc: Fix unhandled errors in rxgk_verify_packet_integrity()")
Closes: https://sashiko.dev/#/patchset/20260422161438.2593376-4-dhowells@redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: netdev@vger.kernel.org
cc: stable@kernel.org
---
net/rxrpc/rxgk_app.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/rxrpc/rxgk_app.c b/net/rxrpc/rxgk_app.c
index 5587639d60c5..0ef2a29eb695 100644
--- a/net/rxrpc/rxgk_app.c
+++ b/net/rxrpc/rxgk_app.c
@@ -245,6 +245,7 @@ int rxgk_extract_token(struct rxrpc_connection *conn, struct sk_buff *skb,
if (ret != -ENOMEM)
return rxrpc_abort_conn(conn, skb, ec, ret,
rxgk_abort_resp_tok_dec);
+ return ret;
}
ret = conn->security->default_decode_ticket(conn, skb, ticket_offset,
^ permalink raw reply related
* Re: [PATCH v4 net 2/3] net: mlx5e: fix CWR handling in drivers to preserve ACE signal
From: Dragos Tatulea @ 2026-04-23 20:13 UTC (permalink / raw)
To: Paolo Abeni, chia-yu.chang, linyunsheng, andrew+netdev, parav,
jasowang, mst, shenjian15, salil.mehta, shaojijie, saeedm, tariqt,
mbloch, leonro, linux-rdma, netdev, davem, edumazet, kuba, horms,
ij, ncardwell, koen.de_schepper, g.white, ingemar.s.johansson,
mirja.kuehlewind, cheshire, rs.ietf, Jason_Livingood, vidhi_goel
In-Reply-To: <e6aa13f1-4284-4ae0-9dda-1a506e729156@redhat.com>
On 23.04.26 19:40, Paolo Abeni wrote:
> On 4/23/26 4:19 PM, Dragos Tatulea wrote:
>> On 23.04.26 09:30, Paolo Abeni wrote:
>> [...]
>>>> ---
>>>> drivers/net/ethernet/mellanox/mlx5/core/en_rx.c | 4 ++--
>>>> 1 file changed, 2 insertions(+), 2 deletions(-)
>>>>
>>>> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
>>>> index 5b60aa47c75b..9b1c80079532 100644
>>>> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
>>>> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
>>>> @@ -1180,7 +1180,7 @@ static void mlx5e_shampo_update_ipv4_tcp_hdr(struct mlx5e_rq *rq, struct iphdr *
>>>> skb->csum_offset = offsetof(struct tcphdr, check);
>>>>
>>>> if (tcp->cwr)
>>>> - skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ECN;
>>>> + skb_shinfo(skb)->gso_type |= SKB_GSO_TCP_ACCECN;
>>>
>>> Here there is an open question for nVidia:
>>>
>> Sorry for missing this question in v3.
>>
>>> Is the above enough or will later segmentation lead to the wrong
>>> results? I think/guess the firmware is (still) aggregating the wire
>>> frames using the ECN schema, i.e. the first wire packet has CWR == 1,
>>> the later CWR==0.
>>>
>> For mlx5 HW-GRO a packet with the CWR flag will flush the previous GRO session
>> and will not start a GRO session for this packet (napi_gro_receive() will be
>> called on this single segment skb).
>>
>> So this change won't impact the current GRO behavior from the mlx5 driver/hw side.
>
> OK, thanks!
>
> For my education: doesn't the above also means that mlx5 will never
> build GSO packets with CWR set (and so the above statement should never
> be reached)?
>
It does look like it... Thanks for pointing it out! Will be addressed in a patch.
Thanks,
Dragos
^ permalink raw reply
* Re: [PATCH v1 net] udp: Use READ_ONCE()/WRITE_ONCE() for hslot->count.
From: Kuniyuki Iwashima @ 2026-04-23 20:15 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S. Miller, Jakub Kicinski, Paolo Abeni, Willem de Bruijn,
Simon Horman, David Held, Kuniyuki Iwashima, netdev,
syzbot+04905b8b3523856476c0
In-Reply-To: <CANn89iLZ3GUpK-iEvr0iyut1p-oXPn64rOnCcqpmbtfLwduNHQ@mail.gmail.com>
On Thu, Apr 23, 2026 at 11:59 AM Eric Dumazet <edumazet@google.com> wrote:
>
> On Thu, Apr 23, 2026 at 11:51 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> >
> > On Thu, Apr 23, 2026 at 12:29 AM Eric Dumazet <edumazet@google.com> wrote:
> > >
> > > On Wed, Apr 22, 2026 at 6:09 PM Kuniyuki Iwashima <kuniyu@google.com> wrote:
> > > >
> > > > __udp4_lib_mcast_demux_lookup() and __udp4_lib_mcast_deliver()
> > > > reads the number of sockets in the 1-tuple hash table chain
> > > > locklessly. [0]
> > > >
> > > > Let's use READ_ONCE() and WRITE_ONCE() for hslot->count.
> > > >
> > > > [0]:
> > > > BUG: KCSAN: data-race in __udp4_lib_mcast_deliver / udp_lib_unhash
> > >
> > > ...
> > >
> > > >
> > > > Reported by Kernel Concurrency Sanitizer on:
> > > > CPU: 1 UID: 0 PID: 15111 Comm: syz.6.4060 Not tainted syzkaller #0 PREEMPT(full)
> > > > Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026
> > > >
> > > > Fixes: 2dc41cff7545 ("udp: Use hash2 for long hash1 chains in __udp*_lib_mcast_deliver.")
> > > > Fixes: 63c6f81cdde5 ("udp: ipv4: do not waste time in __udp4_lib_mcast_demux_lookup")
> > > > Reported-by: syzbot+04905b8b3523856476c0@syzkaller.appspotmail.com
> > > > Closes: https://lore.kernel.org/netdev/69e97093.050a0220.24bfd3.0048.GAE@google.com/
> > > > Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> > > > ---
> > >
> > > You forgot to change net/ipv6/udp.c
> >
> > Ah exactly. Will add this in v2.
> >
> > >
> > > diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
> > > index 15e032194eccc3c29b3e5f3a09214cad60623329..1f4dabe4c350118441f61c1cf0398e698581542c
> > > 100644
> > > --- a/net/ipv6/udp.c
> > > +++ b/net/ipv6/udp.c
> > > @@ -953,7 +953,7 @@ static int __udp6_lib_mcast_deliver(struct net
> > > *net, struct sk_buff *skb,
> > > hash2_any = 0;
> > > hash2 = 0;
> > > hslot = udp_hashslot(udptable, net, hnum);
> > > - use_hash2 = hslot->count > 10;
> > > + use_hash2 = READ_ONCE(hslot->count) > 10;
> > > offset = offsetof(typeof(*sk), sk_node);
> > >
> > > if (use_hash2) {
> > >
> > >
> > > Also one part is missing in udp_lib_get_port()
> >
> > I excluded this part since it's under spin_lock_bh(&hslot->lock).
> >
>
> But you would need a spin_lock(hslot2->lock), wich we do not hold.
Ah, it's hslot2->count ! I'll cover that too, thank you !
>
> > >
> > > @@ -289,7 +289,7 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
> > > hash2_nulladdr &= udptable->mask;
> > >
> > > hslot2 = udp_hashslot2(udptable, slot2);
> > > - if (hslot->count < hslot2->count)
> > > + if (hslot->count < READ_ONCE(hslot2->count))
> > > goto scan_primary_hash;
> > >
> > > exist = udp_lib_lport_inuse2(net, snum, hslot2, sk);
^ permalink raw reply
* Re: [PATCH iwl-net v2 0/4] iavf: fix VLAN filter state machine races
From: Jacob Keller @ 2026-04-23 20:48 UTC (permalink / raw)
To: Simon Horman, Petr Oros
Cc: netdev, Tony Nguyen, Przemek Kitszel, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Jesse Brandeburg, Mitch Williams, Aaron Brown,
Przemyslaw Patynowski, Jedrzej Jagielski, intel-wired-lan,
linux-kernel
In-Reply-To: <20260421090254.GW280379@horms.kernel.org>
On 4/21/2026 2:02 AM, Simon Horman wrote:
> On Fri, Apr 17, 2026 at 04:29:41PM +0200, Petr Oros wrote:
>> The iavf VLAN filter state machine has several design issues that lead
>> to race conditions between userspace add/del calls and the watchdog
>> task's virtchnl processing. Filters can get lost or leak HW resources,
>> especially during interface down/up cycles and namespace moves.
>
> ...
>
> Hi Petr,
>
> Sashiko has a bit to say about this patch.
> I'd appreciate it if you could look over that.
>
> In particular, the feedback on patches 2 and 3 may warrant
> some updates to this patchset, while I think 4 is more
> in the realm of possible future work.
@Petr,
Could you please review the Sashiko reports and clarify whether a new
version will be needed?
The original series posted as a net-next was Tested-by, and it would be
good to get this moving, but I don't want to queue it up for sending
until certain it won't simply get rejected due to these unresolved comments.
Thanks,
Jake
^ permalink raw reply
* Re: [PATCH net v8 4/6] net/sched: netem: validate slot configuration
From: Jamal Hadi Salim @ 2026-04-23 21:12 UTC (permalink / raw)
To: Paolo Abeni
Cc: netdev, jiri, David S. Miller, Eric Dumazet, Jakub Kicinski,
Dave Taht, open list, Stephen Hemminger, Simon Horman
In-Reply-To: <87f5e94e-d354-423d-9976-6cf3fb0710b1@redhat.com>
On Thu, Apr 23, 2026 at 3:50 AM Paolo Abeni <pabeni@redhat.com> wrote:
>
> On 4/21/26 3:10 PM, Simon Horman wrote:
> > On Fri, Apr 17, 2026 at 08:19:42PM -0700, Stephen Hemminger wrote:
> >> Reject slot configurations that have no defensible meaning:
> >>
> >> - negative min_delay or max_delay
> >> - min_delay greater than max_delay
> >> - negative dist_delay or dist_jitter
> >> - negative max_packets or max_bytes
> >>
> >> Negative or out-of-order delays underflow in get_slot_next(),
> >> producing garbage intervals. Negative limits trip the per-slot
> >> accounting (packets_left/bytes_left <= 0) on the first packet of
> >> every slot, defeating the rate-limiting half of the slot feature.
> >>
> >> Note that dist_jitter has been silently coerced to its absolute
> >> value by get_slot() since the feature was introduced; rejecting
> >> negatives here converts that silent coercion into -EINVAL. The
> >> abs() can be removed in a follow-up.
> >>
> >> Fixes: 836af83b54e3 ("netem: support delivering packets in delayed time slots")
> >> Signed-off-by: Stephen Hemminger <stephen@networkplumber.org>
> >
> > Reviewed-by: Simon Horman <horms@kernel.org>
> >
> > I acknowledge that Sashiko has provided feedback on this patch.
> >
> > 1. "Does rejecting negative dist_jitter values with -EINVAL cause a
> > regression in userspace ABI backward compatibility? Since the kernel
> > previously accepted these values and silently coerced them using abs(),
> > existing userspace tools or scripts that happen to pass negative values
> > might start failing to configure the qdisc."
> >
> > This is intended and explicitly explained in the cover letter.
> Jamal, given the uAPI implication, could you please double check that
> the change is fine?
>
It should be fine; at least iproute2 will never allow the kernel to
receive a negative number.
Stephen brought up the fact that strtod() could return a -ve number
(but at least iproute2 makes sure negative numbers are not carried
forward to the kernel).
cheers,
jamal
> Thanks,
>
> Paolo
>
^ permalink raw reply
* [PATCH net-next v2] netlink: clean up failed initial dump-start state
From: Michael Bommarito @ 2026-04-23 21:28 UTC (permalink / raw)
To: Jakub Kicinski, David S . Miller, Eric Dumazet, Paolo Abeni
Cc: Simon Horman, Kuniyuki Iwashima, Kees Cook, Feng Yang, netdev,
linux-kernel, Michael Bommarito
In-Reply-To: <20260420162734.854587-1-michael.bommarito@gmail.com>
__netlink_dump_start() installs cb->skb, takes the module reference,
and sets cb_running before calling netlink_dump(sk, true). If that
first call returns via errout_skb the callback state is left behind:
cb_running stays set, module_put() and consume_skb(cb->skb) are
deferred until recvmsg() drives the dump back through the success
path, or netlink_release() on close runs the catch-all cleanup. On
sustained alloc failure neither fires.
Factor the teardown into netlink_dump_cleanup(nlk, drop) shared by
the dump success path, the lock_taken=true errout_skb path, and
netlink_release(). The @drop flag preserves the existing split:
consume_skb() on normal completion, kfree_skb() on abort.
Validation on a UML guest: an unprivileged task opens NETLINK_ROUTE,
preloads sk_rmem_alloc, then issues RTM_GETLINK | NLM_F_DUMP. Stock
kernel leaves cb_running stuck at 1 until recvmsg() or close()
drives it. Patched kernel clears cb_running immediately on the
lock_taken=true failure; the recvmsg continuation path is unchanged.
At scale: 3500 wedged sockets in a 256M guest show about 3.8-3.9
MiB of extra unreclaimable slab (~1.1 KiB/sock) on stock vs zero on
patched. RLIMIT_NOFILE bounds the test before OOM, so this is a
local availability cleanup rather than an exhaustion primitive.
Fixes: 16b304f3404f ("netlink: Eliminate kmalloc in netlink dump operation.")
Assisted-by: Claude:claude-opus-4-7
Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
---
v2 (per Jakub's review <20260420103715.347fbd4a@kernel.org>):
* commit message names both paths that do clear the state
(recvmsg-driven retry on drain, netlink_release() on close)
and notes that neither fires on sustained alloc failure
* moved the UML validation into the commit message
* extracted netlink_dump_cleanup(nlk, bool drop); shared with
netlink_release() and the success path. The bool preserves
the existing kfree_skb / consume_skb split.
v1: https://lore.kernel.org/netdev/20260420162734.854587-1-michael.bommarito@gmail.com/
net/netlink/af_netlink.c | 47 ++++++++++++++++++++++++++--------------
1 file changed, 31 insertions(+), 16 deletions(-)
diff --git a/net/netlink/af_netlink.c b/net/netlink/af_netlink.c
index 4d609d5cf406..ab21a6218631 100644
--- a/net/netlink/af_netlink.c
+++ b/net/netlink/af_netlink.c
@@ -131,6 +131,7 @@ static const char *const nlk_cb_mutex_key_strings[MAX_LINKS + 1] = {
};
static int netlink_dump(struct sock *sk, bool lock_taken);
+static void netlink_dump_cleanup(struct netlink_sock *nlk, bool drop);
/* nl_table locking explained:
* Lookup and traversal are protected with an RCU read-side lock. Insertion
@@ -763,13 +764,8 @@ static int netlink_release(struct socket *sock)
}
/* Terminate any outstanding dump */
- if (nlk->cb_running) {
- if (nlk->cb.done)
- nlk->cb.done(&nlk->cb);
- module_put(nlk->cb.module);
- kfree_skb(nlk->cb.skb);
- WRITE_ONCE(nlk->cb_running, false);
- }
+ if (nlk->cb_running)
+ netlink_dump_cleanup(nlk, true);
module_put(nlk->module);
@@ -2250,6 +2246,26 @@ static int netlink_dump_done(struct netlink_sock *nlk, struct sk_buff *skb,
return 0;
}
+/* Must be called with nl_cb_mutex NOT held. @drop=true frees the skb
+ * via kfree_skb() so drop-monitor sees the teardown; @drop=false uses
+ * consume_skb() for the normal-completion path.
+ */
+static void netlink_dump_cleanup(struct netlink_sock *nlk, bool drop)
+{
+ struct module *module = nlk->cb.module;
+ struct sk_buff *skb = nlk->cb.skb;
+
+ if (nlk->cb.done)
+ nlk->cb.done(&nlk->cb);
+
+ WRITE_ONCE(nlk->cb_running, false);
+ module_put(module);
+ if (drop)
+ kfree_skb(skb);
+ else
+ consume_skb(skb);
+}
+
static int netlink_dump(struct sock *sk, bool lock_taken)
{
struct netlink_sock *nlk = nlk_sk(sk);
@@ -2258,7 +2274,6 @@ static int netlink_dump(struct sock *sk, bool lock_taken)
struct sk_buff *skb = NULL;
unsigned int rmem, rcvbuf;
size_t max_recvmsg_len;
- struct module *module;
int err = -ENOBUFS;
int alloc_min_size;
int alloc_size;
@@ -2366,19 +2381,19 @@ static int netlink_dump(struct sock *sk, bool lock_taken)
else
__netlink_sendskb(sk, skb);
- if (cb->done)
- cb->done(cb);
-
- WRITE_ONCE(nlk->cb_running, false);
- module = cb->module;
- skb = cb->skb;
mutex_unlock(&nlk->nl_cb_mutex);
- module_put(module);
- consume_skb(skb);
+ netlink_dump_cleanup(nlk, false);
return 0;
errout_skb:
mutex_unlock(&nlk->nl_cb_mutex);
+ /* The recvmsg() retry path (lock_taken=false) keeps cb_running so
+ * the next recvmsg() can drive the dump forward once receive room
+ * is available; only the initial __netlink_dump_start() failure
+ * owns the teardown.
+ */
+ if (lock_taken)
+ netlink_dump_cleanup(nlk, true);
kfree_skb(skb);
return err;
}
--
2.53.0
^ permalink raw reply related
* Re: [PATCH bpf v3] bpf: Fix NULL pointer dereference in bpf_sk_storage_clone and diag paths
From: Amery Hung @ 2026-04-23 21:40 UTC (permalink / raw)
To: Weiming Shi
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Martin KaFai Lau, Alexei Starovoitov, Leon Hwang,
Kees Cook, Fushuai Wang, Menglong Dong, netdev, bpf, Xiang Mei
In-Reply-To: <20260422065411.1007737-2-bestswngs@gmail.com>
On Wed, Apr 22, 2026 at 12:37 AM Weiming Shi <bestswngs@gmail.com> wrote:
>
> bpf_selem_unlink_nofail() sets SDATA(selem)->smap to NULL before
> removing the selem from the storage hlist. A concurrent RCU reader in
> bpf_sk_storage_clone() can observe the selem still on the list with
> smap already NULL, causing a NULL pointer dereference.
>
> general protection fault, probably for non-canonical address 0xdffffc000000000a:
> KASAN: null-ptr-deref in range [0x0000000000000050-0x0000000000000057]
> RIP: 0010:bpf_sk_storage_clone+0x1cd/0xaa0 net/core/bpf_sk_storage.c:174
> Call Trace:
> <IRQ>
> sk_clone+0xfed/0x1980 net/core/sock.c:2591
> inet_csk_clone_lock+0x30/0x760 net/ipv4/inet_connection_sock.c:1222
> tcp_create_openreq_child+0x35/0x2680 net/ipv4/tcp_minisocks.c:571
> tcp_v4_syn_recv_sock+0x123/0xf90 net/ipv4/tcp_ipv4.c:1729
> tcp_check_req+0x8e1/0x2580 include/net/tcp.h:855
> tcp_v4_rcv+0x1845/0x3b80 net/ipv4/tcp_ipv4.c:2347
>
> Add a NULL check for smap in bpf_sk_storage_clone().
> bpf_sk_storage_diag_put_all() and bpf_sk_storage_diag_put() have the
> same unprotected dereference pattern, add NULL checks there as well and
> pass the validated smap to diag_get() so it no longer performs its own
> rcu_dereference.
>
> Fixes: 5d800f87d0a5 ("bpf: Support lockless unlink when freeing map or local storage")
> Reported-by: Xiang Mei <xmei5@asu.edu>
> Signed-off-by: Weiming Shi <bestswngs@gmail.com>
Acked-by: Amery Hung <ameryhung@gmail.com>
> ---
> v3:
> pass smap to diag_get()
> v2:
> drop the NULL check in diag_get(); The caller already checks smap for
> NULL.
>
> net/core/bpf_sk_storage.c | 18 ++++++++++++------
> 1 file changed, 12 insertions(+), 6 deletions(-)
>
> diff --git a/net/core/bpf_sk_storage.c b/net/core/bpf_sk_storage.c
> index f8338acebf077..1f9bd0005883b 100644
> --- a/net/core/bpf_sk_storage.c
> +++ b/net/core/bpf_sk_storage.c
> @@ -172,7 +172,7 @@ int bpf_sk_storage_clone(const struct sock *sk, struct sock *newsk)
> struct bpf_map *map;
>
> smap = rcu_dereference(SDATA(selem)->smap);
> - if (!(smap->map.map_flags & BPF_F_CLONE))
> + if (!smap || !(smap->map.map_flags & BPF_F_CLONE))
> continue;
>
> /* Note that for lockless listeners adding new element
> @@ -534,10 +534,10 @@ bpf_sk_storage_diag_alloc(const struct nlattr *nla_stgs)
> }
> EXPORT_SYMBOL_GPL(bpf_sk_storage_diag_alloc);
>
> -static int diag_get(struct bpf_local_storage_data *sdata, struct sk_buff *skb)
> +static int diag_get(struct bpf_local_storage_map *smap,
> + struct bpf_local_storage_data *sdata, struct sk_buff *skb)
> {
> struct nlattr *nla_stg, *nla_value;
> - struct bpf_local_storage_map *smap;
>
> /* It cannot exceed max nlattr's payload */
> BUILD_BUG_ON(U16_MAX - NLA_HDRLEN < BPF_LOCAL_STORAGE_MAX_VALUE_SIZE);
> @@ -546,7 +546,6 @@ static int diag_get(struct bpf_local_storage_data *sdata, struct sk_buff *skb)
> if (!nla_stg)
> return -EMSGSIZE;
>
> - smap = rcu_dereference(sdata->smap);
> if (nla_put_u32(skb, SK_DIAG_BPF_STORAGE_MAP_ID, smap->map.id))
> goto errout;
>
> @@ -599,9 +598,11 @@ static int bpf_sk_storage_diag_put_all(struct sock *sk, struct sk_buff *skb,
> saved_len = skb->len;
> hlist_for_each_entry_rcu(selem, &sk_storage->list, snode) {
> smap = rcu_dereference(SDATA(selem)->smap);
> + if (!smap)
> + continue;
> diag_size += nla_value_size(smap->map.value_size);
>
> - if (nla_stgs && diag_get(SDATA(selem), skb))
> + if (nla_stgs && diag_get(smap, SDATA(selem), skb))
> /* Continue to learn diag_size */
> err = -EMSGSIZE;
> }
> @@ -633,6 +634,7 @@ int bpf_sk_storage_diag_put(struct bpf_sk_storage_diag *diag,
> unsigned int diag_size = nla_total_size(0);
> struct bpf_local_storage *sk_storage;
> struct bpf_local_storage_data *sdata;
> + struct bpf_local_storage_map *smap;
> struct nlattr *nla_stgs;
> unsigned int saved_len;
> int err = 0;
> @@ -668,7 +670,11 @@ int bpf_sk_storage_diag_put(struct bpf_sk_storage_diag *diag,
>
> diag_size += nla_value_size(diag->maps[i]->value_size);
>
> - if (nla_stgs && diag_get(sdata, skb))
> + smap = rcu_dereference(sdata->smap);
> + if (!smap)
> + continue;
> +
> + if (nla_stgs && diag_get(smap, sdata, skb))
> /* Continue to learn diag_size */
> err = -EMSGSIZE;
> }
> --
> 2.43.0
>
^ permalink raw reply
* [GIT PULL] Networking for v7.1-rc1
From: Jakub Kicinski @ 2026-04-23 21:44 UTC (permalink / raw)
To: torvalds; +Cc: kuba, davem, netdev, linux-kernel, pabeni
Hi Linus!
The following changes since commit 1f5ffc672165ff851063a5fd044b727ab2517ae3:
Fix mismerge of the arm64 / timer-core interrupt handling changes (2026-04-14 23:03:02 -0700)
are available in the Git repository at:
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net.git tags/net-7.1-rc1
for you to fetch changes up to 5e6391da4539c35422c0df1d1d2d9a9bb97cd736:
Merge branch 'rxrpc-miscellaneous-fixes' (2026-04-23 14:29:18 -0700)
----------------------------------------------------------------
Including fixes from Netfilter.
Steady stream of fixes. Last two weeks feel comparable to the two
weeks before the merge window. Lots of AI-aided bug discovery.
A newer big source is Sashiko/Gemini (Roman Gushchin's system),
which points out issues in existing code during patch review
(maybe 25% of fixes here likely originating from Sashiko).
Nice thing is these are often fixed by the respective maintainers,
not drive-bys.
Current release - new code bugs:
- kconfig: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP
Previous releases - regressions:
- add async ndo_set_rx_mode and switch drivers which we promised
to be called under the per-netdev mutex to it
- dsa: remove duplicate netdev_lock_ops() for conduit ethtool ops
- hv_sock: report EOF instead of -EIO for FIN
- vsock/virtio: fix MSG_PEEK calculation on bytes to copy
Previous releases - always broken:
- ipv6: fix possible UAF in icmpv6_rcv()
- icmp: validate reply type before using icmp_pointers
- af_unix: drop all SCM attributes for SOCKMAP
- netfilter: fix a number of bugs in the osf (OS fingerprinting)
- eth: intel: fix timestamp interrupt configuration for E825C
Misc:
- bunch of data-race annotations
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
----------------------------------------------------------------
Alexey Kodanev (1):
nfp: fix swapped arguments in nfp_encode_basic_qdr() calls
Anderson Nascimento (1):
rxrpc: Fix missing validation of ticket length in non-XDR key preparsing
Andrea Mayer (1):
seg6: fix seg6 lwtunnel output redirect for L2 reduced encap mode
Ao Zhou (1):
net: rds: fix MR cleanup on copy error
Ariful Islam Shoikot (1):
docs: maintainer-netdev: fix typo in "targeting"
Bingquan Chen (1):
net/packet: fix TOCTOU race on mmap'd vnet_hdr in tpacket_snd()
Breno Leitao (1):
netconsole: avoid out-of-bounds access on empty string in trim_newline()
Brett Creeley (1):
virtio_net: sync rss_trailer.max_tx_vq on queue_pairs change via VQ_PAIRS_SET
Chia-Yu Chang (1):
net/sched: sch_dualpi2: drain both C-queue and L-queue in dualpi2_change()
Daniel Borkmann (1):
ipv6: Cap TLV scan in ip6_tnl_parse_tlv_enc_lim
Daniel Palmer (1):
m68k: mvme147: Make me the maintainer
David Carlier (1):
gtp: disable BH before calling udp_tunnel_xmit_skb()
David Howells (8):
rxrpc: Fix memory leaks in rxkad_verify_response()
rxrpc: Fix rxkad crypto unalignment handling
rxrpc: Fix potential UAF after skb_unshare() failure
rxrpc: Fix conn-level packet handling to unshare RESPONSE packets
rxgk: Fix potential integer overflow in length check
rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
rxrpc: Fix re-decryption of RESPONSE packets
rxrpc: Fix error handling in rxgk_extract_token()
Dexuan Cui (2):
hv_sock: Report EOF instead of -EIO for FIN
hv_sock: Return -EIO for malformed/short packets
Dudu Lu (4):
net/sched: act_mirred: fix wrong device for mac_header_xmit check in tcf_blockcast_redir
macvlan: fix macvlan_get_size() not reserving space for IFLA_MACVLAN_BC_CUTOFF
net/sched: sch_cake: fix NAT destination port not being updated in cake_update_flowkeys
vsock/virtio: fix accept queue count leak on transport mismatch
Eric Dumazet (20):
tcp: annotate data-races in tcp_get_info_chrono_stats()
tcp: add data-race annotations around tp->data_segs_out and tp->total_retrans
tcp: add data-races annotations around tp->reordering, tp->snd_cwnd
tcp: annotate data-races around tp->snd_ssthresh
tcp: annotate data-races around tp->delivered and tp->delivered_ce
tcp: add data-race annotations for TCP_NLA_SNDQ_SIZE
tcp: annotate data-races around tp->bytes_sent
tcp: annotate data-races around tp->bytes_retrans
tcp: annotate data-races around tp->dsack_dups
tcp: annotate data-races around tp->reord_seen
tcp: annotate data-races around tp->srtt_us
tcp: annotate data-races around tp->timeout_rehash
tcp: annotate data-races around (tp->write_seq - tp->snd_nxt)
tcp: annotate data-races around tp->plb_rehash
ipv6: fix possible UAF in icmpv6_rcv()
net_sched: sch_hhf: annotate data-races in hhf_dump_stats()
net/sched: sch_pie: annotate data-races in pie_dump_stats()
net/sched: sch_fq_codel: remove data-races from fq_codel_dump_stats()
net/sched: sch_red: annotate data-races in red_dump_stats()
net/sched: sch_sfb: annotate data-races in sfb_dump_stats()
Ernestas Kulik (1):
llc: Return -EINPROGRESS from llc_ui_connect()
Erni Sri Satya Vennela (5):
net: mana: Init link_change_work before potential error paths in probe
net: mana: Init gf_stats_work before potential error paths in probe
net: mana: Guard mana_remove against double invocation
net: mana: Don't overwrite port probe error with add_adev result
net: mana: Fix EQ leak in mana_remove on NULL port
Fernando Fernandez Mancera (2):
netfilter: nfnetlink_osf: fix out-of-bounds read on option matching
netfilter: nfnetlink_osf: fix potential NULL dereference in ttl check
Florian Westphal (1):
netfilter: conntrack: remove sprintf usage
Gang Yan (2):
mptcp: sync the msk->sndbuf at accept() time
selftests: mptcp: add a check for sndbuf of S/C
Geert Uytterhoeven (1):
net: mdio: MDIO_PIC64HPSC should depend on ARCH_MICROCHIP
Grzegorz Nitka (4):
ice: fix 'adjust' timer programming for E830 devices
ice: update PCS latency settings for E825 10G/25Gb modes
ice: fix timestamp interrupt configuration for E825C
ice: perform PHY soft reset for E825C ports at initialization
Guangshuo Li (1):
ice: fix double free in ice_sf_eth_activate() error path
Jacob Keller (2):
ice: fix ready bitmap check for non-E822 devices
ice: fix ice_ptp_read_tx_hwtstamp_status_eth56g
Jakub Kicinski (12):
Merge branch 'net-enetc-fix-command-bd-ring-issues'
Merge branch 'vsock-virtio-fix-msg_peek-calculation-on-bytes-to-copy'
selftests: net: add missing CMAC to tcp_ao config
Merge branch 'tcp-take-care-of-tcp_get_timestamping_opt_stats-races'
Merge tag 'ovpn-net-20260417' of https://github.com/OpenVPN/ovpn-net-next
Merge branch 'intel-wired-lan-driver-updates-2026-04-14-ice-i40e-iavf-idpf-e1000e'
Merge branch 'bnge-fixes'
Merge branch 'intel-wired-lan-driver-updates-2026-04-20-ice'
Merge branch 'tcp-symmetric-challenge-ack-for-seg-ack-snd-nxt'
Merge branch 'tcp-fix-listener-wakeup-after-reuseport-migration'
Merge branch 'rxrpc-miscellaneous-fixes'
Merge branch 'rxrpc-miscellaneous-fixes'
Jiawen Wu (1):
net: txgbe: fix firmware version check
Jiayuan Chen (4):
nexthop: fix IPv6 route referencing IPv4 nexthop
selftests: fib_nexthops: test stale has_v4 on nexthop replace
tcp: send a challenge ACK on SEG.ACK > SND.NXT
selftests/net: packetdrill: cover RFC 5961 5.2 challenge ACK on both edges
Keita Morisaki (1):
ice: fix race condition in TX timestamp ring cleanup
KhaiWenTan (1):
net: stmmac: Update default_an_inband before passing value to phylink_config
Kohei Enju (4):
ice: fix potential NULL pointer deref in error path of ice_set_ringparam()
i40e: don't advertise IFF_SUPP_NOFCS
net: validate skb->napi_id in RX tracepoints
vhost_net: fix sleeping with preempt-disabled in vhost_net_busy_poll()
Kory Maincent (1):
net: pse-pd: fix out-of-bounds bitmap access in pse_isr() on 32-bit
Kuniyuki Iwashima (1):
af_unix: Drop all SCM attributes for SOCKMAP.
Lee Jones (1):
tipc: fix double-free in tipc_buf_append()
Longxuan Yu (2):
8021q: use RCU for egress QoS mappings
8021q: delete cleared egress QoS mappings
Lorenzo Bianconi (7):
net: airoha: Wait for NPU PPE configuration to complete in airoha_ppe_offload_setup()
net: airoha: Fix possible TX queue stall in airoha_qdma_tx_napi_poll()
net: airoha: Fix PPE cpu port configuration for GDM2 loopback path
net: airoha: Move ndesc initialization at end of airoha_qdma_init_tx()
net: airoha: Add missing bits in airoha_qdma_cleanup_tx_queue()
net: airoha: Move ndesc initialization at end of airoha_qdma_init_rx_queue()
net: airoha: Add size check for TX NAPIs in airoha_qdma_cleanup()
Luigi Leonardi (3):
vsock/virtio: fix MSG_PEEK ignoring skb offset when calculating bytes to copy
vsock/test: fix MSG_PEEK handling in recv_buf()
vsock/test: add MSG_PEEK after partial recv test
Marek Vasut (2):
net: ks8851: Reinstate disabling of BHs around IRQ handler
net: ks8851: Avoid excess softirq scheduling
Matt Vollrath (1):
e1000e: Unroll PTP in probe error handling
Michael Bommarito (2):
sctp: fix OOB write to userspace in sctp_getsockopt_peer_auth_chunks
net/rds: zero per-item info buffer before handing it to visitors
Michal Schmidt (1):
ice: fix double-free of tx_buf skb
Mieczyslaw Nalewaj (1):
net: dsa: realtek: rtl8365mb: fix mode mask calculation
Pablo Neira Ayuso (3):
netfilter: nft_osf: restrict it to ipv4
netfilter: xtables: restrict several matches to inet family
netfilter: nat: use kfree_rcu to release ops
Paolo Abeni (6):
Merge branch 'net-sleepable-ndo_set_rx_mode'
Merge branch 'net-airoha-fix-airoha_qdma_cleanup_tx_queue-processing'
Merge tag 'nf-26-04-20' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf
Merge branch 'net-airoha-fix-null-pointer-derefrences-in-airoha_qdma_cleanup'
Merge branch 'net-mana-fix-probe-remove-error-path-bugs'
Merge branch 'mptcp-sync-the-msk-sndbuf-at-accept-time'
Paul Greenwalt (2):
ice: fix PHY config on media change with link-down-on-close
ice: fix ICE_AQ_LINK_SPEED_M for 200G
Petr Oros (1):
iavf: fix wrong VLAN mask for legacy Rx descriptors L2TAG2
Prathamesh Deshpande (1):
net/mlx5: Fix HCA caps leak on notifier init failure
Qingfang Deng (2):
flow_dissector: do not dissect PPPoE PFC frames
pppoe: drop PFC frames
Ralf Lici (6):
selftests: ovpn: add nftables config dependencies for test-mark
selftests: ovpn: fail notification check on mismatch
selftests: ovpn: flatten slurped notification JSON before filtering
selftests: ovpn: add prefix to helpers and shared variables
selftests: ovpn: align command flow with TAP
selftests: ovpn: serialize YNL listener startup
Ruide Cao (1):
ipv4: icmp: validate reply type before using icmp_pointers
Ruijie Li (1):
net/smc: avoid early lgr access in smc_clc_wait_msg
Stanislav Fomichev (16):
net: dsa: remove redundant netdev_lock_ops() from conduit ethtool ops
net: add address list snapshot and reconciliation infrastructure
net: introduce ndo_set_rx_mode_async and netdev_rx_mode_work
net: cache snapshot entries for ndo_set_rx_mode_async
net: move promiscuity handling into netdev_rx_mode_work
fbnic: convert to ndo_set_rx_mode_async
mlx5: convert to ndo_set_rx_mode_async
bnxt: convert to ndo_set_rx_mode_async
bnxt: use snapshot in bnxt_cfg_rx_mode
iavf: convert to ndo_set_rx_mode_async
netdevsim: convert to ndo_set_rx_mode_async
dummy: convert to ndo_set_rx_mode_async
netkit: convert to ndo_set_rx_mode_async
net: warn ops-locked drivers still using ndo_set_rx_mode
selftests: net: add team_bridge_macvlan rx_mode test
selftests: net: use ip commands instead of teamd in team rx_mode test
Stefano Garzarella (1):
vsock/virtio: fix MSG_ZEROCOPY pinned-pages accounting
Vikas Gupta (2):
bnge: fix initial HWRM sequence
bnge: remove unsupported backing store type
Vinicius Costa Gomes (1):
net/sched: taprio: fix use-after-free in advance_sched() on schedule switch
Wei Fang (2):
net: enetc: correct the command BD ring consumer index
net: enetc: fix NTMP DMA use-after-free issue
Weiming Shi (3):
openvswitch: cap upcall PID array size and pre-size vport replies
slip: reject VJ receive packets on instances with no rstate array
slip: bound decode() reads against the compressed packet length
Xiang Mei (1):
netfilter: nfnetlink_osf: fix divide-by-zero in OSF_WSS_MODULO
Xin Long (1):
sctp: fix sockets_allocated imbalance after sk_clone()
Yingnan Zhang (1):
ipvs: fix MTU check for GSO packets in tunnel mode
Yuan Zhaoming (1):
net: mctp: fix don't require received header reserved bits to be zero
Zhengchuan Liang (1):
net: bridge: use a stable FDB dst snapshot in RCU readers
Zhenzhong Wu (2):
tcp: call sk_data_ready() after listener migration
selftests/bpf: check epoll readiness during reuseport migration
Documentation/networking/netdevices.rst | 13 +
Documentation/process/maintainer-netdev.rst | 2 +-
MAINTAINERS | 7 +
drivers/net/dsa/realtek/rtl8365mb.c | 2 +-
drivers/net/dummy.c | 6 +-
drivers/net/ethernet/airoha/airoha_eth.c | 110 ++++--
drivers/net/ethernet/airoha/airoha_eth.h | 4 +-
drivers/net/ethernet/airoha/airoha_ppe.c | 34 +-
drivers/net/ethernet/broadcom/bnge/bnge_core.c | 30 +-
drivers/net/ethernet/broadcom/bnge/bnge_rmem.c | 16 -
drivers/net/ethernet/broadcom/bnxt/bnxt.c | 58 +--
drivers/net/ethernet/freescale/enetc/ntmp.c | 231 ++++++-----
.../net/ethernet/freescale/enetc/ntmp_private.h | 10 +-
drivers/net/ethernet/intel/e1000e/netdev.c | 1 +
drivers/net/ethernet/intel/i40e/i40e_main.c | 1 -
drivers/net/ethernet/intel/iavf/iavf_main.c | 16 +-
drivers/net/ethernet/intel/iavf/iavf_type.h | 2 +-
drivers/net/ethernet/intel/ice/ice.h | 4 +-
drivers/net/ethernet/intel/ice/ice_adminq_cmd.h | 2 +-
drivers/net/ethernet/intel/ice/ice_dcb_lib.c | 2 +-
drivers/net/ethernet/intel/ice/ice_ethtool.c | 1 +
drivers/net/ethernet/intel/ice/ice_lib.c | 4 +-
drivers/net/ethernet/intel/ice/ice_main.c | 121 ++----
drivers/net/ethernet/intel/ice/ice_ptp.c | 44 +--
drivers/net/ethernet/intel/ice/ice_ptp_consts.h | 12 +-
drivers/net/ethernet/intel/ice/ice_ptp_hw.c | 259 ++++++++++++-
drivers/net/ethernet/intel/ice/ice_ptp_hw.h | 5 +
drivers/net/ethernet/intel/ice/ice_sf_eth.c | 2 +
drivers/net/ethernet/intel/ice/ice_txrx.c | 29 +-
drivers/net/ethernet/intel/ice/ice_txrx.h | 16 +-
drivers/net/ethernet/mellanox/mlx5/core/en/fs.h | 5 +-
drivers/net/ethernet/mellanox/mlx5/core/en_fs.c | 32 +-
drivers/net/ethernet/mellanox/mlx5/core/en_main.c | 13 +-
drivers/net/ethernet/mellanox/mlx5/core/main.c | 4 +-
drivers/net/ethernet/meta/fbnic/fbnic_netdev.c | 20 +-
drivers/net/ethernet/meta/fbnic/fbnic_netdev.h | 4 +-
drivers/net/ethernet/meta/fbnic/fbnic_pci.c | 4 +-
drivers/net/ethernet/meta/fbnic/fbnic_rpc.c | 2 +-
drivers/net/ethernet/micrel/ks8851.h | 6 +-
drivers/net/ethernet/micrel/ks8851_common.c | 69 ++--
drivers/net/ethernet/micrel/ks8851_par.c | 15 +-
drivers/net/ethernet/micrel/ks8851_spi.c | 11 +-
drivers/net/ethernet/microsoft/mana/mana_en.c | 35 +-
.../ethernet/netronome/nfp/nfpcore/nfp_target.c | 17 +-
drivers/net/ethernet/stmicro/stmmac/stmmac_main.c | 4 +-
drivers/net/ethernet/wangxun/txgbe/txgbe_main.c | 3 +-
drivers/net/gtp.c | 2 +
drivers/net/macvlan.c | 1 +
drivers/net/mdio/Kconfig | 1 +
drivers/net/netconsole.c | 2 +
drivers/net/netdevsim/netdev.c | 8 +-
drivers/net/netkit.c | 6 +-
drivers/net/ppp/ppp_generic.c | 2 +-
drivers/net/ppp/pppoe.c | 8 +-
drivers/net/pse-pd/pse_core.c | 13 +-
drivers/net/slip/slhc.c | 49 ++-
drivers/net/virtio_net.c | 6 +
drivers/vhost/net.c | 4 +-
include/linux/fsl/ntmp.h | 9 +-
include/linux/if_vlan.h | 25 +-
include/linux/netdevice.h | 28 ++
include/linux/ppp_defs.h | 16 +
include/net/mctp.h | 3 +
include/net/pie.h | 2 +-
include/net/tcp.h | 12 +-
include/net/tcp_ecn.h | 2 +-
include/trace/events/net.h | 4 +-
include/trace/events/rxrpc.h | 6 +-
net/8021q/vlan_dev.c | 45 ++-
net/8021q/vlan_netlink.c | 10 +-
net/8021q/vlanproc.c | 12 +-
net/bridge/br_arp_nd_proxy.c | 8 +-
net/bridge/br_fdb.c | 28 +-
net/core/dev.c | 67 +---
net/core/dev.h | 4 +
net/core/dev_addr_lists.c | 385 ++++++++++++++++++-
net/core/dev_addr_lists_test.c | 387 ++++++++++++++++++-
net/core/dev_api.c | 3 +
net/core/dev_ioctl.c | 6 +-
net/core/filter.c | 2 +-
net/core/flow_dissector.c | 13 +-
net/core/rtnetlink.c | 1 +
net/dsa/conduit.c | 16 +-
net/ipv4/icmp.c | 5 +-
net/ipv4/inet_connection_sock.c | 3 +
net/ipv4/netfilter/iptable_nat.c | 4 +-
net/ipv4/nexthop.c | 4 +-
net/ipv4/tcp.c | 62 +--
net/ipv4/tcp_bbr.c | 6 +-
net/ipv4/tcp_bic.c | 2 +-
net/ipv4/tcp_cdg.c | 4 +-
net/ipv4/tcp_cubic.c | 6 +-
net/ipv4/tcp_dctcp.c | 2 +-
net/ipv4/tcp_input.c | 52 +--
net/ipv4/tcp_metrics.c | 6 +-
net/ipv4/tcp_nv.c | 4 +-
net/ipv4/tcp_output.c | 19 +-
net/ipv4/tcp_plb.c | 2 +-
net/ipv4/tcp_timer.c | 2 +-
net/ipv4/tcp_vegas.c | 9 +-
net/ipv4/tcp_westwood.c | 4 +-
net/ipv4/tcp_yeah.c | 3 +-
net/ipv6/icmp.c | 10 +-
net/ipv6/ip6_tunnel.c | 6 +
net/ipv6/netfilter/ip6table_nat.c | 4 +-
net/ipv6/seg6_iptunnel.c | 3 +-
net/llc/af_llc.c | 4 +-
net/mctp/route.c | 8 +-
net/mptcp/protocol.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 19 +-
net/netfilter/nf_nat_amanda.c | 2 +-
net/netfilter/nf_nat_core.c | 10 +-
net/netfilter/nf_nat_sip.c | 33 +-
net/netfilter/nfnetlink_osf.c | 45 +--
net/netfilter/nft_osf.c | 6 +-
net/netfilter/xt_mac.c | 34 +-
net/netfilter/xt_owner.c | 37 +-
net/netfilter/xt_physdev.c | 29 +-
net/netfilter/xt_realm.c | 2 +-
net/openvswitch/datapath.c | 35 +-
net/openvswitch/vport.c | 3 +
net/packet/af_packet.c | 21 +-
net/rds/connection.c | 14 +
net/rds/rdma.c | 4 -
net/rxrpc/ar-internal.h | 1 -
net/rxrpc/call_event.c | 20 +-
net/rxrpc/conn_event.c | 43 ++-
net/rxrpc/io_thread.c | 24 +-
net/rxrpc/key.c | 4 +
net/rxrpc/rxgk_app.c | 3 +-
net/rxrpc/rxgk_common.h | 1 +
net/rxrpc/rxkad.c | 112 +++---
net/rxrpc/skbuff.c | 9 -
net/sched/act_mirred.c | 2 +-
net/sched/sch_cake.c | 2 +-
net/sched/sch_dualpi2.c | 32 +-
net/sched/sch_fq_codel.c | 3 +-
net/sched/sch_hhf.c | 19 +-
net/sched/sch_pie.c | 38 +-
net/sched/sch_red.c | 31 +-
net/sched/sch_sfb.c | 54 +--
net/sched/sch_taprio.c | 9 +-
net/sctp/socket.c | 5 +-
net/smc/smc_clc.c | 4 +-
net/tipc/msg.c | 14 +-
net/unix/af_unix.c | 35 +-
net/vmw_vsock/hyperv_transport.c | 29 +-
net/vmw_vsock/virtio_transport_common.c | 19 +-
.../selftests/bpf/prog_tests/migrate_reuseport.c | 49 ++-
.../selftests/drivers/net/bonding/lag_lib.sh | 17 +-
.../selftests/drivers/net/team/dev_addr_lists.sh | 2 -
tools/testing/selftests/net/config | 1 +
tools/testing/selftests/net/fib_nexthops.sh | 22 ++
tools/testing/selftests/net/mptcp/diag.sh | 28 ++
tools/testing/selftests/net/ovpn/common.sh | 363 +++++++++++++-----
tools/testing/selftests/net/ovpn/config | 3 +
.../testing/selftests/net/ovpn/test-chachapoly.sh | 2 +-
.../selftests/net/ovpn/test-close-socket-tcp.sh | 2 +-
.../selftests/net/ovpn/test-close-socket.sh | 102 +++--
tools/testing/selftests/net/ovpn/test-float.sh | 2 +-
tools/testing/selftests/net/ovpn/test-mark.sh | 233 +++++++----
.../selftests/net/ovpn/test-symmetric-id-float.sh | 4 +-
.../selftests/net/ovpn/test-symmetric-id-tcp.sh | 4 +-
.../selftests/net/ovpn/test-symmetric-id.sh | 2 +-
tools/testing/selftests/net/ovpn/test-tcp.sh | 2 +-
tools/testing/selftests/net/ovpn/test.sh | 427 ++++++++++++++-------
.../packetdrill/tcp_rfc5961_ack-out-of-window.pkt | 48 +++
.../net/packetdrill/tcp_ts_recent_invalid_ack.pkt | 4 +-
tools/testing/selftests/net/rtnetlink.sh | 44 +++
tools/testing/selftests/net/tcp_ao/config | 1 +
tools/testing/vsock/util.c | 15 +
tools/testing/vsock/vsock_test.c | 50 ++-
172 files changed, 3537 insertions(+), 1417 deletions(-)
create mode 100644 tools/testing/selftests/net/packetdrill/tcp_rfc5961_ack-out-of-window.pkt
^ permalink raw reply
* Re: [PATCH net v2 0/6] rxrpc: Miscellaneous fixes
From: Jakub Kicinski @ 2026-04-23 21:46 UTC (permalink / raw)
To: David Howells
Cc: netdev, Marc Dionne, David S. Miller, Eric Dumazet, Paolo Abeni,
Simon Horman, Anderson Nascimento, linux-afs, linux-kernel
In-Reply-To: <3047316.1776974185@warthog.procyon.org.uk>
On Thu, 23 Apr 2026 20:56:25 +0100 David Howells wrote:
> Jakub Kicinski <kuba@kernel.org> wrote:
>
> > I've been hacking up Sashiko on top of Claude in these past few days,
> > and it's far less nit picky. For this series it doesn't flag a thing.
> > I'll just pull this in, if you could LMK whether any of the "real
> > Sashiko" reports are actually valid commentary on the current patches
> > I'd greatly appreciate.
>
> They're all valid comments. I've expanded my series by two further patches
> and modified two others (one just a trivial missing space) and will post a v3
> shortly.
There goes my hope that we found a way to reduce the noise.
^ permalink raw reply
* Re: [PATCH net 0/3] rxrpc: Miscellaneous fixes
From: patchwork-bot+netdevbpf @ 2026-04-23 21:50 UTC (permalink / raw)
To: David Howells
Cc: netdev, marc.dionne, kuba, davem, edumazet, pabeni, horms,
anderson, linux-afs, linux-kernel
In-Reply-To: <20260423200909.3049438-1-dhowells@redhat.com>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 23 Apr 2026 21:09:05 +0100 you wrote:
> Here are some fixes for rxrpc, as found by Sashiko[1]:
>
> (1) Fix rxrpc_input_call_event() to only unshare DATA packets.
>
> (2) Fix re-decryption of RESPONSE packets where a partially decrypted
> skbuff gets requeued if there was a failure due to ENOMEM.
>
> [...]
Here is the summary with links:
- [net,1/3] rxrpc: Fix rxrpc_input_call_event() to only unshare DATA packets
https://git.kernel.org/netdev/net/c/55b2984c96c3
- [net,2/3] rxrpc: Fix re-decryption of RESPONSE packets
https://git.kernel.org/netdev/net/c/0422e7a4883f
- [net,3/3] rxrpc: Fix error handling in rxgk_extract_token()
https://git.kernel.org/netdev/net/c/3476c8bb960f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox