* [PATCH v3 net-next 2/4] net/sched: tc_dump_qdisc_root() refactor
From: Eric Dumazet @ 2026-04-30 2:36 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Jamal Hadi Salim, Jiri Pirko, netdev, eric.dumazet,
Eric Dumazet
In-Reply-To: <20260430023628.3216283-1-edumazet@google.com>
Change tc_fill_qdisc() to return -EMSGSIZE when skb is too small.
Change tc_dump_qdisc_root() to propagate tc_fill_qdisc() error to its callers.
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/sched/sch_api.c | 29 +++++++++++++++--------------
1 file changed, 15 insertions(+), 14 deletions(-)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index 32ccd4672083aa19340520155aeba6d8b6ff546c..029e0f87ea9c61cc757432a07a6af92c90c551ef 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -976,7 +976,7 @@ static int tc_fill_qdisc(struct sk_buff *skb, struct Qdisc *q, u32 clid,
out_nlmsg_trim:
nla_put_failure:
nlmsg_trim(skb, b);
- return -1;
+ return -EMSGSIZE;
}
static bool tc_qdisc_dump_ignore(struct Qdisc *q, bool dump_invisible)
@@ -1836,11 +1836,13 @@ static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,
if (q_idx < s_q_idx) {
q_idx++;
} else {
- if (!tc_qdisc_dump_ignore(q, dump_invisible) &&
- tc_fill_qdisc(skb, q, q->parent, NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq, NLM_F_MULTI,
- RTM_NEWQDISC, NULL) <= 0)
- goto done;
+ if (!tc_qdisc_dump_ignore(q, dump_invisible))
+ ret = tc_fill_qdisc(skb, q, q->parent,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ RTM_NEWQDISC, NULL);
+ if (ret < 0)
+ goto out;
q_idx++;
}
@@ -1858,20 +1860,19 @@ static int tc_dump_qdisc_root(struct Qdisc *root, struct sk_buff *skb,
q_idx++;
continue;
}
- if (!tc_qdisc_dump_ignore(q, dump_invisible) &&
- tc_fill_qdisc(skb, q, q->parent, NETLINK_CB(cb->skb).portid,
- cb->nlh->nlmsg_seq, NLM_F_MULTI,
- RTM_NEWQDISC, NULL) <= 0)
- goto done;
+ if (!tc_qdisc_dump_ignore(q, dump_invisible))
+ ret = tc_fill_qdisc(skb, q, q->parent,
+ NETLINK_CB(cb->skb).portid,
+ cb->nlh->nlmsg_seq, NLM_F_MULTI,
+ RTM_NEWQDISC, NULL);
+ if (ret < 0)
+ goto out;
q_idx++;
}
out:
*q_idx_p = q_idx;
return ret;
-done:
- ret = -1;
- goto out;
}
static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v3 net-next 1/4] net/sched: propagate tc_fill_tclass() error
From: Eric Dumazet @ 2026-04-30 2:36 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Jamal Hadi Salim, Jiri Pirko, netdev, eric.dumazet,
Eric Dumazet
In-Reply-To: <20260430023628.3216283-1-edumazet@google.com>
Change tc_fill_tclass() to return -EMSGSIZE when skb is too small.
Change its caller to propagate this error (instead of -EINVAL)
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
net/sched/sch_api.c | 31 +++++++++++++++++--------------
1 file changed, 17 insertions(+), 14 deletions(-)
diff --git a/net/sched/sch_api.c b/net/sched/sch_api.c
index ed869a5ffc7377b7c19e66ae5fc9788e709488da..32ccd4672083aa19340520155aeba6d8b6ff546c 100644
--- a/net/sched/sch_api.c
+++ b/net/sched/sch_api.c
@@ -1987,15 +1987,16 @@ static int tc_fill_tclass(struct sk_buff *skb, struct Qdisc *q,
out_nlmsg_trim:
nla_put_failure:
nlmsg_trim(skb, b);
- return -1;
+ return -EMSGSIZE;
}
static int tclass_notify(struct net *net, struct sk_buff *oskb,
struct nlmsghdr *n, struct Qdisc *q,
unsigned long cl, int event, struct netlink_ext_ack *extack)
{
- struct sk_buff *skb;
u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
+ struct sk_buff *skb;
+ int ret;
if (!rtnl_notify_needed(net, n->nlmsg_flags, RTNLGRP_TC))
return 0;
@@ -2004,9 +2005,10 @@ static int tclass_notify(struct net *net, struct sk_buff *oskb,
if (!skb)
return -ENOBUFS;
- if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0, event, extack) < 0) {
+ ret = tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0, event, extack);
+ if (ret < 0) {
kfree_skb(skb);
- return -EINVAL;
+ return ret;
}
return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
@@ -2017,17 +2019,19 @@ static int tclass_get_notify(struct net *net, struct sk_buff *oskb,
struct nlmsghdr *n, struct Qdisc *q,
unsigned long cl, struct netlink_ext_ack *extack)
{
- struct sk_buff *skb;
u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
+ struct sk_buff *skb;
+ int ret;
skb = alloc_skb(NLMSG_GOODSIZE, GFP_KERNEL);
if (!skb)
return -ENOBUFS;
- if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0, RTM_NEWTCLASS,
- extack) < 0) {
+ ret = tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0,
+ RTM_NEWTCLASS, extack);
+ if (ret < 0) {
kfree_skb(skb);
- return -EINVAL;
+ return ret;
}
return rtnetlink_send(skb, net, portid, RTNLGRP_TC,
@@ -2041,7 +2045,7 @@ static int tclass_del_notify(struct net *net,
struct netlink_ext_ack *extack)
{
u32 portid = oskb ? NETLINK_CB(oskb).portid : 0;
- struct sk_buff *skb;
+ struct sk_buff *skb = NULL;
int err = 0;
if (!cops->delete)
@@ -2052,13 +2056,12 @@ static int tclass_del_notify(struct net *net,
if (!skb)
return -ENOBUFS;
- if (tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0,
- RTM_DELTCLASS, extack) < 0) {
+ err = tc_fill_tclass(skb, q, cl, portid, n->nlmsg_seq, 0,
+ RTM_DELTCLASS, extack);
+ if (err < 0) {
kfree_skb(skb);
- return -EINVAL;
+ return err;
}
- } else {
- skb = NULL;
}
err = cops->delete(q, cl, extack);
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v3 net-next 0/4] net/sched: tc_dump_qdisc() optimizations
From: Eric Dumazet @ 2026-04-30 2:36 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Jamal Hadi Salim, Jiri Pirko, netdev, eric.dumazet,
Eric Dumazet
Before converting tc_dump_qdisc() to RCU, we make the following changes:
- Use for_each_netdev_dump() instead of for_each_netdev()
- Only dump qdiscs of a single device at user space request.
v2 and v3: addressed Jakub feedback (thanks!)
Eric Dumazet (4):
net/sched: propagate tc_fill_tclass() error
net/sched: tc_dump_qdisc_root() refactor
net/sched: switch tc_dump_qdisc() to for_each_netdev_dump()
net/sched: speedup tc_dump_qdisc() when tcm_ifindex is provided
net/sched/sch_api.c | 127 +++++++++++++++++++++++---------------------
1 file changed, 67 insertions(+), 60 deletions(-)
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply
* Re: [PATCH net v2 2/4] net: macb: drop in-flight Tx SKBs on close
From: Jakub Kicinski @ 2026-04-30 2:34 UTC (permalink / raw)
To: Théo Lebrun
Cc: Nicolas Ferre, Claudiu Beznea, Andrew Lunn, David S. Miller,
Eric Dumazet, Paolo Abeni, Haavard Skinnemoen, Jeff Garzik,
Paolo Valerio, Conor Dooley, Nicolai Buchwitz, netdev,
linux-kernel, Vladimir Kondratiev, Gregory CLEMENT,
Benoît Monin, Tawfik Bayouk, Thomas Petazzoni,
Maxime Chevallier, stable
In-Reply-To: <20260428-macb-drop-tx-v2-2-647f5199d8df@bootlin.com>
On Tue, 28 Apr 2026 18:32:58 +0200 Théo Lebrun wrote:
> for (q = 0, queue = bp->queues; q < bp->num_queues; ++q, ++queue) {
> - kfree(queue->tx_skb);
> - queue->tx_skb = NULL;
> + if (queue->tx_skb) {
> + unsigned int dropped = 0, tail;
> +
> + for (tail = queue->tx_tail; tail != queue->tx_head;
> + tail++) {
> + if (macb_tx_skb(queue, tail)->skb)
> + dropped++;
> + macb_tx_unmap(bp, macb_tx_skb(queue, tail), 0,
> + SKB_DROP_REASON_NOT_SPECIFIED);
> + }
> +
> + queue->stats.tx_dropped += dropped;
> + bp->dev->stats.tx_dropped += dropped;
I'm slightly baffled by the stats in this driver.
Incrementing of both device and queue stats is highly unusual.
The driver seems to already have the values for the per-queue drops
but currently never increments it (did I miss it?) It does for Rx
stats but not for Tx stats.
As sashiko correctly points out incrementing dev stats will lead
to races and lass of increments for multi-queue devices.
Since there are no increments for tx_dropped stat today - could you
please delete it from ethtool -S, migrate the only existing
dev->stats.tx_dropped++; to increment the per-queue stat and make
macb_get_stats() collect the tx_dropped from all queues, instead
of relying on the device-level stat?
This should be patch 2 in this series, and then subsequent patches
don't have to do this double-counting dance.
I suppose you may want to migrate the byte and packet counters
while at it, and add a u64 sync...
^ permalink raw reply
* Re: [PATCH net-next] tcp: add tcp_mstamp_refresh_inline()
From: patchwork-bot+netdevbpf @ 2026-04-30 2:20 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, ncardwell, kuniyu, netdev,
eric.dumazet
In-Reply-To: <20260429010809.784315-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 01:08:09 +0000 you wrote:
> We want to inline tcp_mstamp_refresh() in fast path only:
>
> - tcp_rcv_established()
> - tcp_write_xmit()
>
> Add tcp_mstamp_refresh_inline() for this purpose.
>
> [...]
Here is the summary with links:
- [net-next] tcp: add tcp_mstamp_refresh_inline()
https://git.kernel.org/netdev/net-next/c/28df22acc275
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 net-next 3/4] net/sched: switch tc_dump_qdisc() to for_each_netdev_dump()
From: Eric Dumazet @ 2026-04-30 2:16 UTC (permalink / raw)
To: Jakub Kicinski
Cc: David S . Miller, Paolo Abeni, Simon Horman, Jamal Hadi Salim,
Jiri Pirko, netdev, eric.dumazet
In-Reply-To: <20260429190004.2bb674d4@kernel.org>
On Wed, Apr 29, 2026 at 7:00 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Tue, 28 Apr 2026 17:04:13 +0000 Eric Dumazet wrote:
> > static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
> > {
>
> > + struct {
> > + unsigned long ifindex;
> > + int q_idx;
> > + } *ctx = (void *)cb->ctx;
> > + unsigned long s_ifindex;
> > + struct net_device *dev;
> > + int s_q_idx, q_idx;
> > int err;
> >
> > - s_idx = cb->args[0];
> > - s_q_idx = q_idx = cb->args[1];
> > -
> > - idx = 0;
> > ASSERT_RTNL();
> >
> > err = nlmsg_parse_deprecated(nlh, sizeof(struct tcmsg), tca, TCA_MAX,
> > @@ -1896,42 +1896,40 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
> > if (err < 0)
> > return err;
> >
> > - for_each_netdev(net, dev) {
> > + s_ifindex = ctx->ifindex;
> > + s_q_idx = ctx->q_idx;
> > +
> > + for_each_netdev_dump(net, dev, ctx->ifindex) {
>
> compilers point out that s_ifindex is set but not used since we iterate
> directly on ctx->ifindex
Ah right, I need to remember to add W=1 to my builds :/
^ permalink raw reply
* [PATCH v2 net-next] selftests/net: packetdrill: add tcp_syncookies_ip[46]_9k
From: Eric Dumazet @ 2026-04-30 2:14 UTC (permalink / raw)
To: David S . Miller, Jakub Kicinski, Paolo Abeni
Cc: Simon Horman, Neal Cardwell, Kuniyuki Iwashima, netdev,
eric.dumazet, Eric Dumazet
These tests check syncookie mode is able to reconstruct some
client options when TCP TS are used:
- wscale option.
- sackOK.
- MSS (in a limited way, especially for IPv4).
- ECN : not enabled.
Note that IPv4 and IPv6 have different msstab[] values:
IPv4 msstab[4] = { 536, 1300, 1440, 1460 }
IPv6 msstab[4] = { 1280 - 60, 1480 - 60, 1500 - 60, 9000 - 60 }
IPv4 is currently capping SND_MSS to 1460, even on a 9K MTU network.
Signed-off-by: Eric Dumazet <edumazet@google.com>
---
v2: Fixed typos (Jakub, Neal)
Added ipv4 version.
.../net/packetdrill/tcp_syncookies_ip4_9k.pkt | 37 +++++++++++++++++++
.../net/packetdrill/tcp_syncookies_ip6_9k.pkt | 36 ++++++++++++++++++
2 files changed, 73 insertions(+)
create mode 100644 tools/testing/selftests/net/packetdrill/tcp_syncookies_ip4_9k.pkt
create mode 100644 tools/testing/selftests/net/packetdrill/tcp_syncookies_ip6_9k.pkt
diff --git a/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip4_9k.pkt b/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip4_9k.pkt
new file mode 100644
index 0000000000000000000000000000000000000000..60910069b3d7a4c01d989e48ffb16f12bd56ca25
--- /dev/null
+++ b/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip4_9k.pkt
@@ -0,0 +1,37 @@
+// SPDX-License-Identifier: GPL-2.0
+//
+// Check syncookies.
+//
+// Check we are able to rebuild client sack, wscale, ecn and mss options.
+// IPv4 msstab[4] = { 536, 1300, 1440, 1460 }
+
+--ip_version=ipv4
+
+`./defaults.sh
+sysctl -q net.ipv4.tcp_syncookies=2
+ip link set dev tun0 mtu 9000
+`
+
+ 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+ +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+ +0 bind(3, ..., ...) = 0
+ +0 listen(3, 10) = 0
+
+ +0 < S 0:0(0) win 32792 <mss 8960,sackOK,TS val 100 ecr 0,nop,wscale 10>
+ +0 > S. 0:0(0) ack 1 <mss 8960,sackOK,TS val 4000 ecr 100,nop,wscale 8>
+ +.01 < . 1:1(0) ack 1 win 1024 <nop,nop,TS val 110 ecr 4000>
+
+ +0 accept(3, ..., ...) = 4
+
+// Check we properly infer from the final packet the other peer wanted mss >= 1460, wscale 10, sackOK and no ECN.
+// Note that mss is limited to 1460 - 12 because of IPv4 msstab[]
+// This is only possible because TCP TS option was used.
+// Linux uses the SYNACK TS.val 6 low order bits to encode the options.
+
+ +0 %{ assert tcpi_snd_mss == 1460 - 12, tcpi_snd_mss; \
+ assert tcpi_snd_wscale == 10, tcpi_snd_wscale; \
+ assert (tcpi_options & TCPI_OPT_SACK) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_TIMESTAMPS) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_WSCALE) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_ECN) == 0, tcpi_options
+}%
diff --git a/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip6_9k.pkt b/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip6_9k.pkt
new file mode 100644
index 0000000000000000000000000000000000000000..f333c61044bc6d94a2309b88c9fd83bc608cc28c
--- /dev/null
+++ b/tools/testing/selftests/net/packetdrill/tcp_syncookies_ip6_9k.pkt
@@ -0,0 +1,36 @@
+// SPDX-License-Identifier: GPL-2.0
+//
+// Check syncookies.
+//
+// Check we are able to rebuild client sack, wscale, ecn and mss options.
+// IPv6 msstab[4] = { 1280 - 60, 1480 - 60, 1500 - 60, 9000 - 60 }
+
+--ip_version=ipv6
+
+`./defaults.sh
+sysctl -q net.ipv4.tcp_syncookies=2
+ip link set dev tun0 mtu 9000
+`
+
+ 0 socket(..., SOCK_STREAM, IPPROTO_TCP) = 3
+ +0 setsockopt(3, SOL_SOCKET, SO_REUSEADDR, [1], 4) = 0
+ +0 bind(3, ..., ...) = 0
+ +0 listen(3, 10) = 0
+
+ +0 < S 0:0(0) win 32792 <mss 8940,sackOK,TS val 100 ecr 0,nop,wscale 10>
+ +0 > S. 0:0(0) ack 1 <mss 8940,sackOK,TS val 4000 ecr 100,nop,wscale 8>
+ +.01 < . 1:1(0) ack 1 win 1024 <nop,nop,TS val 110 ecr 4000>
+
+ +0 accept(3, ..., ...) = 4
+
+// Check we properly infer from the final packet the other peer wanted mss >= 8940, wscale 10, sackOK and no ECN.
+// This is only possible because TCP TS option was used.
+// Linux uses the SYNACK TS.val 6 low order bits to encode the options.
+
+ +0 %{ assert tcpi_snd_mss == 8940 - 12, tcpi_snd_mss; \
+ assert tcpi_snd_wscale == 10, tcpi_snd_wscale; \
+ assert (tcpi_options & TCPI_OPT_SACK) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_TIMESTAMPS) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_WSCALE) != 0, tcpi_options; \
+ assert (tcpi_options & TCPI_OPT_ECN) == 0, tcpi_options
+}%
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* Re: [PATCH] crypto: af_alg - Document the deprecation of AF_ALG
From: Eric Biggers @ 2026-04-30 2:10 UTC (permalink / raw)
To: Herbert Xu
Cc: linux-crypto, linux-doc, linux-api, linux-kernel, netdev,
Linus Torvalds, David Howells
In-Reply-To: <afK4zC-Mgo6LBfUh@gondor.apana.org.au>
On Thu, Apr 30, 2026 at 10:05:00AM +0800, Herbert Xu wrote:
> On Wed, Apr 29, 2026 at 06:15:44PM -0700, Eric Biggers wrote:
> > AF_ALG is almost completely unnecessary, and it exposes a massive attack
> > surface that hasn't been standing up to modern vulnerability discovery
> > tools. The latest one even has its own website, providing a small
> > Python script that reliably roots most Linux distros: https://copy.fail/
> >
> > This isn't sustainable, especially as LLMs have accelerated the rate the
> > vulnerabilities are coming in. The effort that is being put into this
> > thing is vastly disproportional to the few programs that actually use
> > it, and those programs would be better served by userspace code anyway.
> >
> > These issues have been noted in many mailing list discussions already.
> > But until now they haven't been reflected in the documentation or
> > kconfig menu itself, and the vulnerabilities are still coming in.
> >
> > Let's go ahead and document the deprecation.
> >
> > This isn't intended to change anything overnight. After all, most Linux
> > distros won't be able to disable the kconfig options quite yet, mainly
> > because of iwd. But this should create a bit more impetus for these
> > userspace programs to be fixed, and the documentation update should also
> > help prevent more users from appearing.
> >
> > Signed-off-by: Eric Biggers <ebiggers@kernel.org>
>
> What about the exposure of akcipher through security/keys/keyctl_pkey.c?
>
> There isn't even a Kconfig option to disable that user-space API.
> If module signatures are enabled then this automatically gets added
> to the kernel:
>
> MODULE_SIG -> MODULE_SIG_FORMAT -> SYSTEM_DATA_VERIFICATION ->
> KEYS + ASYMMETRIC_KEY_TYPE
Yes, that would be a different patch, but KEYCTL_PKEY_* have a very
similar issue. That should have a kconfig option added too.
I believe iwd is the main (or even only?) user there, as well.
- Eric
^ permalink raw reply
* Re: [PATCH net] bonding: 3ad: implement proper RCU rules for port->aggregator
From: patchwork-bot+netdevbpf @ 2026-04-30 2:10 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, netdev, eric.dumazet,
syzbot+9bb2ff2a4ab9e17307e1, jv, andrew+netdev
In-Reply-To: <20260428123207.3809211-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 28 Apr 2026 12:32:07 +0000 you wrote:
> syzbot found a data-race in bond_3ad_get_active_agg_info /
> bond_3ad_state_machine_handler [1] which hints at lack of proper
> RCU implementation.
>
> Add __rcu qualifier to port->aggregator, and add proper RCU API.
>
> [1]
>
> [...]
Here is the summary with links:
- [net] bonding: 3ad: implement proper RCU rules for port->aggregator
https://git.kernel.org/netdev/net/c/c4f050ce06c5
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net-next] selftests/net: packetdrill: add tcp_syncookies_ip6_9k
From: Eric Dumazet @ 2026-04-30 2:09 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Neal Cardwell, David S . Miller, Paolo Abeni, Simon Horman,
Kuniyuki Iwashima, netdev, eric.dumazet
In-Reply-To: <20260429163338.423c75ee@kernel.org>
On Wed, Apr 29, 2026 at 4:33 PM Jakub Kicinski <kuba@kernel.org> wrote:
>
> On Wed, 29 Apr 2026 16:47:14 -0400 Neal Cardwell wrote:
> > > diff --git a/gtests/net/packetdrill/code.c b/gtests/net/packetdrill/code.c
> > > index d90bffabcfe6..6d8d20e64d8c 100644
> > > --- a/gtests/net/packetdrill/code.c
> > > +++ b/gtests/net/packetdrill/code.c
> > > @@ -129,6 +129,7 @@ static void write_symbols(struct code_state *code)
> > > emit_var(code, "TCPI_OPT_WSCALE", TCPI_OPT_WSCALE);
> > > emit_var(code, "TCPI_OPT_ECN", TCPI_OPT_ECN);
> > > emit_var(code, "TCPI_OPT_SYN_DATA", TCPI_OPT_SYN_DATA);
> > > + emit_var(code, "TCPI_OPT_SACK", TCPI_OPT_SACK);
> > > #endif /* linux */
> > > }
> >
> > Sure! Done. I added all the missing bit values in the following commit:
> >
> > https://github.com/google/packetdrill/commit/faa0dfb54065118625e169d3111ce09c65b20229
> >
> > This can be picked up with the following, or similar:
> >
> > git clone https://github.com/google/packetdrill.git
>
> Updated in netdev CI.
Excellent, thanks Neal and Jakub.
I am sending a V2 right now, because I am OOO for the rest of the week.
^ permalink raw reply
* Re: [PATCH net] MAINTAINERS: Add myself as NFC subsystem maintainer
From: Jakub Kicinski @ 2026-04-30 2:04 UTC (permalink / raw)
To: David Heidelberg via B4 Relay; +Cc: david, linux-kernel, netdev, oe-linux-nfc
In-Reply-To: <20260428-nfc-maintainer-v1-1-4cb9d9e121f3@ixit.cz>
On Tue, 28 Apr 2026 16:24:38 +0200 David Heidelberg via B4 Relay wrote:
> From: David Heidelberg <david@ixit.cz>
>
> Add myself and update the mailing list.
Applied! :)
^ permalink raw reply
* Re: [RFC PATCH 1/2] net: af_unix: Useful handling of LSM denials on SCM_RIGHTS
From: Kuniyuki Iwashima @ 2026-04-30 2:04 UTC (permalink / raw)
To: Jori Koolstra
Cc: Alexander Viro, Christian Brauner, Jan Kara, Eric Dumazet,
Paolo Abeni, Willem de Bruijn, David S . Miller, Jakub Kicinski,
Jens Axboe, Kees Cook, Simon Horman, Andy Lutomirski, Will Drewry,
Jeff Layton, Oleg Nesterov, Andrei Vagin, Pavel Tikhomirov,
Mateusz Guzik, Joel Granados, Charlie Mirabile, Aleksa Sarai,
linux-fsdevel, linux-kernel, netdev, io-uring
In-Reply-To: <20260428175125.2705296-2-jkoolstra@xs4all.nl>
On Tue, Apr 28, 2026 at 10:51 AM Jori Koolstra <jkoolstra@xs4all.nl> wrote:
>
> Right now if some LSM such as Smack denies an AF_UNIX socket peer to
> receive an SCM_RIGHTS fd the SCM_RIGHTS fd array will be cut short at
> that point, and MSG_CTRUNC is set on return of recvmsg(). This is
> highly problematic behaviour, because it leaves the receiver
> wondering what happened. As per man page MSG_CTRUNC is supposed to
> indicate that the control buffer was sized too short, but suddenly
> a permission error might result in the exact same flag being set.
> Moreover, the receiver has no chance to determine how many fds got
> originally sent and how many were suppressed.[1]
>
> Add two MSG_* flags:
Since we only have 5 bits remaining for future extension,
we need to consider the use case a bit more carefully.
> - MSG_RIGHTS_DENIAL is set whenever any file is rejected by the LSM
> during recvmsg() of SCM_RIGHTS fds.
Is this really needed ?
Even if the fd array is truncated, the application will traverse
the array anyway since it has some fds already installed (to
clean up in case of MSG_CTRUNC ?).
Then, it will find the -EPERM entry.
I assume no one uses MSG_RIGHTS_DENIAL without
MSG_RIGHTS_FILTER.
> - If MSG_RIGHTS_FILTER is passed as a flag to recvmsg(), the SCM_RIGHTS
Does this flag need per-recvmsg() granularity ?
If the application does not welcome the truncated fd array,
it would have passed MSG_RIGHTS_FILTER to every
recvmsg(), no ?
( and I feel _FILTER sounds like "please do filtering (truncase)".
Maybe _NOTRUNC ? )
> fd array is always passed in its full original size. However, any
> files rejected by the LSM are replaced in this array with -EPERM
> instead of an assigned fd, while keeping the original order. If the
> flag is not set, the original truncate behavior is used.
>
> [1]: https://github.com/uapi-group/kernel-features#useful-handling-of-lsm-denials-on-scm_rights
>
> Signed-off-by: Jori Koolstra <jkoolstra@xs4all.nl>
> ---
> fs/file.c | 21 ++++++++++++++++++---
> include/linux/file.h | 4 +++-
> include/linux/socket.h | 3 +++
> include/net/scm.h | 8 ++++----
> io_uring/openclose.c | 2 +-
> kernel/pid.c | 2 +-
> kernel/seccomp.c | 2 +-
> net/compat.c | 7 ++++---
> net/core/scm.c | 11 ++++++-----
> 9 files changed, 41 insertions(+), 19 deletions(-)
>
> diff --git a/fs/file.c b/fs/file.c
> index 2c81c0b162d0..cc33a1e77049 100644
> --- a/fs/file.c
> +++ b/fs/file.c
> @@ -1370,10 +1370,11 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags)
> }
>
> /**
> - * receive_fd() - Install received file into file descriptor table
> + * receive_fd_msg() - Install received file into file descriptor table
> * @file: struct file that was received from another process
> * @ufd: __user pointer to write new fd number to
> * @o_flags: the O_* flags to apply to the new fd entry
> + * @msg_flags: the MSG_* flags to set for recvmsg(2)
> *
> * Installs a received file into the file descriptor table, with appropriate
> * checks and count updates. Optionally writes the fd number to userspace, if
> @@ -1384,13 +1385,21 @@ int replace_fd(unsigned fd, struct file *file, unsigned flags)
> *
> * Returns newly install fd or -ve on error.
> */
> -int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)
> +int receive_fd_msg(struct file *file, int __user *ufd, unsigned int o_flags,
> + unsigned int *msg_flags)
> {
> int error;
>
> error = security_file_receive(file);
> - if (error)
> + if (error) {
> + if (msg_flags)
> + *msg_flags |= MSG_RIGHTS_DENIAL;
> +
> + if (ufd)
> + put_user(-EPERM, ufd);
> +
> return error;
> + }
>
> FD_PREPARE(fdf, o_flags, file);
> if (fdf.err)
> @@ -1406,6 +1415,12 @@ int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags)
> __receive_sock(fd_prepare_file(fdf));
> return fd_publish(fdf);
> }
> +EXPORT_SYMBOL_GPL(receive_fd_msg);
> +
> +int receive_fd(struct file *file, unsigned int o_flags)
> +{
> + return receive_fd_msg(file, NULL, o_flags, NULL);
> +}
> EXPORT_SYMBOL_GPL(receive_fd);
>
> int receive_fd_replace(int new_fd, struct file *file, unsigned int o_flags)
> diff --git a/include/linux/file.h b/include/linux/file.h
> index 27484b444d31..38f022d997a6 100644
> --- a/include/linux/file.h
> +++ b/include/linux/file.h
> @@ -118,7 +118,9 @@ DEFINE_FREE(fput, struct file *, if (!IS_ERR_OR_NULL(_T)) fput(_T))
>
> extern void fd_install(unsigned int fd, struct file *file);
>
> -int receive_fd(struct file *file, int __user *ufd, unsigned int o_flags);
> +int receive_fd_msg(struct file *file, int __user *ufd, unsigned int o_flags,
> + unsigned int *msg_flags);
> +int receive_fd(struct file *file, unsigned int o_flags);
>
> int receive_fd_replace(int new_fd, struct file *file, unsigned int o_flags);
>
> diff --git a/include/linux/socket.h b/include/linux/socket.h
> index ec4a0a025793..3809a8add2fc 100644
> --- a/include/linux/socket.h
> +++ b/include/linux/socket.h
> @@ -342,6 +342,9 @@ struct ucred {
> * plain text and require encryption
> */
>
> +#define MSG_RIGHTS_DENIAL 0x200000
> +#define MSG_RIGHTS_FILTER 0x400000
> +
> #define MSG_SOCK_DEVMEM 0x2000000 /* Receive devmem skbs as cmsg */
> #define MSG_ZEROCOPY 0x4000000 /* Use user data in kernel path */
> #define MSG_SPLICE_PAGES 0x8000000 /* Splice the pages from the iterator in sendmsg() */
> diff --git a/include/net/scm.h b/include/net/scm.h
> index c52519669349..983efa952c8e 100644
> --- a/include/net/scm.h
> +++ b/include/net/scm.h
> @@ -50,8 +50,8 @@ struct scm_cookie {
> #endif
> };
>
> -void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm);
> -void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm);
> +void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm, int recv_flags);
> +void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm, int recv_flags);
> int __scm_send(struct socket *sock, struct msghdr *msg, struct scm_cookie *scm);
> void __scm_destroy(struct scm_cookie *scm);
> struct scm_fp_list *scm_fp_dup(struct scm_fp_list *fpl);
> @@ -108,11 +108,11 @@ void scm_recv_unix(struct socket *sock, struct msghdr *msg,
> struct scm_cookie *scm, int flags);
>
> static inline int scm_recv_one_fd(struct file *f, int __user *ufd,
> - unsigned int flags)
> + unsigned int o_flags, unsigned int *msg_flags)
> {
> if (!ufd)
> return -EFAULT;
> - return receive_fd(f, ufd, flags);
> + return receive_fd_msg(f, ufd, o_flags, msg_flags);
> }
>
> #endif /* __LINUX_NET_SCM_H */
> diff --git a/io_uring/openclose.c b/io_uring/openclose.c
> index c71242915dad..1b6cb05b0e3d 100644
> --- a/io_uring/openclose.c
> +++ b/io_uring/openclose.c
> @@ -308,7 +308,7 @@ int io_install_fixed_fd(struct io_kiocb *req, unsigned int issue_flags)
> int ret;
>
> ifi = io_kiocb_to_cmd(req, struct io_fixed_install);
> - ret = receive_fd(req->file, NULL, ifi->o_flags);
> + ret = receive_fd(req->file, ifi->o_flags);
> if (ret < 0)
> req_set_fail(req);
> io_req_set_res(req, ret, 0);
> diff --git a/kernel/pid.c b/kernel/pid.c
> index fd5c2d4aa349..62af6874192d 100644
> --- a/kernel/pid.c
> +++ b/kernel/pid.c
> @@ -929,7 +929,7 @@ static int pidfd_getfd(struct pid *pid, int fd)
> if (IS_ERR(file))
> return PTR_ERR(file);
>
> - ret = receive_fd(file, NULL, O_CLOEXEC);
> + ret = receive_fd(file, O_CLOEXEC);
> fput(file);
>
> return ret;
> diff --git a/kernel/seccomp.c b/kernel/seccomp.c
> index 066909393c38..ad5ab16fe2b1 100644
> --- a/kernel/seccomp.c
> +++ b/kernel/seccomp.c
> @@ -1130,7 +1130,7 @@ static void seccomp_handle_addfd(struct seccomp_kaddfd *addfd, struct seccomp_kn
> */
> list_del_init(&addfd->list);
> if (!addfd->setfd)
> - fd = receive_fd(addfd->file, NULL, addfd->flags);
> + fd = receive_fd(addfd->file, addfd->flags);
> else
> fd = receive_fd_replace(addfd->fd, addfd->file, addfd->flags);
> addfd->ret = fd;
> diff --git a/net/compat.c b/net/compat.c
> index 2c9bd0edac99..056bce0927c4 100644
> --- a/net/compat.c
> +++ b/net/compat.c
> @@ -287,18 +287,19 @@ static int scm_max_fds_compat(struct msghdr *msg)
> return (msg->msg_controllen - sizeof(struct compat_cmsghdr)) / sizeof(int);
> }
>
> -void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm)
> +void scm_detach_fds_compat(struct msghdr *msg, struct scm_cookie *scm, int recv_flags)
> {
> struct compat_cmsghdr __user *cm =
> (struct compat_cmsghdr __user *)msg->msg_control_user;
> unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
> + bool filter_rights = recv_flags & MSG_RIGHTS_FILTER;
> int fdmax = min_t(int, scm_max_fds_compat(msg), scm->fp->count);
> int __user *cmsg_data = CMSG_COMPAT_DATA(cm);
> int err = 0, i;
>
> for (i = 0; i < fdmax; i++) {
> - err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);
> - if (err < 0)
> + err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags, &msg->msg_flags);
> + if (err < 0 && !filter_rights)
> break;
> }
>
> diff --git a/net/core/scm.c b/net/core/scm.c
> index eec13f50ecaf..035329645d8f 100644
> --- a/net/core/scm.c
> +++ b/net/core/scm.c
> @@ -351,10 +351,11 @@ static int scm_max_fds(struct msghdr *msg)
> return (msg->msg_controllen - sizeof(struct cmsghdr)) / sizeof(int);
> }
>
> -void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
> +void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm, int recv_flags)
> {
> struct cmsghdr __user *cm =
> (__force struct cmsghdr __user *)msg->msg_control_user;
> + bool filter_rights = recv_flags & MSG_RIGHTS_FILTER;
> unsigned int o_flags = (msg->msg_flags & MSG_CMSG_CLOEXEC) ? O_CLOEXEC : 0;
> int fdmax = min_t(int, scm_max_fds(msg), scm->fp->count);
> int __user *cmsg_data = CMSG_USER_DATA(cm);
> @@ -365,13 +366,13 @@ void scm_detach_fds(struct msghdr *msg, struct scm_cookie *scm)
> return;
>
> if (msg->msg_flags & MSG_CMSG_COMPAT) {
> - scm_detach_fds_compat(msg, scm);
> + scm_detach_fds_compat(msg, scm, recv_flags);
> return;
> }
>
> for (i = 0; i < fdmax; i++) {
> - err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags);
> - if (err < 0)
> + err = scm_recv_one_fd(scm->fp->fp[i], cmsg_data + i, o_flags, &msg->msg_flags);
> + if (err < 0 && !filter_rights)
> break;
> }
>
> @@ -524,7 +525,7 @@ static bool __scm_recv_common(struct sock *sk, struct msghdr *msg,
> scm_passec(sk, msg, scm);
>
> if (scm->fp)
> - scm_detach_fds(msg, scm);
> + scm_detach_fds(msg, scm, flags);
>
> return true;
> }
> --
> 2.54.0
>
^ permalink raw reply
* Re: [PATCH net-next] net/mlx5: Add MLX5_VXLAN config option
From: Jakub Kicinski @ 2026-04-30 2:01 UTC (permalink / raw)
To: Marc Harvey
Cc: Saeed Mahameed, Leon Romanovsky, Tariq Toukan, Mark Bloch,
Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni, netdev,
linux-rdma, linux-kernel, Kuniyuki Iwashima
In-Reply-To: <CANkEMgkBnuRfurKcFEUAZcJcX1XYSnHbBozZGP8DpnKq--tWbw@mail.gmail.com>
On Wed, 29 Apr 2026 17:46:36 -0700 Marc Harvey wrote:
> On Tue, Apr 28, 2026 at 6:46 PM Jakub Kicinski <kuba@kernel.org> wrote:
> >
> > On Tue, 28 Apr 2026 22:44:34 +0000 Marc Harvey wrote:
> > > Currently, there is no way to disable mlx5 vxlan offloading if vxlan
> > > is enabled. We've (possibly) seen some minor udp rr and udp stream
> > > regressions when enabling vxlan, and want a way to disable this
> > > offloading. Also coupling vxlan offloading with vxlan enablement
> > > generally limits the flexability of vxlan setups.
> > >
> > > Add a new config option for mlx5 vxlan offloading specifically, so
> > > that users can use vxlan without automatically opting in to the
> > > offloading.
> > >
> > > To keep the same behavior as before, the new config option is enabled
> > > by default if vxlan is enabled.
> >
> > Can we delay init of whatever makes the device slow down until the
> > first vxlan port is registered? A kconfig level optimization of this
> > sort will have rather limited applicability.
>
> There would still be the problem of wanting to use vxlan without vxlan
> offload. Agree that a kconfig might not be ideal, but it is currently
> guarded by a kconfig that offers no choice to opt out.
Are you aware of NETIF_F_RX_UDP_TUNNEL_PORT ?
I haven't checked it does exactly what we need, but I recall there was
a ethtool feature for this..
^ permalink raw reply
* Re: [PATCH v2 net-next 3/4] net/sched: switch tc_dump_qdisc() to for_each_netdev_dump()
From: Jakub Kicinski @ 2026-04-30 2:00 UTC (permalink / raw)
To: Eric Dumazet
Cc: David S . Miller, Paolo Abeni, Simon Horman, Jamal Hadi Salim,
Jiri Pirko, netdev, eric.dumazet
In-Reply-To: <20260428170414.250566-4-edumazet@google.com>
On Tue, 28 Apr 2026 17:04:13 +0000 Eric Dumazet wrote:
> static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
> {
> + struct {
> + unsigned long ifindex;
> + int q_idx;
> + } *ctx = (void *)cb->ctx;
> + unsigned long s_ifindex;
> + struct net_device *dev;
> + int s_q_idx, q_idx;
> int err;
>
> - s_idx = cb->args[0];
> - s_q_idx = q_idx = cb->args[1];
> -
> - idx = 0;
> ASSERT_RTNL();
>
> err = nlmsg_parse_deprecated(nlh, sizeof(struct tcmsg), tca, TCA_MAX,
> @@ -1896,42 +1896,40 @@ static int tc_dump_qdisc(struct sk_buff *skb, struct netlink_callback *cb)
> if (err < 0)
> return err;
>
> - for_each_netdev(net, dev) {
> + s_ifindex = ctx->ifindex;
> + s_q_idx = ctx->q_idx;
> +
> + for_each_netdev_dump(net, dev, ctx->ifindex) {
compilers point out that s_ifindex is set but not used since we iterate
directly on ctx->ifindex
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH] net/sched: sch_dualpi2: Add missing skb check
From: Jakub Kicinski @ 2026-04-30 1:52 UTC (permalink / raw)
To: Manas
Cc: jhs, jiri, davem, edumazet, pabeni, horms, rakshitawasthi17,
netdev, linux-kernel
In-Reply-To: <20260428145730.26375-1-ghandatmanas@gmail.com>
On Tue, 28 Apr 2026 20:27:30 +0530 Manas wrote:
> A packed is dequeued using the function `dequeue_packet()` but there is
> no check to see if a packet is dequeued. The assignment is always
> considered as true resulting in null-ptr-deref
>
> Fixes: 8f9516daedd6 ("sched: Add enqueue/dequeue of dualpi2 qdisc")
> Reported-by: Manas <ghandatmanas@gmail.com>
> Reported-by: Rakshit Awasthi <rakshitawasthi17@gmail.com>
> Signed-off-by: Manas <ghandatmanas@gmail.com>
Sorry but the patch is nonsensical. Please don't waste our time.
> diff --git a/net/sched/sch_dualpi2.c b/net/sched/sch_dualpi2.c
> index 241e6a46bd00..e360bf16d617 100644
> --- a/net/sched/sch_dualpi2.c
> +++ b/net/sched/sch_dualpi2.c
> @@ -588,7 +588,7 @@ static struct sk_buff *dualpi2_qdisc_dequeue(struct Qdisc *sch)
>
> now = ktime_get_ns();
>
> - while ((skb = dequeue_packet(sch, q, &credit_change, now))) {
> + while ((skb = dequeue_packet(sch, q, &credit_change, now)) && skb) {
> if (!q->drop_early && must_drop(sch, q, skb)) {
> drop_and_retry(q, skb, sch, QDISC_DROP_CONGESTED);
> continue;
--
pw-bot: cr
^ permalink raw reply
* RE: [PATCH v2 net] net: enetc: fix VSI mailbox timeout handling and DMA lifecycle
From: Wei Fang @ 2026-04-30 1:50 UTC (permalink / raw)
To: Jakub Kicinski
Cc: Claudiu Manoil, Vladimir Oltean, Clark Wang,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
pabeni@redhat.com, netdev@vger.kernel.org,
linux-kernel@vger.kernel.org, imx@lists.linux.dev
In-Reply-To: <20260430005919.2320380-2-kuba@kernel.org>
> > @@ -258,6 +281,7 @@ static int enetc_vf_probe(struct pci_dev *pdev,
> > static void enetc_vf_remove(struct pci_dev *pdev)
> > {
> > struct enetc_si *si = pci_get_drvdata(pdev);
> > + struct enetc_msg_swbd msg = si->msg;
> > struct enetc_ndev_priv *priv;
> >
> > priv = netdev_priv(si->ndev);
> > unregister_netdev(si->ndev);
>
> Is there a race between this local copy of si->msg and a concurrent
> ndo callback?
Yes, it is a risk. I noticed this warning from patchwork so I sent v3 yesterday.
^ permalink raw reply
* Re: [PATCH v2] net: ethernet: rnpgbe: mark nonfunctional incomplete driver as BROKEN
From: Ethan Nelson-Moore @ 2026-04-30 1:48 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, stable, Yibo Dong, Andrew Lunn, David S. Miller,
Eric Dumazet, Paolo Abeni, MD Danish Anwar, Vadim Fedorenko
In-Reply-To: <20260429182701.28edde72@kernel.org>
Hi, Jakub,
On Wed, Apr 29, 2026 at 6:27 PM Jakub Kicinski <kuba@kernel.org> wrote:
> That'd require us to know if the device is going to be used on
> desktop because for datacenter NICs suspend/resume does not matter.
Good point - I was thinking about that myself. I would be fine with
only marking it as broken until it can actually transmit and receive
packets. What do you think about that? Of course, as a maintainer, the
decision is up to you in the end.
> Maybe it was written in simpler times, maybe the help message was
> aspirational to begin with..
Probably both. On a related note, I think something needs to be done
about some drivers staying in staging indefinitely without being moved
out of it or removed. The most obvious example is rtl8723bs. Eager new
contributors have spent an inordinate amount of time cleaning it up,
yet it is nowhere near ready to be taken out of staging. One major
blocker is that it doesn't use mac80211, but changing it to do so
would be nearly impossible in its current state. I think it makes the
most sense now to either remove the driver entirely if no one is using
it or add SDIO support to rtl8xxxu (some work has already done on this
out-of-tree).
Ethan
^ permalink raw reply
* Re: [PATCH] nfc: nci: Add skb length validation in nci_core_init_rsp_packet
From: kernel test robot @ 2026-04-30 1:43 UTC (permalink / raw)
To: Dudu Lu, netdev; +Cc: oe-kbuild-all, davem, edumazet, kuba, pabeni, Dudu Lu
In-Reply-To: <20260413090102.77980-1-phx0fer@gmail.com>
Hi Dudu,
kernel test robot noticed the following build errors:
[auto build test ERROR on net/main]
[also build test ERROR on net-next/main linus/master horms-ipvs/master v7.1-rc1 next-20260429]
[If your patch is applied to the wrong git tree, kindly drop us a note.
And when submitting patch, we suggest to use '--base' as documented in
https://git-scm.com/docs/git-format-patch#_base_tree_information]
url: https://github.com/intel-lab-lkp/linux/commits/Dudu-Lu/nfc-nci-Add-skb-length-validation-in-nci_core_init_rsp_packet/20260423-210923
base: net/main
patch link: https://lore.kernel.org/r/20260413090102.77980-1-phx0fer%40gmail.com
patch subject: [PATCH] nfc: nci: Add skb length validation in nci_core_init_rsp_packet
config: arm64-randconfig-001-20260430 (https://download.01.org/0day-ci/archive/20260430/202604300902.FjrlfrkQ-lkp@intel.com/config)
compiler: aarch64-linux-gcc (GCC) 8.5.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260430/202604300902.FjrlfrkQ-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202604300902.FjrlfrkQ-lkp@intel.com/
All errors (new ones prefixed by >>):
>> net/nfc/nci/rsp.c:1:2: error: expected identifier or '(' before 'if'
if (skb->len < sizeof(*rsp)) {
^~
net/nfc/nci/rsp.c:5:2: error: expected identifier or '(' before 'if'
if (skb->len < 6 + rsp_1->num_supported_rf_interfaces +
^~
net/nfc/nci/rsp.c:10:2: error: expected identifier or '(' before 'if'
if (skb->len < sizeof(*rsp_1))
^~
vim +1 net/nfc/nci/rsp.c
> 1 if (skb->len < sizeof(*rsp)) {
2 pr_err("short NCI_CORE_INIT_RSP v2 packet\n");
3 return NCI_STATUS_SYNTAX_ERROR;
4 }
5 if (skb->len < 6 + rsp_1->num_supported_rf_interfaces +
6 sizeof(*rsp_2)) {
7 pr_err("short NCI_CORE_INIT_RSP v1 packet\n");
8 return NCI_STATUS_SYNTAX_ERROR;
9 }
10 if (skb->len < sizeof(*rsp_1))
11 return NCI_STATUS_SYNTAX_ERROR;
12 // SPDX-License-Identifier: GPL-2.0-only
13 /*
14 * The NFC Controller Interface is the communication protocol between an
15 * NFC Controller (NFCC) and a Device Host (DH).
16 *
17 * Copyright (C) 2011 Texas Instruments, Inc.
18 *
19 * Written by Ilan Elias <ilane@ti.com>
20 *
21 * Acknowledgements:
22 * This file is based on hci_event.c, which was written
23 * by Maxim Krasnyansky.
24 */
25
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply
* Re: [PATCH net V4 4/4] net/mlx5e: SD, Fix race condition in secondary device probe/remove
From: Jakub Kicinski @ 2026-04-30 1:42 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, saeedm,
mbloch, leon, shayd, horms, phaddad, kees, parav, gal, netdev,
linux-rdma, linux-kernel, dtatulea
In-Reply-To: <20260428060111.221086-5-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5e: SD, Fix race condition in secondary device probe/remove
This commit updates secondary devices to acquire the device lock of the
primary auxiliary device during probe, suspend, resume, and remove
operations. It introduces mlx5_sd_get_adev() and mlx5_sd_put_adev() to
manage this lock ordering and add a second devcom readiness check.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
> index 7a1787f15320..a43ae482a679 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
[ ... ]
> @@ -563,5 +567,18 @@ struct auxiliary_device *mlx5_sd_get_adev(struct mlx5_core_dev *dev,
> if (dev == primary)
> return adev;
>
> + device_lock(&primary->priv.adev[idx]->adev.dev);
If mlx5_devcom_comp_is_ready() returned true just before this, but the
secondary thread is preempted before reaching device_lock(), could a
concurrent removal of the primary device cause primary->priv.adev[idx]
to become NULL or freed?
It looks like the removal path (such as mlx5_unregister_device) frees the
mlx5_adev memory and explicitly sets primary->priv.adev[idx] to NULL. If
the secondary thread then resumes, it might dereference a NULL or freed
pointer when attempting to acquire the lock.
Since the second readiness check happens after the device_lock() call, does
this leave a window where memory corruption or a panic can still occur?
Additionally, since the driver core already holds device_lock(&adev->dev)
for the secondary device during callbacks like probe() and remove(), will
acquiring the primary device's lock here trigger a lockdep warning for
possible recursive locking?
Both the primary and secondary auxiliary devices use the same generic lock
class assigned in device_initialize(). While the fixed secondary to primary
ordering avoids an actual deadlock, lockdep might not distinguish between
the two mutexes without explicit lockdep subclassing.
> + /* In case primary finish removing its adev */
> + if (!mlx5_devcom_comp_is_ready(sd->devcom)) {
> + device_unlock(&primary->priv.adev[idx]->adev.dev);
> + return NULL;
> + }
> return &primary->priv.adev[idx]->adev;
> }
^ permalink raw reply
* Re: [PATCH net V4 3/4] net/mlx5e: SD, Fix missing cleanup on probe error
From: Jakub Kicinski @ 2026-04-30 1:42 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, saeedm,
mbloch, leon, shayd, horms, phaddad, kees, parav, gal, netdev,
linux-rdma, linux-kernel, dtatulea
In-Reply-To: <20260428060111.221086-4-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5e: SD, Fix missing cleanup on probe error
This commit adds a missing mlx5_sd_cleanup() call to the probe error path.
The commit message notes a similar gap exists on the resume path leaving
sd == NULL on failure, but defers the fix to a follow-up series.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> index 5a46870c4b74..e21affd0ffc4 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/en_main.c
[ ... ]
> @@ -6912,9 +6912,16 @@ static int mlx5e_probe(struct auxiliary_device *adev,
> return err;
>
> actual_adev = mlx5_sd_get_adev(mdev, adev, edev->idx);
> - if (actual_adev)
> - return _mlx5e_probe(actual_adev);
> + if (actual_adev) {
> + err = _mlx5e_probe(actual_adev);
> + if (err)
> + goto sd_cleanup;
> + }
> return 0;
> +
> +sd_cleanup:
> + mlx5_sd_cleanup(mdev);
> + return err;
> }
>
> static void _mlx5e_remove(struct auxiliary_device *adev)
Will leaving the resume gap unfixed as mentioned in the commit message cause
a NULL pointer dereference when a secondary device is later removed?
If a secondary device fails resume, sd becomes NULL. Later during removal,
mlx5_sd_get_adev() will check !sd and return the secondary adev.
This causes _mlx5e_remove() to be executed on the secondary adev:
_mlx5e_remove()
{
struct mlx5_adev *edev = container_of(adev, struct mlx5_adev, adev);
struct mlx5e_dev *mlx5e_dev = auxiliary_get_drvdata(adev);
struct net_device *netdev = mlx5e_dev->netdev;
...
}
Since _mlx5e_probe() is never called on secondary devices,
auxiliary_get_drvdata(adev) returns NULL. Does this mean accessing
mlx5e_dev->netdev will crash?
Would it be safer to add a NULL check for mlx5e_dev in _mlx5e_remove()
until the proper PM lifecycle fixes are implemented?
^ permalink raw reply
* Re: [PATCH net V4 1/4] net/mlx5: SD: Serialize init/cleanup
From: Jakub Kicinski @ 2026-04-30 1:42 UTC (permalink / raw)
To: tariqt
Cc: Jakub Kicinski, edumazet, pabeni, andrew+netdev, davem, saeedm,
mbloch, leon, shayd, horms, phaddad, kees, parav, gal, netdev,
linux-rdma, linux-kernel, dtatulea
In-Reply-To: <20260428060111.221086-2-tariqt@nvidia.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
---
net/mlx5: SD: Serialize init/cleanup
This commit protects the Socket-Direct (SD) init/cleanup paths with the
devcom component lock and tracks the SD group state on the primary device.
It skips init if the primary is already UP, and skips cleanup unless the
primary is UP, serializing the bring-up/tear-down sequence across PFs.
> diff --git a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
> index 762c783156b4..d42c283cbb38 100644
> --- a/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
> +++ b/drivers/net/ethernet/mellanox/mlx5/core/lib/sd.c
[ ... ]
> @@ -491,22 +507,34 @@ void mlx5_sd_cleanup(struct mlx5_core_dev *dev)
> {
> struct mlx5_sd *sd = mlx5_get_sd(dev);
> struct mlx5_core_dev *primary, *pos;
> + struct mlx5_sd *primary_sd;
> int i;
>
> if (!sd)
> return;
>
> + mlx5_devcom_comp_lock(sd->devcom);
> if (!mlx5_devcom_comp_is_ready(sd->devcom))
> - goto out;
> + goto out_unlock;
>
> primary = mlx5_sd_get_primary(dev);
> + if (!primary)
> + goto out_unlock;
> +
> + primary_sd = mlx5_get_sd(primary);
> + if (primary_sd->state != MLX5_SD_STATE_UP)
> + goto out_unlock;
If the device is unbound during the race window where the devcom component
is ready but the state is still MLX5_SD_STATE_DOWN (for example, just after
sd_register() finishes but before mlx5_sd_init() sets the state to UP), does
this early exit leave the component marked as ready?
Since mlx5_devcom_comp_set_ready(sd->devcom, false) was moved out of
sd_unregister() and into this function, skipping it here means the device will
unregister and free its struct mlx5_sd while the group is still ready.
Could a concurrent mlx5_sd_init() on another peer acquire the devcom lock,
observe that it is ready, and proceed? If the unregistered device was the
primary, mlx5_get_sd(primary) would return NULL, causing a NULL pointer
dereference at primary_sd->state. If it was a secondary, mlx5_sd_init()
would iterate over primary_sd->secondaries and access the freed device
structure, resulting in a use-after-free.
> +
> mlx5_sd_for_each_secondary(i, primary, pos)
> sd_cmd_unset_secondary(pos);
> sd_cmd_unset_primary(primary);
> debugfs_remove_recursive(sd->dfs);
This isn't a regression introduced in this patch, but does storing sd->dfs
locally instead of on the primary device cause debugfs entries to leak?
If a different peer is unbound first, its sd->dfs is NULL, making the call
to debugfs_remove_recursive() a no-op. The cleanup then finishes and marks
the group as unready.
When the original device that created the debugfs directory is later unbound,
it sees the group is no longer ready and skips this block entirely, never
freeing its sd->dfs. Since these files hold pointers to the mlx5_core_dev
structs, accessing them from userspace after the devices are freed could
trigger a use-after-free.
I note this was fixed later in the series by commit "net/mlx5: SD, Keep
multi-pf debugfs entries on primary", but wanted to highlight it here.
>
> sd_info(primary, "group id %#x, uncombined\n", sd->group_id);
> -out:
> + primary_sd->state = MLX5_SD_STATE_DOWN;
> + mlx5_devcom_comp_set_ready(sd->devcom, false);
> +out_unlock:
> + mlx5_devcom_comp_unlock(sd->devcom);
> sd_unregister(dev);
> sd_cleanup(dev);
> }
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net] net: airoha: Do not return err in ndo_stop() callback
From: patchwork-bot+netdevbpf @ 2026-04-30 1:40 UTC (permalink / raw)
To: Lorenzo Bianconi
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, horms,
linux-arm-kernel, linux-mediatek, netdev
In-Reply-To: <20260428-airoha-ndo-stop-not-err-v1-1-674506d29a91@kernel.org>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 28 Apr 2026 08:53:16 +0200 you wrote:
> Always complete the airoha_dev_stop() routine regardless of the
> airoha_set_vip_for_gdm_port() return value, since errors from
> ndo_stop() are ignored by the networking stack and the interface is
> always considered down after the call.
>
> Fixes: 23020f049327 ("net: airoha: Introduce ethernet support for EN7581 SoC")
> Signed-off-by: Lorenzo Bianconi <lorenzo@kernel.org>
>
> [...]
Here is the summary with links:
- [net] net: airoha: Do not return err in ndo_stop() callback
https://git.kernel.org/netdev/net/c/4ca01292ea2f
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [RFC PATCH net-next 3/3] tcp: netns: optionally inherit IPv4 TCP sysctls from parent netns
From: nmreadelf @ 2026-04-30 1:33 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, corbet, dsahern
Cc: horms, chia-yu.chang, idosch, ij, brauner, jack, kuniyu, jlayton,
netdev, linux-doc, linux-kernel, kong414, lance.yang, leon.hwang
In-Reply-To: <TY7PR01MB172057C053E8D550485A29A08E0352@TY7PR01MB17205.jpnprd01.prod.outlook.com>
During netns creation, setup_net() initializes IPv4 TCP sysctls. Add an
optional follow-up copy step in copy_net_ns() so selected IPv4 TCP sysctl
settings can be inherited from old_net when
net.ipv4.netns_inherit_tcp_sysctls=1.
The copy uses the tcp_sysctl struct_group plus selected related fields
outside that group, guarded by BUILD_BUG_ON checks for layout safety.
Default behavior is unchanged because inheritance is disabled unless
explicitly enabled in old_net.
---
net/core/net_namespace.c | 72 ++++++++++++++++++++++++++++++++++++++++
1 file changed, 72 insertions(+)
diff --git a/net/core/net_namespace.c b/net/core/net_namespace.c
index a6e6a964a287..d6587362d450 100644
--- a/net/core/net_namespace.c
+++ b/net/core/net_namespace.c
@@ -548,6 +548,74 @@ void net_drop_ns(void *p)
net_passive_dec(net);
}
+static int __net_init copy_net_ns_tcp_sysctls(struct net *net, struct net *old_net)
+{
+ if (net == old_net)
+ return 0;
+
+ /* Make sure TCP sysctl fields are contained by tcp_sysctl group */
+#define CHECK_SYSCTL_TCP_FIELD(lhs, rhs) \
+ BUILD_BUG_ON(offsetof(struct netns_ipv4, lhs) != \
+ offsetof(struct netns_ipv4, tcp_sysctl.rhs))
+
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_ecn, sysctl_tcp_ecn);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_ecn_fallback, sysctl_tcp_ecn_fallback);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_base_mss, sysctl_tcp_base_mss);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_keepalive_time, sysctl_tcp_keepalive_time);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_syncookies, sysctl_tcp_syncookies);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_fin_timeout, sysctl_tcp_fin_timeout);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_sack, sysctl_tcp_sack);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_window_scaling, sysctl_tcp_window_scaling);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_timestamps, sysctl_tcp_timestamps);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_rto_min_us, sysctl_tcp_rto_min_us);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_rto_max_ms, sysctl_tcp_rto_max_ms);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_recovery, sysctl_tcp_recovery);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_max_reordering, sysctl_tcp_max_reordering);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_challenge_ack_limit, sysctl_tcp_challenge_ack_limit);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_pacing_ss_ratio, sysctl_tcp_pacing_ss_ratio);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_pacing_ca_ratio, sysctl_tcp_pacing_ca_ratio);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_comp_sack_delay_ns, sysctl_tcp_comp_sack_delay_ns);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_comp_sack_slack_ns, sysctl_tcp_comp_sack_slack_ns);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_fastopen, sysctl_tcp_fastopen);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_fastopen_blackhole_timeout,
+ sysctl_tcp_fastopen_blackhole_timeout);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_plb_enabled, sysctl_tcp_plb_enabled);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_plb_cong_thresh, sysctl_tcp_plb_cong_thresh);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_shrink_window, sysctl_tcp_shrink_window);
+ CHECK_SYSCTL_TCP_FIELD(sysctl_tcp_syn_linear_timeouts, sysctl_tcp_syn_linear_timeouts);
+
+ memcpy(&net->ipv4.tcp_sysctl,
+ &old_net->ipv4.tcp_sysctl, sizeof(net->ipv4.tcp_sysctl));
+ net->ipv4.sysctl_netns_inherit_tcp_sysctls =
+ old_net->ipv4.sysctl_netns_inherit_tcp_sysctls;
+ net->ipv4.sysctl_tcp_min_snd_mss =
+ old_net->ipv4.sysctl_tcp_min_snd_mss;
+ net->ipv4.sysctl_tcp_reordering =
+ old_net->ipv4.sysctl_tcp_reordering;
+ net->ipv4.sysctl_tcp_notsent_lowat =
+ old_net->ipv4.sysctl_tcp_notsent_lowat;
+
+ net->ipv4.sysctl_tcp_early_retrans =
+ old_net->ipv4.sysctl_tcp_early_retrans;
+ net->ipv4.sysctl_tcp_tso_win_divisor =
+ old_net->ipv4.sysctl_tcp_tso_win_divisor;
+ net->ipv4.sysctl_tcp_tso_rtt_log =
+ old_net->ipv4.sysctl_tcp_tso_rtt_log;
+ net->ipv4.sysctl_tcp_autocorking =
+ old_net->ipv4.sysctl_tcp_autocorking;
+ net->ipv4.sysctl_tcp_limit_output_bytes =
+ old_net->ipv4.sysctl_tcp_limit_output_bytes;
+ net->ipv4.sysctl_tcp_min_rtt_wlen =
+ old_net->ipv4.sysctl_tcp_min_rtt_wlen;
+ net->ipv4.sysctl_tcp_moderate_rcvbuf =
+ old_net->ipv4.sysctl_tcp_moderate_rcvbuf;
+ net->ipv4.sysctl_tcp_rcvbuf_low_rtt =
+ old_net->ipv4.sysctl_tcp_rcvbuf_low_rtt;
+ atomic_set(&net->ipv4.tfo_active_disable_times,
+ atomic_read(&old_net->ipv4.tfo_active_disable_times));
+ return 0;
+}
+
struct net *copy_net_ns(u64 flags,
struct user_namespace *user_ns, struct net *old_net)
{
@@ -594,6 +662,10 @@ struct net *copy_net_ns(u64 flags,
dec_net_namespaces(ucounts);
return ERR_PTR(rv);
}
+
+ if (READ_ONCE(old_net->ipv4.sysctl_netns_inherit_tcp_sysctls))
+ copy_net_ns_tcp_sysctls(net, old_net);
+
return net;
}
--
2.47.3
^ permalink raw reply related
* [RFC PATCH net-next 2/3] net: ipv4: add netns_inherit_tcp_sysctls sysctl
From: nmreadelf @ 2026-04-30 1:33 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, corbet, dsahern
Cc: horms, chia-yu.chang, idosch, ij, brauner, jack, kuniyu, jlayton,
netdev, linux-doc, linux-kernel, kong414, lance.yang, leon.hwang
In-Reply-To: <TY7PR01MB172057C053E8D550485A29A08E0352@TY7PR01MB17205.jpnprd01.prod.outlook.com>
Add net.ipv4.netns_inherit_tcp_sysctls to control whether a newly created
netns inherits selected IPv4 TCP sysctl state from old_net.
Default is 0, preserving current behavior.
When set to 1 in old_net, child netns receives parent TCP sysctl policy
during netns creation.
---
include/net/netns/ipv4.h | 1 +
net/ipv4/sysctl_net_ipv4.c | 9 +++++++++
2 files changed, 10 insertions(+)
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 53b180cc7a94..184498d4d541 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -60,6 +60,7 @@ struct netns_ipv4 {
/* TX readonly hotpath cache lines */
__cacheline_group_begin(netns_ipv4_read_tx);
+ u8 sysctl_netns_inherit_tcp_sysctls;
u8 sysctl_tcp_early_retrans;
u8 sysctl_tcp_tso_win_divisor;
u8 sysctl_tcp_tso_rtt_log;
diff --git a/net/ipv4/sysctl_net_ipv4.c b/net/ipv4/sysctl_net_ipv4.c
index a1a50a5c80dc..58a310c029d9 100644
--- a/net/ipv4/sysctl_net_ipv4.c
+++ b/net/ipv4/sysctl_net_ipv4.c
@@ -1641,6 +1641,15 @@ static struct ctl_table ipv4_net_table[] = {
.extra1 = SYSCTL_ONE_THOUSAND,
.extra2 = &tcp_rto_max_max,
},
+ {
+ .procname = "netns_inherit_tcp_sysctls",
+ .data = &init_net.ipv4.sysctl_netns_inherit_tcp_sysctls,
+ .maxlen = sizeof(u8),
+ .mode = 0644,
+ .proc_handler = proc_dou8vec_minmax,
+ .extra1 = SYSCTL_ZERO,
+ .extra2 = SYSCTL_ONE,
+ },
};
static __net_init int ipv4_sysctl_init_net(struct net *net)
--
2.47.3
^ permalink raw reply related
* [RFC PATCH net-next 1/3] ipv4: netns: group copyable TCP sysctls in netns_ipv4
From: nmreadelf @ 2026-04-30 1:33 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, corbet, dsahern
Cc: horms, chia-yu.chang, idosch, ij, brauner, jack, kuniyu, jlayton,
netdev, linux-doc, linux-kernel, kong414, lance.yang, leon.hwang
In-Reply-To: <TY7PR01MB172057C053E8D550485A29A08E0352@TY7PR01MB17205.jpnprd01.prod.outlook.com>
Group the TCP sysctl members into tcp_sysctl using struct_group().
This makes the memcpy and sizeof boundaries clear in follow-up
patches, avoids relying on writes across neighboring
members, and improves readability.
---
.../net_cachelines/netns_ipv4_sysctl.rst | 25 ++++++++-------
include/net/netns/ipv4.h | 32 +++++++++++--------
2 files changed, 32 insertions(+), 25 deletions(-)
diff --git a/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst b/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
index beaf1880a19b..f6edf02618fa 100644
--- a/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
+++ b/Documentation/networking/net_cachelines/netns_ipv4_sysctl.rst
@@ -43,23 +43,20 @@ u32 ip_rt_min_pmtu
int ip_rt_mtu_expires
int ip_rt_min_advmss
struct_local_ports ip_local_ports
-u8 sysctl_tcp_ecn
-u8 sysctl_tcp_ecn_fallback
u8 sysctl_ip_default_ttl ip4_dst_hoplimit/ip_select_ttl
u8 sysctl_ip_no_pmtu_disc
-u8 sysctl_ip_fwd_use_pmtu read_mostly ip_dst_mtu_maybe_forward/ip_skb_dst_mtu
u8 sysctl_ip_fwd_update_priority ip_forward
u8 sysctl_ip_nonlocal_bind
u8 sysctl_ip_autobind_reuse
u8 sysctl_ip_dynaddr
-u8 sysctl_ip_early_demux read_mostly ip(6)_rcv_finish_core
u8 sysctl_raw_l3mdev_accept
-u8 sysctl_tcp_early_demux read_mostly ip(6)_rcv_finish_core
u8 sysctl_udp_early_demux
u8 sysctl_nexthop_compat_mode
u8 sysctl_fwmark_reflect
+.. struct_group(tcp_sysctl) bulk-copied via memcpy() in tcp_sk_init()
+u8 sysctl_tcp_ecn
+u8 sysctl_tcp_ecn_fallback
u8 sysctl_tcp_fwmark_accept
-u8 sysctl_tcp_l3mdev_accept read_mostly __inet6_lookup_established/inet_request_bound_dev_if
u8 sysctl_tcp_mtu_probing
int sysctl_tcp_mtu_probe_floor
int sysctl_tcp_base_mss
@@ -85,6 +82,7 @@ unsigned_int sysctl_tcp_notsent_lowat rea
u8 sysctl_tcp_sack tcp_syn_options
u8 sysctl_tcp_window_scaling tcp_syn_options,tcp_parse_options
u8 sysctl_tcp_timestamps
+u8 sysctl_netns_inherit_tcp_sysctls read_mostly tcp_schedule_loss_probe(tcp_write_xmit)
u8 sysctl_tcp_early_retrans read_mostly tcp_schedule_loss_probe(tcp_write_xmit)
u32 sysctl_tcp_rto_max_ms
u8 sysctl_tcp_recovery tcp_fastretrans_alert
@@ -123,18 +121,21 @@ unsigned_long sysctl_tcp_comp_sack_delay_ns
unsigned_long sysctl_tcp_comp_sack_slack_ns __tcp_ack_snd_check
int sysctl_max_syn_backlog
int sysctl_tcp_fastopen
-struct_tcp_congestion_ops tcp_congestion_control init_cc
-struct_tcp_fastopen_context tcp_fastopen_ctx
unsigned_int sysctl_tcp_fastopen_blackhole_timeout
-atomic_t tfo_active_disable_times
-unsigned_long tfo_active_disable_stamp
-u32 tcp_challenge_timestamp
-u32 tcp_challenge_count
u8 sysctl_tcp_plb_enabled
u8 sysctl_tcp_plb_idle_rehash_rounds
u8 sysctl_tcp_plb_rehash_rounds
u8 sysctl_tcp_plb_suspend_rto_sec
int sysctl_tcp_plb_cong_thresh
+u8 sysctl_tcp_shrink_window
+u8 sysctl_tcp_syn_linear_timeouts
+.. end_of(tcp_sysctl)
+struct_tcp_congestion_ops tcp_congestion_control init_cc
+struct_tcp_fastopen_context tcp_fastopen_ctx
+atomic_t tfo_active_disable_times
+unsigned_long tfo_active_disable_stamp
+u32 tcp_challenge_timestamp
+u32 tcp_challenge_count
int sysctl_udp_wmem_min
int sysctl_udp_rmem_min
u8 sysctl_fib_notify_on_flag_change
diff --git a/include/net/netns/ipv4.h b/include/net/netns/ipv4.h
index 2dbd46fc4734..53b180cc7a94 100644
--- a/include/net/netns/ipv4.h
+++ b/include/net/netns/ipv4.h
@@ -116,7 +116,6 @@ struct netns_ipv4 {
#endif
bool fib_has_custom_local_routes;
bool fib_offload_disabled;
- u8 sysctl_tcp_shrink_window;
#ifdef CONFIG_IP_ROUTE_CLASSID
atomic_t fib_num_tclassid_users;
#endif
@@ -149,11 +148,6 @@ struct netns_ipv4 {
struct local_ports ip_local_ports;
- u8 sysctl_tcp_ecn;
- u8 sysctl_tcp_ecn_option;
- u8 sysctl_tcp_ecn_option_beacon;
- u8 sysctl_tcp_ecn_fallback;
-
u8 sysctl_ip_default_ttl;
u8 sysctl_ip_no_pmtu_disc;
u8 sysctl_ip_fwd_update_priority;
@@ -169,6 +163,14 @@ struct netns_ipv4 {
u8 sysctl_nexthop_compat_mode;
u8 sysctl_fwmark_reflect;
+
+ /* TCP sysctl fields enclosed in tcp_sysctl group are copied
+ * using a single memcpy() in tcp_sk_init()
+ */
+ struct_group(tcp_sysctl, u8 sysctl_tcp_ecn;
+ u8 sysctl_tcp_ecn_option;
+ u8 sysctl_tcp_ecn_option_beacon;
+ u8 sysctl_tcp_ecn_fallback;
u8 sysctl_tcp_fwmark_accept;
u8 sysctl_tcp_mtu_probing;
int sysctl_tcp_mtu_probe_floor;
@@ -227,24 +229,28 @@ struct netns_ipv4 {
unsigned long sysctl_tcp_comp_sack_slack_ns;
int sysctl_max_syn_backlog;
int sysctl_tcp_fastopen;
- const struct tcp_congestion_ops __rcu *tcp_congestion_control;
- struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
unsigned int sysctl_tcp_fastopen_blackhole_timeout;
- atomic_t tfo_active_disable_times;
- unsigned long tfo_active_disable_stamp;
- u32 tcp_challenge_timestamp;
- u32 tcp_challenge_count;
u8 sysctl_tcp_plb_enabled;
u8 sysctl_tcp_plb_idle_rehash_rounds;
u8 sysctl_tcp_plb_rehash_rounds;
u8 sysctl_tcp_plb_suspend_rto_sec;
int sysctl_tcp_plb_cong_thresh;
+ u8 sysctl_tcp_shrink_window;
+ u8 sysctl_tcp_syn_linear_timeouts;
+
+ ); /* end tcp_sysctl group */
+
+ const struct tcp_congestion_ops __rcu *tcp_congestion_control;
+ struct tcp_fastopen_context __rcu *tcp_fastopen_ctx;
+ atomic_t tfo_active_disable_times;
+ unsigned long tfo_active_disable_stamp;
+ u32 tcp_challenge_timestamp;
+ u32 tcp_challenge_count;
int sysctl_udp_wmem_min;
int sysctl_udp_rmem_min;
u8 sysctl_fib_notify_on_flag_change;
- u8 sysctl_tcp_syn_linear_timeouts;
#ifdef CONFIG_NET_L3_MASTER_DEV
u8 sysctl_udp_l3mdev_accept;
--
2.47.3
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox