* Re: [PATCH net 0/2] net: mctp: test: minor kunit test fixes
From: patchwork-bot+netdevbpf @ 2026-04-30 21:00 UTC (permalink / raw)
To: Jeremy Kerr
Cc: matt, davem, edumazet, kuba, pabeni, horms, netdev, oliver.sang
In-Reply-To: <20260429-dev-mctp-test-fixes-v1-0-1127b7425809@codeconstruct.com.au>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 16:21:40 +0800 you wrote:
> This series provides two fixes in the MCTP kunit tests - one exposed by
> ktr, and one found while debugging the former on different VM configs.
>
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
> ---
> Jeremy Kerr (2):
> net: mctp: test: use a zeroed struct sockaddr_mctp
> net: mctp: test: Use dev_direct_xmit for TX to our test device
>
> [...]
Here is the summary with links:
- [net,1/2] net: mctp: test: use a zeroed struct sockaddr_mctp
https://git.kernel.org/netdev/net/c/18ed60e33e6c
- [net,2/2] net: mctp: test: Use dev_direct_xmit for TX to our test device
https://git.kernel.org/netdev/net/c/768729710641
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH iwl-net v2] idpf: do not perform flow ops when netdev is detached
From: Li Li @ 2026-04-30 20:58 UTC (permalink / raw)
To: Jacob Keller
Cc: Simon Horman, anthony.l.nguyen, przemyslaw.kitszel, davem, kuba,
edumazet, intel-wired-lan, netdev, linux-kernel, decot,
anjali.singhai, sridhar.samudrala, brianvv, emil.s.tantilov,
stable
In-Reply-To: <25163a38-53b5-445c-936c-0cba94cb731f@intel.com>
On Thu, Apr 23, 2026 at 11:40 AM Jacob Keller <jacob.e.keller@intel.com> wrote:
>
> On 4/23/2026 9:33 AM, Simon Horman wrote:
> > From: 'Simon Horman' <horms@kernel.org>
> >
> > This is an AI-generated review of your patch. The human sending this
> > email has considered the AI review valid, or at least plausible.
> > Full review at: https://sashiko.dev
> > ---
> > idpf: do not perform flow ops when netdev is detached
> >
> > This commit adds checks to prevent crashes when out-of-tree modules bypass
> > ethtool core locks and call flow operations on detached netdevs during a
> > hardware reset. It introduces netdev and netif_device_present checks in
> > idpf_get_rxnfc and idpf_set_rxnfc.
> >
> >> Even though commit 2e281e1155fc ("idpf: detach and close netdevs while
> >> handling a reset") prevents ethtool -N/-n operations to operate on
> >> detached netdevs, we found that out-of-tree workflows like OpenOnload
> >> can bypass ethtool core locks and call idpf_set_rxnfc directly during
> >> an idpf HW reset.
> >
> > Is it acceptable to add defensive checks upstream solely to accommodate
> > out-of-tree modules that bypass core kernel locking?
> >
> > The core ethtool infrastructure manages locks like rtnl_lock for in-tree
> > callers to guarantee safety. Modifying the upstream driver to paper over
> > locking violations in out-of-tree modules might contradict upstream policies.
> >
> > Simon says: If this is to address OOT module behaviour then I am concerned.
> > And I would suggest that the correct approach is to fix
> > the OOT kernel module.
> >
>
> The commit message says: "OpenOnload can bypass ethtool core locks and
> call idpf_set_rxnfc directly". But if it somehow calls
> idpf_set_rxnfc_directly without holding the appropriate locks, then no
> amount of changes to the idpf driver will fix that issue. It is simply
> unsafe for that to be occurring, and this feels like it just patches one
> specific problem without addressing the root cause that something is
> calling the drivers ethtool function without correctly holding the
> expected locks.
>
>
> @Li Li, could you please explain more details about the workflow that
> triggers these behaviors? If it can't be reproduced with in-tree modules
> then I don't think we can accept this fix.
Yes, OpenOnload calls idpf_set_rxnfc directly without checking if the
netdev is detached first. I've discussed this with the team
internally, and we decided to fix OpenOnload directly, rather than
adding the check in idpf.
Please feel free to drop this patch, thank you!
^ permalink raw reply
* Re: [PATCH net 06/12] netfilter: nf_conntrack_expect: honor expectation helper field
From: Ilya Maximets @ 2026-04-30 20:58 UTC (permalink / raw)
To: Pablo Neira Ayuso, netfilter-devel, fw
Cc: davem, netdev, kuba, pabeni, edumazet, horms, i.maximets,
Eelco Chaudron, Aaron Conole
In-Reply-To: <20260326125153.685915-7-pablo@netfilter.org>
On 3/26/26 1:51 PM, Pablo Neira Ayuso wrote:
> The expectation helper field is mostly unused. As a result, the
> netfilter codebase relies on accessing the helper through exp->master.
>
> Always set on the expectation helper field so it can be used to reach
> the helper.
>
> nf_ct_expect_init() is called from packet path where the skb owns
> the ct object, therefore accessing exp->master for the newly created
> expectation is safe. This saves a lot of updates in all callsites
> to pass the ct object as parameter to nf_ct_expect_init().
>
> This is a preparation patches for follow up fixes.
>
> Signed-off-by: Florian Westphal <fw@strlen.de>
> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
> ---
Hi, Pablo and Florian.
I was investigating FTP test failures in OVS with 7.0 kernel and bisected
the issue down to this commit. AFAIU, with this change all the related
connections over time gain their parents' helpers,. This is causing a change
visible to the userspace, because FTP data connections are now reported to
have helpers in the conntrack dump:
# conntrack -L
tcp 6 119 TIME_WAIT src=10.1.1.1 dst=10.1.1.2 sport=59534 dport=21 \
src=10.1.1.2 dst=10.1.1.1 sport=21 dport=59534 \
[ASSURED] mark=0 helper=ftp use=2
tcp 6 119 TIME_WAIT src=10.1.1.2 dst=10.1.1.1 sport=52709 dport=52381 \
src=10.1.1.1 dst=10.1.1.2 sport=52381 dport=52709 \
[ASSURED] mark=0 helper=ftp use=1
Before this commit only the control connection had helper=ftp reported in
the dump. The traffic seems to work fine, but our tests fail because we
do not expect the helper attached.
AFAIU, it's generally not something that should be happening, as helpers
on data connections do not really make much sense. But I'm just trying to
figure out if you would consider this as a regression and fix in the kernel
or if we should adjust our userspace components for this new dump content,
which would not be very straightforward to do if we want to be able to run
tests on both old and the new versions.
What do you think?
Best regards, Ilya Maximets.
^ permalink raw reply
* Re: [PATCH] net: stmmac: Add support for TX/RX channel interrupt
From: Andrew Lunn @ 2026-04-30 20:53 UTC (permalink / raw)
To: muhammad.nazim.amirul.nazle.asmade
Cc: netdev, davem, kuba, pabeni, edumazet, andrew+netdev,
linux-kernel
In-Reply-To: <20260429072728.13638-1-muhammad.nazim.amirul.nazle.asmade@altera.com>
> + /* For RX Channel */
> + for (i = 0; i < MTL_MAX_RX_QUEUES; i++) {
> + snprintf(irq_name, sizeof(irq_name), "dma_rx%i", i);
> + irq = platform_get_irq_byname_optional(pdev, irq_name);
> + if (irq == -EPROBE_DEFER)
> + return irq;
> + else if (irq < 0)
> + break;
It would be good to differentiate between real errors, and it not
being available. I think -ENOXIO is returned when it does not
exist. Anything else is a real error?
Andrew
^ permalink raw reply
* Re: [PATCH net-next] net: mctp: test: remove skb dumps from test output
From: patchwork-bot+netdevbpf @ 2026-04-30 20:50 UTC (permalink / raw)
To: Jeremy Kerr; +Cc: matt, davem, edumazet, kuba, pabeni, horms, netdev
In-Reply-To: <20260429-dev-mctp-test-skb-dump-v1-1-13fd5789ef71@codeconstruct.com.au>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 29 Apr 2026 16:27:31 +0800 you wrote:
> We're currently dumping skb info in our fragment input test, which makes
> interpreting the TAP test output a bit awkward.
>
> Remove the skb dumps.
>
> Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
>
> [...]
Here is the summary with links:
- [net-next] net: mctp: test: remove skb dumps from test output
https://git.kernel.org/netdev/net-next/c/8ca4bff2ff3e
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v1 bpf 2/2] selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
From: Kuniyuki Iwashima @ 2026-04-30 20:32 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, bpf, netdev
In-Reply-To: <20260430184405.1227386-3-kuniyu@google.com>
On Thu, Apr 30, 2026 at 11:44 AM Kuniyuki Iwashima <kuniyu@google.com> wrote:
>
> Let's extend sockopt_sk.c to cover bpf_tcp_sock() for the
> wrong socket type.
>
> Before:
> # ./test_progs -t sockopt_sk
> [ 151.948613] ==================================================================
> [ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0
> [ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259
> ...
> run_test:FAIL:getsetsockopt unexpected error: -1 (errno 22)
> #427 sockopt_sk:FAIL
>
> After:
> #427 sockopt_sk:OK
>
> While at it, missing free() is fixed up.
>
> Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
> ---
> .../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
> tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
> 2 files changed, 32 insertions(+), 1 deletion(-)
>
> diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> index 53637431ec5d..87e771c8991f 100644
> --- a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> +++ b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
> @@ -190,7 +190,7 @@ static int getsetsockopt(void)
> fd = socket(AF_NETLINK, SOCK_RAW, 0);
> if (fd < 0) {
> log_err("Failed to create AF_NETLINK socket");
> - return -1;
> + goto err;
> }
>
> buf.u32 = 1;
> @@ -211,6 +211,21 @@ static int getsetsockopt(void)
> }
> ASSERT_EQ(optlen, 8, "Unexpected NETLINK_LIST_MEMBERSHIPS value");
>
> + /* Trick bpf_tcp_sock() with IPPROTO_TCP */
> + close(fd);
> + fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
> + if (fd < 0) {
> + log_err("Failed to create RAW socket");
> + goto err;
> + }
> +
> + optlen = 60;
> + err = setsockopt(fd, SOL_TCP, TCP_SAVED_SYN, &buf, optlen);
> + if (err) {
Ugh, I forgot to commit s/err/!err/ change.. :/
pw-bot: cr
^ permalink raw reply
* [PATCH net v2 2/2] selftest: net: Add test for TCP flow failover with ECMP routes.
From: Sagarika Sharma @ 2026-04-30 20:09 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma
In-Reply-To: <20260430200909.527827-1-sharmasagarika@google.com>
From: Kuniyuki Iwashima <kuniyu@google.com>
Without the previous commit, TCP failed to switch to alternative
IPv6 routes immediately upon carrier loss.
It would persist with the dead route until reaching the threshold
net.ipv4.tcp_retries1, leading to unnecessary delays in failover.
Let's add a selftest for this scenario to ensure TCP fails over
immediately upon a carrier loss event.
Before:
TEST: TCP IPv4 failover [ OK ]
TEST: TCP IPv6 failover [FAIL]
After:
TEST: TCP IPv4 failover [ OK ]
TEST: TCP IPv6 failover [ OK ]
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
Signed-off-by: Sagarika Sharma <sharmasagarika@google.com>
---
v2: Add require_command, fix exit code and shellcheck warnings
except for SC2154 (netns allocation confuses shellcheck),
lower threshold of packets captured for success.
---
tools/testing/selftests/net/Makefile | 1 +
.../selftests/net/tcp_ecmp_failover.sh | 216 ++++++++++++++++++
2 files changed, 217 insertions(+)
create mode 100755 tools/testing/selftests/net/tcp_ecmp_failover.sh
diff --git a/tools/testing/selftests/net/Makefile b/tools/testing/selftests/net/Makefile
index a275ed584026..f3da38c54d27 100644
--- a/tools/testing/selftests/net/Makefile
+++ b/tools/testing/selftests/net/Makefile
@@ -96,6 +96,7 @@ TEST_PROGS := \
srv6_hl2encap_red_l2vpn_test.sh \
srv6_iptunnel_cache.sh \
stress_reuseport_listen.sh \
+ tcp_ecmp_failover.sh \
tcp_fastopen_backup_key.sh \
test_bpf.sh \
test_bridge_backup_port.sh \
diff --git a/tools/testing/selftests/net/tcp_ecmp_failover.sh b/tools/testing/selftests/net/tcp_ecmp_failover.sh
new file mode 100755
index 000000000000..5768aa8bff6a
--- /dev/null
+++ b/tools/testing/selftests/net/tcp_ecmp_failover.sh
@@ -0,0 +1,216 @@
+#!/bin/bash
+# SPDX-License-Identifier: GPL-2.0
+#
+# Copyright 2026 Google LLC.
+#
+# This test verifies TCP flow failover between ECMP routes
+# upon carrier loss on the active device.
+#
+# socat -----------------------------> socat
+# |
+# .-- veth-c1 -|- veth-s1 --.
+# dummy0 -| | |-- dummy0
+# '-- veth-c2 -|- veth-s2 --'
+# |
+#
+
+REQUIRE_JQ=no
+REQUIRE_MZ=no
+NUM_NETIFS=0
+
+source forwarding/lib.sh
+
+CLIENT_IP="10.0.59.1"
+SERVER_IP="10.0.92.1"
+CLIENT_IP6="2001:db8:5a9a::1"
+SERVER_IP6="2001:db8:9292::1"
+
+setup_server()
+{
+ IP="ip -n $server"
+ NS_EXEC="ip netns exec $server"
+
+ $IP link add dummy0 type dummy
+ $IP link set dummy0 up
+
+ $IP -4 addr add $SERVER_IP/32 dev dummy0
+ $IP -6 addr add $SERVER_IP6/128 dev dummy0 nodad
+
+ $IP link set veth-s1 up
+ $IP link set veth-s2 up
+
+ $IP -4 addr add 192.168.1.2/24 dev veth-s1
+ $IP -4 addr add 192.168.2.2/24 dev veth-s2
+
+ $IP -4 route add $CLIENT_IP/32 \
+ nexthop via 192.168.1.1 dev veth-s1 weight 1 \
+ nexthop via 192.168.2.1 dev veth-s2 weight 1
+
+ $IP -6 addr add 2001:db8:1::2/64 dev veth-s1 nodad
+ $IP -6 addr add 2001:db8:2::2/64 dev veth-s2 nodad
+
+ $IP -6 route add $CLIENT_IP6/128 \
+ nexthop via 2001:db8:1::1 dev veth-s1 weight 1 \
+ nexthop via 2001:db8:2::1 dev veth-s2 weight 1
+}
+
+setup_client()
+{
+ IP="ip -n $client"
+ NS_EXEC="ip netns exec $client"
+
+ $IP link add dummy0 type dummy
+ $IP link set dummy0 up
+
+ $IP -4 addr add $CLIENT_IP/32 dev dummy0
+ $IP -6 addr add $CLIENT_IP6/128 dev dummy0 nodad
+
+ $IP link set veth-c1 up
+ $IP link set veth-c2 up
+
+ $IP -4 addr add 192.168.1.1/24 dev veth-c1
+ $IP -4 addr add 192.168.2.1/24 dev veth-c2
+
+ $IP -4 route add $SERVER_IP/32 \
+ nexthop via 192.168.1.2 dev veth-c1 weight 1 \
+ nexthop via 192.168.2.2 dev veth-c2 weight 1
+
+ $IP -6 addr add 2001:db8:1::1/64 dev veth-c1 nodad
+ $IP -6 addr add 2001:db8:2::1/64 dev veth-c2 nodad
+
+ $IP -6 route add $SERVER_IP6/128 \
+ nexthop via 2001:db8:1::2 dev veth-c1 weight 1 \
+ nexthop via 2001:db8:2::2 dev veth-c2 weight 1
+
+ # By default, tcp_retries1=3 triggers a route refresh
+ # after 3 retransmits (~5s). Ensure this never occurs
+ # for test stability.
+ $NS_EXEC sysctl -qw net.ipv4.tcp_retries1=100
+
+ # When NETDEV_CHANGE is issued for a dev tied to an ECMP
+ # route, RTNH_F_LINKDOWN is flagged and the sernum is
+ # bumped to invalidate the route via sk_dst_check().
+ #
+ # Without ignore_routes_with_linkdown=1, subsequent
+ # lookups may still select the same RTNH_F_LINKDOWN route.
+ $NS_EXEC sysctl -qw net.ipv4.conf.veth-c1.ignore_routes_with_linkdown=1
+ $NS_EXEC sysctl -qw net.ipv4.conf.veth-c2.ignore_routes_with_linkdown=1
+
+ $NS_EXEC sysctl -qw net.ipv6.conf.veth-c1.ignore_routes_with_linkdown=1
+ $NS_EXEC sysctl -qw net.ipv6.conf.veth-c2.ignore_routes_with_linkdown=1
+}
+
+setup()
+{
+ setup_ns client server
+
+ ip -n "$client" link add veth-c1 type veth peer veth-s1 netns "$server"
+ ip -n "$client" link add veth-c2 type veth peer veth-s2 netns "$server"
+
+ setup_server
+ setup_client
+}
+
+cleanup()
+{
+ cleanup_all_ns > /dev/null 2>&1
+}
+
+tcp_ecmp_failover()
+{
+ local pf=$1; shift
+ local server_ip=$1; shift
+ local client_ip=$1; shift
+
+ RET=0
+
+ tcpdump_start veth-s1 "$server"
+ tcpdump_start veth-s2 "$server"
+
+ ip netns exec "$server" \
+ socat -u TCP-LISTEN:8080,pf="$pf",bind="$server_ip",reuseaddr /dev/null &
+ server_pid=$!
+
+ # Wait for server to start listening.
+ # Sometimes client fails without this sleep.
+ sleep 1
+
+ ip netns exec "$client" \
+ socat -u /dev/zero TCP:"$server_ip":8080,pf="$pf",bind="$client_ip" &
+ client_pid=$!
+
+ # To capture enough packets.
+ sleep 3
+
+ tcpdump_stop veth-s1
+ tcpdump_stop veth-s2
+
+ pkts_s1=$(tcpdump_show veth-s1 | wc -l)
+ pkts_s2=$(tcpdump_show veth-s2 | wc -l)
+
+ tcpdump_cleanup veth-s1
+ tcpdump_cleanup veth-s2
+
+ # Detect the device chosen by the client
+ if [ "$pkts_s1" -gt "$pkts_s2" ]; then
+ veth_down=veth-s1
+ veth_up=veth-s2
+ else
+ veth_down=veth-s2
+ veth_up=veth-s1
+ fi
+
+ # Taking down $veth_down causes its peer to lose carrier,
+ # triggering NETDEV_CHANGE. This flags RTNH_F_LINKDOWN
+ # and bumps the sernum for the route associated with that
+ # peer, invalidating the cached dst in the TCP socket.
+ #
+ # Consequently, sk_dst_check() fails, forcing the subsequent
+ # lookup to select the remaining healthy route via $veth_up.
+ ip -n "$server" link set "$veth_down" down
+
+ tcpdump_start "$veth_up" "$server"
+
+ # To capture enough packets.
+ sleep 3
+
+ tcpdump_stop "$veth_up"
+
+ kill -9 "$client_pid" > /dev/null 2>&1
+ kill -9 "$server_pid" > /dev/null 2>&1
+ wait 2> /dev/null
+
+ pkts=$(tcpdump_show $veth_up | wc -l)
+
+ tcpdump_cleanup "$veth_up"
+
+ if [ "$pkts" -lt 1000 ]; then
+ RET=$ksft_fail
+ fi
+}
+
+test_ipv4()
+{
+ setup
+ tcp_ecmp_failover IPv4 $SERVER_IP $CLIENT_IP
+ log_test "TCP IPv4 failover"
+ cleanup
+}
+
+test_ipv6()
+{
+ setup
+ tcp_ecmp_failover IPv6 "[$SERVER_IP6]" "[$CLIENT_IP6]"
+ log_test "TCP IPv6 failover"
+ cleanup
+}
+
+require_command socat
+require_command tcpdump
+
+trap cleanup EXIT
+
+test_ipv4
+test_ipv6
+
+exit "$EXIT_STATUS"
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH net v2 1/2] ipv6: update route serial number on NETDEV_CHANGE
From: Sagarika Sharma @ 2026-04-30 20:09 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma, Ido Schimmel
In-Reply-To: <20260430200909.527827-1-sharmasagarika@google.com>
When using IPv6 ECMP routes, if a netdev listed as a nexthop experiences
a carrier change event (e.g., a bond device generating a NETDEV_CHANGE
event after its slaves go linkdown), established connections utilizing
that nexthop fail to fail over to other available nexthops. Instead,
these connections stall or drop.
This happens because the IPv6 FIB code does not invalidate the socket's
cached destination when a NETDEV_CHANGE event occurs. While
fib6_ifdown() correctly marks the nexthop with RTNH_F_LINKDOWN, it
leaves the route's serial number unchanged. As a result, sockets with a
previously cached dst do not realize the route is no longer viable and
continue to try using the non-functional nexthop.
This behavior contrasts with IPv4, which actively flushes cached
destinations on a NETDEV_CHANGE event (see fib_netdev_event() in
net/ipv4/fib_frontend.c).
Fix this by updating the route serial number in fib6_ifdown() when
setting RTNH_F_LINKDOWN. This invalidates stale cached destinations,
forcing sockets to perform a new route lookup and fail over to a
functioning nexthop.
Fixes: 51ebd3181572 ("ipv6: add support of equal cost multipath (ECMP)")
Signed-off-by: Sagarika Sharma <sharmasagarika@google.com>
Reviewed-by: Kuniyuki Iwashima <kuniyu@google.com>
Reviewed-by: Ido Schimmel <idosch@nvidia.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
---
net/ipv6/route.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index 19eb6b702227..0dc0316530ca 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -4995,6 +4995,7 @@ static int fib6_ifdown(struct fib6_info *rt, void *p_arg)
rt->fib6_flags & (RTF_LOCAL | RTF_ANYCAST))
break;
rt->fib6_nh->fib_nh_flags |= RTNH_F_LINKDOWN;
+ fib6_update_sernum(net, rt);
rt6_multipath_rebalance(rt);
break;
}
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH net v2 0/2] ipv6: fix ECMP route failover on carrier loss
From: Sagarika Sharma @ 2026-04-30 20:08 UTC (permalink / raw)
To: David S . Miller, David Ahern, Eric Dumazet, Jakub Kicinski,
Paolo Abeni
Cc: Shuah Khan, Simon Horman, Kuniyuki Iwashima, netdev,
linux-kselftest, Sagarika Sharma
This patchset resolves an issue where established IPv6 connections are
unable to transition to alternative ECMP nexthops upon carrier loss.
Unlike IPv4, the IPv6 routing subsystem does not actively invalidate
cached destinations during a NETDEV_CHANGE event. Sockets persist
with dead routes, leading to stalled traffic or connection drops.
This series introduces a fix to trigger route invalidation by
updating the route serial number on link carrier loss and provides
a corresponding selftest to validate the failover behavior for IPv4
and IPv6.
---
v2:
- Changes to selftest addressing Ido’s and sashiko’s suggestions:
require_command for socat and tcpdump, EXIT trap, lower threshold
for test success, and fix exit code.
v1: https://lore.kernel.org/netdev/20260427224243.3499162-1-sharmasagarika@google.com/
Kuniyuki Iwashima (1):
selftest: net: Add test for TCP flow failover with ECMP routes.
Sagarika Sharma (1):
ipv6: update route serial number on NETDEV_CHANGE
net/ipv6/route.c | 1 +
tools/testing/selftests/net/Makefile | 1 +
.../selftests/net/tcp_ecmp_failover.sh | 216 ++++++++++++++++++
3 files changed, 218 insertions(+)
create mode 100755 tools/testing/selftests/net/tcp_ecmp_failover.sh
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply
* Re: [PATCH net-next] selftests: drv-net: Enable ntuple-filters if supported
From: Joe Damato @ 2026-04-30 19:36 UTC (permalink / raw)
To: Dimitri Daskalakis
Cc: David S . Miller, Andrew Lunn, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Shuah Khan, Dimitri Daskalakis, David Wei,
Dragos Tatulea, Vishwanath Seshagiri, Pavel Begunkov,
Simon Horman, Pavan Chebbi, Michael Chan, Gal Pressman,
linux-kselftest, netdev
In-Reply-To: <20260430165217.3700469-1-dimitri.daskalakis1@gmail.com>
On Thu, Apr 30, 2026 at 09:52:17AM -0700, Dimitri Daskalakis wrote:
> From: Dimitri Daskalakis <daskald@meta.com>
>
> Certain devices which support ntuple-filters do not enable the feature
> by default. The existing tests will skip (if they check for the feature),
> or fail if they blindly attempt to install rules. Therefore, attempt to turn
> on ntuple-filters if the device supports them.
>
> Signed-off-by: Dimitri Daskalakis <daskald@meta.com>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> tools/testing/selftests/drivers/net/gro.py | 10 ++++++++++
> tools/testing/selftests/drivers/net/hw/gro_hw.py | 10 ++++++++++
> tools/testing/selftests/drivers/net/hw/iou-zcrx.py | 12 ++++++++++++
> tools/testing/selftests/drivers/net/hw/ntuple.py | 5 ++++-
> tools/testing/selftests/drivers/net/hw/rss_ctx.py | 7 ++++---
> 5 files changed, 40 insertions(+), 4 deletions(-)
I suppose a future cleanup might be able to add a generic helper for this for
all of the ethtool settings (tx-udp-segmentation, ntuple, etc) to
EthtoolFamily or something?
That said:
Reviewed-by: Joe Damato <joe@dama.to>
^ permalink raw reply
* Re: [PATCH net-next v3 2/3] net/ethernet/zte/dinghai: add logging infrastructure
From: Andrew Lunn @ 2026-04-30 19:36 UTC (permalink / raw)
To: Junyang Han
Cc: andrew+netdev, netdev, vadim.fedorenko, davem, edumazet, kuba,
pabeni, ran.ming, han.chengfei, zhang.yanze
In-Reply-To: <20260430151138.2813381-3-han.junyang@zte.com.cn>
> ret = pci_enable_device(dev->pdev);
> - if (ret)
> + if (ret) {
> + LOG_ERR(dev, "pci_enable_device failed: %d\n", ret);
I asked that your use dev_err().
Andrew
^ permalink raw reply
* Re: [PATCH net-next v3 1/3] net/ethernet: add ZTE network driver support
From: Andrew Lunn @ 2026-04-30 19:34 UTC (permalink / raw)
To: Junyang Han
Cc: andrew+netdev, netdev, vadim.fedorenko, davem, edumazet, kuba,
pabeni, ran.ming, han.chengfei, zhang.yanze
In-Reply-To: <20260430151138.2813381-2-han.junyang@zte.com.cn>
> + struct zxdh_pf_device *pf_dev = NULL;
Please don't initialise variables, unless they actual do need
initialising. It mask used before set warnings the compiler will
issue.
> +void dh_pf_pci_close(struct dh_core_dev *dev)
> +{
> + struct zxdh_pf_device *pf_dev = NULL;
Looks like you can just set it so dev->priv.
> +static int dh_pf_probe(struct pci_dev *pdev, const struct pci_device_id *id)
> +{
> + struct dh_core_dev *dh_dev;
> + struct zxdh_pf_device *pf_dev;
Reverse Christmas tree.
> + struct devlink *devlink;
> + int ret;
> +
> + devlink = devlink_alloc(&dh_pf_devlink_ops, sizeof(struct dh_core_dev),
> + &pdev->dev);
Wrong indentation. In fact, this seems to have spaces not tabs. What
does checkpatch say about these files? Or is you email still broken?
No point reviewing further if the basic are wrong.
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next v3 4/4] net: dsa: initial support for MT7628 embedded switch
From: Andrew Lunn @ 2026-04-30 19:19 UTC (permalink / raw)
To: Joris Vaisvila
Cc: netdev, horms, pabeni, kuba, edumazet, davem, olteanv, devicetree,
Rob Herring, Krzysztof Kozlowski, Conor Dooley
In-Reply-To: <20260428185510.261521-5-joey@tinyisr.com>
> source "drivers/net/dsa/lantiq/Kconfig"
>
> +config NET_DSA_MT7628
> + tristate "MediaTek MT7628 Embedded Ethernet switch support"
> + select NET_DSA_TAG_MT7628
> + select MEDIATEK_FE_SOC_PHY
> + help
> + This enables support for the built-in Ethernet switch found
> + in the MT7628 SoC.
> +
> config NET_DSA_MT7530
> tristate "MediaTek MT7530 and MT7531 Ethernet switch support"
NET_DSA_MT7628 is > NET_DSA_MT7530 so should come second.
> +static int mt7628_mii_read(struct mii_bus *bus, int port, int regnum)
> +{
> + struct mt7628_esw *esw = bus->priv;
> + int ret;
> + u32 val;
> +
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + !(val & MT7628_ESW_PCR1_RD_DONE), 10,
> + 5000);
> + if (ret)
> + goto out;
> +
> + ret = regmap_write(esw->regmap, MT7628_ESW_REG_PCR0,
> + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_REG,
> + regnum) |
> + FIELD_PREP(MT7628_ESW_PCR0_CPU_PHY_ADDR,
> + port) | MT7628_ESW_PCR0_RD_PHY_CMD);
> + if (ret)
> + goto out;
> +
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + (val & MT7628_ESW_PCR1_RD_DONE), 10,
> + 5000);
> +out:
> + if (ret) {
> + dev_err(&bus->dev, "read failed. MDIO timeout?\n");
> + return ret;
> + }
> + return FIELD_GET(MT7628_ESW_PCR1_RD_DATA, val);
This works, but it is an unusual structure. Normally the label is
after the normal exist path, and only deals with errors.
> +}
> +
> +static int mt7628_mii_write(struct mii_bus *bus, int port, int regnum, u16 dat)
> +{
> + ret = regmap_read_poll_timeout(esw->regmap, MT7628_ESW_REG_PCR1, val,
> + (val & MT7628_ESW_PCR1_WT_DONE), 10,
> + 5000);
> +out:
> + if (ret) {
> + dev_err(&bus->dev, "write failed. MDIO timeout?\n");
> + return ret;
> + }
> + return 0;
> +}
Same here.
Otherwise this looks O.K.
Andrew
^ permalink raw reply
* Re: [PATCH net-next v2 1/2] mv88e6xxx: Refactor 6352's serdes functions
From: Andrew Lunn @ 2026-04-30 19:06 UTC (permalink / raw)
To: Fidan Aliyeva
Cc: olteanv, davem, edumazet, kuba, pabeni, netdev, linux-kernel,
thomas.eckerman.ext
In-Reply-To: <20260430124907.3533344-2-fidan.aliyeva.ext@ericsson.com>
> @@ -185,7 +200,7 @@ size_t mv88e6352_serdes_get_stats(struct mv88e6xxx_chip *chip, int port,
>
> for (i = 0; i < ARRAY_SIZE(mv88e6352_serdes_hw_stats); i++) {
> stat = &mv88e6352_serdes_hw_stats[i];
> - value = mv88e6352_serdes_get_stat(chip, stat);
> + value = mv88e6352_serdes_get_stat(chip, MV88E6352_ADDR_SERDES, stat);
If you generalise this, you can use the same code for the mv88e6321.
> +void mv88e6352_serdes_get_regs(struct mv88e6xxx_chip *chip, int port, void *_p)
> +{
> + int err;
> +
> + err = mv88e6352_g2_scratch_port_has_serdes(chip, port);
> + if (err <= 0)
> + return;
> +
> + mv88e6352_serdes_get_regs_from_lane(chip, MV88E6352_ADDR_SERDES, _p);
Here as well.
This is however looking a lot better. Thanks for the generalisation
patch.
Andrew
---
pw-bot: cr
^ permalink raw reply
* [PATCH v1 bpf 2/2] selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev
In-Reply-To: <20260430184405.1227386-1-kuniyu@google.com>
Let's extend sockopt_sk.c to cover bpf_tcp_sock() for the
wrong socket type.
Before:
# ./test_progs -t sockopt_sk
[ 151.948613] ==================================================================
[ 151.951376] BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt+0xc7/0x8e0
[ 151.954159] Read of size 8 at addr ffff88801083d760 by task test_progs/1259
...
run_test:FAIL:getsetsockopt unexpected error: -1 (errno 22)
#427 sockopt_sk:FAIL
After:
#427 sockopt_sk:OK
While at it, missing free() is fixed up.
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
.../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
2 files changed, 32 insertions(+), 1 deletion(-)
diff --git a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
index 53637431ec5d..87e771c8991f 100644
--- a/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
+++ b/tools/testing/selftests/bpf/prog_tests/sockopt_sk.c
@@ -190,7 +190,7 @@ static int getsetsockopt(void)
fd = socket(AF_NETLINK, SOCK_RAW, 0);
if (fd < 0) {
log_err("Failed to create AF_NETLINK socket");
- return -1;
+ goto err;
}
buf.u32 = 1;
@@ -211,6 +211,21 @@ static int getsetsockopt(void)
}
ASSERT_EQ(optlen, 8, "Unexpected NETLINK_LIST_MEMBERSHIPS value");
+ /* Trick bpf_tcp_sock() with IPPROTO_TCP */
+ close(fd);
+ fd = socket(AF_INET, SOCK_RAW, IPPROTO_TCP);
+ if (fd < 0) {
+ log_err("Failed to create RAW socket");
+ goto err;
+ }
+
+ optlen = 60;
+ err = setsockopt(fd, SOL_TCP, TCP_SAVED_SYN, &buf, optlen);
+ if (err) {
+ log_err("Unexpected setsockopt(TCP_SAVED_SYN)");
+ goto err;
+ }
+
free(big_buf);
close(fd);
return 0;
diff --git a/tools/testing/selftests/bpf/progs/sockopt_sk.c b/tools/testing/selftests/bpf/progs/sockopt_sk.c
index cb990a7d3d45..5e0b27e7855c 100644
--- a/tools/testing/selftests/bpf/progs/sockopt_sk.c
+++ b/tools/testing/selftests/bpf/progs/sockopt_sk.c
@@ -149,6 +149,20 @@ int _setsockopt(struct bpf_sockopt *ctx)
if (sk && sk->family == AF_NETLINK)
goto out;
+ if (sk && sk->family == AF_INET && sk->type == SOCK_RAW) {
+ struct bpf_tcp_sock *tp = bpf_tcp_sock(sk);
+
+ if (tp) {
+ char saved_syn[60];
+
+ bpf_getsockopt(sk, SOL_TCP, TCP_SAVED_SYN,
+ &saved_syn, sizeof(saved_syn));
+ goto consumed;
+ }
+
+ goto out;
+ }
+
/* Make sure bpf_get_netns_cookie is callable.
*/
if (bpf_get_netns_cookie(NULL) == 0)
@@ -224,6 +238,8 @@ int _setsockopt(struct bpf_sockopt *ctx)
return 0; /* couldn't get sk storage */
storage->val = optval[0];
+
+consumed:
ctx->optlen = -1; /* BPF has consumed this option, don't call kernel
* setsockopt handler.
*/
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v1 bpf 1/2] bpf: tcp: Fix type confusion in bpf_tcp_sock().
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev, Damiano Melotti
In-Reply-To: <20260430184405.1227386-1-kuniyu@google.com>
bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP,
but RAW socket can bypass it:
socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
Calling bpf_setsockopt() in SOCKOPT prog triggers out-of-bounds
access to another slab object. [0]
Let's use sk_is_tcp().
[0]:
BUG: KASAN: slab-out-of-bounds in sol_tcp_sockopt (net/core/filter.c:5519)
Read of size 8 at addr ffff88801083d760 by task test_progs/1259
CPU: 1 UID: 0 PID: 1259 Comm: test_progs Tainted: G OE 7.0.0-11175-gb5c111f4967b #1 PREEMPT(full)
Tainted: [O]=OOT_MODULE, [E]=UNSIGNED_MODULE
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.17.0-debian-1.17.0-1 04/01/2014
Call Trace:
<TASK>
dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)
print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)
kasan_report (mm/kasan/report.c:595)
sol_tcp_sockopt (net/core/filter.c:5519)
__bpf_getsockopt (net/core/filter.c:5633)
bpf_sk_getsockopt (net/core/filter.c:5654)
bpf_prog_629ba00a1601e9f2__setsockopt+0x86/0x22c
__cgroup_bpf_run_filter_setsockopt (./include/linux/bpf.h:1402 ./include/linux/filter.h:722 ./include/linux/filter.h:729 kernel/bpf/cgroup.c:81 kernel/bpf/cgroup.c:2026)
do_sock_setsockopt (net/socket.c:2363)
__x64_sys_setsockopt (net/socket.c:2406)
do_syscall_64 (arch/x86/entry/syscall_64.c:63)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
RIP: 0033:0x7f85f82fe7de
Code: 55 48 63 c9 48 63 ff 45 89 c9 48 89 e5 48 83 ec 08 6a 2c e8 34 69 f7 ff c9 c3 66 90 f3 0f 1e fa 49 89 ca b8 36 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 0a c3 66 0f 1f 84 00 00 00 00 00 48 8b 15 e1
RSP: 002b:00007ffe59dcecd8 EFLAGS: 00000202 ORIG_RAX: 0000000000000036
RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007f85f82fe7de
RDX: 000000000000001c RSI: 0000000000000006 RDI: 000000000000000d
RBP: 00007ffe59dcef20 R08: 000000000000003c R09: 0000000000000000
R10: 00007ffe59dcef00 R11: 0000000000000202 R12: 00007ffe59dcf268
R13: 0000000000000003 R14: 00007f85f9da5000 R15: 000055b2f3201400
</TASK>
The buggy address belongs to the object at ffff88801083d280
which belongs to the cache RAW of size 1792
The buggy address is located 1248 bytes inside of
allocated 1792-byte region [ffff88801083d280, ffff88801083d980)
Fixes: 655a51e536c0 ("bpf: Add struct bpf_tcp_sock and BPF_FUNC_tcp_sock")
Reported-by: Damiano Melotti <melotti@google.com>
Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com>
---
net/core/filter.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/filter.c b/net/core/filter.c
index bc96c18df4e0..cd88633f8dc1 100644
--- a/net/core/filter.c
+++ b/net/core/filter.c
@@ -7475,7 +7475,7 @@ u32 bpf_tcp_sock_convert_ctx_access(enum bpf_access_type type,
BPF_CALL_1(bpf_tcp_sock, struct sock *, sk)
{
- if (sk_fullsock(sk) && sk->sk_protocol == IPPROTO_TCP)
+ if (sk_fullsock(sk) && sk_is_tcp(sk))
return (unsigned long)sk;
return (unsigned long)NULL;
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply related
* [PATCH v1 bpf 0/2] bpf: tcp: Fix type confusion in bpf_tcp_sock().
From: Kuniyuki Iwashima @ 2026-04-30 18:43 UTC (permalink / raw)
To: Martin KaFai Lau, Daniel Borkmann, Alexei Starovoitov,
Andrii Nakryiko, Eduard Zingerman, Kumar Kartikeya Dwivedi
Cc: John Fastabend, Stanislav Fomichev, Song Liu, Yonghong Song,
Jiri Olsa, Eric Dumazet, Kuniyuki Iwashima, Kuniyuki Iwashima,
bpf, netdev
bpf_tcp_sock() only check if sk->sk_protocol is IPPROTO_TCP,
but RAW socket can bypass it:
socket(AF_INET, SOCK_RAW, IPPROTO_TCP)
Patch 1 fixes it and Patch 2 adds a test.
Kuniyuki Iwashima (2):
bpf: tcp: Fix type confusion in bpf_tcp_sock().
selftest: bpf: Add test for bpf_tcp_sock() and RAW socket.
net/core/filter.c | 2 +-
.../selftests/bpf/prog_tests/sockopt_sk.c | 17 ++++++++++++++++-
tools/testing/selftests/bpf/progs/sockopt_sk.c | 16 ++++++++++++++++
3 files changed, 33 insertions(+), 2 deletions(-)
--
2.54.0.545.g6539524ca2-goog
^ permalink raw reply
* [PATCH net-next v2 2/3] netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port()
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Replace the bare simple_strtoul() call for port parsing with the
shared nf_ct_helper_parse_port(). This avoids reliance on the
nul-terminated string guarantee (currently provided by the newline
scan earlier in parse_dcc) and validates the port fits in u16.
The simple_strtoul() for the IP address field is left as-is since
it returns unsigned long for a __be32 conversion, which is a
separate concern.
Fixes: 869f37d8e48f ("[NETFILTER]: nf_conntrack/nf_nat: add IRC helper port")
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
net/netfilter/nf_conntrack_irc.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_conntrack_irc.c b/net/netfilter/nf_conntrack_irc.c
index 522183b9a..1b51f5a6a 100644
--- a/net/netfilter/nf_conntrack_irc.c
+++ b/net/netfilter/nf_conntrack_irc.c
@@ -93,7 +93,9 @@ static int parse_dcc(char *data, const char *data_end, __be32 *ip,
data++;
}
- *port = simple_strtoul(data, &data, 10);
+ if (nf_ct_helper_parse_port(data, data_end - data, port, &data))
+ return -1;
+
*ad_end_p = data;
return 0;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 0/3] netfilter: conntrack: add shared port parser and use it in IRC and Amanda helpers
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
Both nf_conntrack_irc and nf_conntrack_amanda parse port numbers
from application-layer protocol data using simple_strtoul(), which
relies on nul-terminated strings and returns unsigned long without
range checking. Port values above 65535 silently truncate when
stored in u16.
This v2 adds a shared nf_ct_helper_parse_port() function to the
conntrack helper core, modeled after the approach in 8cf6809cddcb
("netfilter: nf_conntrack_sip: don't use simple_strtoul"), then
converts both helpers to use it.
Changes since v1:
- Added shared nf_ct_helper_parse_port() in the helper core
instead of open-coding range checks in each helper (Pablo)
- Parser does not rely on nul-terminated strings
- Dropped simple_strtoul usage entirely for port parsing
HACKE-RC (3):
netfilter: conntrack: add shared port parser for helpers
netfilter: nf_conntrack_irc: use nf_ct_helper_parse_port()
netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()
include/net/netfilter/nf_conntrack_helper.h | 3 +++
net/netfilter/nf_conntrack_amanda.c | 11 ++++----
net/netfilter/nf_conntrack_helper.c | 28 +++++++++++++++++++++
net/netfilter/nf_conntrack_irc.c | 4 ++-
4 files changed, 40 insertions(+), 6 deletions(-)
--
2.54.0
^ permalink raw reply
* [PATCH net-next v2 3/3] netfilter: nf_conntrack_amanda: use nf_ct_helper_parse_port()
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Replace the bare simple_strtoul() call with the shared
nf_ct_helper_parse_port(). This removes reliance on the
nul-terminated pbuf string for parsing and validates the port
range in a single call.
The len > 5 guard and port == 0 check are now handled by the
shared parser, which rejects zero and values above 65535.
Reorder local variable declarations to reverse christmas tree.
Fixes: 16958900578b ("[NETFILTER]: nf_conntrack/nf_nat: add amanda helper port")
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
net/netfilter/nf_conntrack_amanda.c | 11 ++++++-----
1 file changed, 6 insertions(+), 5 deletions(-)
diff --git a/net/netfilter/nf_conntrack_amanda.c b/net/netfilter/nf_conntrack_amanda.c
index d2c09e8dd..30b5c4b84 100644
--- a/net/netfilter/nf_conntrack_amanda.c
+++ b/net/netfilter/nf_conntrack_amanda.c
@@ -88,11 +88,12 @@ static int amanda_help(struct sk_buff *skb,
struct nf_conntrack_expect *exp;
struct nf_conntrack_tuple *tuple;
unsigned int dataoff, start, stop, off, i;
+ nf_nat_amanda_hook_fn *nf_nat_amanda;
char pbuf[sizeof("65535")], *tmp;
+ int ret = NF_ACCEPT;
u_int16_t len;
+ u16 parsed_port;
__be16 port;
- int ret = NF_ACCEPT;
- nf_nat_amanda_hook_fn *nf_nat_amanda;
/* Only look at packets from the Amanda server */
if (CTINFO2DIR(ctinfo) == IP_CT_DIR_ORIGINAL)
@@ -132,10 +133,10 @@ static int amanda_help(struct sk_buff *skb,
break;
pbuf[len] = '\0';
- port = htons(simple_strtoul(pbuf, &tmp, 10));
- len = tmp - pbuf;
- if (port == 0 || len > 5)
+ if (nf_ct_helper_parse_port(pbuf, len, &parsed_port, &tmp))
break;
+ port = htons(parsed_port);
+ len = tmp - pbuf;
exp = nf_ct_expect_alloc(ct);
if (exp == NULL) {
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v2 1/3] netfilter: conntrack: add shared port parser for helpers
From: HACKE-RC @ 2026-04-30 18:25 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal
Cc: Phil Sutter, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, HACKE-RC
In-Reply-To: <20260430182543.3931718-1-rc@rexion.ai>
Add nf_ct_helper_parse_port() to the conntrack helper core. This
provides a port parser that does not rely on nul-terminated strings,
taking an explicit length parameter and validating the result fits
in the 1-65535 range.
Modeled after the approach in 8cf6809cddcb ("netfilter:
nf_conntrack_sip: don't use simple_strtoul") but as a shared
function so IRC, Amanda, and other helpers can use it instead of
open-coding simple_strtoul calls with ad-hoc range checks.
Signed-off-by: HACKE-RC <rc@rexion.ai>
---
include/net/netfilter/nf_conntrack_helper.h | 3 +++
net/netfilter/nf_conntrack_helper.c | 28 +++++++++++++++++++++
2 files changed, 31 insertions(+)
diff --git a/include/net/netfilter/nf_conntrack_helper.h b/include/net/netfilter/nf_conntrack_helper.h
index de2f956ab..db19fe25f 100644
--- a/include/net/netfilter/nf_conntrack_helper.h
+++ b/include/net/netfilter/nf_conntrack_helper.h
@@ -160,6 +160,9 @@ nf_ct_helper_expectfn_find_by_name(const char *name);
struct nf_ct_helper_expectfn *
nf_ct_helper_expectfn_find_by_symbol(const void *symbol);
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+ u16 *port, char **endp);
+
extern struct hlist_head *nf_ct_helper_hash;
extern unsigned int nf_ct_helper_hsize;
diff --git a/net/netfilter/nf_conntrack_helper.c b/net/netfilter/nf_conntrack_helper.c
index a715304a5..12f51670d 100644
--- a/net/netfilter/nf_conntrack_helper.c
+++ b/net/netfilter/nf_conntrack_helper.c
@@ -499,6 +499,34 @@ void nf_nat_helper_unregister(struct nf_conntrack_nat_helper *nat)
}
EXPORT_SYMBOL_GPL(nf_nat_helper_unregister);
+int nf_ct_helper_parse_port(const char *cp, unsigned int len,
+ u16 *port, char **endp)
+{
+ unsigned long result = 0;
+ const char *start = cp;
+
+ while (len > 0 && *cp >= '0' && *cp <= '9') {
+ result = result * 10 + (*cp - '0');
+ if (result > 65535)
+ return -1;
+ cp++;
+ len--;
+ }
+
+ if (cp == start)
+ return -1;
+
+ if (result == 0)
+ return -1;
+
+ *port = result;
+ if (endp)
+ *endp = (char *)cp;
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(nf_ct_helper_parse_port);
+
int nf_conntrack_helper_init(void)
{
nf_ct_helper_hsize = 1; /* gets rounded up to use one page */
--
2.54.0
^ permalink raw reply related
* Re: [PATCH iproute2-next] tc: use ll_init_map() only when needed
From: Jamal Hadi Salim @ 2026-04-30 18:20 UTC (permalink / raw)
To: David Ahern
Cc: Eric Dumazet, Stephen Hemminger, David S . Miller, Jakub Kicinski,
Paolo Abeni, netdev, eric.dumazet
In-Reply-To: <18134b6e-8944-49f4-9bb0-2903aa00d28a@kernel.org>
On Thu, Apr 30, 2026 at 11:36 AM David Ahern <dsahern@kernel.org> wrote:
>
> Jamal: waiting for your review ...
>
> On 4/28/26 2:28 AM, Eric Dumazet wrote:
> > Some setups can have thousands of devices.
> >
> > ll_init_map() is rather expensive for them.
> >
> > Only call ll_init_map() in the following cases:
> >
> > 1) tc runs in batch mode.
> > 2) tc runs in monitor mode.
> > 3) tc dumps qdiscs/classes/filters for all netdev.
> >
> > This greatly reduces RTNL pressure on common operations.
> >
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
Acked-by: Jamal Hadi Salim <jhs@mojatatu.com>
cheers,
jamal
> > ---
> > tc/f_route.c | 1 -
> > tc/m_mirred.c | 2 --
> > tc/tc.c | 1 +
> > tc/tc_class.c | 6 ++----
> > tc/tc_filter.c | 32 ++++++++++++++++----------------
> > tc/tc_qdisc.c | 5 ++---
> > 6 files changed, 21 insertions(+), 26 deletions(-)
> >
> > diff --git a/tc/f_route.c b/tc/f_route.c
> > index 96b99b06be179c90dfb0d24d9577b5206dd98ef1..c234ddf0cb9309556844c85047d0f9ef53a2fd7b 100644
> > --- a/tc/f_route.c
> > +++ b/tc/f_route.c
> > @@ -76,7 +76,6 @@ static int route_parse_opt(const struct filter_util *qu, char *handle, int argc,
> > __u32 id;
> >
> > NEXT_ARG();
> > - ll_init_map(&rth);
> > if ((id = ll_name_to_index(*argv)) <= 0) {
> > fprintf(stderr, "Illegal \"fromif\"\n");
> > return -1;
> > diff --git a/tc/m_mirred.c b/tc/m_mirred.c
> > index f4da3c76284460d7f4bb73c7c3c172732f054632..e9ae5199432e828026f15ce226c5f5f84998c660 100644
> > --- a/tc/m_mirred.c
> > +++ b/tc/m_mirred.c
> > @@ -213,8 +213,6 @@ parse_direction(const struct action_util *a, int *argc_p, char ***argv_p,
> > if (d[0]) {
> > int idx;
> >
> > - ll_init_map(&rth);
> > -
> > idx = ll_name_to_index(d);
> > if (!idx)
> > return nodev(d);
> > diff --git a/tc/tc.c b/tc/tc.c
> > index 0fc658c881f0f553f1f1f8d87b46943d4d0eed8f..7d69e4d533a98b9c071cb954443a049a52252f2c 100644
> > --- a/tc/tc.c
> > +++ b/tc/tc.c
> > @@ -243,6 +243,7 @@ static int batch(const char *name)
> > return -1;
> > }
> >
> > + ll_init_map(&rth);
> > ret = do_batch(name, force, tc_batch_cmd, NULL);
> >
> > rtnl_close(&rth);
> > diff --git a/tc/tc_class.c b/tc/tc_class.c
> > index 6d707d8c924f4b5e90201d4de8e9779f82ce17f3..9aace019e6c8b96fb51edb4fe89bea5b7469beed 100644
> > --- a/tc/tc_class.c
> > +++ b/tc/tc_class.c
> > @@ -136,11 +136,11 @@ static int tc_class_modify(int cmd, unsigned int flags, int argc, char **argv)
> > }
> >
> > if (d[0]) {
> > - ll_init_map(&rth);
> > -
> > req.t.tcm_ifindex = ll_name_to_index(d);
> > if (!req.t.tcm_ifindex)
> > return -nodev(d);
> > + } else {
> > + ll_init_map(&rth);
> > }
> >
> > if (rtnl_talk(&rth, &req.n, NULL) < 0)
> > @@ -437,8 +437,6 @@ static int tc_class_list(int argc, char **argv)
> > argc--; argv++;
> > }
> >
> > - ll_init_map(&rth);
> > -
> > if (d[0]) {
> > t.tcm_ifindex = ll_name_to_index(d);
> > if (!t.tcm_ifindex)
> > diff --git a/tc/tc_filter.c b/tc/tc_filter.c
> > index 7db850bda11a3408ec66b457c9fc590f3a734f65..be70e360849e5058192640da0f061810a99e2ea8 100644
> > --- a/tc/tc_filter.c
> > +++ b/tc/tc_filter.c
> > @@ -188,16 +188,17 @@ static int tc_filter_modify(int cmd, unsigned int flags, int argc, char **argv)
> > addattr_l(&req.n, sizeof(req), TCA_KIND, k, strlen(k)+1);
> >
> > if (d[0]) {
> > - ll_init_map(&rth);
> > -
> > req.t.tcm_ifindex = ll_name_to_index(d);
> > if (req.t.tcm_ifindex == 0) {
> > fprintf(stderr, "Cannot find device \"%s\"\n", d);
> > return 1;
> > }
> > - } else if (block_index) {
> > - req.t.tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK;
> > - req.t.tcm_block_index = block_index;
> > + } else {
> > + ll_init_map(&rth);
> > + if (block_index) {
> > + req.t.tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK;
> > + req.t.tcm_block_index = block_index;
> > + }
> > }
> >
> > if (q) {
> > @@ -539,8 +540,6 @@ static int tc_filter_get(int cmd, unsigned int flags, int argc, char **argv)
> > }
> >
> > if (d[0]) {
> > - ll_init_map(&rth);
> > -
> > req.t.tcm_ifindex = ll_name_to_index(d);
> > if (!req.t.tcm_ifindex)
> > return -nodev(d);
> > @@ -704,21 +703,22 @@ static int tc_filter_list(int cmd, int argc, char **argv)
> >
> > req.t.tcm_info = TC_H_MAKE(prio<<16, protocol);
> >
> > - ll_init_map(&rth);
> > -
> > if (d[0]) {
> > req.t.tcm_ifindex = ll_name_to_index(d);
> > if (!req.t.tcm_ifindex)
> > return -nodev(d);
> > filter_ifindex = req.t.tcm_ifindex;
> > - } else if (block_index) {
> > - if (!tc_qdisc_block_exists(block_index)) {
> > - fprintf(stderr, "Cannot find block \"%u\"\n", block_index);
> > - return 1;
> > + } else {
> > + ll_init_map(&rth);
> > + if (block_index) {
> > + if (!tc_qdisc_block_exists(block_index)) {
> > + fprintf(stderr, "Cannot find block \"%u\"\n", block_index);
> > + return 1;
> > + }
> > + req.t.tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK;
> > + req.t.tcm_block_index = block_index;
> > + filter_block_index = block_index;
> > }
> > - req.t.tcm_ifindex = TCM_IFINDEX_MAGIC_BLOCK;
> > - req.t.tcm_block_index = block_index;
> > - filter_block_index = block_index;
> > }
> >
> > if (filter_chain_index_set)
> > diff --git a/tc/tc_qdisc.c b/tc/tc_qdisc.c
> > index 7eb9a31baa31fb91a8141c9eca1135e76a52fa8b..252ea861f249a5a71cf782389776e68c3e48c6cc 100644
> > --- a/tc/tc_qdisc.c
> > +++ b/tc/tc_qdisc.c
> > @@ -193,8 +193,6 @@ static int tc_qdisc_modify(int cmd, unsigned int flags, int argc, char **argv)
> > if (d[0]) {
> > int idx;
> >
> > - ll_init_map(&rth);
> > -
> > idx = ll_name_to_index(d);
> > if (!idx)
> > return -nodev(d);
> > @@ -411,13 +409,14 @@ static int tc_qdisc_list(int argc, char **argv)
> > argc--; argv++;
> > }
> >
> > - ll_init_map(&rth);
> >
> > if (d[0]) {
> > req.t.tcm_ifindex = ll_name_to_index(d);
> > if (!req.t.tcm_ifindex)
> > return -nodev(d);
> > filter_ifindex = req.t.tcm_ifindex;
> > + } else {
> > + ll_init_map(&rth);
> > }
> >
> > if (dump_invisible) {
>
^ permalink raw reply
* Re: [PATCH net 5/7] selftests: bpf: cover wrapped sk_msg ring chaining in ktls TX path
From: Jiayuan Chen @ 2026-04-30 17:58 UTC (permalink / raw)
To: Jakub Kicinski, davem
Cc: netdev, edumazet, pabeni, andrew+netdev, horms, bpf,
john.fastabend, sd, linux-kselftest, Jakub Kicinski, ast, daniel,
andrii, martin.lau, eddyz87, memxor, song, yonghong.song, jolsa,
shuah, isolodrai
In-Reply-To: <20260429222944.2139041-6-kuba@kernel.org>
2026年4月29日 15:29, "Jakub Kicinski" <kuba@kernel.org mailto:kuba@kernel.org?to=%22Jakub%20Kicinski%22%20%3Ckuba%40kernel.org%3E > wrote:
>
> Add a regression test for the off-by-one in tls_push_record() where
> the sg_chain() entry count was MAX_SKB_FRAGS instead of NR_MSG_FRAG_IDS,
> causing the chain pointer to overwrite a live ring slot when an sk_msg
> scatterlist ring wrapped (sg.end < sg.start).
>
> The new "tls tx wrapped sg chain" subtest:
> 1. attaches an SK_MSG program (prog_sk_policy_drop) that drops the first
> N bytes of a message via bpf_msg_apply_bytes() + SK_DROP,
> 2. splices 17 single-byte frags through a kTLS TX socket so the ring
> fills to sg.start=16, sg.end=17,
> 3. removes the socket from the sockmap and sends one more byte, which
> wraps sg.end to 0 and exercises the wrap branch in tls_push_record().
>
> Without the fix the kernel hangs on the wrapping send (the corrupted
> chain pointer leaves the sg traversal stuck); with the fix the test
> completes cleanly.
>
> Signed-off-by: Jakub Kicinski <kuba@kernel.org>
> ---
> CC: ast@kernel.org
> CC: daniel@iogearbox.net
> CC: andrii@kernel.org
> CC: martin.lau@linux.dev
> CC: eddyz87@gmail.com
> CC: memxor@gmail.com
> CC: song@kernel.org
> CC: yonghong.song@linux.dev
> CC: jolsa@kernel.org
> CC: shuah@kernel.org
> CC: john.fastabend@gmail.com
> CC: jiayuan.chen@linux.dev
> CC: isolodrai@meta.com
> CC: bpf@vger.kernel.org
> CC: linux-kselftest@vger.kernel.org
> ---
>
Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
^ permalink raw reply
* Re: [PATCH net-deletions] net: remove ISDN subsystem and Bluetooth CMTP
From: patchwork-bot+bluetooth @ 2026-04-30 17:55 UTC (permalink / raw)
To: Jakub Kicinski
Cc: davem, netdev, edumazet, pabeni, andrew+netdev, horms, corbet,
skhan, marcel, luiz.dentz, mchehab+huawei, jani.nikula, gregkh,
demarchi, rdunlap, justonli, ivecera, jonathan.cameron, kees,
marco.crivellari, ferr.lambarginio, nihaal, mingo, tglx, linmq006,
linux-doc, linux-bluetooth
In-Reply-To: <20260421022108.1299678-1-kuba@kernel.org>
Hello:
This patch was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 20 Apr 2026 19:21:07 -0700 you wrote:
> Remove the ISDN (mISDN, CAPI) subsystem and Bluetooth CMTP protocol
> from the kernel tree.
>
> ISDN is a pretty old technology and it's unclear whether anyone still
> uses it. I went over the last few years of git history and all the
> commits are either tree-wide conversions or syzbot/static analyzer
> fixes.
>
> [...]
Here is the summary with links:
- [net-deletions] net: remove ISDN subsystem and Bluetooth CMTP
https://git.kernel.org/bluetooth/bluetooth-next/c/4f10f1dfb235
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [GIT PULL] bluetooth-next 2026-04-13
From: patchwork-bot+bluetooth @ 2026-04-30 17:55 UTC (permalink / raw)
To: Luiz Augusto von Dentz; +Cc: davem, kuba, linux-bluetooth, netdev
In-Reply-To: <20260413132247.320961-1-luiz.dentz@gmail.com>
Hello:
This pull request was applied to bluetooth/bluetooth-next.git (master)
by Jakub Kicinski <kuba@kernel.org>:
On Mon, 13 Apr 2026 09:22:47 -0400 you wrote:
> The following changes since commit 42f9b4c6ef19e71d2c7d9bfd3c5037d4fe434ad7:
>
> tools: ynl: tests: fix leading space on Makefile target (2026-04-09 20:41:40 -0700)
>
> are available in the Git repository at:
>
> git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth-next.git tags/for-net-next-2026-04-13
>
> [...]
Here is the summary with links:
- [GIT,PULL] bluetooth-next 2026-04-13
https://git.kernel.org/bluetooth/bluetooth-next/c/e9dc62f25ba6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox