* Re: [PATCH net] octeontx2-af: fix CGX debugfs RVU AF PCI reference leaks
From: Jakub Kicinski @ 2026-06-21 21:44 UTC (permalink / raw)
To: Ratheesh Kannoth
Cc: davem, hkelam, lcherian, linux-kernel, netdev, pabeni, sgoutham,
andrew+netdev, edumazet, Yuho Choi
In-Reply-To: <20260617104525.1321395-1-rkannoth@marvell.com>
On Wed, 17 Jun 2026 16:15:25 +0530 Ratheesh Kannoth wrote:
> + {
> + struct rvu_cgx_lmac_dbgfs_ctx *ctx;
> +
> + ctx = devm_kzalloc(rvu->dev, sizeof(*ctx), GFP_KERNEL);
> + if (!ctx)
> + continue;
In addition to Simon's nit - please don't create floating code blocks,
just add the var decl at the start of the function.
--
pw-bot: cr
^ permalink raw reply
* Re: [net PATCH v3] octeontx2-af: Validate NIX maximum LFs correctly
From: Jakub Kicinski @ 2026-06-21 21:49 UTC (permalink / raw)
To: Subbaraya Sundeep
Cc: andrew+netdev, davem, edumazet, pabeni, sgoutham, gakula,
bbhushan2, rkannoth, netdev, linux-kernel
In-Reply-To: <1781710853-23420-1-git-send-email-sbhatta@marvell.com>
On Wed, 17 Jun 2026 21:10:53 +0530 Subbaraya Sundeep wrote:
> NIX maximum number of LFs can be set via devlink command
> but that can be done before assigning any LFs to a PF/VF.
> The condition used to check whether any LFs are assigned is
> incorrect. This patch fixes that condition.
Does not apply, please rebase & repost.
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net] octeontx2-af: npc: cn20k: fix NPC defrag
From: patchwork-bot+netdevbpf @ 2026-06-21 21:50 UTC (permalink / raw)
To: Ratheesh Kannoth
Cc: kuba, linux-kernel, netdev, andrew+netdev, davem, edumazet,
pabeni, sgoutham
In-Reply-To: <20260617102149.1309913-1-rkannoth@marvell.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 15:51:49 +0530 you wrote:
> npc_defrag_alloc_free_slots() always passed NPC_MCAM_KEY_X2 into
> __npc_subbank_alloc(), which must match sb->key_type, so defrag never
> allocated replacement slots on X4 banks. Pass the subbank key type for
> bank 0, and only extend the search into bank 1 for X2 (X4 MCAM indices
> are confined to b0b..b0t).
>
> Fixes: 645c6e3c1999 ("octeontx2-af: npc: cn20k: virtual index support")
> Signed-off-by: Ratheesh Kannoth <rkannoth@marvell.com>
>
> [...]
Here is the summary with links:
- [net] octeontx2-af: npc: cn20k: fix NPC defrag
https://git.kernel.org/netdev/net/c/48b67c0e8af6
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: "ip help" output is an error
From: Dmitri Seletski @ 2026-06-21 21:51 UTC (permalink / raw)
To: Stephen Hemminger; +Cc: netdev
In-Reply-To: <20260621082105.1196ef72@phoenix.local>
I never done C or github submit before, I hope I did it right way.
Regards
Dmitri Seletski
On 6/21/26 16:21, Stephen Hemminger wrote:
> On Sat, 20 Jun 2026 10:36:31 +0100
> Dmitri Seletski <drjoms@gmail.com> wrote:
>
>> Hello iproute2 maintainers,
>>
>> I am reporting an inconsistency regarding the exit status of the ip help
>> command.
>>
>> Current Behavior:
>> When running ip help, the command prints the help documentation to
>> stdout, but exits with a non-zero status (error). This causes issues in
>> shell scripts that rely on exit codes for control flow.
>>
>> Steps to reproduce:
>> bash
>>
>> # This returns "FAIL" because the exit code is non-zero
>> if ip help > /dev/null; then
>> echo "SUCCESS"
>> else
>> echo "FAIL"
>> fi
>>
>> Expected Behavior:
>> Since the command successfully performs the requested task (displaying
>> help information) and does not encounter a system error, it should
>> return an exit code of 0.
>>
>> Context:
>> This behavior breaks standard Bash logic for automation. For example:
>> ip help && echo "This will not execute"
>>
>> "ip help |grep br" - this will bring no result.
>>
>> Current version tested: iproute2-6.19.0
>>
>> Thank you for your time and for maintaining this tool.
>>
>> Regards,
>> Dmitri Seletski
>>
>>
> Yes iproute2 doesn't do a great job of handling error codes
> with usage vs help. Its a bug and no one has bothered to fix it.
^ permalink raw reply
* [PATCH iproute2-next] "ip help" wrong output, exit code.
From: Dmitri Seletski @ 2026-06-21 21:56 UTC (permalink / raw)
To: netdev
Changed output of "ip help" from standard error to standard output. And
Exit is now 0 instead of -1. "ip help|grep bridge" - now gives bridge
syntax instead of flooding user with everything from "ip help".
---
ip/ip.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/ip/ip.c b/ip/ip.c
index e4b71bde..4627b61c 100644
--- a/ip/ip.c
+++ b/ip/ip.c
@@ -56,7 +56,7 @@ static void usage(void) __attribute__((noreturn));
static void usage(void)
{
-fprintf(stderr,
+fprintf(stdout,
"Usage: ip [ OPTIONS ] OBJECT { COMMAND | help }\n"
" ip [ -force ] -batch filename\n"
"where OBJECT := { address | addrlabel | fou | help | ila | ioam | l2tp
| link |\n"
@@ -72,7 +72,7 @@ static void usage(void)
" -o[neline] | -t[imestamp] | -ts[hort] | -b[atch]
[filename] |\n"
" -rc[vbuf] [size] | -n[etns] name | -N[umeric] |
-a[ll] |\n"
" -c[olor]}\n");
-exit(-1);
+exit(0);
}
static int do_help(int argc, char **argv)
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net v2] amt: don't read the IP source address from a reallocated skb header
From: Jakub Kicinski @ 2026-06-21 22:00 UTC (permalink / raw)
To: Michael Bommarito
Cc: Taehee Yoo, David S . Miller, Paolo Abeni, Eric Dumazet,
Andrew Lunn, netdev, linux-kernel
In-Reply-To: <20260617123443.3586930-1-michael.bommarito@gmail.com>
On Wed, 17 Jun 2026 08:34:43 -0400 Michael Bommarito wrote:
> amt_update_handler() caches iph = ip_hdr(skb) and then calls
> pskb_may_pull(). pskb_may_pull() can reallocate the skb head: the new
> head is allocated and the old one is freed. The cached iph is not
> refreshed, so the following tunnel lookup reads iph->saddr from the
> freed head. On an AMT relay this lookup runs for every incoming
> membership update, before the update's nonce and response MAC are
> validated.
>
> The sibling handlers amt_multicast_data_handler() and
> amt_membership_query_handler() re-read ip_hdr() after the pull and are
> not affected; only amt_update_handler() keeps the pre-pull pointer.
Sashikos point out a bunch more of these in AMT:
https://sashiko.dev/#/patchset/20260617123443.3586930-1-michael.bommarito@gmail.com
https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260617123443.3586930-1-michael.bommarito@gmail.com
Let's fix them all with one patch?
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net 01/15] batman-adv: gw: don't deselect gateway with active hardif
From: patchwork-bot+netdevbpf @ 2026-06-21 22:00 UTC (permalink / raw)
To: Simon Wunderlich
Cc: netdev, davem, edumazet, kuba, pabeni, horms, b.a.t.m.a.n, sven,
stable, neocturne
In-Reply-To: <20260619070045.438101-2-sw@simonwunderlich.de>
Hello:
This series was applied to netdev/net.git (main)
by Sven Eckelmann <sven@narfation.org>:
On Fri, 19 Jun 2026 09:00:31 +0200 you wrote:
> From: Sven Eckelmann <sven@narfation.org>
>
> The batadv_hardif_cnt() was previously checking if there is an
> batadv_hard_iface->mesh_iface which is has the same mesh_iface. And since
> batadv_hardif_disable_interface() was resetting the
> batadv_hard_iface->mesh_iface after this check, it had to verify whether
> *1* interface was still part of the mesh_iface before it started the
> gateway deselection.
>
> [...]
Here is the summary with links:
- [net,01/15] batman-adv: gw: don't deselect gateway with active hardif
https://git.kernel.org/netdev/net/c/df97a7107b16
- [net,02/15] batman-adv: ensure bcast is writable before modifying TTL
https://git.kernel.org/netdev/net/c/4cd6d3a4b96a
- [net,03/15] batman-adv: fix (m|b)cast csum after decrementing TTL
https://git.kernel.org/netdev/net/c/e728bbdf3266
- [net,04/15] batman-adv: frag: ensure fragment is writable before modifying TTL
https://git.kernel.org/netdev/net/c/b7293c6e8c15
- [net,05/15] batman-adv: frag: avoid underflow of TTL
https://git.kernel.org/netdev/net/c/493d9d2528e1
- [net,06/15] batman-adv: v: prevent OGM aggregation on disabled hardif
https://git.kernel.org/netdev/net/c/d11c00b95b2a
- [net,07/15] batman-adv: tp_meter: restrict number of unacked list entries
https://git.kernel.org/netdev/net/c/e7c775110e18
- [net,08/15] batman-adv: tp_meter: annotate last_recv_time access with READ/WRITE_ONCE
https://git.kernel.org/netdev/net/c/d67c728f07fc
- [net,09/15] batman-adv: tp_meter: prevent parallel modifications of last_recv
https://git.kernel.org/netdev/net/c/6dde0cfcb36e
- [net,10/15] batman-adv: tp_meter: handle overlapping packets
https://git.kernel.org/netdev/net/c/cbde75c38b21
- [net,11/15] batman-adv: tt: don't merge change entries with different VIDs
https://git.kernel.org/netdev/net/c/f08e06c2d5c3
- [net,12/15] batman-adv: tt: track roam count per VID
https://git.kernel.org/netdev/net/c/12407d5f61c2
- [net,13/15] batman-adv: dat: prevent false sharing between VLANs
https://git.kernel.org/netdev/net/c/20d7658b7416
- [net,14/15] batman-adv: tvlv: enforce 2-byte alignment
https://git.kernel.org/netdev/net/c/32a679925552
- [net,15/15] batman-adv: tvlv: avoid race of cifsnotfound handler state
https://git.kernel.org/netdev/net/c/edb557b2ba38
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: pull-request: ieee802154-next 2026-06-20
From: patchwork-bot+netdevbpf @ 2026-06-21 22:00 UTC (permalink / raw)
To: Stefan Schmidt
Cc: davem, kuba, pabeni, linux-wpan, alex.aring, miquel.raynal,
netdev
In-Reply-To: <20260620174903.1010671-1-stefan@datenfreihafen.org>
Hello:
This pull request was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Sat, 20 Jun 2026 19:49:03 +0200 you wrote:
> Hello Dave, Jakub, Paolo.
>
> An overdue pull request for ieee802154, catching up on all the AI found issues
> at last.
>
> Shitalkumar Gandhi fixed problems in the ca8210 driver for cases where we could
> have a leak or a pointer truncation.
>
> [...]
Here is the summary with links:
- pull-request: ieee802154-next 2026-06-20
https://git.kernel.org/netdev/net/c/617fb6fa9c34
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [net PATCH v2] octeontx2-af: mcs: Fix unsupported secy stats read
From: patchwork-bot+netdevbpf @ 2026-06-21 22:01 UTC (permalink / raw)
To: Subbaraya Sundeep
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham, gakula,
bbhushan2, rkannoth, netdev, linux-kernel
In-Reply-To: <1781636420-19816-1-git-send-email-sbhatta@marvell.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 00:30:18 +0530 you wrote:
> From: Geetha sowjanya <gakula@marvell.com>
>
> Secy control stats counter doesn't exist for CNF10KB platform.
> Skip reading this respective register for CNF10KB silicon while
> fetching secy stats.
>
> Fixes: 9312150af8da ("octeontx2-af: cn10k: mcs: Support for stats collection")
> Signed-off-by: Geetha sowjanya <gakula@marvell.com>
> Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
>
> [...]
Here is the summary with links:
- [net,v2] octeontx2-af: mcs: Fix unsupported secy stats read
https://git.kernel.org/netdev/net/c/d4b7440f7316
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [net PATCH v2] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
From: patchwork-bot+netdevbpf @ 2026-06-21 22:01 UTC (permalink / raw)
To: Subbaraya Sundeep
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham, gakula,
bbhushan2, rkannoth, netdev, linux-kernel
In-Reply-To: <1781636420-19816-3-git-send-email-sbhatta@marvell.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 00:30:20 +0530 you wrote:
> From: Geetha sowjanya <gakula@marvell.com>
>
> On PF shutdown, the current driver free mcs hardware
> resources though mcs resources are not allocated to it.
> This patch checks the mcs resources status and if resources
> are allocated then only sends mailbox message to free them.
>
> [...]
Here is the summary with links:
- [net,v2] octeontx2-pf: mcs: Fix mcs resources free on PF shutdown
https://git.kernel.org/netdev/net/c/450d0e90b103
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH] octeontx2-pf: Clear stats of all resources when freeing resources
From: patchwork-bot+netdevbpf @ 2026-06-21 22:01 UTC (permalink / raw)
To: Subbaraya Sundeep
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, sgoutham, gakula,
bbhushan2, rkannoth, netdev, linux-kernel
In-Reply-To: <1781636420-19816-2-git-send-email-sbhatta@marvell.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 00:30:19 +0530 you wrote:
> When all MCS resources mapped to a PF are being freed then clear
> stats of all those resources too.
>
> Fixes: 815debbbf7b5 ("octeontx2-pf: mcs: Clear stats before freeing resource")
> Signed-off-by: Subbaraya Sundeep <sbhatta@marvell.com>
> ---
> drivers/net/ethernet/marvell/octeontx2/nic/cn10k_macsec.c | 1 +
> 1 file changed, 1 insertion(+)
Here is the summary with links:
- octeontx2-pf: Clear stats of all resources when freeing resources
https://git.kernel.org/netdev/net/c/fd4460721fb4
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2] net: add sock_open() with flags for socket creation
From: David Laight @ 2026-06-21 22:02 UTC (permalink / raw)
To: Andrew Lunn; +Cc: Alex Goltsev, davem, netdev, linux-kernel, Al Viro
In-Reply-To: <b057ea36-9810-40c1-9154-859eb9e0da5e@lunn.ch>
On Sun, 21 Jun 2026 15:59:30 +0200
Andrew Lunn <andrew@lunn.ch> wrote:
> On Sun, Jun 21, 2026 at 01:57:46PM +0100, David Laight wrote:
> > On Sun, 21 Jun 2026 14:05:40 +0300
> > Alex Goltsev <sasha.goltsev777@gmail.com> wrote:
> >
> > > From a9316957e594708dfb4258ad968fe88666c9b736 Mon Sep 17 00:00:00 2001
> > > From: 0-x-0-0 <sasha.goltsev777@gmail.com>
> > > Date: Sun, 21 Jun 2026 13:24:29 +0300
> > > Subject: [PATCH v2] net: add sock_open() with flags for socket creation
> >
> > A) There is no info here.
> > B) You've not said why this is of any use.
> > C) It isn't a bug fix so would go into net-next
> > D) net-next is closed.
>
> E) The patch has had all its whitespace corrupted.
F) Patch sent as a reply to version 1.
>
> Please "submit" the patch to yourself and ensure you can cleanly apply
> it.
>
> Andrew
>
^ permalink raw reply
* Re: [PATCH net-next v3] virtio-net: xsk: support tx wake up
From: Jakub Kicinski @ 2026-06-21 22:06 UTC (permalink / raw)
To: xuanzhuo
Cc: Menglong Dong, eperezma, mst, jasowang, andrew+netdev, davem,
edumazet, pabeni, netdev, virtualization, linux-kernel
In-Reply-To: <20260616115912.513183-1-dongml2@chinatelecom.cn>
On Tue, 16 Jun 2026 19:59:12 +0800 Menglong Dong wrote:
> For now, XDP_RING_NEED_WAKEUP is not supported properly by the virtio-net
> in the tx path for example: we set xsk_set_tx_need_wakeup() in
> virtnet_xsk_xmit(), but we didn't call xsk_clear_tx_need_wakeup()
> anywhere, which means the user will call send() for every packet.
>
> We call xsk_set_tx_need_wakeup() after virtnet_xsk_xmit_batch() if sq->vq
> is empty, as we can't be wakeup by the skb_xmit_done() in this case.
> Otherwise, we will clear the wakeup flag.
>
> Race condition is considered for tx path.
Seems to follow what mlx5 does so presumably this is fine but IDK if
there's anything virtio-specific that we need to be worried about.
Xuan Zhuo, please TAL?
--
mping: VIRTIO NET DRIVER
^ permalink raw reply
* Re: [PATCH net 0/2] octeontx2-af: Bug fixes for KPU profile and VF RX mode
From: Jakub Kicinski @ 2026-06-21 22:07 UTC (permalink / raw)
To: nshettyj
Cc: netdev, linux-kernel, sgoutham, lcherian, gakula, hkelam, sbhatta,
andrew+netdev, davem, edumazet, pabeni, Sunil.Goutham, naveenm,
hkalra
In-Reply-To: <20260619090746.1829416-1-nshettyj@marvell.com>
On Fri, 19 Jun 2026 14:37:44 +0530 nshettyj@marvell.com wrote:
> This patch series contains two standalone bug fixes for the Octeontx2
> administrative function (AF) driver targeting the net branch.
Does not apply, please rebase
--
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net] net/sched: act_ct: fix nf_connlabels leak on two error paths
From: patchwork-bot+netdevbpf @ 2026-06-21 22:10 UTC (permalink / raw)
To: Michael Bommarito
Cc: jhs, jiri, pablo, edumazet, kuba, pabeni, netdev, linux-kernel
In-Reply-To: <20260617215708.1115818-1-michael.bommarito@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 17:57:08 -0400 you wrote:
> tcf_ct_fill_params() calls nf_connlabels_get() (setting put_labels) when
> TCA_CT_LABELS is present, but two later error sites use a bare return
> instead of "goto err", skipping the err: nf_connlabels_put() cleanup.
> They also precede the "p->put_labels = put_labels" assignment, so the
> tcf_ct_params_free() fallback does not release the count either. Each
> failed RTM_NEWACTION on these paths leaks one nf_connlabels reference:
> net->ct.labels_used is incremented and never released. The action is
> reachable with CAP_NET_ADMIN over the netns, i.e. from an unprivileged
> user namespace on default-userns kernels.
>
> [...]
Here is the summary with links:
- [net] net/sched: act_ct: fix nf_connlabels leak on two error paths
https://git.kernel.org/netdev/net/c/16e088016f38
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCHv2] net: emac: Fix NULL pointer dereference in emac_probe
From: patchwork-bot+netdevbpf @ 2026-06-21 22:10 UTC (permalink / raw)
To: Rosen Penev
Cc: netdev, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-kernel
In-Reply-To: <20260618023405.415644-1-rosenp@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 19:34:05 -0700 you wrote:
> Move devm_request_irq() after devm_platform_ioremap_resource() so that
> dev->emacp is mapped before the interrupt handler can fire. An early
> interrupt hitting emac_irq() would dereference the NULL dev->emacp and
> crash.
>
> Also remove redundant error message. devm_platform_ioremap_resource()
> already returns an error message with dev_err_probe().
>
> [...]
Here is the summary with links:
- [PATCHv2] net: emac: Fix NULL pointer dereference in emac_probe
https://git.kernel.org/netdev/net/c/f623d38fe6c4
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] net: sit: require CAP_NET_ADMIN in the device netns for changelink
From: patchwork-bot+netdevbpf @ 2026-06-21 22:20 UTC (permalink / raw)
To: Maoyi Xie
Cc: davem, edumazet, kuba, pabeni, horms, kuniyu, shaw.leon,
nicolas.dichtel, kees, netdev, linux-kernel, stable
In-Reply-To: <20260618070817.3378283-1-maoyixie.tju@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 18 Jun 2026 15:08:17 +0800 you wrote:
> ipip6_changelink() operates on at most two netns, dev_net(dev) and the
> tunnel link netns t->net. They differ once the device is created in or
> moved to a netns other than the one the request runs in. The rtnl
> changelink path checks CAP_NET_ADMIN only against dev_net(dev), so a
> caller privileged there but not in t->net can rewrite a tunnel that
> lives in t->net.
>
> [...]
Here is the summary with links:
- [net] net: sit: require CAP_NET_ADMIN in the device netns for changelink
https://git.kernel.org/netdev/net/c/27ccb68e7ccc
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v3 1/2] net/sched: dualpi2: fix GSO backlog accounting
From: patchwork-bot+netdevbpf @ 2026-06-21 22:20 UTC (permalink / raw)
To: Xingquan Liu; +Cc: jhs, netdev, jiri, victor, chia-yu.chang, stable
In-Reply-To: <20260619151447.223640-1-b1n@b1n.io>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Fri, 19 Jun 2026 11:13:47 -0400 you wrote:
> When DualPI2 splits a GSO skb into N segments, it propagates N
> additional packets to its parent before returning NET_XMIT_SUCCESS.
> The parent then accounts for the original skb once more, leaving its
> qlen one larger than the number of packets actually queued.
>
> With QFQ as the parent, after all real packets are dequeued, QFQ still
> has a non-zero qlen while its in-service aggregate has no active
> classes. qfq_choose_next_agg() returns NULL and qfq_dequeue() passes
> the result to qfq_peek_skb(), causing a NULL pointer dereference.
>
> [...]
Here is the summary with links:
- [v3,1/2] net/sched: dualpi2: fix GSO backlog accounting
https://git.kernel.org/netdev/net/c/05ed733b65ab
- [v3,2/2] selftests/tc-testing: Add DualPI2 GSO backlog accounting test
https://git.kernel.org/netdev/net/c/54704b32b2ab
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] ipv6: ndisc: fix NULL deref in accept_untracked_na()
From: patchwork-bot+netdevbpf @ 2026-06-21 22:20 UTC (permalink / raw)
To: Weiming Shi
Cc: davem, dsahern, edumazet, kuba, pabeni, horms, netdev,
linux-kernel, xmei5
In-Reply-To: <20260617065512.2529757-2-bestswngs@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Wed, 17 Jun 2026 14:55:13 +0800 you wrote:
> accept_untracked_na() re-fetches the inet6_dev with __in6_dev_get(dev)
> and dereferences idev->cnf.accept_untracked_na without a NULL check,
> even though its only caller ndisc_recv_na() already fetched and
> NULL-checked idev for the same device.
>
> Both reads of dev->ip6_ptr run in the same RCU read-side critical
> section, but a concurrent addrconf_ifdown() can clear dev->ip6_ptr
> between them: lowering the MTU below IPV6_MIN_MTU calls addrconf_ifdown()
> without the synchronize_net() that orders the unregister path, so the
> re-fetch returns NULL and oopses:
>
> [...]
Here is the summary with links:
- [net] ipv6: ndisc: fix NULL deref in accept_untracked_na()
https://git.kernel.org/netdev/net/c/d186e942365a
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v5] net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
From: patchwork-bot+netdevbpf @ 2026-06-21 22:20 UTC (permalink / raw)
To: Wayen Yan
Cc: netdev, lorenzo, horms, pabeni, kuba, edumazet, andrew+netdev,
angelogioacchino.delregno, matthias.bgg, linux-arm-kernel,
linux-mediatek, joe
In-Reply-To: <178194366700.2485734.5368768965976693502@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Sat, 20 Jun 2026 16:17:44 +0800 you wrote:
> In airoha_dev_select_queue(), the expression:
>
> queue = (skb->priority - 1) % AIROHA_NUM_QOS_QUEUES;
>
> implicitly converts to unsigned arithmetic: when skb->priority is 0
> (the default for unclassified traffic), (0u - 1u) wraps to UINT_MAX,
> and UINT_MAX % 8 = 7, routing default best-effort packets to the
> highest-priority QoS queue. This causes QoS inversion where the
> majority of traffic on a PON gateway starves actual high-priority
> flows (VoIP, gaming, etc.).
>
> [...]
Here is the summary with links:
- [net,v5] net: airoha: Fix skb->priority underflow in airoha_dev_select_queue()
https://git.kernel.org/netdev/net/c/86e51aa24686
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net v4 0/2] ipv4/ipv6: account for fraggap on paged allocation paths
From: patchwork-bot+netdevbpf @ 2026-06-21 22:30 UTC (permalink / raw)
To: Wongi Lee
Cc: netdev, dsahern, idosch, davem, edumazet, kuba, pabeni, horms,
asml.silence, dhowells, willemb, jwlee2217
In-Reply-To: <ajFQn6yh43eDeQm9@DESKTOP-19IMU7U.localdomain>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 16 Jun 2026 22:33:19 +0900 you wrote:
> Fix fraggap accounting in the paged-allocation paths of IPv4 and IPv6.
>
> The IPv6 patch is the v4 update of the previously posted patch. The IPv4
> patch handles the same code pattern (by Ido).
>
> v3->v4
> - Remove the MSG_SPLICE_PAGES exception from the IPv6 negative copy check.
> - Clarify where the fraggap bytes are copied in the commit messages.
> - Add Reviewed-by tags.
>
> [...]
Here is the summary with links:
- [net,v4,1/2] ipv4: account for fraggap on the paged allocation path
https://git.kernel.org/netdev/net/c/eca856950f7c
- [net,v4,2/2] ipv6: account for fraggap on the paged allocation path
https://git.kernel.org/netdev/net/c/736b380e28d0
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] ipv6: ioam: fix type confusion of dst_entry
From: patchwork-bot+netdevbpf @ 2026-06-21 22:30 UTC (permalink / raw)
To: Jiayuan Chen
Cc: netdev, justin.iurman, davem, edumazet, kuba, pabeni, horms,
linux-kernel
In-Reply-To: <20260618104336.48934-1-jiayuan.chen@linux.dev>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 18 Jun 2026 18:43:35 +0800 you wrote:
> IOAM uses a dummy dst_entry(null_dst) to mark that the destination should
> not be changed after the transformation. This dst is stored in the IOAM lwt
> state and may be passed to dst_cache_set_ip6().
>
> However, the IPv6 dst cache path eventually calls rt6_get_cookie(), which
> treats the dst_entry as part of a struct rt6_info. Since the null_dst was
> embedded directly as a struct dst_entry in struct ioam6_lwt, this resulted
> in an invalid cast and rt6_get_cookie() reading fields from the wrong
> object.
>
> [...]
Here is the summary with links:
- [net] ipv6: ioam: fix type confusion of dst_entry
https://git.kernel.org/netdev/net/c/9ed19e11d214
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [RFC v2] Enabling CONFIG_NTP_PPS for NOHZ by adding ntp_error to system_time_snapshot
From: David Woodhouse @ 2026-06-21 22:30 UTC (permalink / raw)
To: Thomas Gleixner, John Stultz, Stephen Boyd, Miroslav Lichvar,
Richard Cochran, linux-kernel, netdev
Cc: Rodolfo Giometti, Alexander Gordeev
[-- Attachment #1: Type: text/plain, Size: 9763 bytes --]
Since the series at
https://lore.kernel.org/all/20260621220051.1030462-1-dwmw2@infradead.org/
we know *precisely* how much the xtime reported as CLOCK_REALTIME
differs from what the kernel *intends* to report (but doesn't, to
ensure smoothness and monotonicity).
Some consumers of time would be very much better off with the "correct"
time, not the sanitized version — especially in a tickless kernel,
where the sanitized version can diverge *far* further from the ideal.
I believe we should be able to enable PPS on tickless kernel, if we
just give it a way to know the *true* time — which is basically as
simple as reporting the existing known ntp_error (plus... details).
This RFC patch adds an 'ntp_error' field to the system_time_snapshot
and a snapshot_ntp_error() helper function to calculate it.
There's a temporary ptp_vmclock debug hack that prints the offset and
applies it to the returned timestamp, for validating the field against
the host vmclock reference under QEMU.
Without this patch, my vmclock reference test reports errors of ±15ns
on a tickless kernel. With the patch, those errors are corrected and
the results are clamped back to the ±1ns that I see with a periodic
tick.
Open question: *how* should this be exposed? It's all very well putting
it into ktime_get_snapshot_id() like this, and we could easily make an
argument that pps_get_ts() should just add it unconditionally, because
*not* doing so makes no sense.
But what about PTP? Should we just start 'correcting' the clock values
we report in ptp_read_system_p{ost,re}ts() too? It's strictly an ABI
change?
And what about userspace which wants to discipline the kernel's
timekeeping? Surely NTP dæmons running on a tickless kernel want *this*
time rather than the approximation that CLOCK_REALTIME will give them?
Could we add it to adjtimex? Do we want to make a new clockid e.g.
CLOCK_REALTIME_PRECISE for it (we'd need it for each of the AUX clocks
too...).
I can't see a perfect answer. I'm inclined to use it unconditionally in
PPS, and probably in PTP too?
Signed-off-by: David Woodhouse <dwmw@amazon.co.uk>
Assisted-by: Kiro:claude-opus-4.8
---
drivers/ptp/ptp_vmclock.c | 2 +
include/linux/timekeeper_internal.h | 6 +++
include/linux/timekeeping.h | 10 +++++
kernel/time/timekeeping.c | 67 ++++++++++++++++++++++++++++-
4 files changed, 83 insertions(+), 2 deletions(-)
diff --git a/drivers/ptp/ptp_vmclock.c b/drivers/ptp/ptp_vmclock.c
index c09ae06d7f68..37a9c8390055 100644
--- a/drivers/ptp/ptp_vmclock.c
+++ b/drivers/ptp/ptp_vmclock.c
@@ -140,7 +140,9 @@ static int vmclock_get_crosststamp(struct vmclock_state *st,
ptp_read_system_prets(sts);
if (sts->pre_sts.cs_id == st->cs_id) {
cycle = sts->pre_sts.cycles;
+ sts->pre_sts.systime += sts->pre_sts.ntp_error;
sts->post_sts = sts->pre_sts;
+ pr_info("vmclock pre error %lld\n", sts->pre_sts.ntp_error);
} else if (sts->pre_sts.hw_csid == st->cs_id &&
sts->pre_sts.hw_cycles) {
cycle = sts->pre_sts.hw_cycles;
diff --git a/include/linux/timekeeper_internal.h b/include/linux/timekeeper_internal.h
index 5dc7f8bf2740..b487e7d925fe 100644
--- a/include/linux/timekeeper_internal.h
+++ b/include/linux/timekeeper_internal.h
@@ -97,6 +97,11 @@ struct tk_read_base {
* @ntp_error_shift: Shift conversion between clock shifted nano seconds and
* ntp shifted nano seconds.
* @ntp_err_mult: Multiplication factor for scaled math conversion
+ * @ntp_err_frac: Fractional part of the per-cycle NTP-ideal mult that the
+ * integer @mult truncates, as a fraction of 2^32 in
+ * clock-shifted nanoseconds per cycle. Used to
+ * extrapolate @ntp_error to an arbitrary cycle count in
+ * the lockless snapshot readers (ktime_get_snapshot_id).
* @cs_tick_adj: Per-second adjustment handed to NTP via ntp_clear()
* accounting for the difference between the nominal
* NTP interval and the real time taken by the
@@ -187,6 +192,7 @@ struct timekeeper {
s64 ntp_error;
u32 ntp_error_shift;
u32 ntp_err_mult;
+ u64 ntp_err_frac;
s64 cs_tick_adj;
u32 skip_second_overflow;
s64 skew_delta;
diff --git a/include/linux/timekeeping.h b/include/linux/timekeeping.h
index 984a866d293b..6df32d5ead2d 100644
--- a/include/linux/timekeeping.h
+++ b/include/linux/timekeeping.h
@@ -283,6 +283,15 @@ static inline bool ktime_get_aux_ts64(clockid_t id, struct timespec64 *kt) { ret
* which @cycles was derived
* @systime: The system time of the selected CLOCK ID
* @monoraw: Monotonic raw system time
+ * @ntp_error: Signed nanosecond offset of @systime from the ideal
+ * NTP-disciplined time at @cycles. Extrapolated to @cycles
+ * (so it is exact even when many cycles have elapsed since the
+ * last timekeeping update, e.g. on a NO_HZ kernel) and includes
+ * the sub-nanosecond fraction dropped when @systime was
+ * truncated to whole ns. A consumer lands on the ideal line by
+ * adding @ntp_error directly to @systime. Zero for
+ * CLOCK_MONOTONIC_RAW; valid for all NTP-disciplined clock ids
+ * (CLOCK_REALTIME/MONOTONIC/BOOTTIME and the AUX clocks).
* @cs_id: Clocksource ID
* @hw_csid: Clocksource ID of the underlying hardware counter for derived
* clocksources which implement the read_snapshot() callback.
@@ -295,6 +304,7 @@ struct system_time_snapshot {
u64 hw_cycles;
ktime_t systime;
ktime_t monoraw;
+ s64 ntp_error;
enum clocksource_ids cs_id;
enum clocksource_ids hw_csid;
unsigned int clock_was_set_seq;
diff --git a/kernel/time/timekeeping.c b/kernel/time/timekeeping.c
index de07ef65da32..a2cb588b5be8 100644
--- a/kernel/time/timekeeping.c
+++ b/kernel/time/timekeeping.c
@@ -422,6 +422,7 @@ static void tk_setup_internals(struct timekeeper *tk, struct clocksource *clock)
tk->tkr_mono.mult = clock->mult;
tk->tkr_raw.mult = clock->mult;
tk->ntp_err_mult = 0;
+ tk->ntp_err_frac = 0;
tk->skip_second_overflow = 0;
tk->skew_delta = 0;
@@ -1226,6 +1227,54 @@ static inline u64 tk_clock_read_snapshot(const struct tk_read_base *tkr,
return clock->read(clock);
}
+/*
+ * snapshot_ntp_error - record how far a snapshot's ::systime is from the
+ * ideal NTP-disciplined time at @now, in signed nanoseconds, so a caller
+ * can land exactly on the ideal line by adding it to ::systime.
+ *
+ * The value is summed in ns << NTP_SCALE_SHIFT from four parts:
+ *
+ * - tk->ntp_error, the deviation accumulated as of the last timekeeping
+ * update (tkr_mono.cycle_last);
+ * - (cycle_delta * ntp_err_frac), the fractional-mult drift accrued over
+ * the cycles read since then -- at most a tick on a tickful kernel, but
+ * potentially many ticks' worth under NO_HZ;
+ * - (cycle_delta * ntp_err_mult), subtracting the applied +1 mult dither
+ * over the same span;
+ * - the sub-nanosecond fraction that ::systime dropped when the read was
+ * truncated to whole ns (the low @shift bits, exact even though the
+ * multiply overflows).
+ *
+ * CLOCK_MONOTONIC_RAW is not NTP-disciplined and carries no error. Every
+ * other clock id uses its own timekeeper @tk -- including the AUX clocks,
+ * which each have their own NTP instance.
+ */
+static void snapshot_ntp_error(struct system_time_snapshot *snap,
+ const struct timekeeper *tk, clockid_t clock_id,
+ u64 now)
+{
+ u64 cycle_delta;
+ u32 nes;
+ s64 tmp, err;
+
+ if (clock_id == CLOCK_MONOTONIC_RAW) {
+ snap->ntp_error = 0;
+ return;
+ }
+
+ cycle_delta = (now - tk->tkr_mono.cycle_last) & tk->tkr_mono.mask;
+ nes = tk->ntp_error_shift;
+
+ err = tk->ntp_error;
+ err += ((s64)mul_u64_u64_shr(cycle_delta, tk->ntp_err_frac, 32) -
+ (s64)(cycle_delta * tk->ntp_err_mult)) << nes;
+
+ tmp = (s64)(cycle_delta * tk->tkr_mono.mult + tk->tkr_mono.xtime_nsec);
+ tmp &= (1ULL << tk->tkr_mono.shift) - 1;
+ err += tmp << nes;
+
+ snap->ntp_error = (err + (1LL << (NTP_SCALE_SHIFT - 1))) >> NTP_SCALE_SHIFT;
+}
/**
* ktime_get_snapshot_id - Simultaneously snapshot a given clock ID with
@@ -1300,6 +1349,8 @@ void ktime_get_snapshot_id(clockid_t clock_id, struct system_time_snapshot *syst
nsec_sys = timekeeping_cycles_to_ns(&tk->tkr_mono, now);
nsec_raw = timekeeping_cycles_to_ns(&tk->tkr_raw, now);
+
+ snapshot_ntp_error(systime_snapshot, tk, clock_id, now);
} while (read_seqcount_retry(&tkd->seq, seq));
systime_snapshot->cycles = now;
@@ -2447,6 +2498,7 @@ static void timekeeping_adjust(struct timekeeper *tk, s64 offset)
{
u64 ntp_tl = ntp_tick_length(tk->id);
s64 skew = ntp_get_skew_delta(tk->id);
+ u64 dividend;
u32 mult;
/*
@@ -2467,8 +2519,19 @@ static void timekeeping_adjust(struct timekeeper *tk, s64 offset)
* scale it back up to the full per-tick rate for the mult bias.
*/
skew *= NTP_INTERVAL_FREQ;
- mult = div64_u64((tk->ntp_tick + skew) >> tk->ntp_error_shift,
- tk->cycle_interval);
+ dividend = (tk->ntp_tick + skew) >> tk->ntp_error_shift;
+ mult = div64_u64(dividend, tk->cycle_interval);
+ /*
+ * Stash the fractional part of the per-cycle ideal mult that
+ * the integer @mult discards, scaled by 2^32, in clock-shifted
+ * ns per cycle. The lockless snapshot readers use it to
+ * extrapolate @ntp_error forward over the cycles accumulated
+ * since the last tick (which on a NO_HZ kernel may be many
+ * ticks' worth).
+ */
+ tk->ntp_err_frac = div64_u64((dividend - (u64)mult *
+ tk->cycle_interval) << 32,
+ tk->cycle_interval);
}
/*
--
2.43.0
[-- Attachment #2: smime.p7s --]
[-- Type: application/pkcs7-signature, Size: 5069 bytes --]
^ permalink raw reply related
* Re: [PATCH net-next v3] virtio-net: xsk: support tx wake up
From: Michael S. Tsirkin @ 2026-06-21 22:31 UTC (permalink / raw)
To: Menglong Dong
Cc: xuanzhuo, eperezma, jasowang, andrew+netdev, davem, edumazet,
kuba, pabeni, netdev, virtualization, linux-kernel
In-Reply-To: <20260616115912.513183-1-dongml2@chinatelecom.cn>
On Tue, Jun 16, 2026 at 07:59:12PM +0800, Menglong Dong wrote:
> For now, XDP_RING_NEED_WAKEUP is not supported properly by the virtio-net
> in the tx path for example: we set xsk_set_tx_need_wakeup() in
> virtnet_xsk_xmit(), but we didn't call xsk_clear_tx_need_wakeup()
> anywhere, which means the user will call send() for every packet.
>
> We call xsk_set_tx_need_wakeup() after virtnet_xsk_xmit_batch() if sq->vq
> is empty, as we can't be wakeup by the skb_xmit_done() in this case.
> Otherwise, we will clear the wakeup flag.
>
> Race condition is considered for tx path.
>
> Fixes: 89f86675cb03 ("virtio_net: xsk: tx: support xmit xsk buffer")
> Signed-off-by: Menglong Dong <dongml2@chinatelecom.cn>
thanks for the patch! yes something to improve.
> ---
> v3:
> - remove the confusing comment
>
> v2:
> - add the Fixes tag
> ---
> drivers/net/virtio_net.c | 23 +++++++++++++++++++----
> 1 file changed, 19 insertions(+), 4 deletions(-)
>
> diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
> index f4adcfee7a80..6e099edef6e9 100644
> --- a/drivers/net/virtio_net.c
> +++ b/drivers/net/virtio_net.c
> @@ -1440,8 +1440,9 @@ static bool virtnet_xsk_xmit(struct send_queue *sq, struct xsk_buff_pool *pool,
> struct virtnet_info *vi = sq->vq->vdev->priv;
> struct virtnet_sq_free_stats stats = {};
> struct net_device *dev = vi->dev;
> + int sent, vring_size;
> + bool need_wakeup;
> u64 kicks = 0;
> - int sent;
>
> /* Avoid to wakeup napi meanless, so call __free_old_xmit instead of
> * free_old_xmit().
> @@ -1451,8 +1452,25 @@ static bool virtnet_xsk_xmit(struct send_queue *sq, struct xsk_buff_pool *pool,
> if (stats.xsk)
> xsk_tx_completed(sq->xsk_pool, stats.xsk);
>
> + vring_size = virtqueue_get_vring_size(sq->vq);
> + need_wakeup = xsk_uses_need_wakeup(pool);
> +
> + if (need_wakeup && vring_size == sq->vq->num_free)
> + xsk_set_tx_need_wakeup(pool);
> +
why are we doing this here?
the check after virtnet_xsk_xmit_batch not enough?
I vaguely think it's some kind of race we are closing?
Pls add a comment to explain.
> sent = virtnet_xsk_xmit_batch(sq, pool, budget, &kicks);
>
> + if (need_wakeup) {
> + if (vring_size == sq->vq->num_free)
> + /* we can't wake up by ourself, and it should be done
> + * by the user.
> + */
> + xsk_set_tx_need_wakeup(pool);
> + else
> + /* we can wake up from skb_xmit_done() */
> + xsk_clear_tx_need_wakeup(pool);
But what if we don't have get tx napi so no wakeup in skb_xmit_done?
> + }
> +
> if (!is_xdp_raw_buffer_queue(vi, sq - vi->sq))
> check_sq_full_and_disable(vi, vi->dev, sq);
>
> @@ -1470,9 +1488,6 @@ static bool virtnet_xsk_xmit(struct send_queue *sq, struct xsk_buff_pool *pool,
> u64_stats_add(&sq->stats.xdp_tx, sent);
> u64_stats_update_end(&sq->stats.syncp);
>
> - if (xsk_uses_need_wakeup(pool))
> - xsk_set_tx_need_wakeup(pool);
> -
> return sent;
> }
>
> --
> 2.54.0
^ permalink raw reply
* Re: [PATCH net v2 0/2] dpaa2-switch: reject VLAN uppers while bridged
From: patchwork-bot+netdevbpf @ 2026-06-21 22:40 UTC (permalink / raw)
To: Ioana Ciornei
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, f.fainelli,
vladimir.oltean, linux-kernel
In-Reply-To: <20260618092813.432535-1-ioana.ciornei@nxp.com>
Hello:
This series was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Thu, 18 Jun 2026 12:28:11 +0300 you wrote:
> The dpaa2-switch driver does not support VLAN uppers on its ports while
> they are bridged. The check which should have prevented a port with a
> VLAN upper to join bridge was poorly refactored and didn't actually
> return an error. Patch 2/2 fixes that.
>
> On the other hand, the driver didn't reject the addition of a VLAN upper
> while bridged. Patch 1/2 fixes that.
>
> [...]
Here is the summary with links:
- [net,v2,1/2] dpaa2-switch: do not accept VLAN uppers while bridged
https://git.kernel.org/netdev/net/c/d07d80b6a129
- [net,v2,2/2] dpaa2-switch: fix VLAN upper check not rejecting bridge join
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox