* Re: [PATCH net-next 11/17] net: dsa: mv88e6xxx: Move available stats into info structure
From: Luke Howard @ 2026-07-06 9:42 UTC (permalink / raw)
To: Jagielski, Jedrzej
Cc: Andrew Lunn, Vladimir Oltean, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Russell King,
Richard Cochran, Florian Fainelli, Cedric Jehasse, Max Holtmann,
Max Hunter, Tyrrell, Kieran, Ryan Wilkins, Mattias Forsblad,
netdev@vger.kernel.org, linux-kernel@vger.kernel.org
In-Reply-To: <PH0PR11MB5902B0E9FF059E56C5D6D32BF0F12@PH0PR11MB5902.namprd11.prod.outlook.com>
> Is everything fine with this patch?
> There's nothing beside adding checks to some of the functions
> (which is reverted in the upcoming patch) what does not
> seem to be corresponding to the commit msg
This (Marvell RMU) patch series has been deferred, I’ll note your comments and return to them once the other patch series I have submitted have been processed.
Cheers,
Luke
^ permalink raw reply
* [PATCH net] net: openvswitch: reject oversized nested action attrs
From: Asim Viladi Oglu Manizada @ 2026-07-06 9:44 UTC (permalink / raw)
To: netdev
Cc: dev, aconole, echaudro, i.maximets, davem, edumazet, kuba, pabeni,
horms, Asim Viladi Oglu Manizada, stable
Open vSwitch stores generated flow actions as nlattrs, whose nla_len
field is u16. Commit a1e64addf3ff ("net: openvswitch: remove
misbehaving actions length check") allowed the total sw_flow_actions
stream to grow beyond 64 KiB, which is valid, but also removed the last
guard preventing a generated nested action attribute from exceeding
U16_MAX.
An oversized generated container can thus be closed with a truncated
nla_len. A later dump or teardown then walks a structurally different
stream than the one that was validated. In particular, an oversized
nested CLONE/CT action may cause subsequent bytes in the generated
stream to be interpreted as independent actions.
Keep the larger total-action-stream behavior, but make nested action
close reject generated containers that do not fit in nla_len, and return
the error through all callers. For recursive SAMPLE, CLONE, DEC_TTL, and
CHECK_PKT_LEN builders, trim resource-owning action-list tails in reverse
construction order before discarding failed wrappers, so resources copied
into the rejected tails are released before the wrappers are removed.
Most failed outer wrappers are discarded by truncating actions_len after
child resources have been released. CHECK_PKT_LEN also trims its parent
after branch resources are gone. SET/TUNNEL close failures unwind their
known tun_dst ownership directly, and SET_TO_MASKED has no external
ownership and truncates on close failure.
Fixes: a1e64addf3ff ("net: openvswitch: remove misbehaving actions length check")
Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
---
net/openvswitch/flow_netlink.c | 201 +++++++++++++++++++++++++--------
1 file changed, 157 insertions(+), 44 deletions(-)
diff --git a/net/openvswitch/flow_netlink.c b/net/openvswitch/flow_netlink.c
index 13052408a132..d8079dee700e 100644
--- a/net/openvswitch/flow_netlink.c
+++ b/net/openvswitch/flow_netlink.c
@@ -2496,13 +2496,56 @@ static inline int add_nested_action_start(struct sw_flow_actions **sfa,
return used;
}
-static inline void add_nested_action_end(struct sw_flow_actions *sfa,
- int st_offset)
+static inline int add_nested_action_end(struct sw_flow_actions *sfa,
+ int st_offset)
{
- struct nlattr *a = (struct nlattr *) ((unsigned char *)sfa->actions +
- st_offset);
+ struct nlattr *a;
+ u32 attr_len;
+
+ if (WARN_ON_ONCE(st_offset < 0 ||
+ (u32)st_offset > sfa->actions_len))
+ return -EINVAL;
+
+ attr_len = sfa->actions_len - (u32)st_offset;
+ if (WARN_ON_ONCE(attr_len < NLA_HDRLEN))
+ return -EINVAL;
- a->nla_len = sfa->actions_len - st_offset;
+ if (attr_len > U16_MAX)
+ return -EMSGSIZE;
+
+ a = (struct nlattr *)((u8 *)sfa->actions + st_offset);
+ a->nla_len = attr_len;
+ return 0;
+}
+
+/* Free the generated action-list tail at @start and truncate it.
+ * If @nested, @start points to its containing nlattr header.
+ */
+static void ovs_nla_trim(struct sw_flow_actions *sfa, int start, bool nested)
+{
+ const struct nlattr *actions;
+ u32 len;
+
+ if (start < 0)
+ return;
+
+ if (WARN_ON_ONCE((u32)start > sfa->actions_len))
+ return;
+
+ actions = (const struct nlattr *)((u8 *)sfa->actions + start);
+ len = sfa->actions_len - (u32)start;
+
+ if (nested) {
+ if (len < NLA_HDRLEN)
+ goto out;
+
+ actions = (const struct nlattr *)((u8 *)actions + NLA_HDRLEN);
+ len -= NLA_HDRLEN;
+ }
+
+ ovs_nla_free_nested_actions(actions, len);
+out:
+ sfa->actions_len = start;
}
static int __ovs_nla_copy_actions(struct net *net, const struct nlattr *attr,
@@ -2522,6 +2565,7 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
const struct nlattr *attrs[OVS_SAMPLE_ATTR_MAX + 1];
const struct nlattr *probability, *actions;
const struct nlattr *a;
+ int actions_start;
int rem, start, err;
struct sample_arg arg;
@@ -2565,18 +2609,27 @@ static int validate_and_copy_sample(struct net *net, const struct nlattr *attr,
err = ovs_nla_add_action(sfa, OVS_SAMPLE_ATTR_ARG, &arg, sizeof(arg),
log);
if (err)
- return err;
+ goto err;
+ actions_start = (*sfa)->actions_len;
err = __ovs_nla_copy_actions(net, actions, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
- return err;
+ goto err_free;
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (err)
+ goto err_free;
return 0;
+
+err_free:
+ ovs_nla_trim(*sfa, actions_start, false);
+err:
+ (*sfa)->actions_len = start;
+ return err;
}
static int validate_and_copy_dec_ttl(struct net *net,
@@ -2624,18 +2677,31 @@ static int validate_and_copy_dec_ttl(struct net *net,
return start;
action_start = add_nested_action_start(sfa, OVS_DEC_TTL_ATTR_ACTION, log);
- if (action_start < 0)
- return action_start;
+ if (action_start < 0) {
+ err = action_start;
+ goto err;
+ }
err = __ovs_nla_copy_actions(net, actions, key, sfa, eth_type,
vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
- return err;
+ goto err_free;
+
+ err = add_nested_action_end(*sfa, action_start);
+ if (err)
+ goto err_free;
- add_nested_action_end(*sfa, action_start);
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (err)
+ goto err_free;
return 0;
+
+err_free:
+ ovs_nla_trim(*sfa, action_start, true);
+err:
+ (*sfa)->actions_len = start;
+ return err;
}
static int validate_and_copy_clone(struct net *net,
@@ -2646,6 +2712,7 @@ static int validate_and_copy_clone(struct net *net,
u32 mpls_label_count, bool log, bool last,
u32 depth)
{
+ int actions_start;
int start, err;
u32 exec;
@@ -2661,17 +2728,26 @@ static int validate_and_copy_clone(struct net *net,
err = ovs_nla_add_action(sfa, OVS_CLONE_ATTR_EXEC, &exec,
sizeof(exec), log);
if (err)
- return err;
+ goto err;
+ actions_start = (*sfa)->actions_len;
err = __ovs_nla_copy_actions(net, attr, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
- return err;
+ goto err_free;
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (err)
+ goto err_free;
return 0;
+
+err_free:
+ ovs_nla_trim(*sfa, actions_start, false);
+err:
+ (*sfa)->actions_len = start;
+ return err;
}
void ovs_match_init(struct sw_flow_match *match,
@@ -2763,20 +2839,20 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
tun_dst = metadata_dst_alloc(key.tun_opts_len, METADATA_IP_TUNNEL,
GFP_KERNEL);
- if (!tun_dst)
- return -ENOMEM;
+ if (!tun_dst) {
+ err = -ENOMEM;
+ goto err;
+ }
err = dst_cache_init(&tun_dst->u.tun_info.dst_cache, GFP_KERNEL);
- if (err) {
- dst_release((struct dst_entry *)tun_dst);
- return err;
- }
+ if (err)
+ goto err_free_tun_dst;
a = __add_action(sfa, OVS_KEY_ATTR_TUNNEL_INFO, NULL,
sizeof(*ovs_tun), log);
if (IS_ERR(a)) {
- dst_release((struct dst_entry *)tun_dst);
- return PTR_ERR(a);
+ err = PTR_ERR(a);
+ goto err_free_tun_dst;
}
ovs_tun = nla_data(a);
@@ -2797,8 +2873,16 @@ static int validate_and_copy_set_tun(const struct nlattr *attr,
ip_tunnel_info_opts_set(tun_info,
TUN_METADATA_OPTS(&key, key.tun_opts_len),
key.tun_opts_len, dst_opt_type);
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (WARN_ON_ONCE(err))
+ goto err_free_tun_dst;
+
+ return 0;
+err_free_tun_dst:
+ dst_release((struct dst_entry *)tun_dst);
+err:
+ (*sfa)->actions_len = start;
return err;
}
@@ -2971,7 +3055,7 @@ static int validate_set(const struct nlattr *a,
/* Convert non-masked non-tunnel set actions to masked set actions. */
if (!masked && key_type != OVS_KEY_ATTR_TUNNEL) {
- int start, len = key_len * 2;
+ int err, start, len = key_len * 2;
struct nlattr *at;
*skip_copy = true;
@@ -2983,8 +3067,11 @@ static int validate_set(const struct nlattr *a,
return start;
at = __add_action(sfa, key_type, NULL, len, log);
- if (IS_ERR(at))
- return PTR_ERR(at);
+ if (IS_ERR(at)) {
+ err = PTR_ERR(at);
+ (*sfa)->actions_len = start;
+ return err;
+ }
memcpy(nla_data(at), nla_data(ovs_key), key_len); /* Key. */
memset(nla_data(at) + key_len, 0xff, key_len); /* Mask. */
@@ -2994,7 +3081,11 @@ static int validate_set(const struct nlattr *a,
mask->ipv6_label &= htonl(0x000FFFFF);
}
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (WARN_ON_ONCE(err)) {
+ (*sfa)->actions_len = start;
+ return err;
+ }
}
return 0;
@@ -3040,7 +3131,8 @@ static int validate_and_copy_check_pkt_len(struct net *net,
const struct nlattr *acts_if_greater, *acts_if_lesser_eq;
struct nlattr *a[OVS_CHECK_PKT_LEN_ATTR_MAX + 1];
struct check_pkt_len_arg arg;
- int nested_acts_start;
+ int greater_acts_start = -1;
+ int lesser_acts_start = -1;
int start, err;
err = nla_parse_deprecated_strict(a, OVS_CHECK_PKT_LEN_ATTR_MAX,
@@ -3075,37 +3167,58 @@ static int validate_and_copy_check_pkt_len(struct net *net,
err = ovs_nla_add_action(sfa, OVS_CHECK_PKT_LEN_ATTR_ARG, &arg,
sizeof(arg), log);
if (err)
- return err;
+ goto err_free;
- nested_acts_start = add_nested_action_start(sfa,
- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL, log);
- if (nested_acts_start < 0)
- return nested_acts_start;
+ lesser_acts_start =
+ add_nested_action_start(sfa,
+ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_LESS_EQUAL,
+ log);
+ if (lesser_acts_start < 0) {
+ err = lesser_acts_start;
+ goto err_free;
+ }
err = __ovs_nla_copy_actions(net, acts_if_lesser_eq, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
- return err;
+ goto err_free;
- add_nested_action_end(*sfa, nested_acts_start);
+ err = add_nested_action_end(*sfa, lesser_acts_start);
+ if (err)
+ goto err_free;
- nested_acts_start = add_nested_action_start(sfa,
- OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER, log);
- if (nested_acts_start < 0)
- return nested_acts_start;
+ greater_acts_start =
+ add_nested_action_start(sfa,
+ OVS_CHECK_PKT_LEN_ATTR_ACTIONS_IF_GREATER,
+ log);
+ if (greater_acts_start < 0) {
+ err = greater_acts_start;
+ goto err_free;
+ }
err = __ovs_nla_copy_actions(net, acts_if_greater, key, sfa,
eth_type, vlan_tci, mpls_label_count, log,
depth + 1);
if (err)
- return err;
+ goto err_free;
+
+ err = add_nested_action_end(*sfa, greater_acts_start);
+ if (err)
+ goto err_free;
- add_nested_action_end(*sfa, nested_acts_start);
- add_nested_action_end(*sfa, start);
+ err = add_nested_action_end(*sfa, start);
+ if (err)
+ goto err_free;
return 0;
+
+err_free:
+ ovs_nla_trim(*sfa, greater_acts_start, true);
+ ovs_nla_trim(*sfa, lesser_acts_start, true);
+ ovs_nla_trim(*sfa, start, false);
+ return err;
}
static int validate_psample(const struct nlattr *attr)
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net-next] tun: no longer rely on RTNL in tun_fill_info()
From: Paolo Abeni @ 2026-07-06 9:45 UTC (permalink / raw)
To: Eric Dumazet, David S . Miller, Jakub Kicinski
Cc: Simon Horman, Kuniyuki Iwashima, Andrew Lunn, netdev,
eric.dumazet
In-Reply-To: <20260701125112.3652880-1-edumazet@google.com>
On 7/1/26 2:51 PM, Eric Dumazet wrote:
> Update tun_fill_info() to read device configuration fields (flags, owner,
> group, numqueues, numdisabled) locklessly using READ_ONCE().
>
> Annotate all writes to these fields in the control paths with WRITE_ONCE()
> to prevent data races, as these fields can be modified concurrently via
> ioctls (TUNSETPERSIST, TUNSETOWNER, TUNSETGROUP, TUNSETIFF) or queue
> attaching/detaching.
Sashiko-gemini notes that:
__tun_chr_ioctl() -> tun_vnet_ioctl
can still update tun->flags with no annotation for TUN_VNET_LE. I'm not
sure if a follow-up or a v2 is preferred.
/P
^ permalink raw reply
* [PATCH net v2] tun/tap & vhost-net: make qdisc backpressure opt-in via IFF_BACKPRESSURE
From: Simon Schippers @ 2026-07-06 9:42 UTC (permalink / raw)
To: Willem de Bruijn, Jason Wang, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Michael S . Tsirkin, netdev
Cc: Simon Horman, Jonathan Corbet, Shuah Khan, Andrew Lunn,
Tim Gebauer, Brett Sheffield, linux-doc, linux-kernel,
Simon Schippers
Commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop
when a qdisc is present") did not show a relevant performance regression
in my testing but on Brett Sheffield's librecast testbed it shows a
significant performance drop in a IPv6 multicast testcase. The regression
can be pinpointed when multiple iperf3 UDP threads are sending. For 8
threads the performance dropped from 13.5 Gbit/s to 9.13 Gbit/s. This is
the reason why this patch makes the qdisc backpressure behavior opt-in.
One option to accomplish the opt-in would be to set the default qdisc to
noqueue at init. However this may also break userspace as users might
have chosen a custom qdisc even though most of the qdiscs did nothing
for tun/tap in the past due to missing backpressure...
This is the reason why in this patch, the flag IFF_BACKPRESSURE is
introduced instead which is required to enable the backpressure logic.
This means the stopping logic in tun_net_xmit() and the waking logic in
__tun_wake_queue() are skipped if the flag is disabled.
To avoid a possible stall due to disabling IFF_BACKPRESSURE, the new
helper tun_force_wake_queue() is implemented. The helper safely wakes the
respective netdev queue and resets cons_cnt while the consumer_lock and
the producer_lock of the ring are held. The helper is run in tun_attach()
when a queue (re)attaches, in tun_set_iff() for attached tfiles, and
in tun_queue_resize().
The documentation in tuntap.rst is updated accordingly.
Fixes: 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop when a qdisc is present")
Reported-by: Brett Sheffield <brett@librecast.net>
Closes: https://lore.kernel.org/netdev/akVnoOYQOrt8k-Gu@karahi.librecast.net/T/#u
Signed-off-by: Simon Schippers <simon.schippers@tu-dortmund.de>
---
V1 -> V2:
- Sashiko: Ensure detached queues are woken on re-attach by calling the
new tun_force_wake_queue() helper from tun_attach(), and reuse it
across the existing wake paths.
- Specify the failing test case in the commit message.
---
Documentation/networking/tuntap.rst | 17 ++++++++++
drivers/net/tun.c | 49 ++++++++++++++++++-----------
include/uapi/linux/if_tun.h | 1 +
tools/include/uapi/linux/if_tun.h | 1 +
4 files changed, 50 insertions(+), 18 deletions(-)
diff --git a/Documentation/networking/tuntap.rst b/Documentation/networking/tuntap.rst
index 4d7087f727be..599264825dd2 100644
--- a/Documentation/networking/tuntap.rst
+++ b/Documentation/networking/tuntap.rst
@@ -206,6 +206,23 @@ enable is true we enable it, otherwise we disable it::
return ioctl(fd, TUNSETQUEUE, (void *)&ifr);
}
+3.4 qdisc backpressure
+----------------------
+
+Starting with Linux 7.2, IFF_BACKPRESSURE can be set to enable qdisc
+backpressure. Without it, TX drops occur when the internal ring buffer is
+full. With it, the kernel stops the TX queue instead, letting the qdisc
+hold packets. Drops only occur as a rare race. This can benefit protocols
+like TCP that react to drops. Backpressure requires a qdisc to be
+attached and has no effect with noqueue.
+
+The TUN/TAP ring buffer size can be reduced alongside this flag to
+further shift buffering into the qdisc and reduce bufferbloat, but comes
+at possible performance cost.
+
+When running multiple network streams in parallel, the flag may reduce
+performance due to the extra overhead of the backpressure mechanism.
+
Universal TUN/TAP device driver Frequently Asked Question
=========================================================
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ffbe6f13fb1f..62e5eab4e345 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -98,7 +98,8 @@ static void tun_default_link_ksettings(struct net_device *dev,
#define TUN_FASYNC IFF_ATTACH_QUEUE
#define TUN_FEATURES (IFF_NO_PI | IFF_ONE_QUEUE | IFF_VNET_HDR | \
- IFF_MULTI_QUEUE | IFF_NAPI | IFF_NAPI_FRAGS)
+ IFF_MULTI_QUEUE | IFF_NAPI | IFF_NAPI_FRAGS | \
+ IFF_BACKPRESSURE)
#define GOODCOPY_LEN 128
@@ -694,6 +695,20 @@ static void tun_detach_all(struct net_device *dev)
module_put(THIS_MODULE);
}
+static void tun_force_wake_queue(struct tun_struct *tun,
+ struct tun_file *tfile)
+{
+ /* Ensure that the producer can not stop the
+ * queue concurrently by taking locks.
+ */
+ spin_lock_bh(&tfile->tx_ring.consumer_lock);
+ spin_lock(&tfile->tx_ring.producer_lock);
+ netif_wake_subqueue(tun->dev, tfile->queue_index);
+ tfile->cons_cnt = 0;
+ spin_unlock(&tfile->tx_ring.producer_lock);
+ spin_unlock_bh(&tfile->tx_ring.consumer_lock);
+}
+
static int tun_attach(struct tun_struct *tun, struct file *file,
bool skip_filter, bool napi, bool napi_frags,
bool publish_tun)
@@ -737,11 +752,9 @@ static int tun_attach(struct tun_struct *tun, struct file *file,
goto out;
}
- spin_lock(&tfile->tx_ring.consumer_lock);
- tfile->cons_cnt = 0;
- spin_unlock(&tfile->tx_ring.consumer_lock);
tfile->queue_index = tun->numqueues;
tfile->socket.sk->sk_shutdown &= ~RCV_SHUTDOWN;
+ tun_force_wake_queue(tun, tfile);
if (tfile->detached) {
/* Re-attach detached tfile, updating XDP queue_index */
@@ -1077,7 +1090,8 @@ static netdev_tx_t tun_net_xmit(struct sk_buff *skb, struct net_device *dev)
spin_lock(&tfile->tx_ring.producer_lock);
ret = __ptr_ring_produce(&tfile->tx_ring, skb);
- if (!qdisc_txq_has_no_queue(queue) &&
+ if ((tun->flags & IFF_BACKPRESSURE) &&
+ !qdisc_txq_has_no_queue(queue) &&
__ptr_ring_check_produce(&tfile->tx_ring) == -ENOSPC) {
netif_tx_stop_queue(queue);
/* Paired with smp_mb() in __tun_wake_queue() */
@@ -2151,8 +2165,12 @@ static ssize_t tun_put_user(struct tun_struct *tun,
static void __tun_wake_queue(struct tun_struct *tun,
struct tun_file *tfile, int consumed)
{
- struct netdev_queue *txq = netdev_get_tx_queue(tun->dev,
- tfile->queue_index);
+ struct netdev_queue *txq;
+
+ if (!(tun->flags & IFF_BACKPRESSURE))
+ return;
+
+ txq = netdev_get_tx_queue(tun->dev, tfile->queue_index);
/* Paired with smp_mb__after_atomic() in tun_net_xmit() */
smp_mb();
@@ -2764,7 +2782,7 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
struct tun_struct *tun;
struct tun_file *tfile = file->private_data;
struct net_device *dev;
- int err;
+ int err, i;
if (tfile->detached)
return -EINVAL;
@@ -2894,7 +2912,8 @@ static int tun_set_iff(struct net *net, struct file *file, struct ifreq *ifr)
* xoff state.
*/
if (netif_running(tun->dev))
- netif_tx_wake_all_queues(tun->dev);
+ for (i = 0; i < tun->numqueues; i++)
+ tun_force_wake_queue(tun, rtnl_dereference(tun->tfiles[i]));
strscpy(ifr->ifr_name, tun->dev->name);
return 0;
@@ -3690,15 +3709,9 @@ static int tun_queue_resize(struct tun_struct *tun)
dev->tx_queue_len, GFP_KERNEL,
tun_ptr_free);
- if (!ret) {
- for (i = 0; i < tun->numqueues; i++) {
- tfile = rtnl_dereference(tun->tfiles[i]);
- spin_lock(&tfile->tx_ring.consumer_lock);
- netif_wake_subqueue(tun->dev, tfile->queue_index);
- tfile->cons_cnt = 0;
- spin_unlock(&tfile->tx_ring.consumer_lock);
- }
- }
+ if (!ret)
+ for (i = 0; i < tun->numqueues; i++)
+ tun_force_wake_queue(tun, rtnl_dereference(tun->tfiles[i]));
kfree(rings);
return ret;
diff --git a/include/uapi/linux/if_tun.h b/include/uapi/linux/if_tun.h
index 79d53c7a1ebd..73a77141315c 100644
--- a/include/uapi/linux/if_tun.h
+++ b/include/uapi/linux/if_tun.h
@@ -69,6 +69,7 @@
#define IFF_NAPI_FRAGS 0x0020
/* Used in TUNSETIFF to bring up tun/tap without carrier */
#define IFF_NO_CARRIER 0x0040
+#define IFF_BACKPRESSURE 0x0080
#define IFF_NO_PI 0x1000
/* This flag has no real effect */
#define IFF_ONE_QUEUE 0x2000
diff --git a/tools/include/uapi/linux/if_tun.h b/tools/include/uapi/linux/if_tun.h
index 2ec07de1d73b..97b670f5bc0a 100644
--- a/tools/include/uapi/linux/if_tun.h
+++ b/tools/include/uapi/linux/if_tun.h
@@ -67,6 +67,7 @@
#define IFF_TAP 0x0002
#define IFF_NAPI 0x0010
#define IFF_NAPI_FRAGS 0x0020
+#define IFF_BACKPRESSURE 0x0080
#define IFF_NO_PI 0x1000
/* This flag has no real effect */
#define IFF_ONE_QUEUE 0x2000
--
2.43.0
^ permalink raw reply related
* Re: [Intel-wired-lan] [PATCH iwl-net v1] idpf: fix lan_regs leak on core init failure
From: Marcin Szycik @ 2026-07-06 9:51 UTC (permalink / raw)
To: xuanqiang.luo, intel-wired-lan
Cc: netdev, linux-kernel, Tony Nguyen, Przemek Kitszel, Andrew Lunn,
Joshua Hay, Tatyana Nikolova, Xuanqiang Luo
In-Reply-To: <20260703104132.47419-1-xuanqiang.luo@linux.dev>
On 03/07/2026 12:41, xuanqiang.luo@linux.dev wrote:
> From: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
>
> idpf_vc_core_init() gets the LAN memory region layout before mapping the
> regions and allocating vport resources. Both layout paths allocate
> hw->lan_regs, but later error paths return without freeing it.
>
> idpf_vc_core_deinit() does not cover these paths because it returns unless
> IDPF_VC_CORE_INIT is set, and that bit is set only after core init
> succeeds.
>
> Free hw->lan_regs on the post-allocation error paths and clear the
> pointer and region count.
>
> Fixes: 6aa53e861c1a ("idpf: implement get LAN MMIO memory regions")
> Signed-off-by: Xuanqiang Luo <luoxuanqiang@kylinos.cn>
> ---
> drivers/net/ethernet/intel/idpf/idpf_virtchnl.c | 14 +++++++++++---
> 1 file changed, 11 insertions(+), 3 deletions(-)
>
> diff --git a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> index be66f9b2e101c..da49bb7b7e671 100644
> --- a/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> +++ b/drivers/net/ethernet/intel/idpf/idpf_virtchnl.c
> @@ -3479,6 +3479,7 @@ static int idpf_vport_params_buf_alloc(struct idpf_adapter *adapter)
> */
> int idpf_vc_core_init(struct idpf_adapter *adapter)
> {
> + struct idpf_hw *hw = &adapter->hw;
> int task_delay = 30;
> u16 num_max_vports;
> int err = 0;
> @@ -3550,15 +3551,18 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
> if (err) {
> dev_err(&adapter->pdev->dev, "Failed to map BAR0 region(s): %d\n",
> err);
> - return -ENOMEM;
> + err = -ENOMEM;
> + goto err_lan_regs;
> }
>
> pci_sriov_set_totalvfs(adapter->pdev, idpf_get_max_vfs(adapter));
> num_max_vports = idpf_get_max_vports(adapter);
> adapter->max_vports = num_max_vports;
> adapter->vports = kzalloc_objs(*adapter->vports, num_max_vports);
> - if (!adapter->vports)
> - return -ENOMEM;
> + if (!adapter->vports) {
> + err = -ENOMEM;
> + goto err_lan_regs;
> + }
>
> if (!adapter->netdevs) {
> adapter->netdevs = kzalloc_objs(struct net_device *,
> @@ -3624,6 +3628,10 @@ int idpf_vc_core_init(struct idpf_adapter *adapter)
> err_netdev_alloc:
> kfree(adapter->vports);
> adapter->vports = NULL;
> +err_lan_regs:
> + kfree(hw->lan_regs);
> + hw->lan_regs = NULL;
> + hw->num_lan_regs = 0;
> return err;
>
> init_failed:
Does this apply? struct idpf_hw was removed in 9f4334ac4a5a ("idpf: refactor
idpf to use libie control queues") [1].
[1] https://lore.kernel.org/intel-wired-lan/20260608144127.2751230-10-larysa.zaremba@intel.com/
Thanks,
Marcin
^ permalink raw reply
* Re: [PATCH net-next] amt: no longer rely on RTNL in amt_fill_info()
From: patchwork-bot+netdevbpf @ 2026-07-06 10:00 UTC (permalink / raw)
To: Eric Dumazet
Cc: davem, kuba, pabeni, horms, kuniyu, andrew+netdev, netdev,
eric.dumazet
In-Reply-To: <20260701125016.3650708-1-edumazet@google.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Wed, 1 Jul 2026 12:50:16 +0000 you wrote:
> Update amt_fill_info() to run under RCU read lock instead of RTNL.
>
> The AMT device configuration fields (mode, relay_port, gw_port, local_ip,
> discovery_ip, max_tunnels) and stream_dev pointer are initialized during
> device creation (amt_newlink) and are immutable. Accessing them locklessly
> is safe. The stream_dev net_device structure is protected from being freed
> by RCU.
>
> [...]
Here is the summary with links:
- [net-next] amt: no longer rely on RTNL in amt_fill_info()
https://git.kernel.org/netdev/net-next/c/586c4dcf28eb
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [Intel-wired-lan] [PATCH] ixgbe: validate E610 PFA TLV bounds
From: Marcin Szycik @ 2026-07-06 10:02 UTC (permalink / raw)
To: Pengpeng Hou, Tony Nguyen
Cc: Przemek Kitszel, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, intel-wired-lan, netdev,
linux-kernel
In-Reply-To: <20260706092500.79044-1-pengpeng@iscas.ac.cn>
On 06/07/2026 11:25, Pengpeng Hou wrote:
> ixgbe_get_pfa_module_tlv() walks E610 PFA TLV records stored in
> EEPROM.
>
> Stop parsing malformed TLVs whose header or declared value length would
> exceed the PFA boundary.
>
> Signed-off-by: Pengpeng Hou <pengpeng@iscas.ac.cn>
> ---
> drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 6 ++++++
> 1 file changed, 6 insertions(+)
>
> diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> index 4d8ae5b56145..03e88bdf5a43 100644
> --- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> +++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
> @@ -3895,6 +3895,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> while (next_tlv < pfa_end_ptr) {
> u16 tlv_sub_module_type, tlv_len;
>
> + if (pfa_end_ptr - next_tlv < 2)
> + break;
This check could go in the while condition above.
> +
> /* Read TLV type */
> err = ixgbe_read_ee_aci_e610(hw, next_tlv,
> &tlv_sub_module_type);
> @@ -3917,6 +3920,9 @@ static int ixgbe_get_pfa_module_tlv(struct ixgbe_hw *hw, u16 *module_tlv,
> /* Check next TLV, i.e. current TLV pointer + length + 2 words
> * (for current TLV's type and length).
> */
> + if (tlv_len > pfa_end_ptr - next_tlv - 2)
> + break;
> +
> next_tlv = next_tlv + tlv_len + 2;
Would be nice to define the magic number (2), since we're reusing it now.
> }
> /* Module does not exist */
Thanks,
Marcin
^ permalink raw reply
* Re: [PATCH net] qede: fix off-by-one in BD ring consumption on build_skb failure
From: Paolo Abeni @ 2026-07-06 10:02 UTC (permalink / raw)
To: Shigeru Yoshida, Jamie Bainbridge
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Matvey Kovalev, Pavel Zhigulin, netdev, linux-kernel
In-Reply-To: <875x2te8l3.fsf@redhat.com>
On 7/5/26 5:53 PM, Shigeru Yoshida wrote:
> Jamie Bainbridge <jamie.bainbridge@gmail.com> writes:
>
>> On Fri, 3 Jul 2026 at 09:52, Jamie Bainbridge
>> <jamie.bainbridge@gmail.com> wrote:
>>>
>>> On Wed, 1 Jul 2026 at 02:47, Shigeru Yoshida <syoshida@redhat.com> wrote:
>>>>
>>>> qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
>>>> NULL return from qede_build_skb(). When it returns NULL under memory
>>>> pressure, the functions still consume a BD from the ring before
>>>> returning NULL. The callers then recycle additional BDs, resulting in
>>>> one extra BD being consumed (off-by-one). This desynchronizes the BD
>>>> ring, which can corrupt DMA page reference counts and lead to SLUB
>>>> freelist corruption.
>>>
>>> Good catch.
>>>
>>> Reviewed-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
>>
>> Sorry for the double mail.
>>
>> I believe the Fixes: should be against the problematic original code:
>>
>> Fixes: 8a8633978b842 ("qede: Add build_skb() support.")
>>
>> because that is what you are fixing.
>
> Thank you for your review.
>
> The problematic code was introduced in commit 8a8633978b84 ("qede: Add
> build_skb() support."), so putting this in the Fixes tag would be
> correct.
>
> I'll send the v2 patch with the modified Fixes tag.
No need for a v2: I'll update the fixes tag while applying the patch.
The PW is already quite significant and I think it's currently better to
avoid repost if possible.
Thanks!
Paolo
^ permalink raw reply
* [PATCH iwl-next v2] ixgbe: E610: force phy link to get down when interface is down
From: Jedrzej Jagielski @ 2026-07-06 9:43 UTC (permalink / raw)
To: intel-wired-lan
Cc: anthony.l.nguyen, netdev, Jedrzej Jagielski, Aleksandr Loktionov
For the E610 family, similarly to the E8xx adapters, the default behavior
is for the PHY link to remain up even when the corresponding OS interface
is down.
Add function setting down the PHY config IXGBE_ACI_PHY_ENA_LINK bit
what leads to disabling PHY link.
Now ixgbe_close() needs to share some of the ixgbe_watchdog_link_is_down
code so move the common part into the separate function.
Align functionality with the implementation of the ice driver.
Let user to configure link-down-on-close enablement through ethtool.
Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Signed-off-by: Jedrzej Jagielski <jedrzej.jagielski@intel.com>
---
v2: apply Paul's notes
---
drivers/net/ethernet/intel/ixgbe/ixgbe.h | 1 +
drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c | 35 ++++++++++++++++++-
drivers/net/ethernet/intel/ixgbe/ixgbe_e610.h | 1 +
.../net/ethernet/intel/ixgbe/ixgbe_ethtool.c | 15 ++++++++
drivers/net/ethernet/intel/ixgbe/ixgbe_main.c | 27 +++++++++++---
5 files changed, 73 insertions(+), 6 deletions(-)
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe.h b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
index 30f62174acf2..7bbb82dd962c 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe.h
@@ -685,6 +685,7 @@ struct ixgbe_adapter {
#define IXGBE_FLAG2_MOD_POWER_UNSUPPORTED BIT(22)
#define IXGBE_FLAG2_API_MISMATCH BIT(23)
#define IXGBE_FLAG2_FW_ROLLBACK BIT(24)
+#define IXGBE_FLAG2_LINK_DOWN_ON_CLOSE BIT(25)
/* Tx fast path data */
int num_tx_queues;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
index 831cfe9a4697..02bc0dac5123 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.c
@@ -1923,6 +1923,33 @@ void ixgbe_fc_autoneg_e610(struct ixgbe_hw *hw)
hw->fc.current_mode = hw->fc.requested_mode;
}
+/**
+ * ixgbe_disable_phy_link - force phy link to get down
+ * @hw: pointer to hardware structure
+ *
+ * Send 0x0601 with the IXGBE_ACI_PHY_ENA_LINK bit set down.
+ *
+ * Return: the exit code of the operation.
+ */
+int ixgbe_disable_phy_link(struct ixgbe_hw *hw)
+{
+ struct ixgbe_aci_cmd_get_phy_caps_data pcaps = {};
+ struct ixgbe_aci_cmd_set_phy_cfg_data pcfg = {};
+ int err;
+
+ err = ixgbe_aci_get_phy_caps(hw, false, IXGBE_ACI_REPORT_ACTIVE_CFG,
+ &pcaps);
+ if (err)
+ return err;
+
+ ixgbe_copy_phy_caps_to_cfg(&pcaps, &pcfg);
+
+ pcfg.caps &= ~IXGBE_ACI_PHY_ENA_LINK;
+ pcfg.caps |= IXGBE_ACI_PHY_ENA_AUTO_LINK_UPDT;
+
+ return ixgbe_aci_set_phy_cfg(hw, &pcfg);
+}
+
/**
* ixgbe_disable_rx_e610 - Disable RX unit
* @hw: pointer to hardware structure
@@ -2207,6 +2234,7 @@ int ixgbe_setup_phy_link_e610(struct ixgbe_hw *hw)
u8 rmode = IXGBE_ACI_REPORT_TOPO_CAP_MEDIA;
u64 sup_phy_type_low, sup_phy_type_high;
u64 phy_type_low = 0, phy_type_high = 0;
+ bool force_on_required;
int err;
err = ixgbe_aci_get_link_info(hw, false, NULL);
@@ -2272,6 +2300,11 @@ int ixgbe_setup_phy_link_e610(struct ixgbe_hw *hw)
phy_type_high |= IXGBE_PHY_TYPE_HIGH_10G_USXGMII;
}
+ /* If IXGBE_ACI_PHY_ENA_LINK has been explicitly disabled that means
+ * we need to force PHY link UP state during PHY link setup
+ */
+ force_on_required = !(pcfg.caps & IXGBE_ACI_PHY_ENA_LINK);
+
/* Mask the set values to avoid requesting unsupported link types. */
phy_type_low &= sup_phy_type_low;
pcfg.phy_type_low = cpu_to_le64(phy_type_low);
@@ -2280,7 +2313,7 @@ int ixgbe_setup_phy_link_e610(struct ixgbe_hw *hw)
if (pcfg.phy_type_high != pcaps.phy_type_high ||
pcfg.phy_type_low != pcaps.phy_type_low ||
- pcfg.caps != pcaps.caps) {
+ pcfg.caps != pcaps.caps || force_on_required) {
pcfg.caps |= IXGBE_ACI_PHY_ENA_LINK;
pcfg.caps |= IXGBE_ACI_PHY_ENA_AUTO_LINK_UPDT;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.h b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.h
index 2cb76a3d30ae..59044d67ebeb 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.h
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_e610.h
@@ -50,6 +50,7 @@ int ixgbe_cfg_phy_fc(struct ixgbe_hw *hw,
enum ixgbe_fc_mode req_mode);
int ixgbe_setup_fc_e610(struct ixgbe_hw *hw);
void ixgbe_fc_autoneg_e610(struct ixgbe_hw *hw);
+int ixgbe_disable_phy_link(struct ixgbe_hw *hw);
void ixgbe_disable_rx_e610(struct ixgbe_hw *hw);
int ixgbe_init_phy_ops_e610(struct ixgbe_hw *hw);
int ixgbe_identify_phy_e610(struct ixgbe_hw *hw);
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
index b8e85bc91a27..16e26d54f3be 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_ethtool.c
@@ -139,6 +139,8 @@ static const char ixgbe_priv_flags_strings[][ETH_GSTRING_LEN] = {
"vf-ipsec",
#define IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF BIT(2)
"mdd-disable-vf",
+#define IXGBE_PRIV_LINK_DOWN_ON_CLOSE BIT(3)
+ "link-down-on-close",
};
#define IXGBE_PRIV_FLAGS_STR_LEN ARRAY_SIZE(ixgbe_priv_flags_strings)
@@ -3822,6 +3824,9 @@ static u32 ixgbe_get_priv_flags(struct net_device *netdev)
if (adapter->flags2 & IXGBE_FLAG2_AUTO_DISABLE_VF)
priv_flags |= IXGBE_PRIV_FLAGS_AUTO_DISABLE_VF;
+ if (adapter->flags2 & IXGBE_FLAG2_LINK_DOWN_ON_CLOSE)
+ priv_flags |= IXGBE_PRIV_LINK_DOWN_ON_CLOSE;
+
return priv_flags;
}
@@ -3859,6 +3864,16 @@ static int ixgbe_set_priv_flags(struct net_device *netdev, u32 priv_flags)
}
}
+ flags2 &= ~IXGBE_FLAG2_LINK_DOWN_ON_CLOSE;
+ if (priv_flags & IXGBE_PRIV_LINK_DOWN_ON_CLOSE) {
+ if (adapter->hw.mac.type == ixgbe_mac_e610) {
+ flags2 |= IXGBE_FLAG2_LINK_DOWN_ON_CLOSE;
+ } else {
+ e_info(probe, "Cannot set private flags: Feature supported only for E610 devices\n");
+ return -EOPNOTSUPP;
+ }
+ }
+
if (flags2 != adapter->flags2) {
adapter->flags2 = flags2;
diff --git a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
index 7a0783c1abc1..f650fa45b9ef 100644
--- a/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
+++ b/drivers/net/ethernet/intel/ixgbe/ixgbe_main.c
@@ -7551,6 +7551,17 @@ static void ixgbe_close_suspend(struct ixgbe_adapter *adapter)
ixgbe_free_all_rx_resources(adapter);
}
+static void ixgbe_handle_link_down(struct ixgbe_adapter *adapter)
+{
+ struct net_device *netdev = adapter->netdev;
+
+ if (test_bit(__IXGBE_PTP_RUNNING, &adapter->state))
+ ixgbe_ptp_start_cyclecounter(adapter);
+
+ e_info(drv, "NIC Link is Down\n");
+ netif_carrier_off(netdev);
+}
+
/**
* ixgbe_close - Disables a network interface
* @netdev: network interface device structure
@@ -7573,6 +7584,16 @@ int ixgbe_close(struct net_device *netdev)
ixgbe_fdir_filter_exit(adapter);
+ if (adapter->flags2 & IXGBE_FLAG2_LINK_DOWN_ON_CLOSE) {
+ int err;
+
+ err = ixgbe_disable_phy_link(&adapter->hw);
+ if (err)
+ e_error(drv, "Cannot set PHY link down\n");
+
+ ixgbe_handle_link_down(adapter);
+ }
+
ixgbe_release_hw_control(adapter);
return 0;
@@ -8251,11 +8272,7 @@ static void ixgbe_watchdog_link_is_down(struct ixgbe_adapter *adapter)
if (ixgbe_is_sfp(hw) && hw->mac.type == ixgbe_mac_82598EB)
adapter->flags2 |= IXGBE_FLAG2_SEARCH_FOR_SFP;
- if (test_bit(__IXGBE_PTP_RUNNING, &adapter->state))
- ixgbe_ptp_start_cyclecounter(adapter);
-
- e_info(drv, "NIC Link is Down\n");
- netif_carrier_off(netdev);
+ ixgbe_handle_link_down(adapter);
}
static bool ixgbe_ring_tx_pending(struct ixgbe_adapter *adapter)
--
2.31.1
^ permalink raw reply related
* [PATCH net-next] net: skbuff: use net_zcopy_get() instead of refcount_inc()
From: Yun Lu @ 2026-07-06 10:02 UTC (permalink / raw)
To: davem, edumazet, kuba, pabeni, horms, kerneljasonxing, kuniyu
Cc: mhal, bjorn, jiayuan.chen, netdev
From: Yun Lu <luyun@kylinos.cn>
The net_zcopy_get() increments the uarg->refcnt, which is called both
in pskb_carve_inside_header() and pskb_carve_inside_nonlinear().
Also use net_zcopy_get() in pskb_expand_head for code consistency.
No functional change intended.
Signed-off-by: Yun Lu <luyun@kylinos.cn>
---
net/core/skbuff.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18dabb4e9cfa..bcf3b2c65fb9 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2326,7 +2326,7 @@ int pskb_expand_head(struct sk_buff *skb, int nhead, int ntail,
if (skb_orphan_frags(skb, gfp_mask))
goto nofrags;
if (skb_zcopy(skb))
- refcount_inc(&skb_uarg(skb)->refcnt);
+ net_zcopy_get(skb_zcopy(skb));
for (i = 0; i < skb_shinfo(skb)->nr_frags; i++)
skb_frag_ref(skb, i);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v2 2/2] bonding: reuse neigh_setup from slave neigh_parms
From: Paritosh Potukuchi @ 2026-07-06 10:07 UTC (permalink / raw)
To: Kuniyuki Iwashima
Cc: netdev, linux-kernel, kuba, edumazet, andrew+netdev, jv, davem,
pabeni, paritosh.potukuchi
In-Reply-To: <CAAVpQUChEhWDxVPXOOQQcPMBLNocCACKNiX6AZwy5O-3+wgbtw@mail.gmail.com>
Hi Kuniyuki,
>The real user is qeth_l3_main.c only and it's not compiled
>on 99% host.
>We usually bail out at if (!slave_ops->ndo_neigh_setup),
>which is called after your neigh_parms_lookup_dev(), and
>there is no need to do O(n) traversal.
>With 2K netns, it could incur unnecessary 4K traversal (lo
>+ another dev) for each neigh creation, which is done under
>RTNL or from interrupt context.
>So, it will be a problem.
That makes sense. Thanks for the insight.
>It does not help. Just populating fields does not change the
>loop detection logic.
True. Just populating fields would not suffice. Do you think
it would a good solution to modify the ndo_neigh_setup
function?
Currently it takes a (netdev, parms) pair as an argument.
The way the ndo_neigh_setup is being used , both in stacked/
virtual devices and slave devices, is to expose the underlying
netdev's local neigh_setup function, through the parms argument.
There is a TODO in the bond_main.c file that suggests the
following:
/* TODO: find another way [1] to implement this.
* Passing a zeroed structure is fragile,
* but at least we do not pass garbage.
*
* [1] One way would be that ndo_neigh_setup() never touch
* struct neigh_parms, but propagate the new neigh_setup()
* back to ___neigh_create() / neigh_parms_alloc()
*/
As the TODO suggests, would it be a good idea to modify the
ndo_neigh_setup function to be able to return the netdev's
local neigh_setup function.
This would solve the problem of passing a dummy parms structure.
typedef int (*neigh_setup_fn_t)(struct neighbour *);
static neigh_setup_fn_t ndo_neigh_setup(struct net_device *dev)
{
return qeth_l3_neigh_setup_noarp;
}
Though the problem with this approach is that ndo_neigh_setup
loses the flexibility to modify other fields in the parms
structure.
What is your opinion on this?
^ permalink raw reply
* Re: [PATCH net] qede: fix off-by-one in BD ring consumption on build_skb failure
From: patchwork-bot+netdevbpf @ 2026-07-06 10:10 UTC (permalink / raw)
To: Shigeru Yoshida
Cc: andrew+netdev, davem, edumazet, kuba, pabeni, matvey.kovalev,
Pavel.Zhigulin, jamie.bainbridge, netdev, linux-kernel
In-Reply-To: <20260630164623.3152625-1-syoshida@redhat.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Wed, 1 Jul 2026 01:46:20 +0900 you wrote:
> qede_rx_build_skb() and qede_tpa_rx_build_skb() do not check for a
> NULL return from qede_build_skb(). When it returns NULL under memory
> pressure, the functions still consume a BD from the ring before
> returning NULL. The callers then recycle additional BDs, resulting in
> one extra BD being consumed (off-by-one). This desynchronizes the BD
> ring, which can corrupt DMA page reference counts and lead to SLUB
> freelist corruption.
>
> [...]
Here is the summary with links:
- [net] qede: fix off-by-one in BD ring consumption on build_skb failure
https://git.kernel.org/netdev/net/c/a0a558ca7e75
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] net:ethernet: mtk_wed: setup WDMA_RING_TX(0) for non-DBDC MT7986
From: Paolo Abeni @ 2026-07-06 10:10 UTC (permalink / raw)
To: hujy652; +Cc: lorenzo, nbd, netdev, linux-mediatek
In-Reply-To: <20260630144831.1109-1-hujy652@gmail.com>
From: AI Reviewer <ai@example.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://sashiko.dev/
---
net:ethernet: mtk_wed: setup WDMA_RING_TX(0) for non-DBDC MT7986
This commit updates mtk_wed_start() to configure WDMA_RING_TX(0) on
non-DBDC MT7986 devices. It adds a call to mtk_wed_wdma_tx_ring_setup()
for v2 hardware if the descriptor is not yet set up.
> diff --git a/drivers/net/ethernet/mediatek/mtk_wed.c b/drivers/net/ethernet/mediatek/mtk_wed.c
> index 10d9beaae3721..2420557f6c966 100644
> --- a/drivers/net/ethernet/mediatek/mtk_wed.c
> +++ b/drivers/net/ethernet/mediatek/mtk_wed.c
> @@ -2334,6 +2334,10 @@ mtk_wed_start(struct mtk_wed_device *dev, u32 irq_mask)
> if (!dev->rx_wdma[i].desc)
> mtk_wed_wdma_rx_ring_setup(dev, i, 16, false);
[Severity: High]
This isn't a bug introduced by this patch, but does this loop need to check
the return value of mtk_wed_wdma_rx_ring_setup()?
If mtk_wed_wdma_rx_ring_setup() returns -ENOMEM, the hardware registers are
not programmed, but mtk_wed_start() continues execution and enables DMA.
Could this lead to hardware DMA using an uninitialized ring base address?
>
> + if (mtk_wed_is_v2(dev->hw))
> + if (!dev->tx_wdma[0].desc)
> + mtk_wed_wdma_tx_ring_setup(dev, 0, MTK_WED_WDMA_RING_SIZE, false);
[Severity: High]
Are there similar error handling concerns with this new call to
mtk_wed_wdma_tx_ring_setup()?
Like the RX path, if dma_alloc_coherent() fails inside this setup function,
it returns -ENOMEM without programming the hardware registers.
Since mtk_wed_start() doesn't check this return value, it will proceed to
enable hardware DMA, which might attempt to use an uninitialized DMA address.
[Severity: High]
Does the check for !dev->tx_wdma[0].desc prevent necessary hardware
initialization after a warm reset?
When the WLAN driver triggers a hardware reset, the WED hardware registers
are cleared, and mtk_wed_start() is called again.
Because dev->tx_wdma[0].desc was allocated during the initial start, the
guard will evaluate to false, skipping the hardware register reprogramming
for tx_wdma[0].
Will the hardware DMA end up using a zeroed ring base address after a reset?
> +
> if (dev->wlan.hw_rro) {
> for (i = 0; i < MTK_WED_RX_PAGE_QUEUES; i++) {
> u32 addr = MTK_WED_RRO_MSDU_PG_CTRL0(i) +
--
This is an AI-generated review.
^ permalink raw reply
* Re: [PATCH net v2] tun/tap & vhost-net: make qdisc backpressure opt-in via IFF_BACKPRESSURE
From: Brett A C Sheffield @ 2026-07-06 10:11 UTC (permalink / raw)
To: Simon Schippers
Cc: Willem de Bruijn, Jason Wang, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Michael S . Tsirkin, netdev,
Simon Horman, Jonathan Corbet, Shuah Khan, Andrew Lunn,
Tim Gebauer, linux-doc, linux-kernel
In-Reply-To: <20260706094242.115992-1-simon.schippers@tu-dortmund.de>
On 2026-07-06 11:42, Simon Schippers wrote:
> Commit 1d6e569b7d0c ("tun/tap & vhost-net: avoid ptr_ring tail-drop
> when a qdisc is present") did not show a relevant performance regression
> in my testing but on Brett Sheffield's librecast testbed it shows a
> significant performance drop in a IPv6 multicast testcase. The regression
> can be pinpointed when multiple iperf3 UDP threads are sending. For 8
> threads the performance dropped from 13.5 Gbit/s to 9.13 Gbit/s. This is
> the reason why this patch makes the qdisc backpressure behavior opt-in.
Your v1 commit message was correct. The iperf3 tests were TCP, not UDP.
The original failing test that alerted me to the problem was IPv6 multicast
(UDP), but the reproducer tests I provided stats for in the regression report
were TCP "To eliminate my code and any multicast weirdness" and also to verify
that this also affected TCP.
Sorry for the confusion. The command lines used are in the regression report.
I've tested the v2 patch (with IPv6 multicast), and verified the
previously failing test passes.
Tested-by: Brett A C Sheffield <bacs@librecast.net>
Cheers,
Brett
--
Brett Sheffield (he/him)
Librecast - Decentralising the Internet with Multicast
https://librecast.net/
https://blog.brettsheffield.com/
^ permalink raw reply
* Re: [PATCH bpf-next 3/6] selftests/bpf: Add ksock kfunc test
From: bot+bpf-ci @ 2026-07-06 10:16 UTC (permalink / raw)
To: mahe.tardy, bpf
Cc: andrew+netdev, andrii, ast, daniel, davem, eddyz87, edumazet,
john.fastabend, kuba, liamwisehart, martin.lau, pabeni, song,
netdev, mahe.tardy, ast, andrii, daniel, martin.lau, eddyz87,
yonghong.song, clm, ihor.solodrai
In-Reply-To: <20260706093525.13030-4-mahe.tardy@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 976 bytes --]
> Add a selftest that exercises the ksock kfuncs end-to-end. One sycall
> bpf setup program creates a ksock context and connect the socket.
> Another syscall bpf program lookup the context and send test data.
> The userspace harness create a network namespace and a new socket on
> loopback, run the setup and send syscall bpf progs then check that the
> userspace socket received the data from bpf.
This isn't a bug, but would a quick pass over the changelog wording help
here? A few spots read a little off:
"One sycall" -> "One syscall"
"creates a ksock context and connect the socket" -> connects
"Another syscall bpf program lookup the context" -> looks up
"The userspace harness create a network namespace" -> creates
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28783010022
^ permalink raw reply
* [PATCH nf v2 2/3] ipvs: use parsed transport offset in TCP state lookup
From: Yizhou Zhao @ 2026-07-06 10:16 UTC (permalink / raw)
To: netdev
Cc: coreteam, davem, edumazet, fengxw06, fw, horms, ja, kuba,
linux-kernel, lvs-devel, netfilter-devel, pabeni, pablo, phil,
qli01, stable, wangao, xuke, yangyx22, Yizhou Zhao
In-Reply-To: <20260706101624.69471-1-zhaoyz24@mails.tsinghua.edu.cn>
TCP state handling reparses the skb to find the TCP header. For IPv6 it
uses sizeof(struct ipv6hdr), while the surrounding IPVS code already
parsed the packet with ip_vs_fill_iph_skb() and has the real
transport-header offset in iph.len.
This makes TCP state handling look at the wrong bytes when an IPv6
packet carries extension headers. Use the parsed transport offset passed
down from ip_vs_set_state() when reading the TCP header.
For IPv4 and for IPv6 packets without extension headers, the passed
offset matches the previous value.
Fixes: 0bbdd42b7efa6 ("IPVS: Extend protocol DNAT/SNAT and state handlers")
Link: https://lore.kernel.org/netdev/20260705125659.37744-1-zhaoyz24@mails.tsinghua.edu.cn/
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
net/netfilter/ipvs/ip_vs_proto_tcp.c | 8 +-------
1 file changed, 1 insertion(+), 7 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 2d3f6aeafe52..f86b763efcc4 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -584,13 +584,7 @@ tcp_state_transition(struct ip_vs_conn *cp, int direction,
{
struct tcphdr _tcph, *th;
-#ifdef CONFIG_IP_VS_IPV6
- int ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
-#else
- int ihl = ip_hdrlen(skb);
-#endif
-
- th = skb_header_pointer(skb, ihl, sizeof(_tcph), &_tcph);
+ th = skb_header_pointer(skb, iph_len, sizeof(_tcph), &_tcph);
if (th == NULL)
return;
--
2.34.1
^ permalink raw reply related
* [PATCH nf v2 0/3] ipvs: use parsed transport offsets in state handlers
From: Yizhou Zhao @ 2026-07-06 10:16 UTC (permalink / raw)
To: netdev
Cc: coreteam, davem, edumazet, fengxw06, fw, horms, ja, kuba,
linux-kernel, lvs-devel, netfilter-devel, pabeni, pablo, phil,
qli01, stable, wangao, xuke, yangyx22, Yizhou Zhao
IPVS parses packets into struct ip_vs_iphdr before scheduling and state
handling. For IPv6, iph.len contains the real transport-header offset
after ipv6_find_hdr() has skipped any extension headers.
TCP and SCTP state handlers still recompute their own transport offsets.
They use sizeof(struct ipv6hdr) for IPv6, so packets with extension
headers make the state machines read the wrong bytes.
Pass the parsed transport offset through the common IPVS state handling
callback, then use it in the TCP and SCTP state lookups.
Changes in v2:
- Pass the parsed transport offset through ip_vs_set_state() and the
protocol callbacks.
- Fix TCP state handling as well as SCTP.
- Avoid reparsing the skb in SCTP state handling.
- Split the common plumbing, TCP fix and SCTP fix into a 3-patch series.
Yizhou Zhao (3):
ipvs: pass parsed transport offset to state handlers
ipvs: use parsed transport offset in TCP state lookup
ipvs: use parsed transport offset in SCTP state lookup
include/net/ip_vs.h | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 10 +++++-----
net/netfilter/ipvs/ip_vs_proto_sctp.c | 18 +++++++-----------
net/netfilter/ipvs/ip_vs_proto_tcp.c | 11 +++--------
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 ++-
5 files changed, 19 insertions(+), 26 deletions(-)
--
2.34.1
^ permalink raw reply
* [PATCH nf v2 1/3] ipvs: pass parsed transport offset to state handlers
From: Yizhou Zhao @ 2026-07-06 10:16 UTC (permalink / raw)
To: netdev
Cc: coreteam, davem, edumazet, fengxw06, fw, horms, ja, kuba,
linux-kernel, lvs-devel, netfilter-devel, pabeni, pablo, phil,
qli01, stable, wangao, xuke, yangyx22, Yizhou Zhao
In-Reply-To: <20260706101624.69471-1-zhaoyz24@mails.tsinghua.edu.cn>
IPVS callers already parse the packet into struct ip_vs_iphdr before
updating connection state. For IPv6 this records the real
transport-header offset after extension headers in iph.len.
Pass this parsed transport offset through ip_vs_set_state() and the
protocol state_transition() callback so protocol handlers can use the
same packet context as scheduling and NAT handling. This patch only
changes the common callback plumbing and adapts the protocol callback
signatures; TCP and SCTP start using the value in follow-up patches.
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
include/net/ip_vs.h | 3 ++-
net/netfilter/ipvs/ip_vs_core.c | 10 +++++-----
net/netfilter/ipvs/ip_vs_proto_sctp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_tcp.c | 3 ++-
net/netfilter/ipvs/ip_vs_proto_udp.c | 3 ++-
5 files changed, 13 insertions(+), 9 deletions(-)
diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
index 49297fec448a..417ff51f62fc 100644
--- a/include/net/ip_vs.h
+++ b/include/net/ip_vs.h
@@ -752,7 +752,8 @@ struct ip_vs_protocol {
void (*state_transition)(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd);
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len);
int (*register_app)(struct netns_ipvs *ipvs, struct ip_vs_app *inc);
diff --git a/net/netfilter/ipvs/ip_vs_core.c b/net/netfilter/ipvs/ip_vs_core.c
index d40b404c1bf6..bd90f03fe3a4 100644
--- a/net/netfilter/ipvs/ip_vs_core.c
+++ b/net/netfilter/ipvs/ip_vs_core.c
@@ -398,10 +398,10 @@ ip_vs_conn_stats(struct ip_vs_conn *cp, struct ip_vs_service *svc)
static inline void
ip_vs_set_state(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd, unsigned int iph_len)
{
if (likely(pd->pp->state_transition))
- pd->pp->state_transition(cp, direction, skb, pd);
+ pd->pp->state_transition(cp, direction, skb, pd, iph_len);
}
static inline int
@@ -803,7 +803,7 @@ int ip_vs_leave(struct ip_vs_service *svc, struct sk_buff *skb,
ip_vs_in_stats(cp, skb);
/* set state */
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph->len);
/* transmit the first SYN packet */
ret = cp->packet_xmit(skb, cp, pd->pp, iph);
@@ -1484,7 +1484,7 @@ handle_response(int af, struct sk_buff *skb, struct ip_vs_proto_data *pd,
after_nat:
ip_vs_out_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_OUTPUT, skb, pd, iph->len);
skb->ipvs_property = 1;
if (!(cp->flags & IP_VS_CONN_F_NFCT))
ip_vs_notrack(skb);
@@ -2233,7 +2233,7 @@ ip_vs_in_hook(void *priv, struct sk_buff *skb, const struct nf_hook_state *state
IP_VS_DBG_PKT(11, af, pp, skb, iph.off, "Incoming packet");
ip_vs_in_stats(cp, skb);
- ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd);
+ ip_vs_set_state(cp, IP_VS_DIR_INPUT, skb, pd, iph.len);
if (cp->packet_xmit)
ret = cp->packet_xmit(skb, cp, pp, &iph);
/* do not touch skb anymore */
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 63c78a1f3918..394367b7b388 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -468,7 +468,8 @@ set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
sctp_state_transition(struct ip_vs_conn *cp, int direction,
- const struct sk_buff *skb, struct ip_vs_proto_data *pd)
+ const struct sk_buff *skb, struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
spin_lock_bh(&cp->lock);
set_sctp_state(pd, cp, direction, skb);
diff --git a/net/netfilter/ipvs/ip_vs_proto_tcp.c b/net/netfilter/ipvs/ip_vs_proto_tcp.c
index 8cc0a8ce6241..2d3f6aeafe52 100644
--- a/net/netfilter/ipvs/ip_vs_proto_tcp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_tcp.c
@@ -579,7 +579,8 @@ set_tcp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
static void
tcp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
struct tcphdr _tcph, *th;
diff --git a/net/netfilter/ipvs/ip_vs_proto_udp.c b/net/netfilter/ipvs/ip_vs_proto_udp.c
index f9de632e38cd..58f9e255927e 100644
--- a/net/netfilter/ipvs/ip_vs_proto_udp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_udp.c
@@ -444,7 +444,8 @@ static const char * udp_state_name(int state)
static void
udp_state_transition(struct ip_vs_conn *cp, int direction,
const struct sk_buff *skb,
- struct ip_vs_proto_data *pd)
+ struct ip_vs_proto_data *pd,
+ unsigned int iph_len)
{
if (unlikely(!pd)) {
pr_err("UDP no ns data\n");
--
2.34.1
^ permalink raw reply related
* [PATCH nf v2 3/3] ipvs: use parsed transport offset in SCTP state lookup
From: Yizhou Zhao @ 2026-07-06 10:16 UTC (permalink / raw)
To: netdev
Cc: coreteam, davem, edumazet, fengxw06, fw, horms, ja, kuba,
linux-kernel, lvs-devel, netfilter-devel, pabeni, pablo, phil,
qli01, stable, wangao, xuke, yangyx22, Yizhou Zhao
In-Reply-To: <20260706101624.69471-1-zhaoyz24@mails.tsinghua.edu.cn>
set_sctp_state() reads the SCTP chunk header again in order to drive the
IPVS SCTP state table. For IPv6 it computes the offset with
sizeof(struct ipv6hdr), while the surrounding IPVS code uses iph.len from
ip_vs_fill_iph_skb(), where ipv6_find_hdr() has already skipped
extension headers and found the real transport header.
This makes the state machine read from the wrong offset for IPv6 SCTP
packets that carry extension headers. For example, an INIT packet with an
8-byte destination options header can be scheduled correctly by
sctp_conn_schedule(), but set_sctp_state() reads the first byte of the
SCTP verification tag as a DATA chunk type. The connection then moves
from NONE to ESTABLISHED instead of INIT1, gets the longer established
timeout, and updates the active/inactive destination counters
incorrectly. This happens even though the SCTP handshake has not
completed.
Use the parsed transport offset passed down from ip_vs_set_state() for
the SCTP chunk-header lookup. For IPv4 and IPv6 packets without
extension headers this preserves the existing offset.
Fixes: 2906f66a5682 ("ipvs: SCTP Trasport Loadbalancing Support")
Cc: stable@vger.kernel.org
Link: https://lore.kernel.org/netdev/20260705123040.35755-1-zhaoyz24@mails.tsinghua.edu.cn/
Reported-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
Reported-by: Yuxiang Yang <yangyx22@mails.tsinghua.edu.cn>
Reported-by: Ao Wang <wangao@seu.edu.cn>
Reported-by: Xuewei Feng <fengxw06@126.com>
Reported-by: Qi Li <qli01@tsinghua.edu.cn>
Reported-by: Ke Xu <xuke@tsinghua.edu.cn>
Assisted-by: Claude Code:GLM-5.2
Signed-off-by: Yizhou Zhao <zhaoyz24@mails.tsinghua.edu.cn>
---
net/netfilter/ipvs/ip_vs_proto_sctp.c | 15 +++++----------
1 file changed, 5 insertions(+), 10 deletions(-)
diff --git a/net/netfilter/ipvs/ip_vs_proto_sctp.c b/net/netfilter/ipvs/ip_vs_proto_sctp.c
index 394367b7b388..c67317be17df 100644
--- a/net/netfilter/ipvs/ip_vs_proto_sctp.c
+++ b/net/netfilter/ipvs/ip_vs_proto_sctp.c
@@ -372,20 +372,15 @@ static const char *sctp_state_name(int state)
static inline void
set_sctp_state(struct ip_vs_proto_data *pd, struct ip_vs_conn *cp,
- int direction, const struct sk_buff *skb)
+ int direction, const struct sk_buff *skb,
+ unsigned int iph_len)
{
struct sctp_chunkhdr _sctpch, *sch;
unsigned char chunk_type;
int event, next_state;
- int ihl, cofs;
-
-#ifdef CONFIG_IP_VS_IPV6
- ihl = cp->af == AF_INET ? ip_hdrlen(skb) : sizeof(struct ipv6hdr);
-#else
- ihl = ip_hdrlen(skb);
-#endif
+ int cofs;
- cofs = ihl + sizeof(struct sctphdr);
+ cofs = iph_len + sizeof(struct sctphdr);
sch = skb_header_pointer(skb, cofs, sizeof(_sctpch), &_sctpch);
if (sch == NULL)
return;
@@ -472,7 +467,7 @@ sctp_state_transition(struct ip_vs_conn *cp, int direction,
unsigned int iph_len)
{
spin_lock_bh(&cp->lock);
- set_sctp_state(pd, cp, direction, skb);
+ set_sctp_state(pd, cp, direction, skb, iph_len);
spin_unlock_bh(&cp->lock);
}
--
2.34.1
^ permalink raw reply related
* [PATCH] ARM: dts: ti: omap: Correct indentation
From: Krzysztof Kozlowski @ 2026-07-06 10:18 UTC (permalink / raw)
To: Aaro Koskinen, Andreas Kemnade, Kevin Hilman, Roger Quadros,
Tony Lindgren, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Richard Cochran, linux-omap, devicetree, linux-kernel, netdev
Cc: Krzysztof Kozlowski
Correct spaces or mix of tabs+spaces into proper tab-indented lines.
No functional impact (same DTB).
Signed-off-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
---
Ongoing bigger work for all bindings and DTS with built-in checker (dt-check-style).
---
.../ti/omap/am335x-icev2-prueth-overlay.dtso | 126 +++++++++---------
arch/arm/boot/dts/ti/omap/am33xx-l4.dtsi | 2 +-
arch/arm/boot/dts/ti/omap/dm8148-evm.dts | 4 +-
arch/arm/boot/dts/ti/omap/dm816x-clocks.dtsi | 2 +-
arch/arm/boot/dts/ti/omap/dra7-l4.dtsi | 2 +-
.../dts/ti/omap/motorola-mapphone-common.dtsi | 10 +-
arch/arm/boot/dts/ti/omap/omap3-cm-t3x30.dtsi | 2 +-
arch/arm/boot/dts/ti/omap/omap3-n950-n9.dtsi | 2 +-
.../dts/ti/omap/omap3-overo-common-lcd35.dtsi | 2 +-
.../dts/ti/omap/omap3-overo-common-lcd43.dtsi | 2 +-
10 files changed, 77 insertions(+), 77 deletions(-)
diff --git a/arch/arm/boot/dts/ti/omap/am335x-icev2-prueth-overlay.dtso b/arch/arm/boot/dts/ti/omap/am335x-icev2-prueth-overlay.dtso
index ffed1f3d046a..c0f32c889f69 100644
--- a/arch/arm/boot/dts/ti/omap/am335x-icev2-prueth-overlay.dtso
+++ b/arch/arm/boot/dts/ti/omap/am335x-icev2-prueth-overlay.dtso
@@ -19,61 +19,61 @@
#include <dt-bindings/clock/am3.h>
&{/} {
- /* Dual-MAC Ethernet application node on PRU-ICSS */
- pruss_eth: pruss-eth {
- compatible = "ti,am3359-prueth";
- ti,prus = <&pru0>, <&pru1>;
- sram = <&ocmcram>;
- ti,mii-rt = <&pruss_mii_rt>;
- ti,iep = <&pruss_iep>;
- ti,ecap = <&pruss_ecap>;
- interrupts = <20 2 2>, <21 3 3>;
- interrupt-names = "rx_hp", "rx_lp";
- interrupt-parent = <&pruss_intc>;
+ /* Dual-MAC Ethernet application node on PRU-ICSS */
+ pruss_eth: pruss-eth {
+ compatible = "ti,am3359-prueth";
+ ti,prus = <&pru0>, <&pru1>;
+ sram = <&ocmcram>;
+ ti,mii-rt = <&pruss_mii_rt>;
+ ti,iep = <&pruss_iep>;
+ ti,ecap = <&pruss_ecap>;
+ interrupts = <20 2 2>, <21 3 3>;
+ interrupt-names = "rx_hp", "rx_lp";
+ interrupt-parent = <&pruss_intc>;
- pinctrl-0 = <&pruss_eth_default>;
- pinctrl-names = "default";
+ pinctrl-0 = <&pruss_eth_default>;
+ pinctrl-names = "default";
- ethernet-ports {
- #address-cells = <1>;
- #size-cells = <0>;
- pruss_emac0: ethernet-port@0 {
- reg = <0>;
- phy-handle = <&pruss_eth0_phy>;
- phy-mode = "mii";
- interrupts = <20 2 2>, <26 6 6>, <23 6 6>;
- interrupt-names = "rx", "emac_ptp_tx",
- "hsr_ptp_tx";
- /* Filled in by bootloader */
- local-mac-address = [00 00 00 00 00 00];
- };
+ ethernet-ports {
+ #address-cells = <1>;
+ #size-cells = <0>;
+ pruss_emac0: ethernet-port@0 {
+ reg = <0>;
+ phy-handle = <&pruss_eth0_phy>;
+ phy-mode = "mii";
+ interrupts = <20 2 2>, <26 6 6>, <23 6 6>;
+ interrupt-names = "rx", "emac_ptp_tx",
+ "hsr_ptp_tx";
+ /* Filled in by bootloader */
+ local-mac-address = [00 00 00 00 00 00];
+ };
- pruss_emac1: ethernet-port@1 {
- reg = <1>;
- phy-handle = <&pruss_eth1_phy>;
- phy-mode = "mii";
- interrupts = <21 3 3>, <27 9 7>, <24 9 7>;
- interrupt-names = "rx", "emac_ptp_tx",
- "hsr_ptp_tx";
- /* Filled in by bootloader */
- local-mac-address = [00 00 00 00 00 00];
- };
- };
- };
+ pruss_emac1: ethernet-port@1 {
+ reg = <1>;
+ phy-handle = <&pruss_eth1_phy>;
+ phy-mode = "mii";
+ interrupts = <21 3 3>, <27 9 7>, <24 9 7>;
+ interrupt-names = "rx", "emac_ptp_tx",
+ "hsr_ptp_tx";
+ /* Filled in by bootloader */
+ local-mac-address = [00 00 00 00 00 00];
+ };
+ };
+ };
};
&am33xx_pinmux {
/* MDIO node for PRU-ICSS */
- pruss_mdio_default: pruss-mdio-default-pins {
- pinctrl-single,pins = <
+ pruss_mdio_default: pruss-mdio-default-pins {
+ pinctrl-single,pins = <
AM33XX_IOPAD(0x88c, PIN_OUTPUT | MUX_MODE5) /* (V12) gpmc_clk.pr1_mdio_mdclk */
AM33XX_IOPAD(0x888, PIN_INPUT | MUX_MODE5) /* (T13) gpmc_csn3.pr1_mdio_data */
- >;
- };
+ >;
+ };
/* Pinmux configuration for PRU-ICSS */
- pruss_eth_default: pruss-eth-default-pins {
- pinctrl-single,pins = <
+ pruss_eth_default: pruss-eth-default-pins {
+ pinctrl-single,pins = <
AM33XX_IOPAD(0x8a0, PIN_INPUT | MUX_MODE2) /* (R1) lcd_data0.pr1_mii_mt0_clk */
AM33XX_IOPAD(0x8b4, PIN_OUTPUT | MUX_MODE2) /* (T2) lcd_data5.pr1_mii0_txd0 */
AM33XX_IOPAD(0x8b0, PIN_OUTPUT | MUX_MODE2) /* (T1) lcd_data4.pr1_mii0_txd1 */
@@ -105,14 +105,14 @@ AM33XX_IOPAD(0x868, PIN_INPUT | MUX_MODE5) /* (T16) gpmc_a10.pr1_mii1_rxdv */
AM33XX_IOPAD(0x86c, PIN_INPUT | MUX_MODE5) /* (V17) gpmc_a11.pr1_mii1_rxer */
AM33XX_IOPAD(0x878, PIN_INPUT | MUX_MODE5) /* (U18) gpmc_be1n.pr1_mii1_rxlink */
AM33XX_IOPAD(0x8ec, PIN_INPUT | MUX_MODE2) /* (R6) lcd_ac_bias_en.pr1_mii1_crs */
- >;
- };
+ >;
+ };
};
&gpio3 {
- mux-mii-hog {
+ mux-mii-hog {
status = "disabled";
- };
+ };
mux-mii-hog-0 {
gpio-hog;
@@ -129,28 +129,28 @@ mux-mii-hog-0 {
* conflict with PRU-ICSS
*/
&mac_sw {
- status = "disabled";
+ status = "disabled";
};
&davinci_mdio_sw {
- status = "disabled";
+ status = "disabled";
};
/* PRU-ICSS MDIO configuration */
&pruss_mdio {
- pinctrl-0 = <&pruss_mdio_default>;
- pinctrl-names = "default";
- reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
- reset-delay-us = <2>; /* PHY datasheet states 1uS min */
- status = "okay";
- #address-cells = <1>;
- #size-cells = <0>;
+ pinctrl-0 = <&pruss_mdio_default>;
+ pinctrl-names = "default";
+ reset-gpios = <&gpio2 5 GPIO_ACTIVE_LOW>;
+ reset-delay-us = <2>; /* PHY datasheet states 1uS min */
+ status = "okay";
+ #address-cells = <1>;
+ #size-cells = <0>;
- pruss_eth0_phy: ethernet-phy@1 {
- reg = <1>;
- };
+ pruss_eth0_phy: ethernet-phy@1 {
+ reg = <1>;
+ };
- pruss_eth1_phy: ethernet-phy@3 {
- reg = <3>;
- };
+ pruss_eth1_phy: ethernet-phy@3 {
+ reg = <3>;
+ };
};
diff --git a/arch/arm/boot/dts/ti/omap/am33xx-l4.dtsi b/arch/arm/boot/dts/ti/omap/am33xx-l4.dtsi
index 8a693c478bea..57a45609f9f5 100644
--- a/arch/arm/boot/dts/ti/omap/am33xx-l4.dtsi
+++ b/arch/arm/boot/dts/ti/omap/am33xx-l4.dtsi
@@ -1870,7 +1870,7 @@ SYSC_OMAP2_SOFTRESET |
gpio2: gpio@0 {
compatible = "ti,omap4-gpio";
- gpio-ranges = <&am33xx_pinmux 0 34 18>,
+ gpio-ranges = <&am33xx_pinmux 0 34 18>,
<&am33xx_pinmux 18 77 4>,
<&am33xx_pinmux 22 56 10>;
gpio-controller;
diff --git a/arch/arm/boot/dts/ti/omap/dm8148-evm.dts b/arch/arm/boot/dts/ti/omap/dm8148-evm.dts
index 57a9eef09f6f..8236d9eb438a 100644
--- a/arch/arm/boot/dts/ti/omap/dm8148-evm.dts
+++ b/arch/arm/boot/dts/ti/omap/dm8148-evm.dts
@@ -99,7 +99,7 @@ partition@780000 {
};
&mmc1 {
- status = "disabled";
+ status = "disabled";
};
&mmc2 {
@@ -111,7 +111,7 @@ &mmc2 {
};
&mmc3 {
- status = "disabled";
+ status = "disabled";
};
&pincntl {
diff --git a/arch/arm/boot/dts/ti/omap/dm816x-clocks.dtsi b/arch/arm/boot/dts/ti/omap/dm816x-clocks.dtsi
index 338449b32a18..76ebc6c3c3e5 100644
--- a/arch/arm/boot/dts/ti/omap/dm816x-clocks.dtsi
+++ b/arch/arm/boot/dts/ti/omap/dm816x-clocks.dtsi
@@ -177,7 +177,7 @@ mpu_ck: mpu_ck@15dc {
compatible = "ti,gate-clock";
clocks = <&sysclk2_ck>;
ti,bit-shift = <1>;
- reg = <0x15dc>;
+ reg = <0x15dc>;
};
audio_pll_a_ck: audio_pll_a_ck@35c {
diff --git a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi
index 9df7648c4b79..a595745afe59 100644
--- a/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi
+++ b/arch/arm/boot/dts/ti/omap/dra7-l4.dtsi
@@ -1695,9 +1695,9 @@ uart4: serial@0 {
reg = <0x0 0x100>;
interrupts = <GIC_SPI 65 IRQ_TYPE_LEVEL_HIGH>;
clock-frequency = <48000000>;
- status = "disabled";
dmas = <&sdma_xbar 55>, <&sdma_xbar 56>;
dma-names = "tx", "rx";
+ status = "disabled";
};
};
diff --git a/arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi b/arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi
index a0c53d9c2625..28b4f12b82a7 100644
--- a/arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi
+++ b/arch/arm/boot/dts/ti/omap/motorola-mapphone-common.dtsi
@@ -91,22 +91,22 @@ &cpu_thermal {
};
&cpu_alert0 {
- temperature = <80000>; /* millicelsius */
+ temperature = <80000>; /* millicelsius */
};
&cpu0 {
- /*
+ /*
* Note that the 1.2GiHz mode is enabled for all SoC variants for
* the Motorola Android Linux v3.0.8 based kernel.
*/
- operating-points = <
- /* kHz uV */
+ operating-points = <
+ /* kHz uV */
300000 1025000
600000 1200000
800000 1313000
1008000 1375000
1200000 1375000
- >;
+ >;
};
&dss {
diff --git a/arch/arm/boot/dts/ti/omap/omap3-cm-t3x30.dtsi b/arch/arm/boot/dts/ti/omap/omap3-cm-t3x30.dtsi
index 0e942513560d..6c4916ec41b4 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-cm-t3x30.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-cm-t3x30.dtsi
@@ -29,7 +29,7 @@ OMAP3_CORE1_IOPAD(0x219a, PIN_INPUT_PULLUP | MUX_MODE4) /* uart3_cts_rctx.gpio_1
>;
};
- hsusb0_pins: hsusb0-pins {
+ hsusb0_pins: hsusb0-pins {
pinctrl-single,pins = <
OMAP3_CORE1_IOPAD(0x21a2, PIN_OUTPUT | MUX_MODE0) /* hsusb0_clk.hsusb0_clk */
OMAP3_CORE1_IOPAD(0x21a4, PIN_OUTPUT | MUX_MODE0) /* hsusb0_stp.hsusb0_stp */
diff --git a/arch/arm/boot/dts/ti/omap/omap3-n950-n9.dtsi b/arch/arm/boot/dts/ti/omap/omap3-n950-n9.dtsi
index aa4fcdbedd8f..519f7b42a59a 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-n950-n9.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-n950-n9.dtsi
@@ -287,7 +287,7 @@ lis302: lis302@1d {
pinctrl-names = "default";
pinctrl-0 = <&accelerator_pins>;
- interrupts-extended = <&gpio6 20 IRQ_TYPE_EDGE_FALLING>, <&gpio6 21 IRQ_TYPE_EDGE_FALLING>; /* 180, 181 */
+ interrupts-extended = <&gpio6 20 IRQ_TYPE_EDGE_FALLING>, <&gpio6 21 IRQ_TYPE_EDGE_FALLING>; /* 180, 181 */
/* click flags */
st,click-single-x;
diff --git a/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd35.dtsi b/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd35.dtsi
index 0da561a23f36..2f7a4a717359 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd35.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd35.dtsi
@@ -103,7 +103,7 @@ ads7846reg: ads7846-reg {
backlight {
compatible = "gpio-backlight";
-
+
pinctrl-names = "default";
pinctrl-0 = <&backlight_pins>;
gpios = <&gpio5 17 GPIO_ACTIVE_HIGH>; /* gpio_145 */
diff --git a/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd43.dtsi b/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd43.dtsi
index 981f02f088f8..35701f596972 100644
--- a/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd43.dtsi
+++ b/arch/arm/boot/dts/ti/omap/omap3-overo-common-lcd43.dtsi
@@ -134,7 +134,7 @@ ads7846reg: ads7846-reg {
backlight {
compatible = "gpio-backlight";
-
+
pinctrl-names = "default";
pinctrl-0 = <&backlight_pins>;
gpios = <&gpio5 17 GPIO_ACTIVE_HIGH>; /* gpio_145 */
--
2.53.0
^ permalink raw reply related
* Re: [PATCH net v2] selftests: net: make busywait timeout clock portable
From: patchwork-bot+netdevbpf @ 2026-07-06 10:20 UTC (permalink / raw)
To: Nirmoy Das
Cc: davem, edumazet, kuba, pabeni, shuah, netdev, linux-kselftest,
stable
In-Reply-To: <20260630165157.3814871-1-nirmoyd@nvidia.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 30 Jun 2026 09:51:57 -0700 you wrote:
> loopy_wait() expects millisecond timestamps. However, Ubuntu Resolute
> can use uutils date, where `date -u +%s%3N` returns seconds plus full
> nanoseconds instead of a 3-digit millisecond field. This makes
> busywait expire too early and can make vlan_bridge_binding.sh read a
> stale operstate.
>
> Fixes: 25ae948b4478 ("selftests/net: add lib.sh")
> Cc: stable@vger.kernel.org # 6.8+
> Link: https://github.com/uutils/coreutils/issues/11658
> Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
>
> [...]
Here is the summary with links:
- [net,v2] selftests: net: make busywait timeout clock portable
https://git.kernel.org/netdev/net/c/dd6a23bac306
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb
From: patchwork-bot+netdevbpf @ 2026-07-06 10:20 UTC (permalink / raw)
To: Victor Nogueira
Cc: davem, edumazet, kuba, pabeni, jhs, jiri, netdev, hexlabsecurity,
pctammela
In-Reply-To: <20260630153651.249752-1-victor@mojatatu.com>
Hello:
This patch was applied to netdev/net-next.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 30 Jun 2026 12:36:51 -0300 you wrote:
> Add test cases to reproduce scenarios fixed recently [1] where
> multiqueue and taprio forced their children into enqueueing an skb to
> gso_skb (during peek), but failed to dequeue from gso_skb because they
> called the child's dequeue callback directly. This causes a desync in the
> child's qlen/backlog and results in an eventual null-ptr-deref (with a
> qfq or dualpi2 child).
>
> [...]
Here is the summary with links:
- [net] selftests/tc-testing: Add tests that force multiq and taprio to enqueue to child's gso_skb
https://git.kernel.org/netdev/net-next/c/1704cc864070
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH bpf-next 2/6] bpf: Add ksock kfuncs
From: bot+bpf-ci @ 2026-07-06 10:30 UTC (permalink / raw)
To: mahe.tardy, bpf
Cc: andrew+netdev, andrii, ast, daniel, davem, eddyz87, edumazet,
john.fastabend, kuba, liamwisehart, martin.lau, pabeni, song,
netdev, mahe.tardy, ast, andrii, daniel, martin.lau, eddyz87,
yonghong.song, clm, ihor.solodrai
In-Reply-To: <20260706093525.13030-3-mahe.tardy@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1707 bytes --]
> diff --git a/net/core/bpf_ksock.c b/net/core/bpf_ksock.c
> new file mode 100644
> index 000000000000..8bde734bc917
> --- /dev/null
> +++ b/net/core/bpf_ksock.c
[ ... ]
> @@ -0,0 +1,516 @@
[ ... ]
> +static int __init bpf_ksock_kfunc_init(void)
> +{
> + int ret;
> + const struct btf_id_dtor_kfunc bpf_ksock_dtors[] = {
> + {
> + .btf_id = bpf_ksock_dtor_ids[0],
> + .kfunc_btf_id = bpf_ksock_dtor_ids[1],
> + },
> + };
> +
> + ret = register_pernet_subsys(&bpf_ksock_net_ops);
> + if (ret)
> + return ret;
> +
> + ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
> + &ksock_init_kfunc_set);
> + if (ret) {
> + unregister_pernet_subsys(&bpf_ksock_net_ops);
> + return ret;
> + }
> +
> + ret = register_btf_kfunc_id_set(BPF_PROG_TYPE_SYSCALL,
> + &ksock_kfunc_set);
> + ret = ret ?: register_btf_kfunc_id_set(BPF_PROG_TYPE_LSM,
> + &ksock_kfunc_set);
> + return ret = ret ?: register_btf_id_dtor_kfuncs(bpf_ksock_dtors,
> + ARRAY_SIZE(bpf_ksock_dtors),
> + THIS_MODULE);
^^^^
This isn't a bug, but in the final return statement the assignment
to ret looks like a dead store since the value is returned right
away. Could this just be:
return ret ?: register_btf_id_dtor_kfuncs(bpf_ksock_dtors,
ARRAY_SIZE(bpf_ksock_dtors),
THIS_MODULE);
> +}
> +
> +late_initcall(bpf_ksock_kfunc_init);
---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md
CI run summary: https://github.com/kernel-patches/bpf/actions/runs/28783010022
^ permalink raw reply
* Re: [PATCH net-next v11 02/12] enic: verify firmware supports V2 SR-IOV at probe time
From: Breno Leitao @ 2026-07-06 10:43 UTC (permalink / raw)
To: Satish Kharat
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, Sesidhar Baddela
In-Reply-To: <20260703-enic-sriov-v2-admin-channel-v2-v11-2-5b739f1fe9e5@cisco.com>
On Fri, Jul 03, 2026 at 11:08:51AM -0700, Satish Kharat wrote:
> During PF probe, query the firmware get-supported-feature interface
> to verify that the running firmware supports V2 SR-IOV. Firmware
> version 5.3(4.72) and later report VIC_FEATURE_SRIOV via
> CMD_GET_SUPP_FEATURE_VER. If the firmware does not support the
> feature, set vf_type to ENIC_VF_TYPE_NONE and log a warning so the
> admin knows a firmware upgrade is needed.
>
> V2 VFs are only ever enabled later through the sysfs .sriov_configure
> path (enic_sriov_configure()), which rejects ENIC_VF_TYPE_NONE before
> calling pci_enable_sriov(); there is no probe-time auto-enable, so
> firmware that lacks V2 support never exposes VFs.
>
> VIC_FEATURE_SRIOV is assigned the explicit value 4 to match the
> firmware ABI. Slot 3 (firmware's VIC_FEATURE_PTP) is reserved with
> a comment rather than a placeholder enum entry, since PTP is not
> used by the upstream driver.
>
> Suggested-by: Breno Leitao <leitao@debian.org>
> Signed-off-by: Satish Kharat <satishkh@cisco.com>
Reviewed-by: Breno Leitao <leitao@debian.org>
^ permalink raw reply
* Re: CL37 autonegotiation not working on amd-xgbe
From: Thorsten Leemhuis @ 2026-07-06 10:44 UTC (permalink / raw)
To: K.R, Prashanth Kumar, S-k, Shyam-sundar, Jakub Kicinski,
Banavara, Madhu
Cc: Patrick Oppenlander, netdev@vger.kernel.org,
Linux kernel regressions list
In-Reply-To: <MN6PR12MB8513D5386E2A586BE4FC68D7CF102@MN6PR12MB8513.namprd12.prod.outlook.com>
On 6/4/26 08:51, K.R, Prashanth Kumar wrote:
> On 5/6/26 05:55, Shyam Sundar S K wrote:
>> On 4/28/2026 04:58, Jakub Kicinski wrote:
>>> On Thu, 23 Apr 2026 10:18:49 +1000 Patrick Oppenlander wrote:
>>>> A recent change [1]
> FWIW, that was 42fd432fe6d320 ("amd-xgbe: align CL37 AN sequence as per
> databook") [v6.16-rc5]
>
>>>> stopped CL37 autonegotiation from working on amd-xgbe hardware.
>> Thanks for the bug report. Prashanth will maintain this driver going
>> forward.
>>
>> Prashanth, can you address this bug? Also, please update the
>> MAINTAINERS list by dropping Raju's name.
> Any progress? It looks like nothing happened to fix this regression since above mail, but I'm looking at things from the outside and there it's easy to miss something, so please tell me if that's the case.
>
> Thanks for the follow-up.
Side note: please fix your quoting, it leads to confusion.
> A fix has been identified and a patch is prepared. We are currently running regression testing to ensure the fix does not introduce any unintended issues. We will share the patch on the mailing list once regression validation is complete.
That was a months ago. Any progress? Didn't spot anything on the lists,
but it's easy to miss something.
Ciao, Thorsten
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox