* Re: Please backport bridge multicast exponential field encoding fix series to stable kernels
From: Ujjal Roy @ 2026-07-09 12:38 UTC (permalink / raw)
To: Greg KH
Cc: Sasha Levin, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Nikolay Aleksandrov, Ido Schimmel,
David Ahern, Shuah Khan, Andy Roulin, Yong Wang, Petr Machata,
stable, Ujjal Roy, bridge, Kernel, Kernel, linux-kselftest
In-Reply-To: <2026063019-crummy-mosaic-d9bb@gregkh>
On Wed, Jul 1, 2026 at 2:00 AM Greg KH <greg@kroah.com> wrote:
>
> On Wed, Jul 01, 2026 at 01:33:07AM +0530, Ujjal Roy wrote:
> > On Thu, Jun 25, 2026 at 8:20 PM Ujjal Roy <royujjal@gmail.com> wrote:
> > >
> > > On Thu, Jun 25, 2026 at 4:12 PM Sasha Levin <sashal@kernel.org> wrote:
> > > >
> > > > > Please backport the 5-patch bridge multicast exponential field
> > > > > encoding series (726fa7da2d8c, 12cfb4ecc471, 95bfd196f0dc,
> > > > > e51560f4220a, 529dbe762de0) to the stable kernels.
> > > >
> > > > I tried, but it doesn't apply to 7.1. Could you provide a backport please?
> > > >
> > > > --
> > > > Thanks,
> > > > Sasha
> > >
> > > I will create patches on top of 7.1. But tell me what about all other
> > > stable releases? I have to create patches to all stables and how to
> > > share the patches to you? Via this email or any other process? I am a
> > > fresh on backporting my changes to all stables.
> >
> > I have prepared the patches for stable releases mentioned in kernel.org.
> >
> > And I am waiting for your response so that I can send you the patchset.
>
> Please just send the patches :)
I just sent another email with the subject "Please backport bridge
multicast exponential field encoding fix series to
6.1.y/6.6.y/6.12.y/6.18.y/7.0.y", please accept that for direct
cherry-picking. Infact 5.15.y also cherry-picked cleanly, except for
the selftest commit which is not needed here, will send another email
regarding this.
I will send a separate patchset after resolving conflicts on 5.10.y and 7.1.y
^ permalink raw reply
* Re: [PATCH net-next 00/15] net/mlx5e: PSP cleanups and improvements
From: Daniel Zahka @ 2026-07-09 12:37 UTC (permalink / raw)
To: Cosmin Ratiu, andrew+netdev@lunn.ch, davem@davemloft.net,
Tariq Toukan, kuba@kernel.org, pabeni@redhat.com,
edumazet@google.com, netdev@vger.kernel.org
Cc: Boris Pismenny, willemdebruijn.kernel@gmail.com, Jianbo Liu,
leon@kernel.org, Rahul Rameshbabu, linux-kernel@vger.kernel.org,
linux-rdma@vger.kernel.org, Raed Salem, Chris Mi, Dragos Tatulea,
sdf.kernel@gmail.com, Mark Bloch, sdf@fomichev.me, Saeed Mahameed,
aleksandr.loktionov@intel.com, Gal Pressman, Lama Kayal,
jacob.e.keller@intel.com
In-Reply-To: <3a8a33b0822e82d8a37aeb7e9c326889074e458a.camel@nvidia.com>
On 7/9/26 6:51 AM, Cosmin Ratiu wrote:
> So the test relies on TCP retransmissions to catch the encrypted echo
> from the responder on the UDP socket. The timeline seems to be:
> 1. data_send_off disables PSP on its end.
> 2. data_send_off opens a UDP socket and binds it to port 1000.
> 3. data_send_off sends "data echo" to psp_responder on the control
> connection.
> 4. psp_responder send "echo" on the now sabotaged PSP connection.
> 5. psp_responder acks the "echo request" on the control connection.
> 6. data_send_off receives the ack.
> 7. data_send_off tries to receive "echo" on the PSP connection but
> expect_fail==True so stops after 100 ms.
> 8. data_send_off reenables PSP on its end.
> 9. data_send_off waits for "echo" to be received now that connectivity
> is back for up to 350 ms.
> 10. data_send_off asserts that something is in the UDP socket queue.
>
> So UDP packets could be enqueued if PSP packets are received between
> steps 4-8.
>
> It seems disabling PSP steering rules isn't as atomic as we thought,
> and sometimes the first echo is discarded by steering. The default TCP
> retransmission timeout is 200 ms so there are no retransmissions in the
> ~150-170 ms between steps 4-8.
>
> With a slightly modified test that directly requests data echoes, the
> test becomes more reliable. Additionally, you need the UDP_NO_CHECK6_RX
> (102) socket options for the ipv6 version, otherwise zero-checksum UDP
> packets are discarded by the stack. I vaguely remember doing this
> change for this test in Jakub's repo a few years ago.
>
> Anyway, here's the diff that makes both tests reliably pass:
Thanks for taking a look. I suppose the timing and 0 udp checksum
explain why I wasn't seeing any packets. I was concerned that we may
have entered a state where we were losing some udp packets permanently,
as opposed to just some transient drops at the time the device is
reconfigured, but it sounds like that isn't the case. So, I think this
works ok then.
^ permalink raw reply
* Re: [PATCHv2 net-next 1/7] net: usb: centralize usbnet_cdc_zte_rx_fixup in usbnet
From: Manuel Ebner @ 2026-07-09 12:37 UTC (permalink / raw)
To: Oliver Neukum, andrew+netdev, davem, edumazet, kuba, pabeni,
netdev, linux-usb, linux-kernel
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
On Thu, 2026-07-09 at 14:01 +0200, Oliver Neukum wrote:
I guess a couple suggestions got lost, that's ok.
> This helper is used by multiple drivers using usbnet.
> It is better to be provided by usbnet than one of them.
>
> Signed-off-by: Oliver Neukum <oneukum@suse.com>
> ---
>
> v2:
> - spelling issues
> - issue with lost synchronization with SPLIT packets
>
> drivers/net/usb/cdc_ether.c | 19 -------------------
> drivers/net/usb/usbnet.c | 19 +++++++++++++++++++
> 2 files changed, 19 insertions(+), 19 deletions(-)
>
> diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
> index b4df32e18461..e688fb99c61d 100644
> --- a/drivers/net/usb/cdc_ether.c
> +++ b/drivers/net/usb/cdc_ether.c
> @@ -404,25 +404,6 @@ static int usbnet_cdc_zte_bind(struct usbnet *dev, struct
> usb_interface *intf)
> return status;
> }
>
> -/* Make sure packets have correct destination MAC address
Make sure packets have the correct destination MAC address
> - *
> - * A firmware bug observed on some devices (ZTE MF823/831/910) is that the
> - * device sends packets with a static, bogus, random MAC address (event if
(even if the device ...
> - * device MAC address has been updated). Always set MAC address to that of the
> - * device.
Always set the MAC address to the one of your device.
Thanks
Manuel
> [...]
^ permalink raw reply
* Re: [PATCH v2 net] octeontx2-af: Block VFs from clobbering special CGX PKIND state
From: Simon Horman @ 2026-07-09 12:26 UTC (permalink / raw)
To: rkannoth
Cc: Simon Horman, davem, gakula, linux-kernel, netdev, sgoutham,
andrew+netdev, edumazet, kuba, pabeni, hkelam
In-Reply-To: <20260703024157.3526879-1-rkannoth@marvell.com>
This is an AI-generated review of your patch. The human sending this
email has considered the AI review valid, or at least plausible.
Full review at: https://netdev-ai.bots.linux.dev/sashiko/
---
octeontx2-af: Block VFs from clobbering special CGX PKIND state
This patch prevents VF NIX LF allocation from resetting the CGX RX PKIND
and default TX parse config when the shared LMAC has HiGig2 or EDSA
parsing enabled. It adds cgx_get_pkind() and a new
rvu_cgx_is_pkind_config_permitted() helper, then gates the pkind and TX
parse writes in nix_interface_init() and rvu_mbox_handler_nix_lf_alloc().
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
> index 4ff3935ed3fe..2be1da3476ac 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_cgx.c
> @@ -1355,3 +1355,35 @@ void rvu_mac_reset(struct rvu *rvu, u16 pcifunc)
> if (mac_ops->mac_reset(cgxd, lmac, !is_vf(pcifunc)))
> dev_err(rvu->dev, "Failed to reset MAC\n");
> }
> +
> +/* Do not allow CGX-mapped VFs to overwrite PKIND when special parse kinds
> + * (HiGig, EDSA, etc.) are in use on the shared LMAC.
> + */
> +bool rvu_cgx_is_pkind_config_permitted(struct rvu *rvu, u16 pcifunc)
> +{
> + int pf, err, rxpkind;
> + u8 cgx_id, lmac_id;
> + void *cgxd;
> +
> + pf = rvu_get_pf(rvu->pdev, pcifunc);
> +
> + if (!(pcifunc & RVU_PFVF_FUNC_MASK))
> + return true;
> +
> + if (!is_pf_cgxmapped(rvu, pf))
> + return true;
> +
> + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id);
> + cgxd = rvu_cgx_pdata(cgx_id, rvu);
> + err = cgx_get_pkind(cgxd, lmac_id, &rxpkind);
> + if (err)
> + return false;
> +
> + switch (rxpkind) {
> + case NPC_RX_HIGIG_PKIND:
> + case NPC_RX_EDSA_PKIND:
> + return false;
> + default:
> + return true;
> + }
> +}
[High]
Is the exclusion actually enforced against the other writers of these
registers?
rvu_npc_set_parse_mode() also calls cgx_set_pkind() and writes
NIX_AF_LFX_TX_PARSE_CFG(nixlf) directly, and it is reachable from the
rvu_mbox_handler_npc_set_pkind mbox handler as well as from
rvu_nix_lf_teardown(). None of those paths take cgxd->lock.
Consider this interleaving on a shared LMAC:
CPU A (PF) CPU B (VF)
rvu_mbox_handler_npc_set_pkind
rvu_npc_set_parse_mode
(no cgxd->lock held)
mutex_lock(&cgxd->lock)
cgx_get_pkind() -> default
rvu_cgx_is_pkind_config_permitted()
returns true
cgx_set_pkind(default)
rvu_npc_set_pkind(default)
mutex_unlock(&cgxd->lock)
cgx_set_pkind(HIGIG)
write NIX_AF_LFX_TX_PARSE_CFG
Or the reverse order, where CPU B's write clobbers CPU A's HiGig
programming after CPU A has already installed it. Since
rvu_npc_set_parse_mode() does not acquire cgxd->lock, does the check in
rvu_cgx_is_pkind_config_permitted() effectively close the race the
commit message describes?
Additionally, the comment on struct cgx's lock in lmac_common.h reads:
/* Lock to serialize read/write of global csrs like
* RPMX_MTI_STAT_DATA_HI_CDC etc
*/
struct mutex lock;
Is cgxd->lock the intended lock to serialize per-NIX-LF register writes
like NIX_AF_LFX_TX_PARSE_CFG, or should a different mechanism be used?
> diff --git a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
> index 0297c7ab0614..4e72d6e072d5 100644
> --- a/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
> +++ b/drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c
[ ... ]
> @@ -1509,11 +1517,14 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,
> u16 bcast, mcast, promisc, ucast;
> struct rvu_hwinfo *hw = rvu->hw;
> u16 pcifunc = req->hdr.pcifunc;
> + u8 cgx_id = 0, lmac_id = 0;
> bool rules_created = false;
> struct rvu_block *block;
> struct rvu_pfvf *pfvf;
> u64 cfg, ctx_cfg;
> + struct cgx *cgxd;
> int blkaddr;
> + int pf;
>
> if (!req->rq_cnt || !req->sq_cnt || !req->cq_cnt)
> return NIX_AF_ERR_PARAM;
> @@ -1685,8 +1696,18 @@ int rvu_mbox_handler_nix_lf_alloc(struct rvu *rvu,
> rvu_write64(rvu, blkaddr, NIX_AF_LFX_RX_CFG(nixlf), req->rx_cfg);
>
> /* Configure pkind for TX parse config */
> - cfg = NPC_TX_DEF_PKIND;
> - rvu_write64(rvu, blkaddr, NIX_AF_LFX_TX_PARSE_CFG(nixlf), cfg);
> + if (is_pf_cgxmapped(rvu, rvu_get_pf(rvu->pdev, pcifunc))) {
> + pf = rvu_get_pf(rvu->pdev, pcifunc);
> + rvu_get_cgx_lmac_id(rvu->pf2cgxlmac_map[pf], &cgx_id, &lmac_id);
> + cgxd = rvu_cgx_pdata(cgx_id, rvu);
> +
> + mutex_lock(&cgxd->lock);
> + if (rvu_cgx_is_pkind_config_permitted(rvu, pcifunc)) {
> + cfg = NPC_TX_DEF_PKIND;
> + rvu_write64(rvu, blkaddr, NIX_AF_LFX_TX_PARSE_CFG(nixlf), cfg);
> + }
> + mutex_unlock(&cgxd->lock);
> + }
[High]
Does this outer is_pf_cgxmapped() guard change behavior for LBK, SDP and
representor NIX LFs?
Prior to this patch the write of NPC_TX_DEF_PKIND to
NIX_AF_LFX_TX_PARSE_CFG(nixlf) was unconditional for every NIX LF that
reached this point. is_pf_cgxmapped() returns false when
pf < PF_CGXMAP_BASE (e.g. AF PF0 that owns LBK VFs) and for SDP PFs (via
the is_sdp_pf() exclusion):
static inline bool is_pf_cgxmapped(struct rvu *rvu, u8 pf)
{
return (pf >= PF_CGXMAP_BASE && pf <= rvu->cgx_mapped_pfs) &&
!is_sdp_pf(rvu, rvu_make_pcifunc(rvu->pdev, pf, 0));
}
For those non-CGX cases the register is now left at whatever
rvu_lf_reset() leaves behind rather than NPC_TX_DEF_PKIND.
The commit message describes the intent narrowly:
a VF NIX LF alloc must not reset the LMAC RX PKIND or default TX
parse config over the PF setup.
rvu_cgx_is_pkind_config_permitted() already returns true for non-VF and
for non-CGX-mapped pcifuncs. Would gating solely on
rvu_cgx_is_pkind_config_permitted() (without the outer
is_pf_cgxmapped()) match the stated intent and preserve prior behavior
for LBK, SDP and representor NIX LFs?
^ permalink raw reply
* Re: [PATCH v2] mptcp: only set DATA_FIN when a mapping is present
From: Matthieu Baerts @ 2026-07-09 12:26 UTC (permalink / raw)
To: gang.yan, Michael Bommarito
Cc: Geliang Tang, Paolo Abeni, Eric Dumazet, Jakub Kicinski, mptcp,
netdev, linux-kernel, Mat Martineau
In-Reply-To: <8155514655323d8c4a07da86d2b2ccdd7244c125@linux.dev>
Hi Michael, Gang,
On 09/07/2026 07:43, gang.yan@linux.dev wrote:
> July 8, 2026 at 1:17 AM, "Michael Bommarito" <michael.bommarito@gmail.com> wrote:
Thank you for this patch and the review!
>> mptcp_get_options() clears only the status group of struct
>> mptcp_options_received; data_seq, subflow_seq and data_len are filled in
>> by mptcp_parse_option() exclusively inside the DSS mapping block, which
>> runs only when the DSS M (mapping present) bit is set.
>>
>> A peer can send a DSS option with the DATA_FIN flag set but the mapping
>> bit clear. The parser then records mp_opt->data_fin while leaving
>> data_len and data_seq uninitialized. For a zero-length segment
>> mptcp_incoming_options() evaluates
By chance, do you have a reproducer? Maybe using Packetdrill with MPTCP
support? [1]
If not, how did you discover this issue?
[1] https://github.com/multipath-tcp/packetdrill/
>> if (mp_opt.data_fin && mp_opt.data_len == 1 &&
>> mptcp_update_rcv_data_fin(msk, mp_opt.data_seq, mp_opt.dsn64))
>>
>> which reads the uninitialized data_len and data_seq; KMSAN reports an
>> uninit-value in mptcp_incoming_options(). The stale data_seq can also be
>> fed into the receive-side DATA_FIN sequence tracking.
>>
>> Record the DATA_FIN flag only when the DSS option carries a mapping, so
>> data_fin is never set without data_seq and data_len also being present.
>> data_fin is part of the status group that mptcp_get_options() clears up
>> front, so on the no-map path it stays zero and the zero-length DATA_FIN
>> branch is simply skipped. A DATA_FIN is always transmitted together with
>> a mapping (mptcp_write_data_fin() sets use_map along with data_seq and
>> data_len), so legitimate DATA_FIN handling is unaffected.
>>
>> Fixes: 43b54c6ee382 ("mptcp: Use full MPTCP-level disconnect state machine")
>> Suggested-by: Paolo Abeni <pabeni@redhat.com>
>> Cc: stable@vger.kernel.org
>> Assisted-by: Claude:claude-opus-4-8
>> Signed-off-by: Michael Bommarito <michael.bommarito@gmail.com>
>> ---
>> v2: adopt Paolo Abeni's suggested approach - do not set mp_opt->data_fin
>> at all unless a mapping is present, rather than gating the consumer in
>> mptcp_incoming_options() (v1). data_fin then defaults to the value
>> mptcp_get_options() already clears it to (0) on the no-map path, so
>> the uninitialized data_len/data_seq are never read.
>>
>> net/mptcp/options.c | 2 +-
>> 1 file changed, 1 insertion(+), 1 deletion(-)
>>
>> diff --git a/net/mptcp/options.c b/net/mptcp/options.c
>> index dff3fd5d3b559..6d003b24b969f 100644
>> --- a/net/mptcp/options.c
>> +++ b/net/mptcp/options.c
>> @@ -157,7 +157,6 @@ static void mptcp_parse_option(const struct sk_buff *skb,
>> ptr++;
>>
>> flags = (*ptr++) & MPTCP_DSS_FLAG_MASK;
>> - mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
>> mp_opt->dsn64 = (flags & MPTCP_DSS_DSN64) != 0;
>> mp_opt->use_map = (flags & MPTCP_DSS_HAS_MAP) != 0;
>> mp_opt->ack64 = (flags & MPTCP_DSS_ACK64) != 0;
>> @@ -178,6 +177,7 @@ static void mptcp_parse_option(const struct sk_buff *skb,
>> }
>>
>> if (mp_opt->use_map) {
>> + mp_opt->data_fin = (flags & MPTCP_DSS_DATA_FIN) != 0;
>> if (mp_opt->dsn64)
>> expected_opsize += TCPOLEN_MPTCP_DSS_MAP64;
>> else
>
> One minor thing I noticed while reviewing: Sashiko previously pointed out
> in a comment that the 'pr_debug' logging 'mp_opt->data_fin' might be
> problematic because it's printed before data_fin is actually assigned
> (since data_fin is now set only inside the if (mp_opt->use_map) block).
>
> I think it would be cleaner to move the pr_debug call after the data_fin
> assignment, so the logged value is always meaningful and consistent with
> the actual parsed state, like:
(...)
> This change isn't critical to the fix itself, so feel free to let Paolo/Matt and
> other Maintainers decide if it should go in now, later, or not at all.
Probably best to fix that now, to avoid getting confused when looking at
debug info. Do you mind doing that in a v3, please?
pw-bot: changes-requested
> A couple of additional notes for future submissions (just friendly reminders):
>
> - The subject-prefix convention for MPTCP patches is typically [PATCH mptcp-net]
> for bug fixes targeting the net tree, or [PATCH mptcp-next] for new features.
> Since this is a fix, something like [PATCH mptcp-net v2] would be more appropriate.
For a "one-off" or urgent fix for MPTCP, that's OK to send patches to
the netdev ML directly. In this case, please use the "net" prefix, see:
https://docs.kernel.org/process/maintainer-netdev.html
For other kind of patches specific to MPTCP, please send them only to
the MPTCP ML with the 'mptcp-net' or 'mptcp-next' prefixes. Just to be
clear: here you can send the v3 to the same people and lists -- you
missed Simon apparently, did you not use get_maintainer.pl script? --
with the 'net' prefix ([PATCH net v3]).
> - It's also helpful to include a Link: to the previous version (v1) in the changelog,
> so reviewers can easily track the discussion history.
If I may add, please also send new version in a separate thread, not as
a reply, not to confuse various tools, as mentioned in the same doc.
Cheers,
Matt
--
Sponsored by the NGI0 Core fund.
^ permalink raw reply
* [PATCH net-next] rndis_host: add overflow check in rndis_rx_fixup()
From: Greg Kroah-Hartman @ 2026-07-09 12:24 UTC (permalink / raw)
To: netdev, linux-usb
Cc: linux-kernel, Griffin Kroah-Hartman, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Shaoxu Liu,
Greg Kroah-Hartman
From: Griffin Kroah-Hartman <griffin@kroah.com>
Add an overflow check to ensure that data_offset + data_len + 8 does not
wrap, which would enable an OOB read of the USB data buffer.
Assisted-by: gkh_clanker_1000
Cc: Andrew Lunn <andrew+netdev@lunn.ch>
Cc: "David S. Miller" <davem@davemloft.net>
Cc: Eric Dumazet <edumazet@google.com>
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: Paolo Abeni <pabeni@redhat.com>
Cc: Shaoxu Liu <shaoxul@foxmail.com>
Signed-off-by: Griffin Kroah-Hartman <griffin@kroah.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
---
drivers/net/usb/rndis_host.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 5e39d05a2d7b..37d4865f5c5e 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -14,6 +14,7 @@
#include <linux/usb/cdc.h>
#include <linux/usb/usbnet.h>
#include <linux/usb/rndis_host.h>
+#include <linux/overflow.h>
/*
@@ -506,6 +507,7 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
struct rndis_data_hdr *hdr = (void *)skb->data;
struct sk_buff *skb2;
u32 msg_type, msg_len, data_offset, data_len;
+ u32 overflow_check;
msg_type = le32_to_cpu(hdr->msg_type);
msg_len = le32_to_cpu(hdr->msg_len);
@@ -514,7 +516,9 @@ int rndis_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
/* don't choke if we see oob, per-packet data, etc */
if (unlikely(msg_type != RNDIS_MSG_PACKET || skb->len < msg_len
- || (data_offset + data_len + 8) > msg_len)) {
+ || (data_offset + data_len + 8) > msg_len
+ || check_add_overflow(data_offset, data_len, &overflow_check)
+ || check_add_overflow(overflow_check, 8, &overflow_check))) {
dev->net->stats.rx_frame_errors++;
netdev_dbg(dev->net, "bad rndis message %d/%d/%d/%d, len %d\n",
le32_to_cpu(hdr->msg_type),
--
2.55.0
^ permalink raw reply related
* [PATCH] docs: packing: fix brackets
From: Manuel Ebner @ 2026-07-09 12:14 UTC (permalink / raw)
To: Vladimir Oltean, Jonathan Corbet, Shuah Khan
Cc: Manuel Ebner, netdev, linux-doc, linux-kernel
Add two ')' to nested functions in code block.
Signed-off-by: Manuel Ebner <manuelebner@mailbox.org>
---
Documentation/core-api/packing.rst | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/Documentation/core-api/packing.rst b/Documentation/core-api/packing.rst
index f68f1e08fef9..cff1a262efce 100644
--- a/Documentation/core-api/packing.rst
+++ b/Documentation/core-api/packing.rst
@@ -330,7 +330,7 @@ Here is an example of how to use the fields APIs:
void unpack_your_data(const packed_buf_t *buf, struct data *unpacked)
{
- BUILD_BUG_ON(sizeof(*buf) != SIZE;
+ BUILD_BUG_ON(sizeof(*buf) != SIZE);
unpack_fields(buf, sizeof(*buf), unpacked, fields,
QUIRK_LITTLE_ENDIAN);
@@ -338,7 +338,7 @@ Here is an example of how to use the fields APIs:
void pack_your_data(const struct data *unpacked, packed_buf_t *buf)
{
- BUILD_BUG_ON(sizeof(*buf) != SIZE;
+ BUILD_BUG_ON(sizeof(*buf) != SIZE);
pack_fields(buf, sizeof(*buf), unpacked, fields,
QUIRK_LITTLE_ENDIAN);
--
2.54.0
^ permalink raw reply related
* RE: [PATCH v3 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback
From: Chia-Yu Chang (Nokia) @ 2026-07-09 12:06 UTC (permalink / raw)
To: Koen De Schepper (Nokia), Alexei Starovoitov, jolsa@kernel.org,
yonghong.song@linux.dev, song@kernel.org,
linux-kselftest@vger.kernel.org, memxor@gmail.com,
shuah@kernel.org, martin.lau@linux.dev, ast@kernel.org,
daniel@iogearbox.net, andrii@kernel.org, eddyz87@gmail.com,
horms@kernel.org, dsahern@kernel.org, bpf@vger.kernel.org,
netdev@vger.kernel.org, pabeni@redhat.com, jhs@mojatatu.com,
kuba@kernel.org, stephen@networkplumber.org, davem@davemloft.net,
edumazet@google.com, andrew+netdev@lunn.ch,
donald.hunter@gmail.com, kuniyu@google.com, ij@kernel.org,
ncardwell@google.com, g.white@cablelabs.com,
ingemar.s.johansson@ericsson.com, mirja.kuehlewind@ericsson.com,
cheshire@apple.com, rs.ietf@gmx.at, Jason_Livingood@comcast.com,
vidhi_goel@apple.com
In-Reply-To: <DU0PR07MB844141FCBD1AD6F40FE08D2EB9F62@DU0PR07MB8441.eurprd07.prod.outlook.com>
> -----Original Message-----
> From: Koen De Schepper (Nokia) <koen.de_schepper@nokia-bell-labs.com>
> Sent: Wednesday, July 1, 2026 6:17 PM
> To: Alexei Starovoitov <alexei.starovoitov@gmail.com>; Chia-Yu Chang (Nokia) <chia-yu.chang@nokia-bell-labs.com>; jolsa@kernel.org; yonghong.song@linux.dev; song@kernel.org; linux-kselftest@vger.kernel.org; memxor@gmail.com; shuah@kernel.org; martin.lau@linux.dev; ast@kernel.org; daniel@iogearbox.net; andrii@kernel.org; eddyz87@gmail.com; horms@kernel.org; dsahern@kernel.org; bpf@vger.kernel.org; netdev@vger.kernel.org; pabeni@redhat.com; jhs@mojatatu.com; kuba@kernel.org; stephen@networkplumber.org; davem@davemloft.net; edumazet@google.com; andrew+netdev@lunn.ch; donald.hunter@gmail.com; kuniyu@google.com; ij@kernel.org; ncardwell@google.com; g.white@cablelabs.com; ingemar.s.johansson@ericsson.com; mirja.kuehlewind@ericsson.com; cheshire@apple.com; rs.ietf@gmx.at; Jason_Livingood@comcast.com; vidhi_goel@apple.com
> Subject: RE: [PATCH v3 net-next 1/1] tcp: Replace min_tso_segs() with tso_segs() CC callback
[...]
>
> > You have to explain why Prague CC cannot rely on autosizing.
> > To me it sounds like a red flag. autosizing logic was there for a decade, if not more.
> > And now you're arguing that your CC logic is special and it deserves new API and breakage of existing convention.
> > Maybe you should step back and reconsider.
>
> Hi Alexei,
>
> >>You have to explain why Prague CC cannot rely on autosizing.
> >>To me it sounds like a red flag. autosizing logic was there for a decade, if not more.
> >>And now you're arguing that your CC logic is special and it deserves new API and breakage of existing convention.
> >>Maybe you should step back and reconsider.
>
> The objective behind Prague auto-sizing is that the TSO burst should not create a queuing latency bigger than 250us, on a bottleneck link rate that is the pacing rate. The rationale is that the L4S AQMs are allowed to have a very small threshold (often somewhere between 0.5ms to 1ms). When the pacing rate is 96Mbps we start allowing TSO size of 2, etc... Below 96Mbps the TSO size is 1, and below 48Mbps the potential serialization time of a single packet is bigger than 250us. You will also see in other patches that we limit the serialization time of one MTU to 10ms when the rate goes lower than 1Mbps by limiting the max MTU (going down to a minimum pacing rate of 100kbps as the minimum sending rate).
> L4S AQMs are designed with these parameters in mind. As AQMs usually work packet per packet and evaluate waiting time in the queue, definitely the minimum inter-packet departure time needs to be bigger than the serialization time - 0.5ms or packets will get marked without necessarily using the full link capacity.
>
> The current autosizing algo has as objective to scale the TSO size depending on both pacing rate and RTT. It targets a 1ms queue delay burst when the RTT is bigger than 3ms, but when the RTT is smaller it further increases the TSO-size. The rationale behind this is that a bigger TSO-size results in a bigger chance of loss, and that loss is easier to retransmit if the RTT is smaller.
>
> So, the current algorithm does not line up with the Prague expectations. Is allows bursts of 1ms instead of 250us and it allows even bigger bursts if the minimum RTT is below 3ms (for instance 27ms burst at 10Mbps and 1ms RTT).
>
> I see following options how to include the Prague requirement of 250us burst instead of 1ms and not increasing TSO if the RTT is lower than 3ms:
> - Let Prague do the calculation and set the desired TSO size
> - previously done with an extra hook to overwrite the autosize, but it was already commented to avoid the extra hook
> - change the existing hook and add a fixed or max TSO size (current patch did the fixed TSO overruling, maybe a max could be more general as it would always be lower than the current calculated autosize)
> - Add a cc settable parameter max-TSO-burst-time to let the current autosize do the extra calculation and take this extra check into account
> - we are open to any other suggestions...
>
> Koen.
Hi Alexei,
I see Koen had responded to your question in above email.
Would you please let us know what's the suggested to proceed?
Thanks!
Chia-Yu
^ permalink raw reply
* [PATCH net-next v5] selftests/net/openvswitch: add ICMPv6 echo type match test
From: Minxi Hou @ 2026-07-09 12:05 UTC (permalink / raw)
To: netdev
Cc: aconole, echaudro, i.maximets, i.maximets, davem, edumazet, kuba,
pabeni, horms, shuah, dev, linux-kselftest, Minxi Hou
Register OVS_KEY_ATTR_ICMPV6 in the flow key parser so that
icmpv6(type=...) can be used in flow specifications. Without this
registration the parser silently drops the token and the kernel
rejects the flow with EINVAL because the expected ICMPv6 key
attribute is missing.
While here, add convert_int() to the ovs_key_ipv6 and ovs_key_icmp
fields_map entries so that specifying a field value produces the
correct wildcard mask. The IPv6 flow label uses convert_int(20) to
produce a 20-bit mask (0x000FFFFF), matching the kernel constraint in
flow_netlink.c that rejects masks with bits 20-31 set; byte-wide
fields use convert_int(8). The ipv4 counterpart already does this via
convert_int(); the ipv6 and icmp classes were simply missing the fifth
tuple element. Existing callers that pass empty parentheses are
unaffected because convert_int("") returns (0, 0).
Add test_icmpv6 exercising the ICMPv6 echo flow key. The test uses
static neighbour entries with nud permanent to prevent racy NDP, then
verifies in three steps: install icmpv6(type=128) and
icmpv6(type=129) flows and confirm ping works, remove the flows and
confirm ping fails, reinstall and confirm recovery.
Signed-off-by: Minxi Hou <houminxi@gmail.com>
Reviewed-by: Aaron Conole <aconole@redhat.com>
---
v4 -> v5: rebase onto latest net-next (2026-07-09), add ksft_skip probe for ICMPv6 key support
.../selftests/net/openvswitch/openvswitch.sh | 81 +++++++++++++++++++
.../selftests/net/openvswitch/ovs-dpctl.py | 26 ++++--
2 files changed, 100 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/net/openvswitch/openvswitch.sh b/tools/testing/selftests/net/openvswitch/openvswitch.sh
index f75ee723415a..853dbc1b00d7 100755
--- a/tools/testing/selftests/net/openvswitch/openvswitch.sh
+++ b/tools/testing/selftests/net/openvswitch/openvswitch.sh
@@ -33,6 +33,7 @@ tests="
flow_set flow-set: Flow modify
action_set set: SET action rewrites fields
trunc trunc: output truncation
+ icmpv6 icmpv6: ICMPv6 echo type match
psample psample: Sampling packets with psample"
info() {
@@ -530,6 +531,86 @@ test_trunc() {
return 0
}
+# icmpv6 test
+# - static neighbours to bypass NDP (nud permanent)
+# - icmpv6(type=128) echo request, icmpv6(type=129) echo reply
+# - remove flows and verify ping fails, reinstall and recover
+test_icmpv6() {
+ local t="test_icmpv6"
+ local v6="eth_type(0x86dd),ipv6(proto=58)"
+
+ sbx_add "$t" || return $?
+ ovs_add_dp "$t" icmpv6 || return 1
+
+ info "create namespaces"
+ for ns in client server; do
+ ovs_add_netns_and_veths "$t" "icmpv6" \
+ "$ns" "${ns:0:1}0" "${ns:0:1}1" || return 1
+ done
+
+ ip netns exec client ip addr add fd00::1/64 dev c1 nodad
+ ip netns exec client ip link set c1 up
+ ip netns exec server ip addr add fd00::2/64 dev s1 nodad
+ ip netns exec server ip link set s1 up
+
+ local cl_mac sl_mac
+ cl_mac=$(ip netns exec client ip link show c1 \
+ | awk '/link\/ether/ {print $2}')
+ [ -z "$cl_mac" ] && \
+ { info "failed to get c1 hwaddr"; return 1; }
+ sl_mac=$(ip netns exec server ip link show s1 \
+ | awk '/link\/ether/ {print $2}')
+ [ -z "$sl_mac" ] && \
+ { info "failed to get s1 hwaddr"; return 1; }
+ ip netns exec client ip -6 neigh add fd00::2 \
+ lladdr "$sl_mac" nud permanent dev c1 || return 1
+ ip netns exec server ip -6 neigh add fd00::1 \
+ lladdr "$cl_mac" nud permanent dev s1 || return 1
+
+ # Probe: check if kernel supports icmpv6 flow key.
+ ovs_add_flow "$t" icmpv6 \
+ "in_port(1),eth(),$v6,icmpv6(type=128)" \
+ '2' &>/dev/null
+ if [ $? -ne 0 ]; then
+ info "no support for icmpv6 key - skipping"
+ ovs_exit_sig
+ return $ksft_skip
+ fi
+ ovs_del_flows "$t" icmpv6
+
+ ovs_add_flow "$t" icmpv6 \
+ "in_port(1),eth(),$v6,icmpv6(type=128)" \
+ '2' || return 1
+ ovs_add_flow "$t" icmpv6 \
+ "in_port(2),eth(),$v6,icmpv6(type=129)" \
+ '1' || return 1
+
+ info "verify ICMPv6 echo with type-specific flows"
+ ovs_sbx "$t" ip netns exec client \
+ ping -6 -c 1 -W 2 fd00::2 || return 1
+
+ ovs_del_flows "$t" icmpv6
+
+ info "verify ping fails without echo flows"
+ ovs_sbx "$t" ip netns exec client \
+ ping -6 -c 1 -W 2 fd00::2 >/dev/null 2>&1 \
+ && { info "ping should fail without flows"
+ return 1; }
+
+ ovs_add_flow "$t" icmpv6 \
+ "in_port(1),eth(),$v6,icmpv6(type=128)" \
+ '2' || return 1
+ ovs_add_flow "$t" icmpv6 \
+ "in_port(2),eth(),$v6,icmpv6(type=129)" \
+ '1' || return 1
+
+ info "verify connectivity restored"
+ ovs_sbx "$t" ip netns exec client \
+ ping -6 -c 1 -W 2 fd00::2 || return 1
+
+ return 0
+}
+
# psample test
# - use psample to observe packets
test_psample() {
diff --git a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
index e1ecfad2c03e..f3edd198223f 100644
--- a/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
+++ b/tools/testing/selftests/net/openvswitch/ovs-dpctl.py
@@ -1255,11 +1255,16 @@ class ovskey(nla):
lambda x: ipaddress.IPv6Address(x).packed if x else 0,
convert_ipv6,
),
- ("label", "label", "%d", lambda x: int(x) if x else 0),
- ("proto", "proto", "%d", lambda x: int(x) if x else 0),
- ("tclass", "tclass", "%d", lambda x: int(x) if x else 0),
- ("hlimit", "hlimit", "%d", lambda x: int(x) if x else 0),
- ("frag", "frag", "%d", lambda x: int(x) if x else 0),
+ ("label", "label", "%d", lambda x: int(x) if x else 0,
+ convert_int(20)),
+ ("proto", "proto", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
+ ("tclass", "tclass", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
+ ("hlimit", "hlimit", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
+ ("frag", "frag", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
)
def __init__(
@@ -1344,8 +1349,10 @@ class ovskey(nla):
)
fields_map = (
- ("type", "type", "%d", lambda x: int(x) if x else 0),
- ("code", "code", "%d", lambda x: int(x) if x else 0),
+ ("type", "type", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
+ ("code", "code", "%d", lambda x: int(x) if x else 0,
+ convert_int(8)),
)
def __init__(
@@ -1982,6 +1989,11 @@ class ovskey(nla):
"icmp",
ovskey.ovs_key_icmp,
),
+ (
+ "OVS_KEY_ATTR_ICMPV6",
+ "icmpv6",
+ ovskey.ovs_key_icmpv6,
+ ),
(
"OVS_KEY_ATTR_TCP_FLAGS",
"tcp_flags",
--
2.55.0
^ permalink raw reply related
* [PATCHv2 net-next 3/7] net: usb: use cdc_state in struct usbnet
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
Remove private copies as now a central state can be used.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/net/usb/cdc_ether.c | 9 +++------
drivers/net/usb/rndis_host.c | 6 +++---
2 files changed, 6 insertions(+), 9 deletions(-)
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index e688fb99c61d..76ad4ffa950a 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -85,7 +85,7 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
u8 *buf = intf->cur_altsetting->extra;
int len = intf->cur_altsetting->extralen;
struct usb_interface_descriptor *d;
- struct cdc_state *info = (void *) &dev->data;
+ struct cdc_state *info = &dev->cdc;
int status = -ENODEV;
int rndis;
bool android_rndis_quirk = false;
@@ -336,7 +336,7 @@ EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
{
- struct cdc_state *info = (void *) &dev->data;
+ struct cdc_state *info = &dev->cdc;
struct usb_driver *driver = driver_of(intf);
/* combined interface - nothing to do */
@@ -374,10 +374,7 @@ EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
{
int status;
- struct cdc_state *info = (void *) &dev->data;
-
- BUILD_BUG_ON((sizeof(((struct usbnet *)0)->data)
- < sizeof(struct cdc_state)));
+ struct cdc_state *info = &dev->cdc;
status = usbnet_ether_cdc_bind(dev, intf);
if (status < 0)
diff --git a/drivers/net/usb/rndis_host.c b/drivers/net/usb/rndis_host.c
index 5e39d05a2d7b..d539654687c3 100644
--- a/drivers/net/usb/rndis_host.c
+++ b/drivers/net/usb/rndis_host.c
@@ -57,7 +57,7 @@ EXPORT_SYMBOL_GPL(rndis_status);
static void rndis_msg_indicate(struct usbnet *dev, struct rndis_indicate *msg,
int buflen)
{
- struct cdc_state *info = (void *)&dev->data;
+ struct cdc_state *info = &dev->cdc;
struct device *udev = &info->control->dev;
if (dev->driver_info->indication) {
@@ -90,7 +90,7 @@ static void rndis_msg_indicate(struct usbnet *dev, struct rndis_indicate *msg,
*/
int rndis_command(struct usbnet *dev, struct rndis_msg_hdr *buf, int buflen)
{
- struct cdc_state *info = (void *) &dev->data;
+ struct cdc_state *info = &dev->cdc;
struct usb_cdc_notification notification;
int master_ifnum;
int retval;
@@ -290,7 +290,7 @@ generic_rndis_bind(struct usbnet *dev, struct usb_interface *intf, int flags)
{
int retval;
struct net_device *net = dev->net;
- struct cdc_state *info = (void *) &dev->data;
+ struct cdc_state *info = &dev->cdc;
union {
void *buf;
struct rndis_msg_hdr *header;
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 6/7] net: usb: remove dependencies on cdc_ether
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
Now that the driver no longer exports symbols to act
as a library for other drivers other drivers don't
depend on it. Remove the dependencies.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
v2:
- added to allow removal of dependencies
drivers/net/usb/Kconfig | 7 ++-----
1 file changed, 2 insertions(+), 5 deletions(-)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index da0f6a138f4f..622ff080218e 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -258,7 +258,6 @@ config USB_NET_CDC_EEM
config USB_NET_CDC_NCM
tristate "CDC NCM support"
depends on USB_USBNET
- select USB_NET_CDCETHER
default y
help
This driver provides support for CDC NCM (Network Control Model
@@ -399,7 +398,6 @@ config USB_NET_MCS7830
config USB_NET_RNDIS_HOST
tristate "Host for RNDIS and ActiveSync devices"
depends on USB_USBNET
- select USB_NET_CDCETHER
help
This option enables hosting "Remote NDIS" USB networking links,
as encouraged by Microsoft (instead of CDC Ethernet!) for use in
@@ -494,7 +492,6 @@ config USB_KC2190
config USB_NET_ZAURUS
tristate "Sharp Zaurus (stock ROMs) and compatible"
depends on USB_USBNET
- select USB_NET_CDCETHER
select CRC32
default y
help
@@ -597,7 +594,7 @@ config USB_SIERRA_NET
config USB_VL600
tristate "LG VL600 modem dongle"
- depends on USB_NET_CDCETHER && TTY
+ depends on TTY
select USB_ACM
help
Select this if you want to use an LG Electronics 4G/LTE usb modem
@@ -634,7 +631,7 @@ config USB_NET_AQC111
config USB_RTL8153_ECM
tristate
- depends on USB_NET_CDCETHER && (USB_RTL8152 || USB_RTL8152=n)
+ depends on (USB_RTL8152 || USB_RTL8152=n)
default y
help
This option supports ECM mode for RTL8153 ethernet adapter, when
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 7/7] net: usb: usbnet: remove outdated sanity check
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
The cdc state is now included as a proper member in the descriptor.
There is no point in checking whether it fits into the scratchpad
area. Just remove the check.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
v2:
- added to address concern about maintainability
drivers/net/usb/usbnet.c | 3 ---
1 file changed, 3 deletions(-)
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index ce932c81382e..0347f6887222 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -2457,9 +2457,6 @@ int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
struct usb_driver *driver = driver_of(intf);
struct usb_cdc_parsed_header header;
- if (sizeof(dev->data) < sizeof(*info))
- return -EDOM;
-
/* expect strict spec conformance for the descriptors, but
* cope with firmware which stores them in the wrong place
*/
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 5/7] net: usb: move exported symbols from cdc_ether to usbnet
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
Move the rest of the symbols to usbnet, so that the cdc_ether
driver does not need to be loaded as a library.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
drivers/net/usb/cdc_ether.c | 372 ------------------------------------
drivers/net/usb/usbnet.c | 356 ++++++++++++++++++++++++++++++++++
include/linux/usb/usbnet.h | 17 ++
3 files changed, 373 insertions(+), 372 deletions(-)
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index 76ad4ffa950a..6bf6538f3468 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -19,378 +19,6 @@
#include <linux/usb/usbnet.h>
-#if IS_ENABLED(CONFIG_USB_NET_RNDIS_HOST)
-
-static int is_rndis(struct usb_interface_descriptor *desc)
-{
- return (desc->bInterfaceClass == USB_CLASS_COMM &&
- desc->bInterfaceSubClass == 2 &&
- desc->bInterfaceProtocol == 0xff);
-}
-
-static int is_activesync(struct usb_interface_descriptor *desc)
-{
- return (desc->bInterfaceClass == USB_CLASS_MISC &&
- desc->bInterfaceSubClass == 1 &&
- desc->bInterfaceProtocol == 1);
-}
-
-static int is_wireless_rndis(struct usb_interface_descriptor *desc)
-{
- return (desc->bInterfaceClass == USB_CLASS_WIRELESS_CONTROLLER &&
- desc->bInterfaceSubClass == 1 &&
- desc->bInterfaceProtocol == 3);
-}
-
-static int is_novatel_rndis(struct usb_interface_descriptor *desc)
-{
- return (desc->bInterfaceClass == USB_CLASS_MISC &&
- desc->bInterfaceSubClass == 4 &&
- desc->bInterfaceProtocol == 1);
-}
-
-#else
-
-#define is_rndis(desc) 0
-#define is_activesync(desc) 0
-#define is_wireless_rndis(desc) 0
-#define is_novatel_rndis(desc) 0
-
-#endif
-
-static const u8 mbm_guid[16] = {
- 0xa3, 0x17, 0xa8, 0x8b, 0x04, 0x5e, 0x4f, 0x01,
- 0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
-};
-
-/* We need to override usbnet_*_link_ksettings in bind() */
-static const struct ethtool_ops cdc_ether_ethtool_ops = {
- .get_link = usbnet_get_link,
- .nway_reset = usbnet_nway_reset,
- .get_drvinfo = usbnet_get_drvinfo,
- .get_msglevel = usbnet_get_msglevel,
- .set_msglevel = usbnet_set_msglevel,
- .get_ts_info = ethtool_op_get_ts_info,
- .get_link_ksettings = usbnet_get_link_ksettings_internal,
- .set_link_ksettings = NULL,
-};
-
-/* probes control interface, claims data interface, collects the bulk
- * endpoints, activates data interface (if needed), maybe sets MTU.
- * all pure cdc, except for certain firmware workarounds, and knowing
- * that rndis uses one different rule.
- */
-int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
-{
- u8 *buf = intf->cur_altsetting->extra;
- int len = intf->cur_altsetting->extralen;
- struct usb_interface_descriptor *d;
- struct cdc_state *info = &dev->cdc;
- int status = -ENODEV;
- int rndis;
- bool android_rndis_quirk = false;
- struct usb_driver *driver = driver_of(intf);
- struct usb_cdc_parsed_header header;
-
- if (sizeof(dev->data) < sizeof(*info))
- return -EDOM;
-
- /* expect strict spec conformance for the descriptors, but
- * cope with firmware which stores them in the wrong place
- */
- if (len == 0 && dev->udev->actconfig->extralen) {
- /* Motorola SB4100 (and others: Brad Hards says it's
- * from a Broadcom design) put CDC descriptors here
- */
- buf = dev->udev->actconfig->extra;
- len = dev->udev->actconfig->extralen;
- dev_dbg(&intf->dev, "CDC descriptors on config\n");
- }
-
- /* Maybe CDC descriptors are after the endpoint? This bug has
- * been seen on some 2Wire Inc RNDIS-ish products.
- */
- if (len == 0) {
- struct usb_host_endpoint *hep;
-
- hep = intf->cur_altsetting->endpoint;
- if (hep) {
- buf = hep->extra;
- len = hep->extralen;
- }
- if (len)
- dev_dbg(&intf->dev,
- "CDC descriptors on endpoint\n");
- }
-
- /* this assumes that if there's a non-RNDIS vendor variant
- * of cdc-acm, it'll fail RNDIS requests cleanly.
- */
- rndis = (is_rndis(&intf->cur_altsetting->desc) ||
- is_activesync(&intf->cur_altsetting->desc) ||
- is_wireless_rndis(&intf->cur_altsetting->desc) ||
- is_novatel_rndis(&intf->cur_altsetting->desc));
-
- memset(info, 0, sizeof(*info));
- info->control = intf;
-
- cdc_parse_cdc_header(&header, intf, buf, len);
-
- info->u = header.usb_cdc_union_desc;
- info->header = header.usb_cdc_header_desc;
- info->ether = header.usb_cdc_ether_desc;
- if (!info->u) {
- if (rndis) {
- goto skip;
- } else {
- /* in that case a quirk is mandatory */
- dev_err(&dev->udev->dev, "No union descriptors\n");
- goto bad_desc;
- }
- }
- /* we need a master/control interface (what we're
- * probed with) and a slave/data interface; union
- * descriptors sort this all out.
- */
- info->control = usb_ifnum_to_if(dev->udev, info->u->bMasterInterface0);
- info->data = usb_ifnum_to_if(dev->udev, info->u->bSlaveInterface0);
- if (!info->control || !info->data) {
- dev_dbg(&intf->dev,
- "master #%u/%p slave #%u/%p\n",
- info->u->bMasterInterface0,
- info->control,
- info->u->bSlaveInterface0,
- info->data);
- /* fall back to hard-wiring for RNDIS */
- if (rndis) {
- android_rndis_quirk = true;
- goto skip;
- }
- dev_err(&intf->dev, "bad CDC descriptors\n");
- goto bad_desc;
- }
- if (info->control != intf) {
- /* Ambit USB Cable Modem (and maybe others)
- * interchanges master and slave interface.
- */
- if (info->data == intf) {
- info->data = info->control;
- info->control = intf;
- } else {
- dev_err(&intf->dev, "bogus CDC Union\n");
- goto bad_desc;
- }
- }
-
- /* some devices merge these - skip class check */
- if (info->control == info->data)
- goto skip;
-
- /* a data interface altsetting does the real i/o */
- d = &info->data->cur_altsetting->desc;
- if (d->bInterfaceClass != USB_CLASS_CDC_DATA) {
- dev_err(&intf->dev, "slave class %u\n", d->bInterfaceClass);
- goto bad_desc;
- }
-skip:
- /* Communication class functions with bmCapabilities are not
- * RNDIS. But some Wireless class RNDIS functions use
- * bmCapabilities for their own purpose. The failsafe is
- * therefore applied only to Communication class RNDIS
- * functions. The rndis test is redundant, but a cheap
- * optimization.
- */
- if (rndis && is_rndis(&intf->cur_altsetting->desc) &&
- header.usb_cdc_acm_descriptor &&
- header.usb_cdc_acm_descriptor->bmCapabilities) {
- dev_err(&intf->dev,
- "ACM capabilities %02x, not really RNDIS?\n",
- header.usb_cdc_acm_descriptor->bmCapabilities);
- goto bad_desc;
- }
-
- if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) {
- dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize);
- /* because of Zaurus, we may be ignoring the host
- * side link address we were given.
- */
- }
-
- if (header.usb_cdc_mdlm_desc &&
- memcmp(header.usb_cdc_mdlm_desc->bGUID, mbm_guid, 16)) {
- dev_err(&intf->dev, "GUID doesn't match\n");
- goto bad_desc;
- }
-
- if (header.usb_cdc_mdlm_detail_desc &&
- header.usb_cdc_mdlm_detail_desc->bLength <
- (sizeof(struct usb_cdc_mdlm_detail_desc) + 1)) {
- dev_err(&intf->dev, "Descriptor too short\n");
- goto bad_desc;
- }
-
-
-
- /* Microsoft ActiveSync based and some regular RNDIS devices lack the
- * CDC descriptors, so we'll hard-wire the interfaces and not check
- * for descriptors.
- *
- * Some Android RNDIS devices have a CDC Union descriptor pointing
- * to non-existing interfaces. Ignore that and attempt the same
- * hard-wired 0 and 1 interfaces.
- */
- if (rndis && (!info->u || android_rndis_quirk)) {
- info->control = usb_ifnum_to_if(dev->udev, 0);
- info->data = usb_ifnum_to_if(dev->udev, 1);
- if (!info->control || !info->data || info->control != intf) {
- dev_err(&intf->dev,
- "rndis: master #0/%p slave #1/%p\n",
- info->control,
- info->data);
- goto bad_desc;
- }
-
- } else if (!info->header || (!rndis && !info->ether)) {
- dev_err(&intf->dev, "missing cdc %s%s%sdescriptor\n",
- info->header ? "" : "header ",
- info->u ? "" : "union ",
- info->ether ? "" : "ether ");
- goto bad_desc;
- }
-
- /* claim data interface and set it up ... with side effects.
- * network traffic can't flow until an altsetting is enabled.
- */
- if (info->data != info->control) {
- status = usb_driver_claim_interface(driver, info->data, dev);
- if (status < 0) {
- dev_err(&intf->dev, "Second interface unclaimable\n");
- goto bad_desc;
- }
- }
- status = usbnet_get_endpoints(dev, info->data);
- if (status < 0) {
- dev_dbg(&intf->dev, "Mandatory endpoints missing\n");
- goto bail_out_and_release;
- }
-
- /* status endpoint: optional for CDC Ethernet, not RNDIS (or ACM) */
- if (info->data != info->control)
- dev->status = NULL;
- if (info->control->cur_altsetting->desc.bNumEndpoints == 1) {
- struct usb_endpoint_descriptor *desc;
-
- dev->status = &info->control->cur_altsetting->endpoint[0];
- desc = &dev->status->desc;
- if (!usb_endpoint_is_int_in(desc) ||
- (le16_to_cpu(desc->wMaxPacketSize)
- < sizeof(struct usb_cdc_notification)) ||
- !desc->bInterval) {
- dev_dbg(&intf->dev, "bad notification endpoint\n");
- dev->status = NULL;
- }
- }
- if (rndis && !dev->status) {
- dev_err(&intf->dev, "missing RNDIS status endpoint\n");
- status = -ENODEV;
- goto bail_out_and_release;
- }
-
- /* override ethtool_ops */
- dev->net->ethtool_ops = &cdc_ether_ethtool_ops;
-
- return 0;
-
-bail_out_and_release:
- usb_set_intfdata(info->data, NULL);
- if (info->data != info->control)
- usb_driver_release_interface(driver, info->data);
-bad_desc:
- return status;
-}
-EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
-
-
-/* like usbnet_generic_cdc_bind() but handles filter initialization
- * correctly
- */
-int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
-{
- int rv;
-
- rv = usbnet_generic_cdc_bind(dev, intf);
- if (rv < 0)
- goto bail_out;
-
- /* Some devices don't initialise properly. In particular
- * the packet filter is not reset. There are devices that
- * don't do reset all the way. So the packet filter should
- * be set to a sane initial value.
- */
- usbnet_cdc_update_filter(dev);
-
-bail_out:
- return rv;
-}
-EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
-
-void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
-{
- struct cdc_state *info = &dev->cdc;
- struct usb_driver *driver = driver_of(intf);
-
- /* combined interface - nothing to do */
- if (info->data == info->control)
- return;
-
- /* disconnect master --> disconnect slave */
- if (intf == info->control && info->data) {
- /* ensure immediate exit from usbnet_disconnect */
- usb_set_intfdata(info->data, NULL);
- usb_driver_release_interface(driver, info->data);
- info->data = NULL;
- }
-
- /* and vice versa (just in case) */
- else if (intf == info->data && info->control) {
- /* ensure immediate exit from usbnet_disconnect */
- usb_set_intfdata(info->control, NULL);
- usb_driver_release_interface(driver, info->control);
- info->control = NULL;
- }
-}
-EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
-
-/* Communications Device Class, Ethernet Control model
- *
- * Takes two interfaces. The DATA interface is inactive till an altsetting
- * is selected. Configuration data includes class descriptors. There's
- * an optional status endpoint on the control interface.
- *
- * This should interop with whatever the 2.4 "CDCEther.c" driver
- * (by Brad Hards) talked with, with more functionality.
- */
-
-int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
-{
- int status;
- struct cdc_state *info = &dev->cdc;
-
- status = usbnet_ether_cdc_bind(dev, intf);
- if (status < 0)
- return status;
-
- status = usbnet_get_ethernet_addr(dev, info->ether->iMACAddress);
- if (status < 0) {
- usb_set_intfdata(info->data, NULL);
- usb_driver_release_interface(driver_of(intf), info->data);
- return status;
- }
-
- return 0;
-}
-EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
-
static int usbnet_cdc_zte_bind(struct usbnet *dev, struct usb_interface *intf)
{
int status = usbnet_cdc_bind(dev, intf);
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 14e9f1b1e0a2..ce932c81382e 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -2369,6 +2369,362 @@ int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
return 1;
}
EXPORT_SYMBOL_GPL(usbnet_cdc_zte_rx_fixup);
+
+
+#if IS_ENABLED(CONFIG_USB_NET_RNDIS_HOST)
+
+static int is_rndis(struct usb_interface_descriptor *desc)
+{
+ return (desc->bInterfaceClass == USB_CLASS_COMM &&
+ desc->bInterfaceSubClass == 2 &&
+ desc->bInterfaceProtocol == 0xff);
+}
+
+static int is_activesync(struct usb_interface_descriptor *desc)
+{
+ return (desc->bInterfaceClass == USB_CLASS_MISC &&
+ desc->bInterfaceSubClass == 1 &&
+ desc->bInterfaceProtocol == 1);
+}
+
+static int is_wireless_rndis(struct usb_interface_descriptor *desc)
+{
+ return (desc->bInterfaceClass == USB_CLASS_WIRELESS_CONTROLLER &&
+ desc->bInterfaceSubClass == 1 &&
+ desc->bInterfaceProtocol == 3);
+}
+
+static int is_novatel_rndis(struct usb_interface_descriptor *desc)
+{
+ return (desc->bInterfaceClass == USB_CLASS_MISC &&
+ desc->bInterfaceSubClass == 4 &&
+ desc->bInterfaceProtocol == 1);
+}
+
+#else
+
+#define is_rndis(desc) 0
+#define is_activesync(desc) 0
+#define is_wireless_rndis(desc) 0
+#define is_novatel_rndis(desc) 0
+
+#endif
+
+/* Communications Device Class, Ethernet Control model
+ *
+ * Takes two interfaces. The DATA interface is inactive till an altsetting
+ * is selected. Configuration data includes class descriptors. There's
+ * an optional status endpoint on the control interface.
+ *
+ * This should interop with whatever the 2.4 "CDCEther.c" driver
+ * (by Brad Hards) talked with, with more functionality.
+ */
+
+int usbnet_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+ int status;
+ struct cdc_state *info = &dev->cdc;
+
+ status = usbnet_ether_cdc_bind(dev, intf);
+ if (status < 0)
+ return status;
+
+ status = usbnet_get_ethernet_addr(dev, info->ether->iMACAddress);
+ if (status < 0) {
+ usb_set_intfdata(info->data, NULL);
+ usb_driver_release_interface(driver_of(intf), info->data);
+ return status;
+ }
+
+ return 0;
+}
+EXPORT_SYMBOL_GPL(usbnet_cdc_bind);
+
+/* probes control interface, claims data interface, collects the bulk
+ * endpoints, activates data interface (if needed), maybe sets MTU.
+ * all pure cdc, except for certain firmware workarounds, and knowing
+ * that rndis uses one different rule.
+ */
+int usbnet_generic_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+ u8 *buf = intf->cur_altsetting->extra;
+ int len = intf->cur_altsetting->extralen;
+ struct usb_interface_descriptor *d;
+ struct cdc_state *info = &dev->cdc;
+ int status = -ENODEV;
+ int rndis;
+ bool android_rndis_quirk = false;
+ struct usb_driver *driver = driver_of(intf);
+ struct usb_cdc_parsed_header header;
+
+ if (sizeof(dev->data) < sizeof(*info))
+ return -EDOM;
+
+ /* expect strict spec conformance for the descriptors, but
+ * cope with firmware which stores them in the wrong place
+ */
+ if (len == 0 && dev->udev->actconfig->extralen) {
+ /* Motorola SB4100 (and others: Brad Hards says it's
+ * from a Broadcom design) put CDC descriptors here
+ */
+ buf = dev->udev->actconfig->extra;
+ len = dev->udev->actconfig->extralen;
+ dev_dbg(&intf->dev, "CDC descriptors on config\n");
+ }
+
+ /* Maybe CDC descriptors are after the endpoint? This bug has
+ * been seen on some 2Wire Inc RNDIS-ish products.
+ */
+ if (len == 0) {
+ struct usb_host_endpoint *hep;
+
+ hep = intf->cur_altsetting->endpoint;
+ if (hep) {
+ buf = hep->extra;
+ len = hep->extralen;
+ }
+ if (len)
+ dev_dbg(&intf->dev,
+ "CDC descriptors on endpoint\n");
+ }
+
+ /* this assumes that if there's a non-RNDIS vendor variant
+ * of cdc-acm, it'll fail RNDIS requests cleanly.
+ */
+ rndis = (is_rndis(&intf->cur_altsetting->desc) ||
+ is_activesync(&intf->cur_altsetting->desc) ||
+ is_wireless_rndis(&intf->cur_altsetting->desc) ||
+ is_novatel_rndis(&intf->cur_altsetting->desc));
+
+ memset(info, 0, sizeof(*info));
+ info->control = intf;
+
+ cdc_parse_cdc_header(&header, intf, buf, len);
+
+ info->u = header.usb_cdc_union_desc;
+ info->header = header.usb_cdc_header_desc;
+ info->ether = header.usb_cdc_ether_desc;
+ if (!info->u) {
+ if (rndis) {
+ goto skip;
+ } else {
+ /* in that case a quirk is mandatory */
+ dev_err(&dev->udev->dev, "No union descriptors\n");
+ goto bad_desc;
+ }
+ }
+ /* we need a master/control interface (what we're
+ * probed with) and a slave/data interface; union
+ * descriptors sort this all out.
+ */
+ info->control = usb_ifnum_to_if(dev->udev, info->u->bMasterInterface0);
+ info->data = usb_ifnum_to_if(dev->udev, info->u->bSlaveInterface0);
+ if (!info->control || !info->data) {
+ dev_dbg(&intf->dev,
+ "master #%u/%p slave #%u/%p\n",
+ info->u->bMasterInterface0,
+ info->control,
+ info->u->bSlaveInterface0,
+ info->data);
+ /* fall back to hard-wiring for RNDIS */
+ if (rndis) {
+ android_rndis_quirk = true;
+ goto skip;
+ }
+ dev_err(&intf->dev, "bad CDC descriptors\n");
+ goto bad_desc;
+ }
+ if (info->control != intf) {
+ /* Ambit USB Cable Modem (and maybe others)
+ * interchanges master and slave interface.
+ */
+ if (info->data == intf) {
+ info->data = info->control;
+ info->control = intf;
+ } else {
+ dev_err(&intf->dev, "bogus CDC Union\n");
+ goto bad_desc;
+ }
+ }
+
+ /* some devices merge these - skip class check */
+ if (info->control == info->data)
+ goto skip;
+
+ /* a data interface altsetting does the real i/o */
+ d = &info->data->cur_altsetting->desc;
+ if (d->bInterfaceClass != USB_CLASS_CDC_DATA) {
+ dev_err(&intf->dev, "slave class %u\n", d->bInterfaceClass);
+ goto bad_desc;
+ }
+skip:
+ /* Communication class functions with bmCapabilities are not
+ * RNDIS. But some Wireless class RNDIS functions use
+ * bmCapabilities for their own purpose. The failsafe is
+ * therefore applied only to Communication class RNDIS
+ * functions. The rndis test is redundant, but a cheap
+ * optimization.
+ */
+ if (rndis && is_rndis(&intf->cur_altsetting->desc) &&
+ header.usb_cdc_acm_descriptor &&
+ header.usb_cdc_acm_descriptor->bmCapabilities) {
+ dev_err(&intf->dev,
+ "ACM capabilities %02x, not really RNDIS?\n",
+ header.usb_cdc_acm_descriptor->bmCapabilities);
+ goto bad_desc;
+ }
+
+ if (header.usb_cdc_ether_desc && info->ether->wMaxSegmentSize) {
+ dev->hard_mtu = le16_to_cpu(info->ether->wMaxSegmentSize);
+ /* because of Zaurus, we may be ignoring the host
+ * side link address we were given.
+ */
+ }
+
+ if (header.usb_cdc_mdlm_desc &&
+ memcmp(header.usb_cdc_mdlm_desc->bGUID, mbm_guid, 16)) {
+ dev_err(&intf->dev, "GUID doesn't match\n");
+ goto bad_desc;
+ }
+
+ if (header.usb_cdc_mdlm_detail_desc &&
+ header.usb_cdc_mdlm_detail_desc->bLength <
+ (sizeof(struct usb_cdc_mdlm_detail_desc) + 1)) {
+ dev_err(&intf->dev, "Descriptor too short\n");
+ goto bad_desc;
+ }
+
+
+
+ /* Microsoft ActiveSync based and some regular RNDIS devices lack the
+ * CDC descriptors, so we'll hard-wire the interfaces and not check
+ * for descriptors.
+ *
+ * Some Android RNDIS devices have a CDC Union descriptor pointing
+ * to non-existing interfaces. Ignore that and attempt the same
+ * hard-wired 0 and 1 interfaces.
+ */
+ if (rndis && (!info->u || android_rndis_quirk)) {
+ info->control = usb_ifnum_to_if(dev->udev, 0);
+ info->data = usb_ifnum_to_if(dev->udev, 1);
+ if (!info->control || !info->data || info->control != intf) {
+ dev_err(&intf->dev,
+ "rndis: master #0/%p slave #1/%p\n",
+ info->control,
+ info->data);
+ goto bad_desc;
+ }
+
+ } else if (!info->header || (!rndis && !info->ether)) {
+ dev_err(&intf->dev, "missing cdc %s%s%sdescriptor\n",
+ info->header ? "" : "header ",
+ info->u ? "" : "union ",
+ info->ether ? "" : "ether ");
+ goto bad_desc;
+ }
+
+ /* claim data interface and set it up ... with side effects.
+ * network traffic can't flow until an altsetting is enabled.
+ */
+ if (info->data != info->control) {
+ status = usb_driver_claim_interface(driver, info->data, dev);
+ if (status < 0) {
+ dev_err(&intf->dev, "Second interface unclaimable\n");
+ goto bad_desc;
+ }
+ }
+ status = usbnet_get_endpoints(dev, info->data);
+ if (status < 0) {
+ dev_dbg(&intf->dev, "Mandatory endpoints missing\n");
+ goto bail_out_and_release;
+ }
+
+ /* status endpoint: optional for CDC Ethernet, not RNDIS (or ACM) */
+ if (info->data != info->control)
+ dev->status = NULL;
+ if (info->control->cur_altsetting->desc.bNumEndpoints == 1) {
+ struct usb_endpoint_descriptor *desc;
+
+ dev->status = &info->control->cur_altsetting->endpoint[0];
+ desc = &dev->status->desc;
+ if (!usb_endpoint_is_int_in(desc) ||
+ (le16_to_cpu(desc->wMaxPacketSize)
+ < sizeof(struct usb_cdc_notification)) ||
+ !desc->bInterval) {
+ dev_dbg(&intf->dev, "bad notification endpoint\n");
+ dev->status = NULL;
+ }
+ }
+ if (rndis && !dev->status) {
+ dev_err(&intf->dev, "missing RNDIS status endpoint\n");
+ status = -ENODEV;
+ goto bail_out_and_release;
+ }
+
+ /* override ethtool_ops */
+ dev->net->ethtool_ops = &cdc_ether_ethtool_ops;
+
+ return 0;
+
+bail_out_and_release:
+ usb_set_intfdata(info->data, NULL);
+ if (info->data != info->control)
+ usb_driver_release_interface(driver, info->data);
+bad_desc:
+ return status;
+}
+EXPORT_SYMBOL_GPL(usbnet_generic_cdc_bind);
+
+/* like usbnet_generic_cdc_bind() but handles filter initialization
+ * correctly
+ */
+int usbnet_ether_cdc_bind(struct usbnet *dev, struct usb_interface *intf)
+{
+ int rv;
+
+ rv = usbnet_generic_cdc_bind(dev, intf);
+ if (rv < 0)
+ goto bail_out;
+
+ /* Some devices don't initialise properly. In particular
+ * the packet filter is not reset. There are devices that
+ * don't do reset all the way. So the packet filter should
+ * be set to a sane initial value.
+ */
+ usbnet_cdc_update_filter(dev);
+
+bail_out:
+ return rv;
+}
+EXPORT_SYMBOL_GPL(usbnet_ether_cdc_bind);
+
+void usbnet_cdc_unbind(struct usbnet *dev, struct usb_interface *intf)
+{
+ struct cdc_state *info = &dev->cdc;
+ struct usb_driver *driver = driver_of(intf);
+
+ /* combined interface - nothing to do */
+ if (info->data == info->control)
+ return;
+
+ /* disconnect master --> disconnect slave */
+ if (intf == info->control && info->data) {
+ /* ensure immediate exit from usbnet_disconnect */
+ usb_set_intfdata(info->data, NULL);
+ usb_driver_release_interface(driver, info->data);
+ info->data = NULL;
+ }
+
+ /* and vice versa (just in case) */
+ else if (intf == info->data && info->control) {
+ /* ensure immediate exit from usbnet_disconnect */
+ usb_set_intfdata(info->control, NULL);
+ usb_driver_release_interface(driver, info->control);
+ info->control = NULL;
+ }
+}
+EXPORT_SYMBOL_GPL(usbnet_cdc_unbind);
+
/*-------------------------------------------------------------------------*/
static int __init usbnet_init(void)
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index 79f48eb388ee..b3a77078fb10 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -16,6 +16,11 @@
#include <linux/usb.h>
#include <linux/spinlock.h>
+static const u8 mbm_guid[16] = {
+ 0xa3, 0x17, 0xa8, 0x8b, 0x04, 0x5e, 0x4f, 0x01,
+ 0xa6, 0x07, 0xc0, 0xff, 0xcb, 0x7e, 0x39, 0x2a,
+};
+
struct cdc_state {
struct usb_cdc_header_desc *header;
struct usb_cdc_union_desc *u;
@@ -304,4 +309,16 @@ extern void usbnet_status_stop(struct usbnet *dev);
extern void usbnet_update_max_qlen(struct usbnet *dev);
+/* We need to override usbnet_*_link_ksettings in bind() */
+static const struct ethtool_ops cdc_ether_ethtool_ops = {
+ .get_link = usbnet_get_link,
+ .nway_reset = usbnet_nway_reset,
+ .get_drvinfo = usbnet_get_drvinfo,
+ .get_msglevel = usbnet_get_msglevel,
+ .set_msglevel = usbnet_set_msglevel,
+ .get_ts_info = ethtool_op_get_ts_info,
+ .get_link_ksettings = usbnet_get_link_ksettings_internal,
+ .set_link_ksettings = NULL,
+};
+
#endif /* __LINUX_USB_USBNET_H */
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 4/7] net: usb: int51x1: drop dependency on cdc_ether
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
The driver depended on cdc_ether only for usbnet_cdc_update_filter().
This has been shifted to usbnet. Drop the dependency.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
v2:
- added as missed opportunity
drivers/net/usb/Kconfig | 1 -
1 file changed, 1 deletion(-)
diff --git a/drivers/net/usb/Kconfig b/drivers/net/usb/Kconfig
index 52a5c0922c79..da0f6a138f4f 100644
--- a/drivers/net/usb/Kconfig
+++ b/drivers/net/usb/Kconfig
@@ -563,7 +563,6 @@ config USB_HSO
config USB_NET_INT51X1
tristate "Intellon PLC based usb adapter"
depends on USB_USBNET
- select USB_NET_CDCETHER
help
Choose this option if you're using a 14Mb USB-based PLC
(Powerline Communications) solution with an Intellon
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 2/7] net: usb: usbnet: add cdc_state to struct usbnet
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
In-Reply-To: <20260709120116.1423033-1-oneukum@suse.com>
This allows centralisation of code using cdc_state in usbnet, reducing
code duplication. No functional change intended.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
include/linux/usb/usbnet.h | 16 +++++++++-------
1 file changed, 9 insertions(+), 7 deletions(-)
diff --git a/include/linux/usb/usbnet.h b/include/linux/usb/usbnet.h
index bbf799ccf3b3..79f48eb388ee 100644
--- a/include/linux/usb/usbnet.h
+++ b/include/linux/usb/usbnet.h
@@ -16,6 +16,14 @@
#include <linux/usb.h>
#include <linux/spinlock.h>
+struct cdc_state {
+ struct usb_cdc_header_desc *header;
+ struct usb_cdc_union_desc *u;
+ struct usb_cdc_ether_desc *ether;
+ struct usb_interface *control;
+ struct usb_interface *data;
+};
+
/* interface from usbnet core to each USB networking link we handle */
struct usbnet {
/* housekeeping */
@@ -41,6 +49,7 @@ struct usbnet {
/* protocol/interface state */
struct net_device *net;
int msg_enable;
+ struct cdc_state cdc; /* too common to leave out*/
unsigned long data[5];
u32 xid;
u32 hard_mtu; /* count any extra framing */
@@ -211,13 +220,6 @@ extern int usbnet_write_cmd_async(struct usbnet *dev, u8 cmd, u8 reqtype,
* (notably, using multiple interfaces according to the CDC
* union descriptor) get some helper code.
*/
-struct cdc_state {
- struct usb_cdc_header_desc *header;
- struct usb_cdc_union_desc *u;
- struct usb_cdc_ether_desc *ether;
- struct usb_interface *control;
- struct usb_interface *data;
-};
extern void usbnet_cdc_update_filter(struct usbnet *dev);
extern int usbnet_generic_cdc_bind(struct usbnet *, struct usb_interface *);
--
2.54.0
^ permalink raw reply related
* [PATCHv2 net-next 1/7] net: usb: centralize usbnet_cdc_zte_rx_fixup in usbnet
From: Oliver Neukum @ 2026-07-09 12:01 UTC (permalink / raw)
To: andrew+netdev, davem, edumazet, kuba, pabeni, netdev, linux-usb,
linux-kernel, manuelebner
Cc: Oliver Neukum
This helper is used by multiple drivers using usbnet.
It is better to be provided by usbnet than one of them.
Signed-off-by: Oliver Neukum <oneukum@suse.com>
---
v2:
- spelling issues
- issue with lost synchronization with SPLIT packets
drivers/net/usb/cdc_ether.c | 19 -------------------
drivers/net/usb/usbnet.c | 19 +++++++++++++++++++
2 files changed, 19 insertions(+), 19 deletions(-)
diff --git a/drivers/net/usb/cdc_ether.c b/drivers/net/usb/cdc_ether.c
index b4df32e18461..e688fb99c61d 100644
--- a/drivers/net/usb/cdc_ether.c
+++ b/drivers/net/usb/cdc_ether.c
@@ -404,25 +404,6 @@ static int usbnet_cdc_zte_bind(struct usbnet *dev, struct usb_interface *intf)
return status;
}
-/* Make sure packets have correct destination MAC address
- *
- * A firmware bug observed on some devices (ZTE MF823/831/910) is that the
- * device sends packets with a static, bogus, random MAC address (event if
- * device MAC address has been updated). Always set MAC address to that of the
- * device.
- */
-int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
-{
- if (skb->len < ETH_HLEN || !(skb->data[0] & 0x02))
- return 1;
-
- skb_reset_mac_header(skb);
- ether_addr_copy(eth_hdr(skb)->h_dest, dev->net->dev_addr);
-
- return 1;
-}
-EXPORT_SYMBOL_GPL(usbnet_cdc_zte_rx_fixup);
-
/* Ensure correct link state
*
* Some devices (ZTE MF823/831/910) export two carrier on notifications when
diff --git a/drivers/net/usb/usbnet.c b/drivers/net/usb/usbnet.c
index 21c55d70f27c..14e9f1b1e0a2 100644
--- a/drivers/net/usb/usbnet.c
+++ b/drivers/net/usb/usbnet.c
@@ -2350,6 +2350,25 @@ void usbnet_cdc_status(struct usbnet *dev, struct urb *urb)
}
}
EXPORT_SYMBOL_GPL(usbnet_cdc_status);
+
+/* Make sure packets have correct destination MAC address
+ *
+ * A firmware bug observed on some devices (ZTE MF823/831/910) is that the
+ * device sends packets with a static, bogus, random MAC address (event if
+ * device MAC address has been updated). Always set MAC address to that of the
+ * device.
+ */
+int usbnet_cdc_zte_rx_fixup(struct usbnet *dev, struct sk_buff *skb)
+{
+ if (skb->len < ETH_HLEN || !(skb->data[0] & 0x02))
+ return 1;
+
+ skb_reset_mac_header(skb);
+ ether_addr_copy(eth_hdr(skb)->h_dest, dev->net->dev_addr);
+
+ return 1;
+}
+EXPORT_SYMBOL_GPL(usbnet_cdc_zte_rx_fixup);
/*-------------------------------------------------------------------------*/
static int __init usbnet_init(void)
--
2.54.0
^ permalink raw reply related
* Re: [PATCH net] openvswitch: fix GSO userspace truncation underflow
From: Aaron Conole @ 2026-07-09 12:00 UTC (permalink / raw)
To: Kyle Zeng; +Cc: netdev, Eelco Chaudron, Ilya Maximets, stable
In-Reply-To: <20260707221635.27489-1-kylebot@openai.com>
Kyle Zeng <kylebot@openai.com> writes:
> OVS_ACTION_ATTR_TRUNC currently stores a delta from the original skb
> length in OVS_CB(skb)->cutlen. When a later userspace action segments a
> GSO skb, queue_gso_packets() reuses that delta for each smaller segment.
> A segment can then reach queue_userspace_packet() with cutlen greater
> than skb->len, underflowing the length passed to skb_zerocopy().
>
> Store the maximum preserved length instead and bound each consumer
> against the current skb length. Use U32_MAX as the no-truncation
> sentinel so the value remains valid if skb geometry changes before a
> consumer handles it.
>
> Fixes: f2a4d086ed4c ("openvswitch: Add packet truncation support.")
> Cc: stable@vger.kernel.org
> Assisted-by: Codex:gpt-5.5
> Signed-off-by: Kyle Zeng <kylebot@openai.com>
> ---
Reviewed-by: Aaron Conole <aconole@redhat.com>
^ permalink raw reply
* [GIT PULL] wireless-2026-07-09
From: Johannes Berg @ 2026-07-09 11:49 UTC (permalink / raw)
To: netdev; +Cc: linux-wireless
Hi,
Sorry, I meant to send this yesterday, hoping it'd get
in/out before netdevconf and all that, because it's
actually really big. Mostly I've now collected many
random LLM-induced robustness fixes (I can't really
call most of them security fixes, though there likely
are a few).
Please pull and let us know if there's any problem.
Thanks,
johannes
The following changes since commit 87320be9f0d24fce67631b7eef919f0b79c3e45c:
Merge tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net (2026-07-02 06:01:12 -1000)
are available in the Git repository at:
https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless.git tags/wireless-2026-07-09
for you to fetch changes up to cb8afea4655ff004fa7feee825d5c79783525383:
wifi: cfg80211: bound element ID read when checking non-inheritance (2026-07-07 14:00:35 +0200)
----------------------------------------------------------------
Too many robustness fixes to list. Mostly for
- slight out-of-bounds reads of SKBs,
- leaks on error conditions, and
- malformed netlink input rejection.
----------------------------------------------------------------
Abdun Nihaal (1):
wifi: ipw2100: fix potential memory leak in ipw2100_pci_init_one()
Arnd Bergmann (1):
wifi: mac80211: allocate backup ieee80211_nan_sched_cfg off stack
Bryam Vargas (1):
wifi: mac80211_hwsim: clamp virtio RX length before skb_put
Cen Zhang (3):
wifi: cfg80211: cancel sched scan results work on unregister
wifi: mac80211: free AP_VLAN bc_buf SKBs outside IRQ lock
wifi: cfg80211: use wiphy work for socket owner autodisconnect
Christophe JAILLET (1):
wifi: cfg80211: Fix an error handling path in cfg80211_wext_siwscan()
Corentin Labbe (1):
wifi: ralink: RT2X00: init EEPROM properly
Dawei Feng (2):
wifi: libertas: fix memory leak in helper_firmware_cb()
wifi: mac80211: fix memory leak in ieee80211_register_hw()
HE WEI (ギカク) (1):
wifi: cfg80211: bound element ID read when checking non-inheritance
Haofeng Li (1):
wifi: cfg80211: validate EHT MLE before MLD ID read
Maoyi Xie (3):
wifi: libertas_tf: fix use-after-free in lbtf_free_adapter()
wifi: mac80211: defer link RX stats percpu free to RCU
wifi: brcmfmac: cyw: fix heap overflow on a short auth frame
Pagadala Yesu Anjaneyulu (1):
wifi: mac80211: ibss: wait for in-flight TX on disconnect
Peddolla Harshavardhan Reddy (1):
wifi: cfg80211: convert pmsr_free_wk to wiphy_work to fix deadlock
Pengpeng Hou (5):
wifi: rsi: avoid reading TKIP MIC keys for non-TKIP ciphers
wifi: libertas: reject short monitor TX frames
wifi: rsi: bound background scan probe request copy
wifi: libipw: fix key index receive bound checks
wifi: rsi: validate beacon length before fixed buffer copy
Rafael Beims (2):
wifi: mwifiex: fix roaming to different channel in host_mlme mode
wifi: mwifiex: fix permanently busy scans after multiple roam iterations
Runyu Xiao (2):
wifi: rt2x00: avoid full teardown before work setup in probe
wifi: brcmfmac: initialize SDIO data work before cleanup
Shahar Tzarfati (1):
wifi: mac80211: recalculate rx_nss on IBSS peer capability update
Xiang Mei (3):
wifi: mac80211: fix unsol_bcast_probe_resp double free on alloc failure
wifi: mac80211: fix fils_discovery double free on alloc failure
wifi: p54: validate RX frame length in p54_rx_eeprom_readback()
Yousef Alhouseen (1):
wifi: mac80211_hwsim: avoid treating MCS as legacy rate index
Zhao Li (14):
wifi: nl80211: free RNR data on MBSSID mismatch
wifi: mac80211: validate extension-frame layout before RX
wifi: cfg80211: derive S1G beacon TSF from S1G fields
wifi: ieee80211: validate MLE common info length
wifi: nl80211: validate nested MBSSID IE blobs
wifi: nl80211: constrain MBSSID TX link ID range
wifi: cfg80211: validate PMSR measurement type data
wifi: cfg80211: validate PMSR FTM preamble range
wifi: cfg80211: reject unsupported PMSR FTM location requests
wifi: cfg80211: reject empty PMSR peer lists
wifi: mac80211: avoid non-S1G AID fallback for S1G assoc
wifi: mac80211: validate deauth frame length before reason access
wifi: cfg80211: validate rx/tx MLME callback frame lengths before access
wifi: cfg80211: validate assoc response length before status and IE access
Zhiling Zou (1):
wifi: mac80211: free ack status frame on TX header build failure
.../broadcom/brcm80211/brcmfmac/cyw/core.c | 6 ++
.../wireless/broadcom/brcm80211/brcmfmac/sdio.c | 2 +-
drivers/net/wireless/intel/ipw2x00/ipw2100.c | 8 +-
drivers/net/wireless/intel/ipw2x00/libipw_rx.c | 4 +-
drivers/net/wireless/intersil/p54/txrx.c | 8 ++
drivers/net/wireless/marvell/libertas/firmware.c | 1 +
drivers/net/wireless/marvell/libertas/tx.c | 7 ++
drivers/net/wireless/marvell/libertas_tf/main.c | 2 +-
drivers/net/wireless/marvell/mwifiex/cfg80211.c | 2 +-
drivers/net/wireless/marvell/mwifiex/join.c | 1 -
drivers/net/wireless/ralink/rt2x00/rt2400pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2500pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2800pci.c | 2 +-
drivers/net/wireless/ralink/rt2x00/rt2x00dev.c | 12 ++-
drivers/net/wireless/ralink/rt2x00/rt61pci.c | 2 +-
drivers/net/wireless/rsi/rsi_91x_hal.c | 8 ++
drivers/net/wireless/rsi/rsi_91x_mgmt.c | 12 ++-
drivers/net/wireless/virtual/mac80211_hwsim_main.c | 16 +++-
include/linux/ieee80211-eht.h | 12 +--
include/net/cfg80211.h | 4 +-
net/mac80211/cfg.c | 11 ++-
net/mac80211/ibss.c | 13 +--
net/mac80211/iface.c | 8 +-
net/mac80211/main.c | 3 +-
net/mac80211/mlme.c | 12 ++-
net/mac80211/nan.c | 35 +++----
net/mac80211/rx.c | 34 ++++++-
net/mac80211/sta_info.c | 15 ++-
net/mac80211/tx.c | 17 +++-
net/mac80211/util.c | 3 +
net/wireless/core.c | 14 +--
net/wireless/core.h | 4 +-
net/wireless/mlme.c | 105 +++++++++++++++------
net/wireless/nl80211.c | 25 +++--
net/wireless/pmsr.c | 34 +++++--
net/wireless/scan.c | 18 ++--
net/wireless/sme.c | 6 +-
37 files changed, 336 insertions(+), 134 deletions(-)
^ permalink raw reply
* Re: [PATCH nf] ipvs: make destination flags atomic
From: Florian Westphal @ 2026-07-09 11:46 UTC (permalink / raw)
To: Julian Anastasov
Cc: Yizhou Zhao, Simon Horman, David Ahern, Ido Schimmel,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Pablo Neira Ayuso, Phil Sutter, Alexander Frolkin, netdev,
lvs-devel, linux-kernel, netfilter-devel, coreteam, stable,
Yuxiang Yang, Ao Wang, Xuewei Feng, Qi Li, Ke Xu
In-Reply-To: <afcdb34c-ec10-de8e-083c-624bcedca90e@ssi.bg>
Julian Anastasov <ja@ssi.bg> wrote:
> After looking again at the code, I think we can
> do it in different way:
>
> - IP_VS_DEST_F_AVAILABLE and IP_VS_DEST_F_OVERLOAD are defined
> in include/uapi/linux/ip_vs.h but we never export them to user
> space. So, we are free to change them. We can move them to
> include/net/ip_vs.h, see below...
>
> - IP_VS_DEST_F_AVAILABLE is changed only under service_mutex,
> so we can keep its usage
>
> - IP_VS_DEST_F_OVERLOAD needs different access methods.
> We can add 'unsigned long flags2;', may be after l_threshold.
> And to switch to such usage (F_OVERLOAD -> FL_OVERLOAD):
>
> - test_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2)
> - set_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2)
>
> Sometimes if (test_bit()) clear_bit() can avoid
> full memory barrier in ip_vs_dest_update_overload()
>
> - clear_bit(IP_VS_DEST_FL_OVERLOAD, &dest->flags2)
> test_bit() guard can help here too
>
> As there are other races involved, something like
> this can be a starting point for such change. It tries harder
> to update the overload flag on dest edit/add but it does not
> include the proposed bitops:
>
> diff --git a/include/net/ip_vs.h b/include/net/ip_vs.h
> index 49297fec448a..b34631270e24 100644
Who is supposed to do what?
I.e., are you going to submit this officially as replacement
for the v2 of this patch or do you expect the sumbitters of
this patch to rework their v2 along these lines?
^ permalink raw reply
* Re: [PATCH net-next] net: Convert %pK back to %p
From: Petr Mladek @ 2026-07-09 11:28 UTC (permalink / raw)
To: Sebastian Andrzej Siewior
Cc: linux-atm-general, linux-can, linux-sctp, netdev, David S. Miller,
Eric Dumazet, Herbert Xu, Jakub Kicinski, Kuniyuki Iwashima,
Marc Kleine-Budde, Marcelo Ricardo Leitner, Neal Cardwell,
Oliver Hartkopp, Paolo Abeni, Remi Denis-Courmont, Simon Horman,
Steffen Klassert, Willem de Bruijn, Xin Long,
Thomas Weißschuh, Kees Cook
In-Reply-To: <20260706073824.xixrLxoD@linutronix.de>
On Mon 2026-07-06 09:38:24, Sebastian Andrzej Siewior wrote:
> This is a revert of commit 71338aa7d050c ("net: convert %p usage to
> %pK") which is from 2011. Back then the default behaviour for %p was to
> print the pointer. The %pK modifier was introduced to be able to control
> the behaviour of specific pointer output without changing the behaviour
> of %p for everyone. It was dedicated to avoid leaking pointers via
> /proc.
> There was also the idea to remove the check from formatting the string
> and move to the open callback (of the /proc file) with some helpers but
> this did not happen.
>
> Things changed over time. The default behaviour for %p is now to print a
> hash pointer which does not leak the address but allows to
> correlate if two pointers are equal. The pointer to hash value mapping
> is not stable across reboots so one can not precompute the values and
> have a lookup table. There is also the `hash_pointers' boot argument
> which allows to disable it and print real pointers if needed. The
> default behaviour of %pK (kptr_restrict==0) is already %p (hashed
> pointer).
>
> The %pK modifier brings hardly and value over %p. Removing it allows to
> remove the policy checks from pointer formatting.
Yes, I believe that the %pK behavior has been obsoleted by hashing
pointers printed via %p by default and hash_pointers= boot parameter.
> My long term goal is remove the restricted_pointer() handling from
> vsprintf. I don't see any benefit in having it and case kptr_restrict==1
> caused problems in terms of locking. Instead of attempting to get the
> debug/ warn infrastructure right I am for removing it.
Yes, it would be nice because the locking is tricky.
Acked-by: Petr Mladek <pmladek@suse.com>
Best Regards,
Petr
^ permalink raw reply
* Re: [PATCH net] macsec: don't read an unset MAC header in macsec_encrypt()
From: patchwork-bot+netdevbpf @ 2026-07-09 11:10 UTC (permalink / raw)
To: Daehyeon Ko
Cc: netdev, sd, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-kernel, stable
In-Reply-To: <20260703083634.2035145-1-4ncienth@gmail.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Fri, 3 Jul 2026 17:36:33 +0900 you wrote:
> macsec_encrypt() reads the Ethernet header via eth_hdr(skb)
> (skb->head + skb->mac_header) to memmove() the 12 source/destination MAC
> bytes forward and make room for the SecTAG.
>
> On the AF_PACKET SOCK_RAW + PACKET_QDISC_BYPASS transmit path the skb
> reaches the macsec ndo_start_xmit() with the MAC header unset, so
> eth_hdr(skb) resolves to skb->head + (u16)~0 and the read is out of
> bounds: a 12-byte heap over-read that is also emitted on the wire as the
> frame's outer source/destination MAC. KASAN reports a slab-out-of-bounds
> read in macsec_start_xmit() on 6.0; on current mainline a CONFIG_DEBUG_NET
> build flags it as an unset mac header in skb_mac_header().
>
> [...]
Here is the summary with links:
- [net] macsec: don't read an unset MAC header in macsec_encrypt()
https://git.kernel.org/netdev/net/c/f5089008f90c
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] dibs: loopback: validate offset and size in move_data()
From: patchwork-bot+netdevbpf @ 2026-07-09 11:10 UTC (permalink / raw)
To: Dust Li
Cc: wintera, wenjia, guwen, pabeni, mjambigi, alibuda, sidraya,
netdev, linux-kernel, stable, federico.kirschbaum
In-Reply-To: <20260707074318.1448662-1-dust.li@linux.alibaba.com>
Hello:
This patch was applied to netdev/net.git (main)
by Paolo Abeni <pabeni@redhat.com>:
On Tue, 7 Jul 2026 15:43:18 +0800 you wrote:
> The loopback move_data() performs a memcpy into the registered DMB
> without checking whether offset + size exceeds the DMB length. Unlike
> real ISM hardware, which enforces memory region bounds natively, the
> software loopback has no such protection.
>
> A peer-supplied out-of-bounds offset or oversized write would result in
> an OOB write past the allocated kernel buffer. Add an explicit bounds
> check before the memcpy to reject such requests with -EINVAL.
>
> [...]
Here is the summary with links:
- [net] dibs: loopback: validate offset and size in move_data()
https://git.kernel.org/netdev/net/c/78237e3c0720
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: Please backport bridge multicast exponential field encoding fix series to 6.1.y/6.6.y/6.12.y/6.18.y/7.0.y
From: Greg KH @ 2026-07-09 11:04 UTC (permalink / raw)
To: Ujjal Roy
Cc: Linux Stable, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, Nikolay Aleksandrov, Ido Schimmel,
David Ahern, Shuah Khan, Andy Roulin, Yong Wang, Petr Machata,
Ujjal Roy, bridge, netdev, linux-kernel, linux-kselftest
In-Reply-To: <20260709101327.9508-1-royujjal@gmail.com>
On Thu, Jul 09, 2026 at 10:13:27AM +0000, Ujjal Roy wrote:
> Hi Greg,
>
> Please consider backporting the following bridge multicast fix series to 6.1.y, 6.6.y, 6.12.y, 6.18.y and 7.0.y.
>
> 726fa7da2d8c ("ipv4: igmp: get rid of IGMPV3_{QQIC,MRC} and simplify calculation")
> 12cfb4ecc471 ("ipv6: mld: rename mldv2_mrc() and add mldv2_qqi()")
> 95bfd196f0dc ("ipv4: igmp: encode multicast exponential fields")
> e51560f4220a ("ipv6: mld: encode multicast exponential fields")
> 529dbe762de0 ("selftests: net: bridge: add MRC and QQIC field encoding tests")
Why is any of this needed in older kernels?
And 7.0.y is long end-of-life.
And why, if this does fix issues, was it not tagged for stable to start
with?
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH nf] netfilter: ip6tables: set hotdrop for malformed extension header matches
From: Phil Sutter @ 2026-07-09 11:02 UTC (permalink / raw)
To: Zhixing Chen
Cc: Florian Westphal, Pablo Neira Ayuso, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
netfilter-devel, coreteam, netdev
In-Reply-To: <20260709063012.33160-1-running910@gmail.com>
Hi,
On Thu, Jul 09, 2026 at 02:30:12PM +0800, Zhixing Chen wrote:
> The hbh, srh and ipv6header matches have paths that return false for
> malformed IPv6 extension header packets without setting hotdrop.
>
> For hbh, strict option parsing stops when the option type or length field
> cannot be read, or when advancing to the next requested option would
> exceed the available header data. Mark these packets for hotdrop instead
> of treating them as a rule mismatch.
There is another candidate for hotdrop in there, e.g. the "Packet
smaller than it's length field" check in line 76. Or is this a
legitimate non-match?
Given the many common blocks, maybe introduce a 'hotdrop' goto label to
jump to instead of break/return?
>
> For srh, keep a missing SRH as a normal mismatch, but set hotdrop when
> header lookup fails for other reasons, when the SRH fixed header is not
> present, when the advertised SRH length exceeds the available skb data, or
> when SID selector reads fail.
I think the 'srh->segments_left > srh->first_segment' case is also a
candidate:
According to RFC8200, segments_left contains the "Number of route
segments remaining, i.e., number of explicitly listed intermediate nodes
still to be visited before reaching the final destination."
RFC8754 reads: "Last Entry: contains the index (zero based), in the
Segment List, of the last element of the Segment List." ('first_segment'
is called Last Entry in there.)
AIUI, segments_left should never exceed first_segment in a packet.
Though RFC8754 mentions a case where "Segments Left is greater than Last
Entry", but it's about HMAC verification and it doesn't explain why it
should happen.
[...]
> diff --git a/net/ipv6/netfilter/ip6t_ipv6header.c b/net/ipv6/netfilter/ip6t_ipv6header.c
> index c52ff929c93b..0568eb99eb1c 100644
> --- a/net/ipv6/netfilter/ip6t_ipv6header.c
> +++ b/net/ipv6/netfilter/ip6t_ipv6header.c
> @@ -53,8 +53,10 @@ ipv6header_mt6(const struct sk_buff *skb, struct xt_action_param *par)
> break;
> }
> /* Is there enough space for the next ext header? */
> - if (len < (int)sizeof(struct ipv6_opt_hdr))
> + if (len < (int)sizeof(struct ipv6_opt_hdr)) {
> + par->hotdrop = true;
> return false;
> + }
This check is actually redundant, no? The following call to
skb_header_pointer() should discover the skb->len underrun?
Cheers, Phil
^ permalink raw reply
* [PATCH v4 7/7] net: wwan: t9xx: Add maintainers entry
From: Jack Wu via B4 Relay @ 2026-07-09 10:53 UTC (permalink / raw)
To: Loic Poulain, Sergey Ryazanov, Johannes Berg, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Jack Wu, Wen-Zhi Huang, Shi-Wei Yeh, Minano Tseng,
Matthias Brugger, AngeloGioacchino Del Regno, Simon Horman,
Jonathan Corbet, Shuah Khan
Cc: linux-kernel, netdev, linux-arm-kernel, linux-mediatek, linux-doc
In-Reply-To: <20260709-t9xx_driver_v1-v4-0-a8c009d509c5@compal.com>
From: Jack Wu <jackbb_wu@compal.com>
Add MAINTAINERS entry for the MediaTek T9XX 5G WWAN modem device
driver.
Signed-off-by: Jack Wu <jackbb_wu@compal.com>
---
MAINTAINERS | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/MAINTAINERS b/MAINTAINERS
index 461a3eed6129..8155d26bff03 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -16494,6 +16494,15 @@ L: netdev@vger.kernel.org
S: Supported
F: drivers/net/wwan/t7xx/
+MEDIATEK T9XX 5G WWAN MODEM DRIVER
+M: Jack Wu <jackbb_wu@compal.com>
+R: Wen-Zhi Huang <wen-zhi.huang@mediatek.com>
+R: Shi-Wei Yeh <shi-wei.yeh@mediatek.com>
+R: Minano Tseng <Minano.tseng@mediatek.com>
+L: netdev@vger.kernel.org
+S: Supported
+F: drivers/net/wwan/t9xx/
+
MEDIATEK USB3 DRD IP DRIVER
M: Chunfeng Yun <chunfeng.yun@mediatek.com>
L: linux-usb@vger.kernel.org
--
2.34.1
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).