* [PATCH net-next v9 8/9] geneve: Enable BIG TCP packets
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
From: Daniel Borkmann <daniel@iogearbox.net>
In Cilium we do support BIG TCP, but so far the latter has only been
enabled for direct routing use-cases. A lot of users rely on Cilium
with vxlan/geneve tunneling though. The underlying kernel infra for
tunneling has not been supporting BIG TCP up to this point.
Given we do now, bump tso_max_size for geneve netdevs up to GSO_MAX_SIZE
to allow the admin to use BIG TCP with geneve tunnels.
BIG TCP on geneve disabled:
Standard MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 30.00 37391.34
8k MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
262144 32768 32768 60.00 58030.19
BIG TCP on geneve enabled:
Standard MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 30.00 40891.57
8k MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
262144 32768 32768 60.00 61458.39
Example receive side:
swapper 0 [008] 3682.509996: net:netif_receive_skb: dev=geneve0 skbaddr=0xffff8f3b0a781800 len=129492
ffffffff8cfe3aaa __netif_receive_skb_core.constprop.0+0x6ca ([kernel.kallsyms])
ffffffff8cfe3aaa __netif_receive_skb_core.constprop.0+0x6ca ([kernel.kallsyms])
ffffffff8cfe47dd __netif_receive_skb_list_core+0xed ([kernel.kallsyms])
ffffffff8cfe4e52 netif_receive_skb_list_internal+0x1d2 ([kernel.kallsyms])
ffffffff8cfe573c napi_complete_done+0x7c ([kernel.kallsyms])
ffffffff8d046c23 gro_cell_poll+0x83 ([kernel.kallsyms])
ffffffff8cfe586d __napi_poll+0x2d ([kernel.kallsyms])
ffffffff8cfe5f8d net_rx_action+0x20d ([kernel.kallsyms])
ffffffff8c35d252 handle_softirqs+0xe2 ([kernel.kallsyms])
ffffffff8c35d556 __irq_exit_rcu+0xd6 ([kernel.kallsyms])
ffffffff8c35d81e irq_exit_rcu+0xe ([kernel.kallsyms])
ffffffff8d2602b8 common_interrupt+0x98 ([kernel.kallsyms])
ffffffff8c000da7 asm_common_interrupt+0x27 ([kernel.kallsyms])
ffffffff8d2645c5 cpuidle_enter_state+0xd5 ([kernel.kallsyms])
ffffffff8cf6358e cpuidle_enter+0x2e ([kernel.kallsyms])
ffffffff8c3ba932 call_cpuidle+0x22 ([kernel.kallsyms])
ffffffff8c3bfb5e do_idle+0x1ce ([kernel.kallsyms])
ffffffff8c3bfd79 cpu_startup_entry+0x29 ([kernel.kallsyms])
ffffffff8c30a6c2 start_secondary+0x112 ([kernel.kallsyms])
ffffffff8c2c142d common_startup_64+0x13e ([kernel.kallsyms])
Example transmit side:
swapper 0 [002] 3403.688687: net:net_dev_xmit: dev=enp10s0f0np0 skbaddr=0xffff8af31d104ae8 len=129556 rc=0
ffffffffa75e19c3 dev_hard_start_xmit+0x173 ([kernel.kallsyms])
ffffffffa75e19c3 dev_hard_start_xmit+0x173 ([kernel.kallsyms])
ffffffffa7653823 sch_direct_xmit+0x143 ([kernel.kallsyms])
ffffffffa75e2780 __dev_queue_xmit+0xc70 ([kernel.kallsyms])
ffffffffa76a1205 ip_finish_output2+0x265 ([kernel.kallsyms])
ffffffffa76a1577 __ip_finish_output+0x87 ([kernel.kallsyms])
ffffffffa76a165b ip_finish_output+0x2b ([kernel.kallsyms])
ffffffffa76a179e ip_output+0x5e ([kernel.kallsyms])
ffffffffa76a19d5 ip_local_out+0x35 ([kernel.kallsyms])
ffffffffa770d0e5 iptunnel_xmit+0x185 ([kernel.kallsyms])
ffffffffc179634e nf_nat_used_tuple_new.cold+0x1129 ([kernel.kallsyms])
ffffffffc179d3e0 geneve_xmit+0x920 ([kernel.kallsyms])
ffffffffa75e18af dev_hard_start_xmit+0x5f ([kernel.kallsyms])
ffffffffa75e1d3f __dev_queue_xmit+0x22f ([kernel.kallsyms])
ffffffffa76a1205 ip_finish_output2+0x265 ([kernel.kallsyms])
ffffffffa76a1577 __ip_finish_output+0x87 ([kernel.kallsyms])
ffffffffa76a165b ip_finish_output+0x2b ([kernel.kallsyms])
ffffffffa76a179e ip_output+0x5e ([kernel.kallsyms])
ffffffffa76a1de2 __ip_queue_xmit+0x1b2 ([kernel.kallsyms])
ffffffffa76a2135 ip_queue_xmit+0x15 ([kernel.kallsyms])
ffffffffa76c70a2 __tcp_transmit_skb+0x522 ([kernel.kallsyms])
ffffffffa76c931a tcp_write_xmit+0x65a ([kernel.kallsyms])
ffffffffa76ca3b9 __tcp_push_pending_frames+0x39 ([kernel.kallsyms])
ffffffffa76c1fb6 tcp_rcv_established+0x276 ([kernel.kallsyms])
ffffffffa76d3957 tcp_v4_do_rcv+0x157 ([kernel.kallsyms])
ffffffffa76d6053 tcp_v4_rcv+0x1243 ([kernel.kallsyms])
ffffffffa769b8ea ip_protocol_deliver_rcu+0x2a ([kernel.kallsyms])
ffffffffa769bab7 ip_local_deliver_finish+0x77 ([kernel.kallsyms])
ffffffffa769bb4d ip_local_deliver+0x6d ([kernel.kallsyms])
ffffffffa769abe7 ip_sublist_rcv_finish+0x37 ([kernel.kallsyms])
ffffffffa769b713 ip_sublist_rcv+0x173 ([kernel.kallsyms])
ffffffffa769bde2 ip_list_rcv+0x102 ([kernel.kallsyms])
ffffffffa75e4868 __netif_receive_skb_list_core+0x178 ([kernel.kallsyms])
ffffffffa75e4e52 netif_receive_skb_list_internal+0x1d2 ([kernel.kallsyms])
ffffffffa75e573c napi_complete_done+0x7c ([kernel.kallsyms])
ffffffffa7646c23 gro_cell_poll+0x83 ([kernel.kallsyms])
ffffffffa75e586d __napi_poll+0x2d ([kernel.kallsyms])
ffffffffa75e5f8d net_rx_action+0x20d ([kernel.kallsyms])
ffffffffa695d252 handle_softirqs+0xe2 ([kernel.kallsyms])
ffffffffa695d556 __irq_exit_rcu+0xd6 ([kernel.kallsyms])
ffffffffa695d81e irq_exit_rcu+0xe ([kernel.kallsyms])
ffffffffa78602b8 common_interrupt+0x98 ([kernel.kallsyms])
ffffffffa6600da7 asm_common_interrupt+0x27 ([kernel.kallsyms])
ffffffffa78645c5 cpuidle_enter_state+0xd5 ([kernel.kallsyms])
ffffffffa756358e cpuidle_enter+0x2e ([kernel.kallsyms])
ffffffffa69ba932 call_cpuidle+0x22 ([kernel.kallsyms])
ffffffffa69bfb5e do_idle+0x1ce ([kernel.kallsyms])
ffffffffa69bfd79 cpu_startup_entry+0x29 ([kernel.kallsyms])
ffffffffa690a6c2 start_secondary+0x112 ([kernel.kallsyms])
ffffffffa68c142d common_startup_64+0x13e ([kernel.kallsyms])
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Co-developed-by: Alice Mikityanska <alice@isovalent.com>
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
drivers/net/geneve.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 011bf9d833ca..a1639ad53077 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -1745,6 +1745,8 @@ static void geneve_setup(struct net_device *dev)
dev->max_mtu = IP_MAX_MTU - GENEVE_BASE_HLEN - dev->hard_header_len;
netif_keep_dst(dev);
+ netif_set_tso_max_size(dev, GSO_MAX_SIZE);
+
dev->priv_flags &= ~IFF_TX_SKB_SHARING;
dev->priv_flags |= IFF_LIVE_ADDR_CHANGE | IFF_NO_QUEUE;
dev->lltx = true;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 7/9] vxlan: Enable BIG TCP packets
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
In Cilium we do support BIG TCP, but so far the latter has only been
enabled for direct routing use-cases. A lot of users rely on Cilium
with vxlan/geneve tunneling though. The underlying kernel infra for
tunneling has not been supporting BIG TCP up to this point.
Given we do now, bump tso_max_size for vxlan netdevs up to GSO_MAX_SIZE
to allow the admin to use BIG TCP with vxlan tunnels.
BIG TCP on vxlan disabled:
Standard MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 30.00 34440.00
8k MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
262144 32768 32768 30.00 55684.26
BIG TCP on vxlan enabled:
Standard MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 30.00 39564.78
8k MTU:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
262144 32768 32768 30.00 61466.47
When tunnel offloads are not enabled/exposed and we fully need to rely on
SW-based segmentation on transmit (e.g. in case of Azure) then the more
aggressive batching also has a visible effect. Below example was on the
same setup as with above benchmarks but with HW support disabled:
# ethtool -k enp10s0f0np0 | grep udp
tx-udp_tnl-segmentation: off
tx-udp_tnl-csum-segmentation: off
tx-udp-segmentation: off
rx-udp_tunnel-port-offload: off
rx-udp-gro-forwarding: off
Before:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 60.00 21820.82
After:
# netperf -H 10.1.0.2 -t TCP_STREAM -l60
MIGRATED TCP STREAM TEST from 0.0.0.0 (0.0.0.0) port 0 AF_INET to 10.1.0.2 () port 0 AF_INET : demo
Recv Send Send
Socket Socket Message Elapsed
Size Size Size Time Throughput
bytes bytes bytes secs. 10^6bits/sec
131072 16384 16384 60.00 29390.78
Example receive side:
swapper 0 [002] 4712.645070: net:netif_receive_skb: dev=enp10s0f0np0 skbaddr=0xffff8f3b086e0200 len=129542
ffffffff8cfe3aaa __netif_receive_skb_core.constprop.0+0x6ca ([kernel.kallsyms])
ffffffff8cfe3aaa __netif_receive_skb_core.constprop.0+0x6ca ([kernel.kallsyms])
ffffffff8cfe47dd __netif_receive_skb_list_core+0xed ([kernel.kallsyms])
ffffffff8cfe4e52 netif_receive_skb_list_internal+0x1d2 ([kernel.kallsyms])
ffffffff8d0210d8 gro_complete.constprop.0+0x108 ([kernel.kallsyms])
ffffffff8d021724 dev_gro_receive+0x4e4 ([kernel.kallsyms])
ffffffff8d021a99 gro_receive_skb+0x89 ([kernel.kallsyms])
ffffffffc06edb71 mlx5e_handle_rx_cqe_mpwrq+0x131 ([kernel.kallsyms])
ffffffffc06ee38a mlx5e_poll_rx_cq+0x9a ([kernel.kallsyms])
ffffffffc06ef2c7 mlx5e_napi_poll+0x107 ([kernel.kallsyms])
ffffffff8cfe586d __napi_poll+0x2d ([kernel.kallsyms])
ffffffff8cfe5f8d net_rx_action+0x20d ([kernel.kallsyms])
ffffffff8c35d252 handle_softirqs+0xe2 ([kernel.kallsyms])
ffffffff8c35d556 __irq_exit_rcu+0xd6 ([kernel.kallsyms])
ffffffff8c35d81e irq_exit_rcu+0xe ([kernel.kallsyms])
ffffffff8d2602b8 common_interrupt+0x98 ([kernel.kallsyms])
ffffffff8c000da7 asm_common_interrupt+0x27 ([kernel.kallsyms])
ffffffff8d2645c5 cpuidle_enter_state+0xd5 ([kernel.kallsyms])
ffffffff8cf6358e cpuidle_enter+0x2e ([kernel.kallsyms])
ffffffff8c3ba932 call_cpuidle+0x22 ([kernel.kallsyms])
ffffffff8c3bfb5e do_idle+0x1ce ([kernel.kallsyms])
ffffffff8c3bfd79 cpu_startup_entry+0x29 ([kernel.kallsyms])
ffffffff8c30a6c2 start_secondary+0x112 ([kernel.kallsyms])
ffffffff8c2c142d common_startup_64+0x13e ([kernel.kallsyms])
Example transmit side:
swapper 0 [005] 4768.021375: net:net_dev_xmit: dev=enp10s0f0np0 skbaddr=0xffff8af32ebe1200 len=129556 rc=0
ffffffffa75e19c3 dev_hard_start_xmit+0x173 ([kernel.kallsyms])
ffffffffa75e19c3 dev_hard_start_xmit+0x173 ([kernel.kallsyms])
ffffffffa7653823 sch_direct_xmit+0x143 ([kernel.kallsyms])
ffffffffa75e2780 __dev_queue_xmit+0xc70 ([kernel.kallsyms])
ffffffffa76a1205 ip_finish_output2+0x265 ([kernel.kallsyms])
ffffffffa76a1577 __ip_finish_output+0x87 ([kernel.kallsyms])
ffffffffa76a165b ip_finish_output+0x2b ([kernel.kallsyms])
ffffffffa76a179e ip_output+0x5e ([kernel.kallsyms])
ffffffffa76a19d5 ip_local_out+0x35 ([kernel.kallsyms])
ffffffffa770d0e5 iptunnel_xmit+0x185 ([kernel.kallsyms])
ffffffffc179634e nf_nat_used_tuple_new.cold+0x1129 ([kernel.kallsyms])
ffffffffc17a7301 vxlan_xmit_one+0xc21 ([kernel.kallsyms])
ffffffffc17a80a2 vxlan_xmit+0x4a2 ([kernel.kallsyms])
ffffffffa75e18af dev_hard_start_xmit+0x5f ([kernel.kallsyms])
ffffffffa75e1d3f __dev_queue_xmit+0x22f ([kernel.kallsyms])
ffffffffa76a1205 ip_finish_output2+0x265 ([kernel.kallsyms])
ffffffffa76a1577 __ip_finish_output+0x87 ([kernel.kallsyms])
ffffffffa76a165b ip_finish_output+0x2b ([kernel.kallsyms])
ffffffffa76a179e ip_output+0x5e ([kernel.kallsyms])
ffffffffa76a1de2 __ip_queue_xmit+0x1b2 ([kernel.kallsyms])
ffffffffa76a2135 ip_queue_xmit+0x15 ([kernel.kallsyms])
ffffffffa76c70a2 __tcp_transmit_skb+0x522 ([kernel.kallsyms])
ffffffffa76c931a tcp_write_xmit+0x65a ([kernel.kallsyms])
ffffffffa76cb42e tcp_tsq_write+0x5e ([kernel.kallsyms])
ffffffffa76cb7ef tcp_tasklet_func+0x10f ([kernel.kallsyms])
ffffffffa695d9f7 tasklet_action_common+0x107 ([kernel.kallsyms])
ffffffffa695db99 tasklet_action+0x29 ([kernel.kallsyms])
ffffffffa695d252 handle_softirqs+0xe2 ([kernel.kallsyms])
ffffffffa695d556 __irq_exit_rcu+0xd6 ([kernel.kallsyms])
ffffffffa695d81e irq_exit_rcu+0xe ([kernel.kallsyms])
ffffffffa78602b8 common_interrupt+0x98 ([kernel.kallsyms])
ffffffffa6600da7 asm_common_interrupt+0x27 ([kernel.kallsyms])
ffffffffa78645c5 cpuidle_enter_state+0xd5 ([kernel.kallsyms])
ffffffffa756358e cpuidle_enter+0x2e ([kernel.kallsyms])
ffffffffa69ba932 call_cpuidle+0x22 ([kernel.kallsyms])
ffffffffa69bfb5e do_idle+0x1ce ([kernel.kallsyms])
ffffffffa69bfd79 cpu_startup_entry+0x29 ([kernel.kallsyms])
ffffffffa690a6c2 start_secondary+0x112 ([kernel.kallsyms])
ffffffffa68c142d common_startup_64+0x13e ([kernel.kallsyms])
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Co-developed-by: Daniel Borkmann <daniel@iogearbox.net>
Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
Cc: Nikolay Aleksandrov <razor@blackwall.org>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
drivers/net/vxlan/vxlan_core.c | 2 ++
1 file changed, 2 insertions(+)
diff --git a/drivers/net/vxlan/vxlan_core.c b/drivers/net/vxlan/vxlan_core.c
index 67c367cc5662..3a32f067e701 100644
--- a/drivers/net/vxlan/vxlan_core.c
+++ b/drivers/net/vxlan/vxlan_core.c
@@ -3370,6 +3370,8 @@ static void vxlan_setup(struct net_device *dev)
dev->mangleid_features = NETIF_F_GSO_PARTIAL;
netif_keep_dst(dev);
+ netif_set_tso_max_size(dev, GSO_MAX_SIZE);
+
dev->priv_flags |= IFF_NO_QUEUE;
dev->change_proto_down = true;
dev->lltx = true;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 6/9] udp: Set length in UDP header to 0 for big GSO packets
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
skb->len may be bigger than 65535 in UDP-based tunnels that have BIG TCP
enabled. If GSO aggregates packets that large, set the length in the UDP
header to 0, so that tcpdump can print such packets properly (treating
them as RFC 2675 jumbograms). Later in the pipeline, __udp_gso_segment
will set uh->len to the size of individual packets.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
net/ipv4/udp_tunnel_core.c | 2 +-
net/ipv6/ip6_udp_tunnel.c | 2 +-
2 files changed, 2 insertions(+), 2 deletions(-)
diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
index 0fccb38f074d..a128fe85620d 100644
--- a/net/ipv4/udp_tunnel_core.c
+++ b/net/ipv4/udp_tunnel_core.c
@@ -178,7 +178,7 @@ void udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb
uh->dest = dst_port;
uh->source = src_port;
- udp_set_len_short(uh, skb->len);
+ udp_set_len(uh, skb->len);
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index dcff7fb16ff6..32525a051a6f 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -93,7 +93,7 @@ void udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
uh->dest = dst_port;
uh->source = src_port;
- udp_set_len_short(uh, skb->len);
+ udp_set_len(uh, skb->len);
skb_dst_set(skb, dst);
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 5/9] udp: Validate UDP length in udp_gro_receive
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
In the previous commit we started using uh->len = 0 as a marker of a GRO
packet bigger than 65536 bytes. Filter out malformed packets coming from
the wire with len=0 at udp_gro_receive to exclude them from GRO.
Note that a similar check was present in udp_gro_receive_segment, but
not in the UDP socket gro_receive flow. By adding an early check to
udp_gro_receive, the check in udp_gro_receive_segment can be dropped.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
net/ipv4/udp_offload.c | 12 +++++++-----
1 file changed, 7 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 4f9a3922937c..8f77c8788f6d 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -707,12 +707,8 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
return NULL;
}
- /* Do not deal with padded or malicious packets, sorry ! */
ulen = udp_get_len_short(uh);
- if (ulen <= sizeof(*uh) || ulen != skb_gro_len(skb)) {
- NAPI_GRO_CB(skb)->flush = 1;
- return NULL;
- }
+
/* pull encapsulating udp header */
skb_gro_pull(skb, sizeof(struct udphdr));
@@ -782,8 +778,14 @@ struct sk_buff *udp_gro_receive(struct list_head *head, struct sk_buff *skb,
struct sk_buff *p;
struct udphdr *uh2;
unsigned int off = skb_gro_offset(skb);
+ unsigned int ulen;
int flush = 1;
+ /* Do not deal with padded or malicious packets, sorry! */
+ ulen = udp_get_len_short(uh);
+ if (ulen <= sizeof(*uh) || ulen != skb_gro_len(skb))
+ goto out;
+
/* We can do L4 aggregation only if the packet can't land in a tunnel
* otherwise we could corrupt the inner stream. Detecting such packets
* cannot be foolproof and the aggregation might still happen in some
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 4/9] udp: Support gro_ipv4_max_size > 65536
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
Currently, gro_max_size and gro_ipv4_max_size can be set to values
bigger than 65536, and GRO will happily aggregate UDP to the configured
size (for example, with TCP traffic in VXLAN tunnels). However,
udp_gro_complete uses the 16-bit length field in the UDP header to store
the length of the aggregated packet. It leads to the packet truncation
later in udp_rcv.
Fix this by storing 0 to the UDP length field and by restoring the real
length from skb->len in udp_rcv. IP GRO already can store 0 to the IP
length field, and iph_totlen()/ipv6_payload_len() are capable of
restoring the real length, because the relevant packets (BIG TCP
tunneled in UDP tunnels) will have skb_is_gso_tcp == true.
Additionally, restrict handling uh->len=0 in udpv6_rcv to BIG TCP and
jumbograms only by using the udp_get_len helper.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
net/ipv4/udp.c | 4 ++--
net/ipv4/udp_offload.c | 4 ++--
net/ipv6/udp.c | 4 ++--
net/ipv6/udp_offload.c | 2 +-
4 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cb86124fd963..2b9b55a14758 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -2592,8 +2592,8 @@ int udp_rcv(struct sk_buff *skb)
struct rtable *rt = skb_rtable(skb);
struct net *net = dev_net(skb->dev);
struct sock *sk = NULL;
- unsigned short ulen;
__be32 saddr, daddr;
+ unsigned int ulen;
struct udphdr *uh;
bool refcounted;
int drop_reason;
@@ -2607,7 +2607,7 @@ int udp_rcv(struct sk_buff *skb)
goto drop; /* No space for header. */
uh = udp_hdr(skb);
- ulen = ntohs(uh->len);
+ ulen = udp_get_len(skb, uh, 0);
saddr = ip_hdr(skb)->saddr;
daddr = ip_hdr(skb)->daddr;
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 493e2b9e16fb..4f9a3922937c 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -919,7 +919,7 @@ int udp_gro_complete(struct sk_buff *skb, int nhoff,
struct sock *sk;
int err;
- udp_set_len_short(uh, newlen);
+ udp_set_len(uh, newlen);
sk = INDIRECT_CALL_INET(lookup, udp6_lib_lookup_skb,
udp4_lib_lookup_skb, skb, uh->source, uh->dest);
@@ -956,7 +956,7 @@ INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff)
/* do fraglist only if there is no outer UDP encap (or we already processed it) */
if (NAPI_GRO_CB(skb)->is_flist && !NAPI_GRO_CB(skb)->encap_mark) {
- udp_set_len_short(uh, skb->len - nhoff);
+ udp_set_len(uh, skb->len - nhoff);
skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 8bbd55546b6e..02272466f4c2 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1081,12 +1081,12 @@ INDIRECT_CALLABLE_SCOPE int udpv6_rcv(struct sk_buff *skb)
daddr = &ipv6_hdr(skb)->daddr;
uh = udp_hdr(skb);
- ulen = ntohs(uh->len);
+ ulen = udp_get_len(skb, uh, 0);
if (ulen > skb->len)
goto short_packet;
/* Check for jumbo payload */
- if (ulen == 0)
+ if (ulen == 0 && inet6_is_jumbogram(skb))
ulen = skb->len;
if (ulen < sizeof(*uh))
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index c92cf5ee3e6a..7370bcb80332 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -171,7 +171,7 @@ int udp6_gro_complete(struct sk_buff *skb, int nhoff)
/* do fraglist only if there is no outer UDP encap (or we already processed it) */
if (NAPI_GRO_CB(skb)->is_flist && !NAPI_GRO_CB(skb)->encap_mark) {
- udp_set_len_short(uh, skb->len - nhoff);
+ udp_set_len(uh, skb->len - nhoff);
skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 3/9] udp: Support BIG TCP GSO packets where they can occur
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
Wherever a GSO packet can occur, and its length is used to fill the UDP
header, use udp_set_len that assigns 0 if the length doesn't fit 16
bits, so that the packet can be properly parsed and segmented later,
instead of having truncated length.
Use udp_get_len in udp_validate_len to treat BIG TCP packets as valid.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
net/ipv4/fou_core.c | 2 +-
net/ipv6/fou6.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 2 +-
net/psp/psp_main.c | 2 +-
5 files changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/ipv4/fou_core.c b/net/ipv4/fou_core.c
index a50740d0f288..aef3ce1dec7a 100644
--- a/net/ipv4/fou_core.c
+++ b/net/ipv4/fou_core.c
@@ -1040,7 +1040,7 @@ static void fou_build_udp(struct sk_buff *skb, struct ip_tunnel_encap *e,
uh->dest = e->dport;
uh->source = sport;
- udp_set_len_short(uh, skb->len);
+ udp_set_len(uh, skb->len);
udp_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM), skb,
fl4->saddr, fl4->daddr, skb->len);
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index 588929409241..4b659ca60ba9 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -30,7 +30,7 @@ static void fou6_build_udp(struct sk_buff *skb, struct ip_tunnel_encap *e,
uh->dest = e->dport;
uh->source = sport;
- udp_set_len_short(uh, skb->len);
+ udp_set_len(uh, skb->len);
udp6_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM6), skb,
&fl6->saddr, &fl6->daddr, skb->len);
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index ae3ed2c00ec3..c51ebd83a476 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -1100,7 +1100,7 @@ ipvs_gue_encap(struct net *net, struct sk_buff *skb,
dport = cp->dest->tun_port;
udph->dest = dport;
udph->source = sport;
- udp_set_len_short(udph, skb->len);
+ udp_set_len(udph, skb->len);
udph->check = 0;
*next_protocol = IPPROTO_UDP;
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index 8a5675983e7c..a7edfefd6fd1 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -45,7 +45,7 @@ static bool udp_validate_len(struct sk_buff *skb,
const struct udphdr *hdr,
unsigned int dataoff)
{
- unsigned int udplen = udp_get_len_short(hdr);
+ unsigned int udplen = udp_get_len(skb, hdr, dataoff);
unsigned int skblen = skb->len - dataoff;
if (udplen > skblen || udplen < sizeof(*hdr))
diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index 90c7dc4e76a1..c9c1a8826b7f 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -231,7 +231,7 @@ static void psp_write_headers(struct net *net, struct sk_buff *skb, __be32 spi,
uh->source = udp_flow_src_port(net, skb, 0, 0, false);
}
uh->check = 0;
- udp_set_len_short(uh, udp_len);
+ udp_set_len(uh, udp_len);
psph->nexthdr = IPPROTO_TCP;
psph->hdrlen = PSP_HDRLEN_NOOPT;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 2/9] net: Enable BIG TCP with partial GSO
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
skb_segment is called for partial GSO, when netif_needs_gso returns true
in validate_xmit_skb. Partial GSO is needed, for example, when
segmentation of tunneled traffic is offloaded to a NIC that only
supports inner checksum offload.
Currently, skb_segment clamps the segment length to 65534 bytes, because
gso_size == 65535 is a special value GSO_BY_FRAGS, and we don't want
to accidentally assign mss = 65535, as it would fall into the
GSO_BY_FRAGS check further in the function.
This implementation, however, artificially blocks len > 65534, which is
possible since the introduction of BIG TCP. To allow bigger lengths and
avoid resegmentation of BIG TCP packets, store the gso_by_frags flag in
the beginning and don't use a special value of mss for this purpose
after mss was modified.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
---
net/core/skbuff.c | 10 +++++-----
1 file changed, 5 insertions(+), 5 deletions(-)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 18dabb4e9cfa..6ae4c2b205f2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4775,6 +4775,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
struct sk_buff *tail = NULL;
struct sk_buff *list_skb = skb_shinfo(head_skb)->frag_list;
unsigned int mss = skb_shinfo(head_skb)->gso_size;
+ bool gso_by_frags = mss == GSO_BY_FRAGS;
unsigned int doffset = head_skb->data - skb_mac_header(head_skb);
unsigned int offset = doffset;
unsigned int tnl_hlen = skb_tnl_header_len(head_skb);
@@ -4790,7 +4791,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
int nfrags, pos;
if ((skb_shinfo(head_skb)->gso_type & SKB_GSO_DODGY) &&
- mss != GSO_BY_FRAGS && mss != skb_headlen(head_skb)) {
+ !gso_by_frags && mss != skb_headlen(head_skb)) {
struct sk_buff *check_skb;
for (check_skb = list_skb; check_skb; check_skb = check_skb->next) {
@@ -4818,7 +4819,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
sg = !!(features & NETIF_F_SG);
csum = !!can_checksum_protocol(features, proto);
- if (sg && csum && (mss != GSO_BY_FRAGS)) {
+ if (sg && csum && !gso_by_frags) {
if (!(features & NETIF_F_GSO_PARTIAL)) {
struct sk_buff *iter;
unsigned int frag_len;
@@ -4852,9 +4853,8 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
/* GSO partial only requires that we trim off any excess that
* doesn't fit into an MSS sized block, so take care of that
* now.
- * Cap len to not accidentally hit GSO_BY_FRAGS.
*/
- partial_segs = min(len, GSO_BY_FRAGS - 1) / mss;
+ partial_segs = len / mss;
if (partial_segs > 1)
mss *= partial_segs;
else
@@ -4878,7 +4878,7 @@ struct sk_buff *skb_segment(struct sk_buff *head_skb,
int hsize;
int size;
- if (unlikely(mss == GSO_BY_FRAGS)) {
+ if (unlikely(gso_by_frags)) {
len = list_skb->len;
} else {
len = head_skb->len - offset;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 1/9] net: Use helpers to get/set UDP len tree-wide
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska, Jason A. Donenfeld
In-Reply-To: <20260710134242.216538-1-alice.kernel@fastmail.im>
From: Alice Mikityanska <alice@isovalent.com>
Since BIG TCP for UDP tunnels will start using len=0 in the UDP header
as an indicator of a GSO packet bigger than 65535 bytes, this commit
introduces the following getter and setters to use tree-wide, in order
to explicitly mark places where len=0 may be expected, and handle them
properly:
1. udp_set_len() sets uh->len to its real value if it's not bigger than
65535, and to 0 otherwise: to be used in GSO context with aggregated
packets.
2. udp_set_len_short() is to be used when the length is known to fit 16
bits. It WARNs when the caller tries to assign a bigger value if
CONFIG_DEBUG_NET=y.
3. udp_get_len_short() returns len in host byte order: to be used on the
RX side to deal with non-aggregated packets, or to access the raw value
of the len field.
4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether
the packet is GSO to guard from malformed packets.
At the moment udp_set_len() is not used, a following commit will start
using it after enabling len>65535 for GSO.
Raw uh->len (in network byte order) is still accessed in a few places
for checksum calculation purposes, and to decode len=0 in udpv6_rcv for
jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that
starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP
tunnels.
Signed-off-by: Alice Mikityanska <alice@isovalent.com>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Acked-by: Jason A. Donenfeld <Jason@zx2c4.com>
---
drivers/infiniband/core/lag.c | 2 +-
drivers/infiniband/sw/rxe/rxe_net.c | 4 +-
drivers/net/amt.c | 6 +--
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +-
drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +-
.../marvell/octeontx2/nic/otx2_txrx.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/en_rx.c | 4 +-
.../ethernet/mellanox/mlx5/core/en_selftest.c | 2 +-
drivers/net/ethernet/sfc/falcon/selftest.c | 4 +-
drivers/net/ethernet/sfc/selftest.c | 4 +-
drivers/net/ethernet/sfc/siena/selftest.c | 4 +-
drivers/net/ethernet/sfc/tc_encap_actions.c | 2 +-
.../stmicro/stmmac/stmmac_selftests.c | 4 +-
drivers/net/geneve.c | 2 +-
drivers/net/netconsole.c | 2 +-
drivers/net/netdevsim/dev.c | 2 +-
drivers/net/netdevsim/psample.c | 2 +-
drivers/net/netdevsim/psp.c | 8 ++--
drivers/net/wireguard/receive.c | 2 +-
include/linux/udp.h | 27 ++++++++++++++
include/trace/events/icmp.h | 2 +-
lib/tests/blackhole_dev_kunit.c | 2 +-
net/6lowpan/nhc_udp.c | 10 ++---
net/core/pktgen.c | 4 +-
net/core/selftests.c | 4 +-
net/core/tso.c | 3 +-
net/ipv4/esp4.c | 2 +-
net/ipv4/fou_core.c | 2 +-
net/ipv4/ipconfig.c | 6 +--
net/ipv4/netfilter/nf_nat_snmp_basic_main.c | 4 +-
net/ipv4/route.c | 2 +-
net/ipv4/udp.c | 3 +-
net/ipv4/udp_offload.c | 37 +++++++++----------
net/ipv4/udp_tunnel_core.c | 2 +-
net/ipv6/esp6.c | 5 ++-
net/ipv6/fou6.c | 2 +-
net/ipv6/ip6_udp_tunnel.c | 2 +-
net/ipv6/udp.c | 3 +-
net/ipv6/udp_offload.c | 2 +-
net/l2tp/l2tp_core.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 15 +++++++-
net/netfilter/nf_log_syslog.c | 2 +-
net/netfilter/nf_nat_helper.c | 2 +-
net/psp/psp_main.c | 2 +-
net/sched/act_csum.c | 4 +-
net/xfrm/xfrm_nat_keepalive.c | 2 +-
49 files changed, 131 insertions(+), 88 deletions(-)
diff --git a/drivers/infiniband/core/lag.c b/drivers/infiniband/core/lag.c
index 8fd80adfe833..00fe241737ff 100644
--- a/drivers/infiniband/core/lag.c
+++ b/drivers/infiniband/core/lag.c
@@ -36,7 +36,7 @@ static struct sk_buff *rdma_build_skb(struct net_device *netdev,
uh->source =
htons(rdma_flow_label_to_udp_sport(ah_attr->grh.flow_label));
uh->dest = htons(ROCE_V2_UDP_DPORT);
- uh->len = htons(sizeof(struct udphdr));
+ udp_set_len_short(uh, sizeof(struct udphdr));
if (is_ipv4) {
skb_push(skb, sizeof(struct iphdr));
diff --git a/drivers/infiniband/sw/rxe/rxe_net.c b/drivers/infiniband/sw/rxe/rxe_net.c
index 3741b2c4b0bb..53daaf4c1eb2 100644
--- a/drivers/infiniband/sw/rxe/rxe_net.c
+++ b/drivers/infiniband/sw/rxe/rxe_net.c
@@ -242,7 +242,7 @@ static int rxe_udp_encap_recv(struct sock *sk, struct sk_buff *skb)
pkt->port_num = 1;
pkt->hdr = (u8 *)(udph + 1);
pkt->mask = RXE_GRH_MASK;
- pkt->paylen = be16_to_cpu(udph->len) - sizeof(*udph);
+ pkt->paylen = udp_get_len_short(udph) - sizeof(*udph);
/* remove udp header */
skb_pull(skb, sizeof(struct udphdr));
@@ -305,7 +305,7 @@ static void prepare_udp_hdr(struct sk_buff *skb, __be16 src_port,
udph->dest = dst_port;
udph->source = src_port;
- udph->len = htons(skb->len);
+ udp_set_len_short(udph, skb->len);
udph->check = 0;
}
diff --git a/drivers/net/amt.c b/drivers/net/amt.c
index 02168862f676..f8169c5512a5 100644
--- a/drivers/net/amt.c
+++ b/drivers/net/amt.c
@@ -667,7 +667,7 @@ static void amt_send_discovery(struct amt_dev *amt)
udph = udp_hdr(skb);
udph->source = amt->gw_port;
udph->dest = amt->relay_port;
- udph->len = htons(sizeof(*udph) + sizeof(*amtd));
+ udp_set_len_short(udph, sizeof(*udph) + sizeof(*amtd));
udph->check = 0;
offset = skb_transport_offset(skb);
skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
@@ -760,7 +760,7 @@ static void amt_send_request(struct amt_dev *amt, bool v6)
udph = udp_hdr(skb);
udph->source = amt->gw_port;
udph->dest = amt->relay_port;
- udph->len = htons(sizeof(*amtrh) + sizeof(*udph));
+ udp_set_len_short(udph, sizeof(*amtrh) + sizeof(*udph));
udph->check = 0;
offset = skb_transport_offset(skb);
skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
@@ -2611,7 +2611,7 @@ static void amt_send_advertisement(struct amt_dev *amt, __be32 nonce,
udph = udp_hdr(skb);
udph->source = amt->relay_port;
udph->dest = dport;
- udph->len = htons(sizeof(*amta) + sizeof(*udph));
+ udp_set_len_short(udph, sizeof(*amta) + sizeof(*udph));
udph->check = 0;
offset = skb_transport_offset(skb);
skb->csum = skb_checksum(skb, offset, skb->len - offset, 0);
diff --git a/drivers/net/ethernet/intel/i40e/i40e_txrx.c b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
index 894f2d06d39d..ef5e657816f0 100644
--- a/drivers/net/ethernet/intel/i40e/i40e_txrx.c
+++ b/drivers/net/ethernet/intel/i40e/i40e_txrx.c
@@ -3129,7 +3129,7 @@ static int i40e_tso(struct i40e_tx_buffer *first, u8 *hdr_len,
SKB_GSO_UDP_TUNNEL_CSUM)) {
if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) {
- l4.udp->len = 0;
+ udp_set_len_short(l4.udp, 0);
/* determine offset of outer transport header */
l4_offset = l4.hdr - skb->data;
diff --git a/drivers/net/ethernet/intel/iavf/iavf_txrx.c b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
index 363c42bf3dcf..c30abf17cf5d 100644
--- a/drivers/net/ethernet/intel/iavf/iavf_txrx.c
+++ b/drivers/net/ethernet/intel/iavf/iavf_txrx.c
@@ -1774,7 +1774,7 @@ static int iavf_tso(struct iavf_tx_buffer *first, u8 *hdr_len,
SKB_GSO_UDP_TUNNEL_CSUM)) {
if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) {
- l4.udp->len = 0;
+ udp_set_len_short(l4.udp, 0);
/* determine offset of outer transport header */
l4_offset = l4.hdr - skb->data;
diff --git a/drivers/net/ethernet/intel/ice/ice_txrx.c b/drivers/net/ethernet/intel/ice/ice_txrx.c
index 4ca1a0602307..fdea2758adf1 100644
--- a/drivers/net/ethernet/intel/ice/ice_txrx.c
+++ b/drivers/net/ethernet/intel/ice/ice_txrx.c
@@ -1893,7 +1893,7 @@ int ice_tso(struct ice_tx_buf *first, struct ice_tx_offload_params *off)
SKB_GSO_UDP_TUNNEL_CSUM)) {
if (!(skb_shinfo(skb)->gso_type & SKB_GSO_PARTIAL) &&
(skb_shinfo(skb)->gso_type & SKB_GSO_UDP_TUNNEL_CSUM)) {
- l4.udp->len = 0;
+ udp_set_len_short(l4.udp, 0);
/* determine offset of outer transport header */
l4_start = (u8)(l4.hdr - skb->data);
diff --git a/drivers/net/ethernet/intel/idpf/idpf_txrx.c b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
index 7f9056404f64..566b08ca3a6c 100644
--- a/drivers/net/ethernet/intel/idpf/idpf_txrx.c
+++ b/drivers/net/ethernet/intel/idpf/idpf_txrx.c
@@ -2871,7 +2871,7 @@ int idpf_tso(struct sk_buff *skb, struct idpf_tx_offload_params *off)
(__force __wsum)htonl(paylen));
/* compute length of segmentation header */
off->tso_hdr_len = sizeof(struct udphdr) + l4_start;
- l4.udp->len = htons(shinfo->gso_size + sizeof(struct udphdr));
+ udp_set_len_short(l4.udp, shinfo->gso_size + sizeof(struct udphdr));
break;
default:
return -EINVAL;
diff --git a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
index 625bb5a05344..8d2d607bc92f 100644
--- a/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
+++ b/drivers/net/ethernet/marvell/octeontx2/nic/otx2_txrx.c
@@ -750,7 +750,7 @@ static void otx2_sqe_add_ext(struct otx2_nic *pfvf, struct otx2_snd_queue *sq,
ext->lso_format = pfvf->hw.lso_udpv6_idx;
}
- udph->len = htons(sizeof(struct udphdr));
+ udp_set_len_short(udph, sizeof(struct udphdr));
}
} else if (skb_shinfo(skb)->tx_flags & SKBTX_HW_TSTAMP) {
ext->tstmp = 1;
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
index 6fbc0441c4b8..04af54b704d8 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_rx.c
@@ -1081,7 +1081,7 @@ static void mlx5e_shampo_update_ipv4_udp_hdr(struct mlx5e_rq *rq, struct iphdr *
struct udphdr *uh;
uh = (struct udphdr *)(skb->data + udp_off);
- uh->len = htons(skb->len - udp_off);
+ udp_set_len_short(uh, skb->len - udp_off);
if (uh->check)
uh->check = ~udp_v4_check(skb->len - udp_off, ipv4->saddr,
@@ -1100,7 +1100,7 @@ static void mlx5e_shampo_update_ipv6_udp_hdr(struct mlx5e_rq *rq, struct ipv6hdr
struct udphdr *uh;
uh = (struct udphdr *)(skb->data + udp_off);
- uh->len = htons(skb->len - udp_off);
+ udp_set_len_short(uh, skb->len - udp_off);
if (uh->check)
uh->check = ~udp_v6_check(skb->len - udp_off, &ipv6->saddr,
diff --git a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
index accc26d1a872..1dcdb86690bb 100644
--- a/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
+++ b/drivers/net/ethernet/mellanox/mlx5/core/en_selftest.c
@@ -113,7 +113,7 @@ static struct sk_buff *mlx5e_test_get_udp_skb(struct mlx5e_priv *priv)
/* Fill UDP header */
udph->source = htons(9);
udph->dest = htons(9); /* Discard Protocol */
- udph->len = htons(sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
+ udp_set_len_short(udph, sizeof(struct mlx5ehdr) + sizeof(struct udphdr));
udph->check = 0;
/* Fill IP header */
diff --git a/drivers/net/ethernet/sfc/falcon/selftest.c b/drivers/net/ethernet/sfc/falcon/selftest.c
index db4dd7fb77f5..4d29e0baf2eb 100644
--- a/drivers/net/ethernet/sfc/falcon/selftest.c
+++ b/drivers/net/ethernet/sfc/falcon/selftest.c
@@ -401,8 +401,8 @@ static void ef4_iterate_state(struct ef4_nic *efx)
/* Initialise udp header */
payload->udp.source = 0;
- payload->udp.len = htons(sizeof(*payload) -
- offsetof(struct ef4_loopback_payload, udp));
+ udp_set_len_short(&payload->udp, sizeof(*payload) -
+ offsetof(struct ef4_loopback_payload, udp));
payload->udp.check = 0; /* checksum ignored */
/* Fill out payload */
diff --git a/drivers/net/ethernet/sfc/selftest.c b/drivers/net/ethernet/sfc/selftest.c
index 8ec76329237a..dc716feb79cb 100644
--- a/drivers/net/ethernet/sfc/selftest.c
+++ b/drivers/net/ethernet/sfc/selftest.c
@@ -398,8 +398,8 @@ static void efx_iterate_state(struct efx_nic *efx)
/* Initialise udp header */
payload->udp.source = 0;
- payload->udp.len = htons(sizeof(*payload) -
- offsetof(struct efx_loopback_payload, udp));
+ udp_set_len_short(&payload->udp, sizeof(*payload) -
+ offsetof(struct efx_loopback_payload, udp));
payload->udp.check = 0; /* checksum ignored */
/* Fill out payload */
diff --git a/drivers/net/ethernet/sfc/siena/selftest.c b/drivers/net/ethernet/sfc/siena/selftest.c
index 930643612df5..c74cf5131364 100644
--- a/drivers/net/ethernet/sfc/siena/selftest.c
+++ b/drivers/net/ethernet/sfc/siena/selftest.c
@@ -399,8 +399,8 @@ static void efx_iterate_state(struct efx_nic *efx)
/* Initialise udp header */
payload->udp.source = 0;
- payload->udp.len = htons(sizeof(*payload) -
- offsetof(struct efx_loopback_payload, udp));
+ udp_set_len_short(&payload->udp, sizeof(*payload) -
+ offsetof(struct efx_loopback_payload, udp));
payload->udp.check = 0; /* checksum ignored */
/* Fill out payload */
diff --git a/drivers/net/ethernet/sfc/tc_encap_actions.c b/drivers/net/ethernet/sfc/tc_encap_actions.c
index db222abef53b..c2ad3a358d20 100644
--- a/drivers/net/ethernet/sfc/tc_encap_actions.c
+++ b/drivers/net/ethernet/sfc/tc_encap_actions.c
@@ -311,7 +311,7 @@ static void efx_gen_tun_header_udp(struct efx_tc_encap_action *encap, u8 len)
encap->encap_hdr_len += sizeof(*udp);
udp->dest = key->tp_dst;
- udp->len = cpu_to_be16(sizeof(*udp) + len);
+ udp_set_len_short(udp, sizeof(*udp) + len);
}
static void efx_gen_tun_header_vxlan(struct efx_tc_encap_action *encap)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
index a0c75886587c..29e824bd90ca 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c
@@ -154,9 +154,9 @@ static struct sk_buff *stmmac_test_get_udp_skb(struct stmmac_priv *priv,
} else {
uhdr->source = htons(attr->sport);
uhdr->dest = htons(attr->dport);
- uhdr->len = htons(sizeof(*shdr) + sizeof(*uhdr) + attr->size);
+ udp_set_len_short(uhdr, sizeof(*shdr) + sizeof(*uhdr) + attr->size);
if (attr->max_size)
- uhdr->len = htons(attr->max_size -
+ udp_set_len_short(uhdr, attr->max_size -
(sizeof(*ihdr) + sizeof(*ehdr)));
uhdr->check = 0;
}
diff --git a/drivers/net/geneve.c b/drivers/net/geneve.c
index 396e1a113cd4..011bf9d833ca 100644
--- a/drivers/net/geneve.c
+++ b/drivers/net/geneve.c
@@ -631,7 +631,7 @@ static int geneve_post_decap_hint(const struct sock *sk, struct sk_buff *skb,
/* Adjust the nested UDP header len and checksum. */
uh = udp_hdr(skb);
- uh->len = htons(skb->len - gro_hint->nested_tp_offset);
+ udp_set_len_short(uh, skb->len - gro_hint->nested_tp_offset);
if (uh->check) {
len = skb->len - gro_hint->nested_tp_offset;
skb_shinfo(skb)->gso_type |= SKB_GSO_UDP_TUNNEL_CSUM;
diff --git a/drivers/net/netconsole.c b/drivers/net/netconsole.c
index c1812a98365b..a531548eb891 100644
--- a/drivers/net/netconsole.c
+++ b/drivers/net/netconsole.c
@@ -1792,7 +1792,7 @@ static void push_udp(struct netpoll *np, struct sk_buff *skb, int len)
udph = udp_hdr(skb);
udph->source = htons(np->local_port);
udph->dest = htons(np->remote_port);
- udph->len = htons(udp_len);
+ udp_set_len_short(udph, udp_len);
netpoll_udp_checksum(np, skb, len);
}
diff --git a/drivers/net/netdevsim/dev.c b/drivers/net/netdevsim/dev.c
index aed9ad5f1b43..f65b4cf4ea39 100644
--- a/drivers/net/netdevsim/dev.c
+++ b/drivers/net/netdevsim/dev.c
@@ -845,7 +845,7 @@ static struct sk_buff *nsim_dev_trap_skb_build(void)
udph = skb_put_zero(skb, sizeof(struct udphdr) + data_len);
get_random_bytes(&udph->source, sizeof(u16));
get_random_bytes(&udph->dest, sizeof(u16));
- udph->len = htons(sizeof(struct udphdr) + data_len);
+ udp_set_len_short(udph, sizeof(struct udphdr) + data_len);
return skb;
}
diff --git a/drivers/net/netdevsim/psample.c b/drivers/net/netdevsim/psample.c
index 717d157c3ae2..1e71c3da4def 100644
--- a/drivers/net/netdevsim/psample.c
+++ b/drivers/net/netdevsim/psample.c
@@ -73,7 +73,7 @@ static struct sk_buff *nsim_dev_psample_skb_build(void)
udph = skb_put_zero(skb, sizeof(struct udphdr) + data_len);
get_random_bytes(&udph->source, sizeof(u16));
get_random_bytes(&udph->dest, sizeof(u16));
- udph->len = htons(sizeof(struct udphdr) + data_len);
+ udp_set_len_short(udph, sizeof(struct udphdr) + data_len);
return skb;
}
diff --git a/drivers/net/netdevsim/psp.c b/drivers/net/netdevsim/psp.c
index 59c990fdc79e..6b3532b5e360 100644
--- a/drivers/net/netdevsim/psp.c
+++ b/drivers/net/netdevsim/psp.c
@@ -84,6 +84,7 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
struct iphdr *iph;
struct udphdr *uh;
__wsum csum;
+ int udplen;
/* Do not decapsulate. Receive the skb with the udp and psp
* headers still there as if this is a normal udp packet.
@@ -91,19 +92,20 @@ nsim_do_psp(struct sk_buff *skb, struct netdevsim *ns,
* provide a valid checksum here, so the skb isn't dropped.
*/
uh = udp_hdr(skb);
+ udplen = udp_get_len(skb, uh, skb_transport_offset(skb));
csum = skb_checksum(skb, skb_transport_offset(skb),
- ntohs(uh->len), 0);
+ udplen, 0);
switch (skb->protocol) {
case htons(ETH_P_IP):
iph = ip_hdr(skb);
- uh->check = udp_v4_check(ntohs(uh->len), iph->saddr,
+ uh->check = udp_v4_check(udplen, iph->saddr,
iph->daddr, csum);
break;
#if IS_ENABLED(CONFIG_IPV6)
case htons(ETH_P_IPV6):
ip6h = ipv6_hdr(skb);
- uh->check = udp_v6_check(ntohs(uh->len), &ip6h->saddr,
+ uh->check = udp_v6_check(udplen, &ip6h->saddr,
&ip6h->daddr, csum);
break;
#endif
diff --git a/drivers/net/wireguard/receive.c b/drivers/net/wireguard/receive.c
index eb8851113654..824bbefce61c 100644
--- a/drivers/net/wireguard/receive.c
+++ b/drivers/net/wireguard/receive.c
@@ -62,7 +62,7 @@ static int prepare_skb_header(struct sk_buff *skb, struct wg_device *wg)
* to have UDP fields.
*/
return -EINVAL;
- data_len = ntohs(udp->len);
+ data_len = udp_get_len_short(udp);
if (unlikely(data_len < sizeof(struct udphdr) ||
data_len > skb->len - data_offset))
/* UDP packet is reporting too small of a size or lying about
diff --git a/include/linux/udp.h b/include/linux/udp.h
index ce56ebcee5cb..998906ec3b32 100644
--- a/include/linux/udp.h
+++ b/include/linux/udp.h
@@ -23,6 +23,33 @@ static inline struct udphdr *udp_hdr(const struct sk_buff *skb)
return (struct udphdr *)skb_transport_header(skb);
}
+static inline unsigned int udp_get_len(const struct sk_buff *skb,
+ const struct udphdr *uh,
+ unsigned int dataoff)
+{
+ if (uh->len)
+ return ntohs(uh->len);
+ if (skb_is_gso(skb)) /* BIG TCP */
+ return skb->len - dataoff;
+ return 0;
+}
+
+static inline unsigned int udp_get_len_short(const struct udphdr *uh)
+{
+ return ntohs(uh->len);
+}
+
+static inline void udp_set_len(struct udphdr *uh, unsigned int len)
+{
+ uh->len = len < GRO_LEGACY_MAX_SIZE ? htons(len) : 0;
+}
+
+static inline void udp_set_len_short(struct udphdr *uh, unsigned int len)
+{
+ DEBUG_NET_WARN_ON_ONCE(len >= GRO_LEGACY_MAX_SIZE);
+ uh->len = htons(len);
+}
+
#define UDP_HTABLE_SIZE_MIN_PERNET 128
#define UDP_HTABLE_SIZE_MIN (IS_ENABLED(CONFIG_BASE_SMALL) ? 128 : 256)
#define UDP_HTABLE_SIZE_MAX 65536
diff --git a/include/trace/events/icmp.h b/include/trace/events/icmp.h
index 31559796949a..09ae115099df 100644
--- a/include/trace/events/icmp.h
+++ b/include/trace/events/icmp.h
@@ -44,7 +44,7 @@ TRACE_EVENT(icmp_send,
} else {
__entry->sport = ntohs(uh->source);
__entry->dport = ntohs(uh->dest);
- __entry->ulen = ntohs(uh->len);
+ __entry->ulen = udp_get_len_short(uh);
}
p32 = (__be32 *) __entry->saddr;
diff --git a/lib/tests/blackhole_dev_kunit.c b/lib/tests/blackhole_dev_kunit.c
index 06834ab35f43..fa3e0533038d 100644
--- a/lib/tests/blackhole_dev_kunit.c
+++ b/lib/tests/blackhole_dev_kunit.c
@@ -46,7 +46,7 @@ static void test_blackholedev(struct kunit *test)
uh = (struct udphdr *)skb_push(skb, sizeof(struct udphdr));
skb_set_transport_header(skb, 0);
uh->source = uh->dest = htons(UDP_PORT);
- uh->len = htons(data_len);
+ udp_set_len_short(uh, data_len);
uh->check = 0;
/* (Network) IPv6 */
ip6h = (struct ipv6hdr *)skb_push(skb, sizeof(struct ipv6hdr));
diff --git a/net/6lowpan/nhc_udp.c b/net/6lowpan/nhc_udp.c
index 0a506c77283d..ed4227e6db74 100644
--- a/net/6lowpan/nhc_udp.c
+++ b/net/6lowpan/nhc_udp.c
@@ -88,16 +88,16 @@ static int udp_uncompress(struct sk_buff *skb, size_t needed)
switch (lowpan_dev(skb->dev)->lltype) {
case LOWPAN_LLTYPE_IEEE802154:
if (lowpan_802154_cb(skb)->d_size)
- uh.len = htons(lowpan_802154_cb(skb)->d_size -
- sizeof(struct ipv6hdr));
+ udp_set_len_short(&uh, lowpan_802154_cb(skb)->d_size -
+ sizeof(struct ipv6hdr));
else
- uh.len = htons(skb->len + sizeof(struct udphdr));
+ udp_set_len_short(&uh, skb->len + sizeof(struct udphdr));
break;
default:
- uh.len = htons(skb->len + sizeof(struct udphdr));
+ udp_set_len_short(&uh, skb->len + sizeof(struct udphdr));
break;
}
- pr_debug("uncompressed UDP length: src = %d", ntohs(uh.len));
+ pr_debug("uncompressed UDP length: src = %d", udp_get_len_short(&uh));
/* replace the compressed UDP head by the uncompressed UDP
* header
diff --git a/net/core/pktgen.c b/net/core/pktgen.c
index 8e185b318288..5b4dd04d6124 100644
--- a/net/core/pktgen.c
+++ b/net/core/pktgen.c
@@ -3005,7 +3005,7 @@ static struct sk_buff *fill_packet_ipv4(struct net_device *odev,
udph->source = htons(pkt_dev->cur_udp_src);
udph->dest = htons(pkt_dev->cur_udp_dst);
- udph->len = htons(datalen + 8); /* DATA + udphdr */
+ udp_set_len_short(udph, datalen + 8); /* DATA + udphdr */
udph->check = 0;
iph->ihl = 5;
@@ -3138,7 +3138,7 @@ static struct sk_buff *fill_packet_ipv6(struct net_device *odev,
udplen = datalen + sizeof(struct udphdr);
udph->source = htons(pkt_dev->cur_udp_src);
udph->dest = htons(pkt_dev->cur_udp_dst);
- udph->len = htons(udplen);
+ udp_set_len_short(udph, udplen);
udph->check = 0;
*(__be32 *) iph = htonl(0x60000000); /* Version + flow */
diff --git a/net/core/selftests.c b/net/core/selftests.c
index 0a203d3fb9dc..36b949ae520b 100644
--- a/net/core/selftests.c
+++ b/net/core/selftests.c
@@ -72,9 +72,9 @@ struct sk_buff *net_test_get_skb(struct net_device *ndev, u8 id,
} else {
uhdr->source = htons(attr->sport);
uhdr->dest = htons(attr->dport);
- uhdr->len = htons(sizeof(*shdr) + sizeof(*uhdr) + attr->size);
+ udp_set_len_short(uhdr, sizeof(*shdr) + sizeof(*uhdr) + attr->size);
if (attr->max_size)
- uhdr->len = htons(attr->max_size -
+ udp_set_len_short(uhdr, attr->max_size -
(sizeof(*ihdr) + sizeof(*ehdr)));
uhdr->check = 0;
}
diff --git a/net/core/tso.c b/net/core/tso.c
index 347b3856ddb9..d2934bcfa795 100644
--- a/net/core/tso.c
+++ b/net/core/tso.c
@@ -39,7 +39,8 @@ void tso_build_hdr(const struct sk_buff *skb, char *hdr, struct tso_t *tso,
} else {
struct udphdr *uh = (struct udphdr *)hdr;
- uh->len = htons(sizeof(*uh) + size);
+ /* size is after segmentation. */
+ udp_set_len_short(uh, sizeof(*uh) + size);
}
}
EXPORT_SYMBOL(tso_build_hdr);
diff --git a/net/ipv4/esp4.c b/net/ipv4/esp4.c
index dfc81ee969ae..a6c18aea7498 100644
--- a/net/ipv4/esp4.c
+++ b/net/ipv4/esp4.c
@@ -323,7 +323,7 @@ static struct ip_esp_hdr *esp_output_udp_encap(struct sk_buff *skb,
uh = (struct udphdr *)esp->esph;
uh->source = sport;
uh->dest = dport;
- uh->len = htons(len);
+ udp_set_len_short(uh, len);
uh->check = 0;
/* For IPv4 ESP with UDP encapsulation, if xo is not null, the skb is in the crypto offload
diff --git a/net/ipv4/fou_core.c b/net/ipv4/fou_core.c
index 865bd7205122..a50740d0f288 100644
--- a/net/ipv4/fou_core.c
+++ b/net/ipv4/fou_core.c
@@ -1040,7 +1040,7 @@ static void fou_build_udp(struct sk_buff *skb, struct ip_tunnel_encap *e,
uh->dest = e->dport;
uh->source = sport;
- uh->len = htons(skb->len);
+ udp_set_len_short(uh, skb->len);
udp_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM), skb,
fl4->saddr, fl4->daddr, skb->len);
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index a35ffedacc7c..155db067eaec 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -847,7 +847,7 @@ static void __init ic_bootp_send_if(struct ic_device *d, unsigned long jiffies_d
/* Construct UDP header */
b->udph.source = htons(68);
b->udph.dest = htons(67);
- b->udph.len = htons(sizeof(struct bootp_pkt) - sizeof(struct iphdr));
+ udp_set_len_short(&b->udph, sizeof(struct bootp_pkt) - sizeof(struct iphdr));
/* UDP checksum not calculated -- explicitly allowed in BOOTP RFC */
/* Construct DHCP/BOOTP header */
@@ -1025,10 +1025,10 @@ static int __init ic_bootp_recv(struct sk_buff *skb, struct net_device *dev, str
if (b->udph.source != htons(67) || b->udph.dest != htons(68))
goto drop;
- if (ntohs(h->tot_len) < ntohs(b->udph.len) + sizeof(struct iphdr))
+ if (ntohs(h->tot_len) < udp_get_len_short(&b->udph) + sizeof(struct iphdr))
goto drop;
- len = ntohs(b->udph.len) - sizeof(struct udphdr);
+ len = udp_get_len_short(&b->udph) - sizeof(struct udphdr);
ext_len = len - (sizeof(*b) -
sizeof(struct iphdr) -
sizeof(struct udphdr) -
diff --git a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
index e540b86bd15b..4492bc548a66 100644
--- a/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
+++ b/net/ipv4/netfilter/nf_nat_snmp_basic_main.c
@@ -127,7 +127,7 @@ static int snmp_translate(struct nf_conn *ct, int dir, struct sk_buff *skb)
{
struct iphdr *iph = ip_hdr(skb);
struct udphdr *udph = (struct udphdr *)((__be32 *)iph + iph->ihl);
- u16 datalen = ntohs(udph->len) - sizeof(struct udphdr);
+ u16 datalen = udp_get_len_short(udph) - sizeof(struct udphdr);
char *data = (unsigned char *)udph + sizeof(struct udphdr);
struct snmp_ctx ctx;
int ret;
@@ -181,7 +181,7 @@ static int help(struct sk_buff *skb, unsigned int protoff,
* enough room for a UDP header. Just verify the UDP length field so we
* can mess around with the payload.
*/
- if (ntohs(udph->len) != skb->len - (iph->ihl << 2)) {
+ if (udp_get_len_short(udph) != skb->len - (iph->ihl << 2)) {
nf_ct_helper_log(skb, ct, "dropping malformed packet\n");
return NF_DROP;
}
diff --git a/net/ipv4/route.c b/net/ipv4/route.c
index 3f3de5164d6e..0825ed983714 100644
--- a/net/ipv4/route.c
+++ b/net/ipv4/route.c
@@ -3187,7 +3187,7 @@ static struct sk_buff *inet_rtm_getroute_build_skb(__be32 src, __be32 dst,
udph = skb_put_zero(skb, sizeof(struct udphdr));
udph->source = sport;
udph->dest = dport;
- udph->len = htons(sizeof(struct udphdr));
+ udp_set_len_short(udph, sizeof(struct udphdr));
udph->check = 0;
break;
}
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index 59248a59358c..cb86124fd963 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -1108,7 +1108,8 @@ static int udp_send_skb(struct sk_buff *skb, struct flowi4 *fl4,
uh = udp_hdr(skb);
uh->source = inet_sk(sk)->inet_sport;
uh->dest = fl4->fl4_dport;
- uh->len = htons(len);
+ /* Datagram length checked in udp_sendmsg. */
+ udp_set_len_short(uh, len);
uh->check = 0;
if (cork->gso_size) {
diff --git a/net/ipv4/udp_offload.c b/net/ipv4/udp_offload.c
index 29651b1a0bc7..493e2b9e16fb 100644
--- a/net/ipv4/udp_offload.c
+++ b/net/ipv4/udp_offload.c
@@ -279,11 +279,11 @@ static struct sk_buff *__skb_udp_tunnel_segment(struct sk_buff *skb,
* segment instead of the entire frame.
*/
if (gso_partial && skb_is_gso(skb)) {
- uh->len = htons(skb_shinfo(skb)->gso_size +
- SKB_GSO_CB(skb)->data_offset +
- skb->head - (unsigned char *)uh);
+ udp_set_len_short(uh, skb_shinfo(skb)->gso_size +
+ SKB_GSO_CB(skb)->data_offset +
+ skb->head - (unsigned char *)uh);
} else {
- uh->len = htons(len);
+ udp_set_len_short(uh, len);
}
if (!need_csum)
@@ -468,7 +468,7 @@ static struct sk_buff *__udp_gso_segment_list(struct sk_buff *skb,
if (IS_ERR(skb))
return skb;
- udp_hdr(skb)->len = htons(sizeof(struct udphdr) + mss);
+ udp_set_len_short(udp_hdr(skb), sizeof(struct udphdr) + mss);
if (is_ipv6)
return __udpv6_gso_segment_list_csum(skb);
@@ -486,8 +486,8 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
unsigned int mss;
bool copy_dtor;
__sum16 check;
- __be16 newlen;
int ret = 0;
+ u16 newlen;
mss = skb_shinfo(gso_skb)->gso_size;
if (gso_skb->len <= sizeof(*uh) + mss)
@@ -564,8 +564,8 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
(skb_shinfo(gso_skb)->tx_flags & SKBTX_ANY_TSTAMP);
/* compute checksum adjustment based on old length versus new */
- newlen = htons(sizeof(*uh) + mss);
- check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
+ newlen = sizeof(*uh) + mss;
+ check = csum16_add(csum16_sub(uh->check, uh->len), htons(newlen));
for (;;) {
if (copy_dtor) {
@@ -577,7 +577,7 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
if (!seg->next)
break;
- uh->len = newlen;
+ udp_set_len_short(uh, newlen);
uh->check = check;
if (seg->ip_summed == CHECKSUM_PARTIAL)
@@ -594,11 +594,10 @@ struct sk_buff *__udp_gso_segment(struct sk_buff *gso_skb,
* segment may not be full MSS, account for that in the checksum
*/
if (!skb_is_gso(seg))
- newlen = htons(skb_tail_pointer(seg) -
- skb_transport_header(seg) + seg->data_len);
- check = csum16_add(csum16_sub(uh->check, uh->len), newlen);
+ newlen = skb_tail_pointer(seg) - skb_transport_header(seg) + seg->data_len;
+ check = csum16_add(csum16_sub(uh->check, uh->len), htons(newlen));
- uh->len = newlen;
+ udp_set_len_short(uh, newlen);
uh->check = check;
if (seg->ip_summed == CHECKSUM_PARTIAL)
@@ -709,7 +708,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
}
/* Do not deal with padded or malicious packets, sorry ! */
- ulen = ntohs(uh->len);
+ ulen = udp_get_len_short(uh);
if (ulen <= sizeof(*uh) || ulen != skb_gro_len(skb)) {
NAPI_GRO_CB(skb)->flush = 1;
return NULL;
@@ -742,7 +741,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
* On len mismatch merge the first packet shorter than gso_size,
* otherwise complete the GRO packet.
*/
- if (ulen > ntohs(uh2->len) || flush) {
+ if (ulen > udp_get_len_short(uh2) || flush) {
pp = p;
} else {
if (NAPI_GRO_CB(skb)->is_flist) {
@@ -765,7 +764,7 @@ static struct sk_buff *udp_gro_receive_segment(struct list_head *head,
}
}
- if (ret || ulen != ntohs(uh2->len) ||
+ if (ret || ulen != udp_get_len_short(uh2) ||
NAPI_GRO_CB(p)->count >= UDP_GRO_CNT_MAX)
pp = p;
@@ -915,12 +914,12 @@ static int udp_gro_complete_segment(struct sk_buff *skb)
int udp_gro_complete(struct sk_buff *skb, int nhoff,
udp_lookup_t lookup)
{
- __be16 newlen = htons(skb->len - nhoff);
struct udphdr *uh = (struct udphdr *)(skb->data + nhoff);
+ unsigned int newlen = skb->len - nhoff;
struct sock *sk;
int err;
- uh->len = newlen;
+ udp_set_len_short(uh, newlen);
sk = INDIRECT_CALL_INET(lookup, udp6_lib_lookup_skb,
udp4_lib_lookup_skb, skb, uh->source, uh->dest);
@@ -957,7 +956,7 @@ INDIRECT_CALLABLE_SCOPE int udp4_gro_complete(struct sk_buff *skb, int nhoff)
/* do fraglist only if there is no outer UDP encap (or we already processed it) */
if (NAPI_GRO_CB(skb)->is_flist && !NAPI_GRO_CB(skb)->encap_mark) {
- uh->len = htons(skb->len - nhoff);
+ udp_set_len_short(uh, skb->len - nhoff);
skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
diff --git a/net/ipv4/udp_tunnel_core.c b/net/ipv4/udp_tunnel_core.c
index 9ab3728f9630..0fccb38f074d 100644
--- a/net/ipv4/udp_tunnel_core.c
+++ b/net/ipv4/udp_tunnel_core.c
@@ -178,7 +178,7 @@ void udp_tunnel_xmit_skb(struct rtable *rt, struct sock *sk, struct sk_buff *skb
uh->dest = dst_port;
uh->source = src_port;
- uh->len = htons(skb->len);
+ udp_set_len_short(uh, skb->len);
memset(&(IPCB(skb)->opt), 0, sizeof(IPCB(skb)->opt));
diff --git a/net/ipv6/esp6.c b/net/ipv6/esp6.c
index 296b57926abb..72ec0d7d1120 100644
--- a/net/ipv6/esp6.c
+++ b/net/ipv6/esp6.c
@@ -230,7 +230,8 @@ static void esp_output_encap_csum(struct sk_buff *skb)
if (*skb_mac_header(skb) == IPPROTO_UDP) {
struct udphdr *uh = udp_hdr(skb);
struct ipv6hdr *ip6h = ipv6_hdr(skb);
- int len = ntohs(uh->len);
+ /* esp6_output_udp_encap limits len to U16_MAX. */
+ int len = udp_get_len_short(uh);
unsigned int offset = skb_transport_offset(skb);
__wsum csum = skb_checksum(skb, offset, skb->len - offset, 0);
@@ -358,7 +359,7 @@ static struct ip_esp_hdr *esp6_output_udp_encap(struct sk_buff *skb,
uh = (struct udphdr *)esp->esph;
uh->source = sport;
uh->dest = dport;
- uh->len = htons(len);
+ udp_set_len_short(uh, len);
uh->check = 0;
*skb_mac_header(skb) = IPPROTO_UDP;
diff --git a/net/ipv6/fou6.c b/net/ipv6/fou6.c
index 157765259e2f..588929409241 100644
--- a/net/ipv6/fou6.c
+++ b/net/ipv6/fou6.c
@@ -30,7 +30,7 @@ static void fou6_build_udp(struct sk_buff *skb, struct ip_tunnel_encap *e,
uh->dest = e->dport;
uh->source = sport;
- uh->len = htons(skb->len);
+ udp_set_len_short(uh, skb->len);
udp6_set_csum(!(e->flags & TUNNEL_ENCAP_FLAG_CSUM6), skb,
&fl6->saddr, &fl6->daddr, skb->len);
diff --git a/net/ipv6/ip6_udp_tunnel.c b/net/ipv6/ip6_udp_tunnel.c
index 9adb5775487f..dcff7fb16ff6 100644
--- a/net/ipv6/ip6_udp_tunnel.c
+++ b/net/ipv6/ip6_udp_tunnel.c
@@ -93,7 +93,7 @@ void udp_tunnel6_xmit_skb(struct dst_entry *dst, struct sock *sk,
uh->dest = dst_port;
uh->source = src_port;
- uh->len = htons(skb->len);
+ udp_set_len_short(uh, skb->len);
skb_dst_set(skb, dst);
diff --git a/net/ipv6/udp.c b/net/ipv6/udp.c
index 392e18b97045..8bbd55546b6e 100644
--- a/net/ipv6/udp.c
+++ b/net/ipv6/udp.c
@@ -1369,7 +1369,8 @@ static int udp_v6_send_skb(struct sk_buff *skb, struct flowi6 *fl6,
uh = udp_hdr(skb);
uh->source = fl6->fl6_sport;
uh->dest = fl6->fl6_dport;
- uh->len = htons(len);
+ /* Datagram length checked in udpv6_sendmsg. */
+ udp_set_len_short(uh, len);
uh->check = 0;
if (cork->gso_size) {
diff --git a/net/ipv6/udp_offload.c b/net/ipv6/udp_offload.c
index 778afc7453ce..c92cf5ee3e6a 100644
--- a/net/ipv6/udp_offload.c
+++ b/net/ipv6/udp_offload.c
@@ -171,7 +171,7 @@ int udp6_gro_complete(struct sk_buff *skb, int nhoff)
/* do fraglist only if there is no outer UDP encap (or we already processed it) */
if (NAPI_GRO_CB(skb)->is_flist && !NAPI_GRO_CB(skb)->encap_mark) {
- uh->len = htons(skb->len - nhoff);
+ udp_set_len_short(uh, skb->len - nhoff);
skb_shinfo(skb)->gso_type |= (SKB_GSO_FRAGLIST|SKB_GSO_UDP_L4);
skb_shinfo(skb)->gso_segs = NAPI_GRO_CB(skb)->count;
diff --git a/net/l2tp/l2tp_core.c b/net/l2tp/l2tp_core.c
index f940914959b1..4712cc41881a 100644
--- a/net/l2tp/l2tp_core.c
+++ b/net/l2tp/l2tp_core.c
@@ -1296,7 +1296,7 @@ static int l2tp_xmit_core(struct l2tp_session *session, struct sk_buff *skb, uns
ret = NET_XMIT_DROP;
goto out_unlock;
}
- uh->len = htons(udp_len);
+ udp_set_len_short(uh, udp_len);
/* Calculate UDP checksum if configured to do so */
#if IS_ENABLED(CONFIG_IPV6)
diff --git a/net/netfilter/ipvs/ip_vs_xmit.c b/net/netfilter/ipvs/ip_vs_xmit.c
index ce542ed4b013..ae3ed2c00ec3 100644
--- a/net/netfilter/ipvs/ip_vs_xmit.c
+++ b/net/netfilter/ipvs/ip_vs_xmit.c
@@ -1100,7 +1100,7 @@ ipvs_gue_encap(struct net *net, struct sk_buff *skb,
dport = cp->dest->tun_port;
udph->dest = dport;
udph->source = sport;
- udph->len = htons(skb->len);
+ udp_set_len_short(udph, skb->len);
udph->check = 0;
*next_protocol = IPPROTO_UDP;
diff --git a/net/netfilter/nf_conntrack_proto_udp.c b/net/netfilter/nf_conntrack_proto_udp.c
index cc9b7e5e1935..8a5675983e7c 100644
--- a/net/netfilter/nf_conntrack_proto_udp.c
+++ b/net/netfilter/nf_conntrack_proto_udp.c
@@ -41,11 +41,22 @@ static void udp_error_log(const struct sk_buff *skb,
nf_l4proto_log_invalid(skb, state, IPPROTO_UDP, "%s", msg);
}
+static bool udp_validate_len(struct sk_buff *skb,
+ const struct udphdr *hdr,
+ unsigned int dataoff)
+{
+ unsigned int udplen = udp_get_len_short(hdr);
+ unsigned int skblen = skb->len - dataoff;
+
+ if (udplen > skblen || udplen < sizeof(*hdr))
+ return false;
+ return true;
+}
+
static bool udp_error(struct sk_buff *skb,
unsigned int dataoff,
const struct nf_hook_state *state)
{
- unsigned int udplen = skb->len - dataoff;
const struct udphdr *hdr;
struct udphdr _hdr;
@@ -57,7 +68,7 @@ static bool udp_error(struct sk_buff *skb,
}
/* Truncated/malformed packets */
- if (ntohs(hdr->len) > udplen || ntohs(hdr->len) < sizeof(*hdr)) {
+ if (!udp_validate_len(skb, hdr, dataoff)) {
udp_error_log(skb, state, "truncated/malformed packet");
return true;
}
diff --git a/net/netfilter/nf_log_syslog.c b/net/netfilter/nf_log_syslog.c
index e37b09b3203b..71dff0eb672c 100644
--- a/net/netfilter/nf_log_syslog.c
+++ b/net/netfilter/nf_log_syslog.c
@@ -301,7 +301,7 @@ nf_log_dump_udp_header(struct nf_log_buf *m,
/* Max length: 20 "SPT=65535 DPT=65535 " */
nf_log_buf_add(m, "SPT=%u DPT=%u LEN=%u ",
- ntohs(uh->source), ntohs(uh->dest), ntohs(uh->len));
+ ntohs(uh->source), ntohs(uh->dest), udp_get_len_short(uh));
out:
return 0;
diff --git a/net/netfilter/nf_nat_helper.c b/net/netfilter/nf_nat_helper.c
index bf591e6af005..3853f41db499 100644
--- a/net/netfilter/nf_nat_helper.c
+++ b/net/netfilter/nf_nat_helper.c
@@ -161,7 +161,7 @@ nf_nat_mangle_udp_packet(struct sk_buff *skb,
/* update the length of the UDP packet */
datalen = skb->len - protoff;
- udph->len = htons(datalen);
+ udp_set_len_short(udph, datalen);
/* fix udp checksum if udp checksum was previously calculated */
if (!udph->check && skb->ip_summed != CHECKSUM_PARTIAL)
diff --git a/net/psp/psp_main.c b/net/psp/psp_main.c
index 8b2f178e317c..90c7dc4e76a1 100644
--- a/net/psp/psp_main.c
+++ b/net/psp/psp_main.c
@@ -231,7 +231,7 @@ static void psp_write_headers(struct net *net, struct sk_buff *skb, __be32 spi,
uh->source = udp_flow_src_port(net, skb, 0, 0, false);
}
uh->check = 0;
- uh->len = htons(udp_len);
+ udp_set_len_short(uh, udp_len);
psph->nexthdr = IPPROTO_TCP;
psph->hdrlen = PSP_HDRLEN_NOOPT;
diff --git a/net/sched/act_csum.c b/net/sched/act_csum.c
index 078d3a27130b..5fff52a8ca90 100644
--- a/net/sched/act_csum.c
+++ b/net/sched/act_csum.c
@@ -276,7 +276,7 @@ static int tcf_csum_ipv4_udp(struct sk_buff *skb, unsigned int ihl,
return 0;
iph = ip_hdr(skb);
- ul = ntohs(udph->len);
+ ul = udp_get_len_short(udph);
if (udplite || udph->check) {
@@ -334,7 +334,7 @@ static int tcf_csum_ipv6_udp(struct sk_buff *skb, unsigned int ihl,
return 0;
ip6h = ipv6_hdr(skb);
- ul = ntohs(udph->len);
+ ul = udp_get_len_short(udph);
udph->check = 0;
diff --git a/net/xfrm/xfrm_nat_keepalive.c b/net/xfrm/xfrm_nat_keepalive.c
index 458931062a04..906458f3d8c5 100644
--- a/net/xfrm/xfrm_nat_keepalive.c
+++ b/net/xfrm/xfrm_nat_keepalive.c
@@ -133,7 +133,7 @@ static void nat_keepalive_send(struct nat_keepalive *ka)
uh = skb_push(skb, sizeof(*uh));
uh->source = ka->encap_sport;
uh->dest = ka->encap_dport;
- uh->len = htons(skb->len);
+ udp_set_len_short(uh, skb->len);
uh->check = 0;
skb->mark = ka->smark;
--
2.54.0
^ permalink raw reply related
* [PATCH net-next v9 0/9] BIG TCP for UDP tunnels
From: Alice Mikityanska @ 2026-07-10 13:42 UTC (permalink / raw)
To: Daniel Borkmann, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Xin Long, Willem de Bruijn, Willem de Bruijn,
David Ahern, Nikolay Aleksandrov
Cc: Shuah Khan, Stanislav Fomichev, Andrew Lunn, Simon Horman,
Florian Westphal, netdev, Alice Mikityanska
From: Alice Mikityanska <alice@isovalent.com>
This series is a follow-up to "BIG TCP without HBH in IPv6", and it adds
support for BIG TCP IPv4/IPv6 workloads in vxlan and geneve. Now that
IPv6 BIG TCP doesn't require stripping the HBH in all various
combinations in tunneled traffic, adding BIG TCP becomes feasible.
Patch 01 adds accessors for the length field in the UDP header, as
suggested by Paolo in review. The usage of udp_set_len is then added in
the following patches that start using length=0 in BIG TCP UDP packets.
Patches 02-04 close the gaps that prevent BIG TCP packets from going
through UDP tunnel code.
Patch 05 validates packets in udp_gro_receive to exclude packets with
length=0 from GRO aggregation.
Patch 06 is for proper formatting in tcpdump (set UDP len to 0 rather
than a trimmed value on overflow).
Patches 07-08 bump up tso_max_size for VXLAN and GENEVE.
Patch 09 adds selftests.
Thanks all!
v9 changes: Converted the selftest to iptables counters to avoid the
issue with tcpdump pcaps taking all space in /tmp.
v8: https://lore.kernel.org/netdev/20260706181941.385672-1-alice.kernel@fastmail.im/
v8 changes: Addressed Paolo's and Jason's review comments. Made the
selftest more robust, added checks for SACK and mode with disabled tx
checksum offload on lower veth netdevs. Added details to commit
messages. Kept skb_segment logic unchanged, because the frags overflow
issue is not specific to BIG TCP.
v7: https://lore.kernel.org/netdev/20260611192955.604661-1-alice.kernel@fastmail.im/
v7 changes: Addressed Paolo's comments to properly block malformed
packets with UDP length=0 at udp_rcv level.
v6: https://lore.kernel.org/netdev/20260602093931.516281-1-alice.kernel@fastmail.im/
v6 changes: Lowered the packets threshold in the selftest to pass
upstream CI on debug kernels, also made it configurable.
v5: https://lore.kernel.org/netdev/20260526161200.1135899-1-alice.kernel@fastmail.im/
v5 changes: Rebased, dropped one of the patches that came in via the net
tree, addressed an overflow in nsim_do_psp found by Sashiko.
v4: https://lore.kernel.org/netdev/20260512165648.386518-1-alice.kernel@fastmail.im/
v4 changes: Rebased, addressed Sashiko AI review [1] and Willem's
comment about netperf flags.
My comments on Sashiko AI review per patch:
01: I'd prefer to keep the cases that I haven't tested outside of the
scope of this series, which is for VXLAN/GENEVE tunnels, not for ESP.
02: The patch doesn't have behavioral changes other than fixing the
checksum. The final uh->len assignment assigns the actual length, not
64k.
03: The check can't be loosened, because total_len is also assigned to
UDP length. BIG TCP works in the mode without GRO hint option.
04: Fixed the fallback value for udplen. BIG TCP is fine, it's the
uh->len = 0 case, uh->len can't exceed 64k.
05: In the BIG TCP case, partial GSO splits the SKB in two. If full
segmentation is needed, the SKB is split in many MSS-sized SKBs without
fragments.
06: Invalid packets from the wire are addressed in 08.
07: __udp_gso_segment only handles UDP GSO packets, which can't be
bigger than 64k. Kept udp_set_len_short in nf_nat_mangle_udp_packet, as
the function doesn't support BIG TCP packets anyway (see
mangle_contents).
08: udp_gro_receive handles packets before aggregation, there are no BIG
TCP packets at this point. RFC 768 doesn't say that padded UDP packets
are valid. Real jumbograms don't seem to be supported in this path
anyway.
09: The packet goes to skb_udp_tunnel_segment, not __udp_gso_segment.
__skb_udp_tunnel_segment handles this case.
12: Improved process cleanup by killing everything inside netns before
deleting them, and by avoiding killing netserver outside of netns.
netperf with -r in TCP_STREAM mode works, and the option has the
intended effect, but I replaced it with -m. Added dependency check for
tcpdump.
[1]: https://sashiko.dev/#/patchset/20260410150943.993350-1-alice.kernel%40fastmail.im
v3: https://lore.kernel.org/netdev/20260410150943.993350-1-alice.kernel@fastmail.im/
v3 changes: Fixed the redirect in the selftest, rebased over my L2TP fix
[2] for the syzbot report [3].
[2]: https://lore.kernel.org/netdev/20260403174949.843941-1-alice.kernel@fastmail.im/
[3]: https://lore.kernel.org/netdev/69a1dfba.050a0220.3a55be.0026.GAE@google.com/
v2: https://lore.kernel.org/netdev/20260226201600.222044-1-alice.kernel@fastmail.im/
v2 changes: Addressed the review comments: added UDP len helpers,
consolidated UDP len sanity checks in patch 08 into one, added
selftests. Added fixups to related code (patch 01-03).
v1: https://lore.kernel.org/netdev/20250923134742.1399800-1-maxtram95@gmail.com/
Alice Mikityanska (8):
net: Use helpers to get/set UDP len tree-wide
net: Enable BIG TCP with partial GSO
udp: Support BIG TCP GSO packets where they can occur
udp: Support gro_ipv4_max_size > 65536
udp: Validate UDP length in udp_gro_receive
udp: Set length in UDP header to 0 for big GSO packets
vxlan: Enable BIG TCP packets
selftests: net: Add a test for BIG TCP in UDP tunnels
Daniel Borkmann (1):
geneve: Enable BIG TCP packets
drivers/infiniband/core/lag.c | 2 +-
drivers/infiniband/sw/rxe/rxe_net.c | 4 +-
drivers/net/amt.c | 6 +-
drivers/net/ethernet/intel/i40e/i40e_txrx.c | 2 +-
drivers/net/ethernet/intel/iavf/iavf_txrx.c | 2 +-
drivers/net/ethernet/intel/ice/ice_txrx.c | 2 +-
drivers/net/ethernet/intel/idpf/idpf_txrx.c | 2 +-
.../marvell/octeontx2/nic/otx2_txrx.c | 2 +-
.../net/ethernet/mellanox/mlx5/core/en_rx.c | 4 +-
.../ethernet/mellanox/mlx5/core/en_selftest.c | 2 +-
drivers/net/ethernet/sfc/falcon/selftest.c | 4 +-
drivers/net/ethernet/sfc/selftest.c | 4 +-
drivers/net/ethernet/sfc/siena/selftest.c | 4 +-
drivers/net/ethernet/sfc/tc_encap_actions.c | 2 +-
.../stmicro/stmmac/stmmac_selftests.c | 4 +-
drivers/net/geneve.c | 4 +-
drivers/net/netconsole.c | 2 +-
drivers/net/netdevsim/dev.c | 2 +-
drivers/net/netdevsim/psample.c | 2 +-
drivers/net/netdevsim/psp.c | 8 +-
drivers/net/vxlan/vxlan_core.c | 2 +
drivers/net/wireguard/receive.c | 2 +-
include/linux/udp.h | 27 +++
include/trace/events/icmp.h | 2 +-
lib/tests/blackhole_dev_kunit.c | 2 +-
net/6lowpan/nhc_udp.c | 10 +-
net/core/pktgen.c | 4 +-
net/core/selftests.c | 4 +-
net/core/skbuff.c | 10 +-
net/core/tso.c | 3 +-
net/ipv4/esp4.c | 2 +-
net/ipv4/fou_core.c | 2 +-
net/ipv4/ipconfig.c | 6 +-
net/ipv4/netfilter/nf_nat_snmp_basic_main.c | 4 +-
net/ipv4/route.c | 2 +-
net/ipv4/udp.c | 7 +-
net/ipv4/udp_offload.c | 49 ++---
net/ipv4/udp_tunnel_core.c | 2 +-
net/ipv6/esp6.c | 5 +-
net/ipv6/fou6.c | 2 +-
net/ipv6/ip6_udp_tunnel.c | 2 +-
net/ipv6/udp.c | 7 +-
net/ipv6/udp_offload.c | 2 +-
net/l2tp/l2tp_core.c | 2 +-
net/netfilter/ipvs/ip_vs_xmit.c | 2 +-
net/netfilter/nf_conntrack_proto_udp.c | 15 +-
net/netfilter/nf_log_syslog.c | 2 +-
net/netfilter/nf_nat_helper.c | 2 +-
net/psp/psp_main.c | 2 +-
net/sched/act_csum.c | 4 +-
net/xfrm/xfrm_nat_keepalive.c | 2 +-
tools/testing/selftests/net/Makefile | 1 +
.../testing/selftests/net/big_tcp_tunnels.sh | 188 ++++++++++++++++++
53 files changed, 340 insertions(+), 102 deletions(-)
create mode 100755 tools/testing/selftests/net/big_tcp_tunnels.sh
--
2.54.0
^ permalink raw reply
* Re: [PATCH] net: gianfar: fix use-after-free in gfar_enet_open on startup_gfar failure
From: Simon Horman @ 2026-07-10 13:39 UTC (permalink / raw)
To: Rosen Penev
Cc: netdev, Claudiu Manoil, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, open list
In-Reply-To: <20260704234734.1779991-1-rosenp@gmail.com>
On Sat, Jul 04, 2026 at 04:47:34PM -0700, Rosen Penev wrote:
> If startup_gfar() fails in gfar_enet_open(), the PHY remains connected
> and IRQs remain requested. Since ndo_open returned an error, IFF_UP is
> not set and ndo_stop (gfar_close) will not be called on unregister,
> leaving the IRQ handlers registered against freed net_device memory
> when the driver is removed.
>
> Add proper error unwinding: phy_disconnect() and gfar_free_irq() before
> returning the error.
>
> Fixes: 80ec396cb6b5 ("gianfar: Don't free/request irqs on device reset")
>
nit: no blank line here
> Assisted-by: Opencode:Big-Pickle
> Signed-off-by: Rosen Penev <rosenp@gmail.com>
> ---
> drivers/net/ethernet/freescale/gianfar.c | 5 ++++-
> 1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/drivers/net/ethernet/freescale/gianfar.c b/drivers/net/ethernet/freescale/gianfar.c
> index 89215e1ddc2d..4b3a5eaadfb5 100644
> --- a/drivers/net/ethernet/freescale/gianfar.c
> +++ b/drivers/net/ethernet/freescale/gianfar.c
> @@ -2878,8 +2878,11 @@ static int gfar_enet_open(struct net_device *dev)
> return err;
>
> err = startup_gfar(dev);
> - if (err)
> + if (err) {
> + phy_disconnect(dev->phydev);
> + gfar_free_irq(priv);
> return err;
> + }
>
> return err;
> }
The AI-generated review on https://netdev-ai.bots.linux.dev/sashiko/ has
the following to say. I'd suggest addressing this using a more
comprehensive patch that makes use of an idiomatic goto ladder to unwind on
error.
Should the gfar_request_irq() failure path also disconnect the PHY?
Looking at gfar_enet_open() after this patch:
err = init_phy(dev);
if (err)
return err;
err = gfar_request_irq(priv);
if (err)
return err;
err = startup_gfar(dev);
if (err) {
phy_disconnect(dev->phydev);
gfar_free_irq(priv);
return err;
}
init_phy() calls of_phy_connect(), which installs the driver's
adjust_link callback (holding a net_device pointer) into the phy_device.
If gfar_request_irq() then fails, the function returns without calling
phy_disconnect().
Since ndo_open returned an error, IFF_UP is not set and gfar_close()
will not be called by unregister_netdev(). When the driver is later
removed (gfar_remove -> unregister_netdev -> free_gfar_dev), the
net_device is freed while the phy_device still holds a reference to
it via adjust_link, which is the same use-after-free scenario the
commit message describes.
This pre-existed the patch, but since the changelog says it fixes the
failure of gfar_enet_open() leaving stale references, would it make
sense to also add phy_disconnect(dev->phydev) to the gfar_request_irq()
error path, e.g.:
err = gfar_request_irq(priv);
if (err) {
phy_disconnect(dev->phydev);
return err;
}
^ permalink raw reply
* Re: [PATCH net-next 1/6] dt-bindings: net: mediatek-dwmac: add support for MT8189 SoC
From: Andrew Lunn @ 2026-07-10 13:35 UTC (permalink / raw)
To: Louis-Alexis Eyraud
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Richard Cochran, Matthias Brugger, AngeloGioacchino Del Regno,
Biao Huang, Maxime Coquelin, Alexandre Torgue, maxime.chevallier,
rmk+kernel, kernel, netdev, devicetree, linux-kernel,
linux-arm-kernel, linux-mediatek, linux-stm32
In-Reply-To: <f85e08cf5e119e30ab4513e78ffa833fbe0832b7.camel@collabora.com>
> I don't.
> All the MTK Genio boards (510, 520, 720, 1200 EVK) I have are using
> RGMII only.
>
> > Ideally, for a new device, we should not repeat past errors.
>
> So, do you want I remove this clock from mt8189 clocks list for v2?
Yes, lets remove it, until somebody actually has an RMII device, and
we can figure out the correct way to do it.
Andrew
^ permalink raw reply
* Re: [PATCH net-next 2/2] net: dsa: mt7530: add EN7528 support
From: Andrew Lunn @ 2026-07-10 13:32 UTC (permalink / raw)
To: Ahmed Naseef
Cc: netdev, Arınç ÜNAL, Chester A. Unal,
David S. Miller, AngeloGioacchino Del Regno, Conor Dooley,
DENG Qingfang, Daniel Golle, Eric Dumazet, Jakub Kicinski,
Krzysztof Kozlowski, Landen Chao, Matthias Brugger, Paolo Abeni,
Rob Herring, Russell King, Sean Wang, Vladimir Oltean, devicetree,
linux-arm-kernel, linux-kernel, linux-mediatek
In-Reply-To: <1865eaedef97e593ba608764c7390209cae85b30.1783680864.git.naseefkm@gmail.com>
> + /* The EN7528 LAN GPHYs advertise EEE by default, but negotiating EEE
> + * with common link partners (e.g. Realtek GbE NICs) results in an
> + * unstable link with dropped frames. Disable EEE advertisement on
> + * them.
> + */
> + if (priv->id == ID_EN7528)
> + for (i = EN7528_GPHY_BASE;
> + i < EN7528_GPHY_BASE + EN7528_NUM_GPHYS; i++)
> + mt7531_ind_c45_phy_write(priv, i, MDIO_MMD_AN,
> + MDIO_AN_EEE_ADV, 0);
> +
The problem with this is, you can still use ethtool to enable EEE.
Please look at phylink_bringup_phy(), where it calls
phy_disable_eee().
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next] selftests/net: Skip srv6_end_dt46_l3vpn_test::host_vpn_tests if iproute2 too old
From: Alessio Faina @ 2026-07-10 13:31 UTC (permalink / raw)
To: Andrea Mayer
Cc: netdev, linux-kselftest, Po-Hsu Lin, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan, stefano.salsano, Andrea Mayer
In-Reply-To: <20260710152211.63eb25d604ea0aa2b3707d68@common-net.org>
On Fri, Jul 10, 2026 at 03:22:11PM +0200, Andrea Mayer wrote:
> On Wed, 8 Jul 2026 17:27:45 +0200
> Alessio Faina <alessio.faina@canonical.com> wrote:
>
> > In case iproute2 is older than version 5.14.0, released ~Sept 1, 2021,
> > the End.DT46 support is not available and the host_vpn_tests test contained
> > in the srv6_end_dt46_l3vpn_test.sh file is failing in some kernel backports.
> > This is the result of those tests:
> >
> > ################################################################################
> > TEST SECTION: SRv6 VPN connectivity test among hosts in the same tenant
> > ################################################################################
> >
> > TEST: IPv6 Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [ FAIL ]
> >
> > TEST: IPv4 Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [ FAIL ]
> >
> > TEST: IPv6 Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [ FAIL ]
> >
> > TEST: IPv4 Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [ FAIL ]
> >
> > TEST: IPv6 Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [ FAIL ]
> >
> > TEST: IPv4 Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [ FAIL ]
> >
> > TEST: IPv6 Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [ FAIL ]
> >
> > TEST: IPv4 Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [ FAIL ]
> >
> > To amend this, check the current running iproute2 supports the required
> > feature and, if not, just skip the test to avoid a failure.
> >
> >
> > Signed-off-by: Alessio Faina <alessio.faina@canonical.com>
> > ---
> > .../selftests/net/srv6_end_dt46_l3vpn_test.sh | 13 ++++++++-----
> > 1 file changed, 8 insertions(+), 5 deletions(-)
> >
> > diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> > index a5e959a080bb..406c6a3d253e 100755
> > --- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> > +++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> > @@ -510,12 +510,15 @@ host2gateway_tests()
> > host_vpn_tests()
> > {
> > log_section "SRv6 VPN connectivity test among hosts in the same tenant"
> > + if ip route add help 2>&1 | grep -q -i End.DT46; then
> > + check_and_log_hs_connectivity 1 2 100
> > + check_and_log_hs_connectivity 2 1 100
> >
> > - check_and_log_hs_connectivity 1 2 100
> > - check_and_log_hs_connectivity 2 1 100
> > -
> > - check_and_log_hs_connectivity 3 4 200
> > - check_and_log_hs_connectivity 4 3 200
> > + check_and_log_hs_connectivity 3 4 200
> > + check_and_log_hs_connectivity 4 3 200
> > + else
> > + echo "SKIP: SRv6 End.DT46 is unsupported by the installed iproute2 version"
> > + fi
> > }
>
> Hi Alessio,
>
> Rather than inlining the check inside host_vpn_tests(), I think it would be
> better to follow the pattern already used in srv6_hencap_red_l3vpn_test.sh,
> where test_iproute2_supp_or_ksft_skip() is called before setup(). A similar
> function here could exit the whole script with $ksft_skip if End.DT46 is not
> supported by the installed iproute2.
>
> Thanks,
>
> Ciao
> Andrea
Hi Andrea,
Thanks for your feedback, I will send a V2 with the requested changes.
Kind regards,
-Alessio
^ permalink raw reply
* Re: [PATCH 6.12.y] net: add missing ns_capable check for peer netns
From: Greg KH @ 2026-07-10 13:31 UTC (permalink / raw)
To: Maximilian Heyne
Cc: stable, Marc Kleine-Budde, Vincent Mailhol, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Daniel Borkmann, Nikolay Aleksandrov, Eric W. Biederman,
linux-can, netdev, linux-kernel, bpf
In-Reply-To: <20260710-wry-moral-3892dd17@mheyne-amazon>
On Fri, Jul 10, 2026 at 12:49:54PM +0000, Maximilian Heyne wrote:
> Hi Greg,
>
> On Thu, Jun 25, 2026 at 12:37:31PM +0100, Greg KH wrote:
> > On Wed, Jun 17, 2026 at 08:25:31AM +0000, Maximilian Heyne wrote:
> > > The upstream commit 7b735ef81286 ("rtnetlink: add missing
> > > netlink_ns_capable() check for peer netns") doesn't apply on older
> > > stable kernels due to refactoring. Therefore, this patch is an attempt
> > > to implement the same capability check just directly in the respective
> > > interface types.
> >
> > Why can't we take the full series of patches instead? Otherwise this is
> > going to be a pain over time for any other fixes/updates in this area,
> > right?
>
> Agree that this would be a pain. The issue is that this requires to
> backport >10 patches. I think for 6.12 it would be like 15 patches so
> that each patch doesn't need to be reworked too much.
15 is trivial, we have taken hundreds in the past :)
> The reason for me submitting this was that it's easily backports to all
> stable kernels. I haven't tested for 6.6 or earlier how many patches
> would need to be backported.
>
> I can try to post the series for 6.12 after some more testing (after my
> vacation) but I'm think I won't succeed backporting the refactoring
> patches back to, say, 5.10.
Full series is best because maintaining this over time will be easier if
you do that, not harder.
thanks,
greg k-h
^ permalink raw reply
* Re: [PATCH net] net: stmmac: enable the MAC on link up at 10G on 10GBASE-R
From: Maxime Chevallier @ 2026-07-10 13:30 UTC (permalink / raw)
To: vadik likholetov, netdev
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Thierry Reding, Jonathan Hunter, Bhadram Varka,
linux-tegra, linux-kernel
In-Reply-To: <20260710120908.3731591-1-vadikas@gmail.com>
Hi,
On 7/10/26 14:09, vadik likholetov wrote:
> stmmac_mac_link_down() clears the MAC's transmit and receive enable bits.
> stmmac_mac_link_up() is expected to set them again through
> stmmac_mac_set(..., true), but it first switches on the negotiated speed
> and returns early for a speed it does not recognise.
>
> The generic branch of that switch -- taken for every interface that is
> neither USXGMII nor XLGMII, which includes PHY_INTERFACE_MODE_10GBASER --
> handles only SPEED_2500, SPEED_1000, SPEED_100 and SPEED_10.
>
> MGBE on Tegra234 runs 10GBASE-R into an Aquantia AQR113C. That PHY does
> rate matching, so phylink_link_up() replaces the media speed with the
> MAC-side interface speed before calling into the MAC:
>
> case RATE_MATCH_PAUSE:
> speed = phylink_interface_max_speed(link_state.interface);
> duplex = DUPLEX_FULL;
>
> The driver is therefore called as
>
> stmmac_mac_link_up(interface=10GBASER, speed=10000, duplex=1)
>
> which falls through to "default: return;". The MAC is never re-enabled,
> and the interface stops passing traffic after the first link flap.
>
> The failure is easy to misread. The link still comes up, because the PHY
> is polled over MDIO and needs no MAC, so the interface reports carrier 1
> at the media speed. The DMA is untouched, so its start bits stay set and
> descriptors are still consumed. Only the MAC itself is gated off: the
> receiver counts nothing (mmc_rx_framecount_gb stops advancing, RE is 0)
> and nothing reaches the wire (TE is 0). The interface survives boot only
> because stmmac_hw_setup(), called from ndo_open, enables the MAC
> unconditionally -- so the problem appears only once the cable has been
> unplugged and plugged back in, and "ip link set dev <ethX> down && ip
> link set dev <ethX> up" appears to fix it.
>
> Handle SPEED_10000 in the generic branch, as the USXGMII and XLGMII
> branches already do. For dwxgmac2, link.xgmii.speed10000 is
> XGMAC_CONFIG_SS_10000, which is 0 and is the correct speed selection for
> a 10GBASE-R MAC: ctrl then equals old_ctrl, the register write is
> skipped, and execution reaches stmmac_mac_set(..., true).
>
> Fixes: d8ca113724e7 ("net: stmmac: tegra: Add MGBE support")
> Signed-off-by: vadik likholetov <vadikas@gmail.com>
Looking at this, it seems the only important thing in that speed selection
logic is how 2.5G is handled :
- either through the XGMII block when using USXGMII
ctrl |= priv->hw->link.xgmii.speed2500;
- or through the regular speed selection bits :
ctrl |= priv->hw->link.speed2500;
The rest is speed validation, and phylink should already be doing that for us.
I suggest that instead of this fix (that is ommiting the 5G case btw), we rewrite
the whole ctrl assignment as :
switch (speed) {
case SPEED_100000:
ctrl |= priv->hw->link.xlgmii.speed100000;
break;
case SPEED_50000:
ctrl |= priv->hw->link.xlgmii.speed50000;
break;
case SPEED_40000:
ctrl |= priv->hw->link.xlgmii.speed40000;
break;
case SPEED_25000:
ctrl |= priv->hw->link.xlgmii.speed25000;
break;
case SPEED_10000:
ctrl |= priv->hw->link.xgmii.speed10000;
break;
case SPEED_5000:
ctrl |= priv->hw->link.xgmii.speed5000;
break;
case SPEED_2500:
if (interface == PHY_INTERFACE_MODE_USXGMII)
ctrl |= priv->hw->link.xgmii.speed2500;
else
ctrl |= priv->hw->link.speed2500;
break;
case SPEED_1000:
ctrl |= priv->hw->link.speed1000;
case SPEED_100:
ctrl |= priv->hw->link.speed100;
break;
case SPEED_10:
ctrl |= priv->hw->link.speed10;
break;
default:
return;
}
(I haven't tested that, I don't have any stmmac boards here that can do more
than 1Gbps :( )
Thanks,
Maxime
^ permalink raw reply
* Re: [PATCH net-next] selftests/net: Skip srv6_end_dt46_l3vpn_test::host_vpn_tests if iproute2 too old
From: Andrea Mayer @ 2026-07-10 13:22 UTC (permalink / raw)
To: Alessio Faina
Cc: netdev, linux-kselftest, Po-Hsu Lin, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Shuah Khan, stefano.salsano, Andrea Mayer
In-Reply-To: <20260708152745.2430714-1-alessio.faina@canonical.com>
On Wed, 8 Jul 2026 17:27:45 +0200
Alessio Faina <alessio.faina@canonical.com> wrote:
> In case iproute2 is older than version 5.14.0, released ~Sept 1, 2021,
> the End.DT46 support is not available and the host_vpn_tests test contained
> in the srv6_end_dt46_l3vpn_test.sh file is failing in some kernel backports.
> This is the result of those tests:
>
> ################################################################################
> TEST SECTION: SRv6 VPN connectivity test among hosts in the same tenant
> ################################################################################
>
> TEST: IPv6 Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [ FAIL ]
>
> TEST: IPv4 Hosts connectivity: hs-t100-1 -> hs-t100-2 (tenant 100) [ FAIL ]
>
> TEST: IPv6 Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [ FAIL ]
>
> TEST: IPv4 Hosts connectivity: hs-t100-2 -> hs-t100-1 (tenant 100) [ FAIL ]
>
> TEST: IPv6 Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [ FAIL ]
>
> TEST: IPv4 Hosts connectivity: hs-t200-3 -> hs-t200-4 (tenant 200) [ FAIL ]
>
> TEST: IPv6 Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [ FAIL ]
>
> TEST: IPv4 Hosts connectivity: hs-t200-4 -> hs-t200-3 (tenant 200) [ FAIL ]
>
> To amend this, check the current running iproute2 supports the required
> feature and, if not, just skip the test to avoid a failure.
>
>
> Signed-off-by: Alessio Faina <alessio.faina@canonical.com>
> ---
> .../selftests/net/srv6_end_dt46_l3vpn_test.sh | 13 ++++++++-----
> 1 file changed, 8 insertions(+), 5 deletions(-)
>
> diff --git a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> index a5e959a080bb..406c6a3d253e 100755
> --- a/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> +++ b/tools/testing/selftests/net/srv6_end_dt46_l3vpn_test.sh
> @@ -510,12 +510,15 @@ host2gateway_tests()
> host_vpn_tests()
> {
> log_section "SRv6 VPN connectivity test among hosts in the same tenant"
> + if ip route add help 2>&1 | grep -q -i End.DT46; then
> + check_and_log_hs_connectivity 1 2 100
> + check_and_log_hs_connectivity 2 1 100
>
> - check_and_log_hs_connectivity 1 2 100
> - check_and_log_hs_connectivity 2 1 100
> -
> - check_and_log_hs_connectivity 3 4 200
> - check_and_log_hs_connectivity 4 3 200
> + check_and_log_hs_connectivity 3 4 200
> + check_and_log_hs_connectivity 4 3 200
> + else
> + echo "SKIP: SRv6 End.DT46 is unsupported by the installed iproute2 version"
> + fi
> }
Hi Alessio,
Rather than inlining the check inside host_vpn_tests(), I think it would be
better to follow the pattern already used in srv6_hencap_red_l3vpn_test.sh,
where test_iproute2_supp_or_ksft_skip() is called before setup(). A similar
function here could exit the whole script with $ksft_skip if End.DT46 is not
supported by the installed iproute2.
Thanks,
Ciao
Andrea
^ permalink raw reply
* Re: [PATCH net] net: dpaa: always set a valid mode I/F mode
From: Sean Anderson @ 2026-07-10 13:27 UTC (permalink / raw)
To: Michael Walle, Madalin Bucur, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel
In-Reply-To: <DJUSHXVKZ0OC.1VDMPW228IYHO@kernel.org>
On 7/10/26 05:39, Michael Walle wrote:
> Hi,
>
> On Fri Jul 10, 2026 at 1:45 AM CEST, Sean Anderson wrote:
>> On 7/6/26 08:08, Michael Walle wrote:
>>> Before converting to the phylink interface, the init function would have
>>> set the correct mode in the maccfg2.
>>
>> So for reference, the old logic is
>>
>> if (iface_speed < SPEED_1000)
>> tmp |= MACCFG2_NIBBLE_MODE;
>> else if (iface_speed == SPEED_1000)
>> tmp |= MACCFG2_BYTE_MODE;
>>
>> which changes between nibble/byte mode depending on the max link speed
>> (e.g. phylink_interface_max_speed). Notably, neither is set for 2.5G.
>
> Ahh you're right, I totally missed, that the speed parameter was
> actually max_speed, which was set by
>
> priv->speed = phy2speed[macdev->phy_if];
> priv->max_speed = priv->speed;
>
> FWIW, in the DPAA RM I have, there is no 2.5G speed. Are you sure,
> there are DTSEC controllers with 2.5Gbps support? The only board I
> found in the device trees is the T1023RDB which is using the memac.
It's listed as an option in the P5020/P5040 RMs (under "SerDes Lane
Assignments and Multiplexing"). Of course despite other parts of the
DPAARM referring to the dTSEC's 2.5G capabilities, the the dTSEC chapter
itself makes no mention of any speed higher than 1G.
As unlike U-Boot, Linux promises backwards compatibility even for
out-of-tree devicetrees, I kept the existing behavior when doing my
conversion on the off chance that someone had a board configured for
2.5G.
Given the similarities of 2.5G "SGMII" and SGMII, I suspect that the
settings should probably be the same for 2.5G as for 1G.
>> Can you try moving this write to dtsec_mac_config?
>
> That worked! At least for SGMII. I don't have a board with another
> interface to test tough. I'll prepare a new version, making
> phylink_interface_max_speed() public and setting the correct value
> in .mac_config().
Well, we already have switch/case there, so you could just use that
since only RMII would default to nibble mode.
> Alternatively, we could move
> phylink_interface_max_speed() to the header as static inline, but
> that function isn't that small.
>
>> And check in the RM
>> whether this is configured based on the interface (in which case we should
>> remove it from dtsec_link_up) or the link speed. And please also check what
>> the correct behavior for 2.5G should be.
>
> This is an excerpt from the RM:
>
> I/F Mode (bits 22-23):
> This field determines the type of interface to which the MAC is
> connected. Its default is 00.
Of course, this implies that it's OK to leave this field as 0, which is probably
why I left the logic as-is. But since you actually tested this (and I just tried
to piece things together from the RMs) we should set it.
> 00 Reserved
> 01 Used for all 10Mbps and 100Mbps speeds
> 10 Used for all 1Gbps speeds
> 11 Reserved
>
> So you could read it both ways? But since the older driver was using
> the maximum interface speed..
>
>> At one point I had the P-series RMs downloaded, but it appears I've misplaced
>> them...
>
> FWIW, I think it's freely available as long as you're logged in with
> your NXP account.
I was at home without access to my NXP account :)
--Sean
> -michael
>
>>
>> --Sean
>>
>>> After converting, init will just
>>> set 0 as the mode. According to the "QorIQ Data Path Acceleration
>>> Architecture (DPAA) Reference Manual", this is a reserved value. In
>>> fact, this will prevent the PCS to establish a link to a connected SGMII
>>> PHY. In turn, mac_link_up() is never called. Fix it by setting a
>>> non-reserved mode; mac_link_up() will then set the correct mode later.
>>>
>>> Fixes: 5d93cfcf7360 ("net: dpaa: Convert to phylink")
>>> Signed-off-by: Michael Walle <mwalle@kernel.org>
>>> ---
>>> FWIW, I've tested this with a Marvell 88E1112 PHY.
>>>
>>> drivers/net/ethernet/freescale/fman/fman_dtsec.c | 5 ++++-
>>> 1 file changed, 4 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>> index fe35703c509e..566921d3a884 100644
>>> --- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>> +++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
>>> @@ -402,7 +402,10 @@ static int init(struct dtsec_regs __iomem *regs, struct dtsec_cfg *cfg,
>>> tmp |= MACCFG1_TX_FLOW;
>>> iowrite32be(tmp, ®s->maccfg1);
>>>
>>> - tmp = 0;
>>> + /* write a non-reserved mode, otherwise the PCS won't establish a link
>>> + * and .mac_link_up() is never called.
>>> + */
>>> + tmp = MACCFG2_NIBBLE_MODE;
>>>
>>> tmp |= (cfg->preamble_len << MACCFG2_PREAMBLE_LENGTH_SHIFT) &
>>> MACCFG2_PREAMBLE_LENGTH_MASK;
>
^ permalink raw reply
* [PATCH net-next] net: mana: Add debug knob to skip TX timeout recovery reset
From: Aditya Garg @ 2026-07-10 13:22 UTC (permalink / raw)
To: kys, haiyangz, wei.liu, decui, longli, andrew+netdev, davem,
edumazet, kuba, pabeni, kotaranov, horms, ernis, dipayanroy,
gargaditya, ssengar, gargaditya, linux-hyperv, netdev,
linux-kernel, linux-rdma
Add a per-port debugfs boolean "tx_timeout_skip_reset" that, when
enabled, makes mana_tx_timeout() log the TX timeout and return without
queueing the per-port detach/attach recovery work.
This is a debug-only aid for bringup and qualification: skipping the
recovery reset keeps the device and queue state intact so a TX timeout
can be correlated with hardware telemetry. The knob defaults to false,
so production recovery behaviour is unchanged.
Signed-off-by: Aditya Garg <gargaditya@linux.microsoft.com>
Reviewed-by: Haiyang Zhang <haiyangz@microsoft.com>
Reviewed-by: Dipayaan Roy <dipayanroy@linux.microsoft.com>
---
drivers/net/ethernet/microsoft/mana/mana_en.c | 14 ++++++++++++++
include/net/mana/mana.h | 3 +++
2 files changed, 17 insertions(+)
diff --git a/drivers/net/ethernet/microsoft/mana/mana_en.c b/drivers/net/ethernet/microsoft/mana/mana_en.c
index 89e7f59f635d..a8c329bdbacf 100644
--- a/drivers/net/ethernet/microsoft/mana/mana_en.c
+++ b/drivers/net/ethernet/microsoft/mana/mana_en.c
@@ -892,6 +892,17 @@ static void mana_tx_timeout(struct net_device *netdev, unsigned int txqueue)
struct mana_context *ac = apc->ac;
struct gdma_context *gc = ac->gdma_dev->gdma_context;
+ /* Debug knob for bringup/qualification: when set, log the timeout and
+ * skip the reset so the failing state is preserved for telemetry.
+ * Disabled by default; production behaviour is unchanged.
+ */
+ if (READ_ONCE(apc->tx_timeout_skip_reset)) {
+ netdev_warn(netdev,
+ "TX timeout on queue %u: reset skipped (tx_timeout_skip_reset enabled)\n",
+ txqueue);
+ return;
+ }
+
/* Already in service, hence tx queue reset is not required.*/
if (test_bit(GC_IN_SERVICE, &gc->flags))
return;
@@ -3486,6 +3497,9 @@ static int mana_init_port(struct net_device *ndev)
&apc->steer_cqe_coalescing);
debugfs_create_u32("current_speed", 0400, apc->mana_port_debugfs,
&apc->speed);
+ debugfs_create_bool("tx_timeout_skip_reset", 0600,
+ apc->mana_port_debugfs,
+ &apc->tx_timeout_skip_reset);
return 0;
reset_apc:
diff --git a/include/net/mana/mana.h b/include/net/mana/mana.h
index 226b61504596..4d041fb8437f 100644
--- a/include/net/mana/mana.h
+++ b/include/net/mana/mana.h
@@ -530,6 +530,9 @@ struct mana_port_context {
struct net_device *ndev;
struct work_struct queue_reset_work;
+ /* Debug knob to log TX timeout but skip recovery reset */
+ bool tx_timeout_skip_reset;
+
u8 mac_addr[ETH_ALEN];
struct mana_eq *eqs;
--
2.43.0
^ permalink raw reply related
* Re: Please backport bridge multicast exponential field encoding fix series to 6.1.y/6.6.y/6.12.y/6.18.y/7.0.y
From: Andrew Lunn @ 2026-07-10 13:21 UTC (permalink / raw)
To: Ujjal Roy
Cc: Greg KH, Linux Stable, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, Nikolay Aleksandrov,
Ido Schimmel, David Ahern, Shuah Khan, Andy Roulin, Yong Wang,
Petr Machata, Ujjal Roy, bridge, netdev, linux-kernel,
linux-kselftest
In-Reply-To: <CAE2MWknt86W6yCtuS_RupiuwiDqXT8wZqENM2DjiW1R=eY8qdg@mail.gmail.com>
On Fri, Jul 10, 2026 at 02:40:39PM +0530, Ujjal Roy wrote:
> On Fri, Jul 10, 2026 at 1:31 AM Andrew Lunn <andrew@lunn.ch> wrote:
> >
> > > > > History: The multicast stack currently supports decoding of IGMPv3 and
> > > > > MLDv2 exponential timer field encodings, but lacks the corresponding
> > > > > encoding logic when generating multicast query packets.
> >
> > RFC 3376 says:
> >
> > 4.1.1. Max Resp Code
> >
> > The Max Resp Code field specifies the maximum time allowed before
> > sending a responding report. The actual time allowed, called the Max
> > Resp Time, is represented in units of 1/10 second and is derived from
> > the Max Resp Code as follows:
> Here I can give you some input. Default value is 10 seconds for which
> the protocol value sent on the wire will be 100. This means 100 *
> (1/10 second) = 10s. Similarly, setting just 14 seconds will cause
> issues. The protocol value transmitted on the wire is 140, which, when
> decoded as a linear value, results in 224. Similarly, values greater
> than 25.5 seconds cannot be represented directly in the 8-bit field.
>
> >
> > Let me check i understand the issue. If the user configures a value >
> > 127, linux continues to use the linear encoding, but a peer decodes it
> > as a floating value.
> Yes, you are right and that is what it does till now. And the Kernel
> applies same to the QQIC field as well.
>
> >
> > 128 linear is 0 | 0x10) << (0 + 3) = 0x40 = 64. So the peer sends the
> > reports earlier than required?
> No, it is not 64. This becomes (0x10 << 3) = 0x80 = 128 again.
>
> >
> > 255 linear is (0xf | 0x10) << (7 + 3) = 0x1F0000 = 2031616. So the
> > peer can send the reports much later than the 255 1/10 of a second
> > than userspace expected.
> Yes, you are right. But the calculation is incorrect; it becomes
> 0x7C00, which is 31744.
Thanks for correcting my maths.
> > I think a much simpler fix for stable is to clamp the user space
> > request for setting the max response time to 127. That seems like a
> > one line patch.
> In mainline I encoded the value according to the RFC. We can clamp to
> 127 in stables, if we are not willing to take the entire series. This
> will force user to use value < 128. Also, please consider QQIC; a
> similar encoding issue persists.
It does not force the users to use a value < 128. You would need to
return EINVAL for that, which i'm not proposing. Returning an error
could break user space.
By clamping to 127, we don't break user space, but we do avoid the
kernel bug, and at least to my superficial reading of the RFC, we are
"language lawyer" compliant with the RFC.
Andrew
^ permalink raw reply
* [PATCH net v3] netfilter: nf_nat: recalculate TCP TS offset after SNAT port rewrite
From: xietangxin @ 2026-07-10 13:30 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: Phil Sutter, Simon Horman, netfilter-devel, coreteam, netdev,
linux-kernel, Victor Nogueira, gaoxingwang, huyizhen, xietangxin
Problem observed in Kubernetes environments where MASQUERADE target with
--random-fully is configured by default. after commit
165573e41f2f ("tcp: secure_seq: add back ports to TS offset") TCP short
connection QPS dropped from ~20000 to ~10000. This added source and
destination ports into TS offset calculation.
However, with MASQUERADE --random-fully, when multiple internal connections
(e.g sport 10000,20000) are mapped to the same external port (e.g 30000),
their TS offsets are calculated as ts_offset(10000) and ts_offset(20000).
If the server reuses the TIME_WAIT slot from the first connection, there is
a chance that ts_offset(20000) < ts_offset(10000), breaking TSval
monotonicity for the same 4-tuple and causing RST packets:
Client -> Server 24870 -> 80 [SYN] TSval=2294041168
Server -> Client 80 -> 24870 [ACK] TSecr=2846236456
Client -> Server 24870 -> 80 [RST] Seq=855605690
After nf_nat_inet_fn() successfully assigns a new randomized
source port, recalculate the TS offset using the new port and
update the SYN packet's TSval accordingly.
Test results on 4U4G VM with
`./wrk -t8 -c200 -H "Connection: close" -d10s --latency http://5.5.5.5:80`
Before:
random:10712 req/s, random-fully:10986 req/s
After:
random:20530 req/s, random-fully:19511 req/s
Fixes: 165573e41f2f ("tcp: secure_seq: add back ports to TS offset")
Cc: stable@vger.kernel.org
Closes:https://lore.kernel.org/all/92935c00-e0be-4591-ac44-5978c7804d57@yeah.net/
Signed-off-by: xietangxin <xietangxin@h-partners.com>
---
v3:
- Add skb_ensure_writable check before munge packet and some comments.
- Use get/put_unaligned_be32() op tsval and update tcp checksum.
- Reorder variables to follow the reverse xmas tree style.
- Keep the helper in POST_ROUTING since MASQUERADE runs there, and
move `if (!skb->sk)` to the very beginning.
v2: https://lore.kernel.org/all/20260709131216.2189210-1-xietangxin@h-partners.com/
- Move the new helper in the IP_CT_NEW case of nf_nat_inet_fn().
- Fix a compilation failure when CONFIG_IPV6 is disabled.
v1: https://lore.kernel.org/all/20260629093408.3927103-1-xietangxin@h-partners.com/
---
net/netfilter/nf_nat_core.c | 116 +++++++++++++++++++++++++++++++++++-
1 file changed, 115 insertions(+), 1 deletion(-)
diff --git a/net/netfilter/nf_nat_core.c b/net/netfilter/nf_nat_core.c
index 63ff6b4d5d21..01836ad70b0f 100644
--- a/net/netfilter/nf_nat_core.c
+++ b/net/netfilter/nf_nat_core.c
@@ -16,6 +16,8 @@
#include <linux/siphash.h>
#include <linux/rtnetlink.h>
+#include <net/tcp.h>
+#include <net/secure_seq.h>
#include <net/netfilter/nf_conntrack_bpf.h>
#include <net/netfilter/nf_conntrack_core.h>
#include <net/netfilter/nf_conntrack_helper.h>
@@ -894,6 +896,112 @@ static bool in_vrf_postrouting(const struct nf_hook_state *state)
return false;
}
+static unsigned char *nf_nat_tcp_ts_option_ptr(struct sk_buff *skb)
+{
+ unsigned int optlen, offset;
+ unsigned char opsize;
+ unsigned char opcode;
+ unsigned char *ptr;
+ struct tcphdr *th;
+
+ if (skb_ensure_writable(skb, tcp_hdrlen(skb)))
+ return NULL;
+
+ offset = 0;
+ th = tcp_hdr(skb);
+ optlen = tcp_optlen(skb);
+ ptr = (unsigned char *)(th + 1);
+
+ while (offset < optlen) {
+ opcode = ptr[offset];
+ if (opcode == TCPOPT_EOL)
+ break;
+
+ if (opcode == TCPOPT_NOP) {
+ offset++;
+ continue;
+ }
+
+ if (offset + 1 >= optlen)
+ break;
+
+ opsize = ptr[offset + 1];
+ if (opsize < 2 || offset + opsize > optlen)
+ break;
+
+ if (opcode == TCPOPT_TIMESTAMP && opsize == TCPOLEN_TIMESTAMP)
+ return ptr + offset + 2;
+
+ offset += opsize;
+ }
+
+ return NULL;
+}
+
+/* Update TCP TS offset for local packets after SNAT port rewrite */
+static void nf_nat_update_tcp_ts_offset(struct nf_conn *ct, struct sk_buff *skb)
+{
+ struct nf_conntrack_tuple *reply_tuple;
+ struct nf_conntrack_tuple *orig_tuple;
+ union tcp_seq_and_ts_off st;
+ unsigned char *tsptr;
+ struct tcp_sock *tp;
+ struct tcphdr *th;
+ struct net *net;
+ u32 old_ts, new_ts;
+
+ if (!skb->sk)
+ return;
+
+ orig_tuple = &ct->tuplehash[IP_CT_DIR_ORIGINAL].tuple;
+ reply_tuple = &ct->tuplehash[IP_CT_DIR_REPLY].tuple;
+
+ /* No port rewrite? No need to update anything */
+ if (orig_tuple->src.u.tcp.port == reply_tuple->dst.u.tcp.port)
+ return;
+
+ th = tcp_hdr(skb);
+ if (!th || !th->syn || th->ack)
+ return;
+
+ net = nf_ct_net(ct);
+
+ /* Avoid bogus tsoff update for non-randomized tcp timestamps */
+ if (READ_ONCE(net->ipv4.sysctl_tcp_timestamps) != 1)
+ return;
+
+ tsptr = nf_nat_tcp_ts_option_ptr(skb);
+ if (!tsptr)
+ return;
+
+ switch (nf_ct_l3num(ct)) {
+ case NFPROTO_IPV4:
+ st = secure_tcp_seq_and_ts_off(net, reply_tuple->dst.u3.ip,
+ reply_tuple->src.u3.ip,
+ reply_tuple->dst.u.tcp.port,
+ reply_tuple->src.u.tcp.port);
+ break;
+#if IS_ENABLED(CONFIG_IPV6)
+ case NFPROTO_IPV6:
+ st = secure_tcpv6_seq_and_ts_off(net, reply_tuple->dst.u3.ip6,
+ reply_tuple->src.u3.ip6,
+ reply_tuple->dst.u.tcp.port,
+ reply_tuple->src.u.tcp.port);
+ break;
+#endif
+ default:
+ return;
+ }
+
+ tp = tcp_sk(skb->sk);
+ old_ts = get_unaligned_be32(tsptr);
+ new_ts = tcp_skb_timestamp_ts(tp->tcp_usec_ts, skb) + st.ts_off;
+ put_unaligned_be32(new_ts, tsptr);
+ inet_proto_csum_replace4(&th->check, skb, cpu_to_be32(old_ts),
+ cpu_to_be32(new_ts), false);
+ WRITE_ONCE(tp->tsoffset, st.ts_off);
+}
+
unsigned int
nf_nat_inet_fn(void *priv, struct sk_buff *skb,
const struct nf_hook_state *state)
@@ -937,8 +1045,14 @@ nf_nat_inet_fn(void *priv, struct sk_buff *skb,
state);
if (ret != NF_ACCEPT)
return ret;
- if (nf_nat_initialized(ct, maniptype))
+ if (nf_nat_initialized(ct, maniptype)) {
+ if (state->hook == NF_INET_POST_ROUTING &&
+ nf_ct_protonum(ct) == IPPROTO_TCP &&
+ (ct->status & IPS_SRC_NAT)) {
+ nf_nat_update_tcp_ts_offset(ct, skb);
+ }
goto do_nat;
+ }
}
null_bind:
ret = nf_nat_alloc_null_binding(ct, state->hook);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH v2 0/7] usb: fix UAF related to dynamic ID
From: Greg Kroah-Hartman @ 2026-07-10 13:13 UTC (permalink / raw)
To: Gary Guo
Cc: Rafael J. Wysocki, Danilo Krummrich,
Toke Høiland-Jørgensen, Johan Hovold,
Mauro Carvalho Chehab, Petko Manolov, Andrew Lunn,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Chas Williams, Alan Stern, linux-usb, driver-core, linux-wireless,
linux-media, linux-atm-general, netdev, usb-storage, linux-kernel,
Manuel Ebner
In-Reply-To: <20260707-usb_dyn_id_uaf-v2-0-632dcf3adfba@garyguo.net>
On Tue, Jul 07, 2026 at 01:26:39PM +0100, Gary Guo wrote:
> This is the USB version of the dynamic ID UAF fix similar to that of PCI
> [1]. usb_match_dynamic_id returns a pointer to field of usb_dynid, which
> can be freed when dynamic ID is removed via sysfs. It can be triggered with
> the following sequence:
>
> echo <vid> <pid> > /sys/bus/usb/drivers/<name>/new_id
> <probe start>
> echo <vid> <pid> > /sys/bus/usb/drivers/<name>/remove_id
> <probe use ID>
>
> Fix it by making a stack copy of the ID. This does mean that the lifetime
> of ID is scoped to probe (which is already the case but never spelled out
> explicitly). Drivers use these device IDs creatively, so this series also
> fix these drivers.
>
> The following coccinelle script is used to find all cases that are deemed
> suspicious. Only useful case for IDs should be access its fields, or
> forwarding (without type cast) to functions that do so.
>
> @usage@
> identifier fn, id;
> position p;
> @@
> fn(..., struct usb_device_id *id, ...)
> {
> ...
> id@p
> ...
> }
>
> // Due to cocci isomorphism this needs to be explicit
> @bad@
> identifier fn, id;
> type T;
> position usage.p;
> @@
> fn(..., struct usb_device_id *id, ...)
> {
> ...
> (T*)id@p
> ...
> }
>
> // Good use cases
> @good@
> identifier fn, id, fld;
> expression E;
> position usage.p;
> @@
> fn(..., struct usb_device_id *id, ...)
> {
> ...
> (
> id@p->fld
> |
> E(..., id@p, ...)
> |
> // Redundant checks, but ignore
> !id@p
> |
> // Redundant checks, but ignore
> id ? ... : ...
> )
> ...
> }
>
> @script:python depends on usage && (bad || !good)@
> p << usage.p;
> @@
> coccilib.report.print_report(p[0], "suspicious use of device ID")
>
> There're 3 drivers that store usb_device_id, and they're converted to just
> use driver_info instead. The other fields of usb_device_id can be easily
> retrieved from usb_device via descriptor.id{Vendor,Product}.
>
> There're also a few users that rely on pointer arithmetics. Pegaus and
> xusbatm are converted to use driver_info. All unusal USB mass storage
> drivers rely on pointer arithemtic to index into a side table, because USB
> storage subsystem is using the driver_data for flags. Luckily all these
> drivers set no_dynamic_id. Ideally these could be fixed too but their
> maintainers probably have a better idea of how.
>
> Link: https://lore.kernel.org/driver-core/20260706-pci_id_fix-v3-0-2d48fc025acc@garyguo.net [1]
>
> Signed-off-by: Gary Guo <gary@garyguo.net>
Thanks for these. I had an old patch series that attempted to do some
locking in this area to fix this up, but this version is much nicer.
I'll go queue it up now.
greg k-h
^ permalink raw reply
* Re: [PATCH net V2] net: phy: motorcomm: read EEE abilities in yt8521_get_features()
From: Andrew Lunn @ 2026-07-10 13:12 UTC (permalink / raw)
To: xiaoning.wang
Cc: Frank.Sae, leitao, hkallweit1, linux, davem, edumazet, kuba,
pabeni, netdev, linux-kernel, imx, xiaoning.wang
In-Reply-To: <20260710080018.1070789-1-xiaoning.wang@oss.nxp.com>
> @@ -2490,7 +2490,8 @@ static int yt8521_get_features(struct phy_device *phydev)
> /* add fiber's features to phydev->supported */
> yt8521_prepare_fiber_features(phydev, phydev->supported);
> }
> - return ret;
> +
> + return ret ? ret : genphy_c45_read_eee_abilities(phydev);
Using a ? like this is very uncommon.
Please change it to the usual
if (ret < 0)
return ret;
return genphy_c45_read_eee_abilities(phydev);
It might also be better to put the test after
yt8521_get_features_paged() call, since that is the only place missing
the test.
Andrew
---
pw-bot: cr
^ permalink raw reply
* Re: [PATCH net-next 2/4] dpll: zl3073x: add PTP clock support
From: Vadim Fedorenko @ 2026-07-10 13:08 UTC (permalink / raw)
To: Ivan Vecera, netdev
Cc: Chris du Quesnay, Arkadiusz Kubalewski, David S. Miller,
Jakub Kicinski, Jiri Pirko, Michal Schmidt, Paolo Abeni,
Pasi Vaananen, Petr Oros, Prathosh Satish, Richard Cochran,
Simon Horman, linux-kernel
In-Reply-To: <20260708170527.916035-3-ivecera@redhat.com>
On 08/07/2026 18:05, Ivan Vecera wrote:
> Add PTP clock support for the ZL3073x DPLL driver. A PTP clock device
> is registered for each DPLL channel that is in NCO mode, providing
> gettimex64, settime64, adjtime, adjfine and perout callbacks.
Here we come back to the discussion of NCO mode. Is DPLL channel
actually a pin (virtual or physical)? If it's not, then it means that
channel is exposed as independent DPLL device, that shouldn't affect
other devices, but AFAIU, it can in the current implementation. If it is
a pin, why do you check device's mode rather then pins?
And another question - what happens when channel changes its mode to
non-NCO? Do we have ptp device disappearing from the system?
^ permalink raw reply
* Re: [PATCH net v2 2/2] net: dsa: mv88e6xxx: flush the ATU when the hash algorithm changes
From: Andrew Lunn @ 2026-07-10 13:06 UTC (permalink / raw)
To: Luke Howard
Cc: Vladimir Oltean, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Vivien Didelot, Gregory CLEMENT, Richard Cochran,
Cedric Jehasse, Kieran Tyrrell, Max Holtmann, Max Hunter,
Christoph Mellauner, Simon Gapp, netdev, linux-kernel
In-Reply-To: <20260710-mv88e6x41-fixes-v2-2-e23654c65aa0@padl.com>
On Fri, Jul 10, 2026 at 09:29:33AM +1000, Luke Howard wrote:
> Changing the ATU hash algorithm invalidates existing entries: those
> loaded under the previous algorithm end up in different bins and read
> back corrupted.
>
> Flush the ATU whenever the hash algorithm is changed through devlink
> and reload the default broadcast entries. Per-VLAN ATU entries and
> any static addresses are not replayed, so the hash must be selected
> before the FDB or MDB are configured.
>
> Fixes: 23e8b470c778 ("net: dsa: mv88e6xxx: Add devlink param for ATU hash algorithm.")
> Assisted-by: Claude:claude-opus-4-8
> Signed-off-by: Luke Howard <lukeh@padl.com>
Reviewed-by: Andrew Lunn <andrew@lunn.ch>
Andrew
^ permalink raw reply
* Re: [PATCH net-next 1/6] dt-bindings: net: mediatek-dwmac: add support for MT8189 SoC
From: Louis-Alexis Eyraud @ 2026-07-10 13:01 UTC (permalink / raw)
To: Andrew Lunn
Cc: Andrew Lunn, David S. Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Richard Cochran, Matthias Brugger, AngeloGioacchino Del Regno,
Biao Huang, Maxime Coquelin, Alexandre Torgue, maxime.chevallier,
rmk+kernel, kernel, netdev, devicetree, linux-kernel,
linux-arm-kernel, linux-mediatek, linux-stm32
In-Reply-To: <6ea11726-8d50-411e-afab-da346e09ab9b@lunn.ch>
Hi Andrew,
On Wed, 2026-07-08 at 16:35 +0200, Andrew Lunn wrote:
> > On Tue, 2026-07-07 at 14:42 +0200, Andrew Lunn wrote:
> > > > + - if:
> > > > + properties:
> > > > + compatible:
> > > > + contains:
> > > > + enum:
> > > > + - mediatek,mt8189-gmac
> > > > + then:
> > > > + properties:
> > > > + clocks:
> > > > + items:
> > > > + - description: MAC Main clock
> > > > + - description: PTP clock
> > > > + - description: RMII reference clock provided by
> > > > MAC
> > >
> > > Since this is a MAC, it sounds like it is consuming its own
> > > clock?
> >
> > In the driver ([1]), this clock is described as being only used and
> > needed in RMII when MAC provides the reference clock, and useless
> > otherwise (RGMII/MII or RMII when PHY provides the reference
> > clock).
>
> So it sounds like this is a clock output, going to the PHY, as its
> reference clock input. So ideally, the PHY should consume this clock,
> not the MAC.
>
> > Its use and configuration also depends on the "mediatek,rmii-clk-
> > from-
> > mac" vendor property ([2]) presence in devicetree.
>
> This makes it sounds like it is historically wrong, and the patch is
> just extending this to the new device.
>
> Do you have a board using RMII? Can you list the clock in the PHY
> node, not the MAC, and see if it still works?
>
I don't.
All the MTK Genio boards (510, 520, 720, 1200 EVK) I have are using
RGMII only.
> Ideally, for a new device, we should not repeat past errors.
So, do you want I remove this clock from mt8189 clocks list for v2?
Regards,
Louis-Alexis
>
> Andrew
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox