* Re: VXLAN FDB nexthop groups: per-nexthop UDP dst port / VNI feasibility
From: Jack Ma @ 2026-07-12 20:46 UTC (permalink / raw)
To: Ido Schimmel
Cc: David Ahern, Roopa Prabhu, netdev@vger.kernel.org,
Nikolay Aleksandrov
In-Reply-To: <20260712070543.GA126372@shredder>
Thank you, Ido, for the comments. I'm new to this side of the work, so please excuse my plain-text email handling!
I have submitted the patch here: https://lore.kernel.org/netdev/20260712191218.236-1-jack4it@gmail.com/. I also switched to my Gmail address for easier git and email workflow. Thanks to David as well!
To give some context on my approach: I am implementing a multi-tenant VXLAN overlay where we pack multiple VTEPs onto a shared pool of machines. Because we can't assign a directly routable IP to each individual VTEP, I am trying to route traffic from the shared host IP to a specific VTEP using unique port mappings. This is running in a Kubernetes/pod-based environment, if that helps clarify the use case.
Thank you so much, and I hope the patch can be reviewed.
Best,
-Jack
________________________________________
From: Ido Schimmel <idosch@nvidia.com>
Sent: Sunday, July 12, 2026 12:05 AM
To: Jack Ma <jack4it@hotmail.com>
Cc: David Ahern <dsahern@kernel.org>; Roopa Prabhu <roopa@nvidia.com>; netdev@vger.kernel.org <netdev@vger.kernel.org>; Nikolay Aleksandrov <razor@blackwall.org>
Subject: Re: VXLAN FDB nexthop groups: per-nexthop UDP dst port / VNI feasibility
On Fri, Jul 10, 2026 at 05:30:40AM +0000, Jack Ma wrote:
> Thanks very much for any pointers.
I already commented here:
https://lore.kernel.org/netdev/20260709102247.GA1536940@shredder/
^ permalink raw reply
* [syzbot] [wireless?] WARNING in ieee80211_encrypt_tx_skb
From: syzbot @ 2026-07-12 21:33 UTC (permalink / raw)
To: johannes, linux-kernel, linux-wireless, netdev, syzkaller-bugs
Hello,
syzbot found the following issue on:
HEAD commit: 61c03dfde854 Merge tag 'ntfs-for-7.2-rc3' of git://git.ker..
git tree: upstream
console output: https://syzkaller.appspot.com/x/log.txt?x=116470b9580000
kernel config: https://syzkaller.appspot.com/x/.config?x=20c9876b0f77b546
dashboard link: https://syzkaller.appspot.com/bug?extid=b6ce23950fd636e6efb6
compiler: Debian clang version 22.1.8 (++20260613092233+e80beda6e255-1~exp1~20260613092250.77), Debian LLD 22.1.8
syz repro: https://syzkaller.appspot.com/x/repro.syz?x=16b85432580000
C reproducer: https://syzkaller.appspot.com/x/repro.c?x=162e20b9580000
Downloadable assets:
disk image (non-bootable): https://storage.googleapis.com/syzbot-assets/d900f083ada3/non_bootable_disk-61c03dfd.raw.xz
vmlinux: https://storage.googleapis.com/syzbot-assets/e06f2aec094f/vmlinux-61c03dfd.xz
kernel image: https://storage.googleapis.com/syzbot-assets/a85168c67732/bzImage-61c03dfd.xz
IMPORTANT: if you fix the issue, please add the following tag to the commit:
Reported-by: syzbot+b6ce23950fd636e6efb6@syzkaller.appspotmail.com
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fb87e825fac R14: 00007fb87e825fa0 R15: 00007fb87e825fa0
</TASK>
------------[ cut here ]------------
res != TX_CONTINUE
WARNING: net/mac80211/tx.c:5460 at ieee80211_encrypt_tx_skb+0x3e4/0x3f0 net/mac80211/tx.c:5460, CPU#0: syz.0.17/5534
Modules linked in:
CPU: 0 UID: 0 PID: 5534 Comm: syz.0.17 Not tainted syzkaller #0 PREEMPT(full)
Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014
RIP: 0010:ieee80211_encrypt_tx_skb+0x3e4/0x3f0 net/mac80211/tx.c:5460
Code: ff ff ff e8 9e 1a 7a f6 90 0f 0b 90 e9 0b ff ff ff e8 90 1a 7a f6 90 0f 0b 90 bb ea ff ff ff e9 20 ff ff ff e8 7d 1a 7a f6 90 <0f> 0b 90 eb eb e8 d2 bb 84 00 66 90 90 90 90 90 90 90 90 90 90 90
RSP: 0018:ffffc90003526a20 EFLAGS: 00010293
RAX: ffffffff8b4c6813 RBX: 0000000000000000 RCX: ffff88803a6f0000
RDX: 0000000000000000 RSI: 0000000000000001 RDI: 0000000000000000
RBP: ffffc90003526b90 R08: ffff8880129723cf R09: 0000000000000000
R10: ffff8880129723c0 R11: ffffed100252e47a R12: ffffc90003526a68
R13: 1ffff920006a4d48 R14: dffffc0000000000 R15: 0000000000000001
FS: 00005555940ec500(0000) GS:ffff88808c54d000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: 0000200000003700 CR3: 0000000012968000 CR4: 0000000000352ef0
Call Trace:
<TASK>
mac80211_hwsim_tx+0x1de/0x2500 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2116
ieee80211_hwsim_wake_tx_queue+0xd4/0x150 drivers/net/wireless/virtual/mac80211_hwsim_main.c:2291
drv_wake_tx_queue net/mac80211/driver-ops.h:1394 [inline]
schedule_and_wake_txq net/mac80211/driver-ops.h:1401 [inline]
ieee80211_queue_skb+0x1923/0x22c0 net/mac80211/tx.c:1674
__ieee80211_xmit_fast+0x8ea/0x2160 net/mac80211/tx.c:3785
ieee80211_xmit_fast net/mac80211/tx.c:3853 [inline]
__ieee80211_subif_start_xmit+0x12af/0x1690 net/mac80211/tx.c:4367
ieee80211_tx_control_port+0xaba/0xcd0 net/mac80211/tx.c:6592
rdev_tx_control_port net/wireless/rdev-ops.h:783 [inline]
nl80211_tx_control_port+0x604/0x990 net/wireless/nl80211.c:18403
genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114
genl_family_rcv_msg net/netlink/genetlink.c:1194 [inline]
genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7bb/0x940 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:775
__sock_sendmsg net/socket.c:790 [inline]
____sys_sendmsg+0x54e/0x850 net/socket.c:2684
___sys_sendmsg+0x2a5/0x360 net/socket.c:2738
__sys_sendmsg net/socket.c:2770 [inline]
__do_sys_sendmsg net/socket.c:2775 [inline]
__se_sys_sendmsg net/socket.c:2773 [inline]
__x64_sys_sendmsg+0x1b1/0x290 net/socket.c:2773
do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]
do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94
entry_SYSCALL_64_after_hwframe+0x77/0x7f
RIP: 0033:0x7fb87e59de59
Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
RSP: 002b:00007ffca021cc48 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
RAX: ffffffffffffffda RBX: 00007fb87e825fa0 RCX: 00007fb87e59de59
RDX: 0000000000000800 RSI: 0000200000003700 RDI: 0000000000000003
RBP: 00007ffca021ccb0 R08: 0000000000000000 R09: 0000000000000000
R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
R13: 00007fb87e825fac R14: 00007fb87e825fa0 R15: 00007fb87e825fa0
</TASK>
---
This report is generated by a bot. It may contain errors.
See https://goo.gl/tpsmEJ for more information about syzbot.
syzbot engineers can be reached at syzkaller@googlegroups.com.
syzbot will keep track of this issue. See:
https://goo.gl/tpsmEJ#status for how to communicate with syzbot.
If the report is already addressed, let syzbot know by replying with:
#syz fix: exact-commit-title
If you want syzbot to run the reproducer, reply with:
#syz test: git://repo/address.git branch-or-commit-hash
If you attach or paste a git patch, syzbot will apply it before testing.
If you want to overwrite report's subsystems, reply with:
#syz set subsystems: new-subsystem
(See the list of subsystem names on the web dashboard)
If the report is a duplicate of another one, reply with:
#syz dup: exact-subject-of-another-report
If you want to undo deduplication, reply with:
#syz undup
^ permalink raw reply
* Re: [PATCH] wifi: brcmfmac: drain bus_reset work on device removal
From: Arend van Spriel @ 2026-07-12 21:57 UTC (permalink / raw)
To: Fan Wu
Cc: David S . Miller, Arend van Spriel, Chi-Hsien Lin,
Chung-Hsien Hsu, Franky Lin, Hante Meuleman, Jakub Kicinski,
Kalle Valo, SHA-cyfmac-dev-list, Wright Feng,
brcm80211-dev-list.pdl, linux-kernel, linux-wireless, netdev,
stable
In-Reply-To: <20260709101635.103005-1-fanwu01@zju.edu.cn>
On Thu, 9 Jul 2026 10:16:35 +0000, Fan Wu wrote:
> brcmf_fw_crashed() and the debugfs "reset" entry both schedule
> drvr->bus_reset, whose callback recovers drvr through container_of()
> and dereferences it.
[...]
The patch does not apply cleanly on wl-next/main -- a rebase is needed.
I looked more carefully at the cancel_work_sync-under-lock concern that was
raised in the thread. brcmf_core_bus_reset() never acquires bus_reset_lock,
so there is no deadlock. If the work has already started when
brcmf_bus_cancel_reset_work() is called, cancel_work_sync() waits for it to
finish; by then the reset op (brcmf_pcie_reset) has completed its own
teardown and reinitialized the device, so the subsequent remove teardown acts
on a clean device. The design is correct as submitted; only the rebase is
needed.
Regards,
Arend
^ permalink raw reply
* [PATCH net] mpls: fix NULL deref in mpls_valid_fib_dump_req() on CONFIG_INET=n
From: Xiang Mei @ 2026-07-12 22:09 UTC (permalink / raw)
To: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
Cc: David Ahern, netdev, linux-kernel, bestswngs, Xiang Mei
On CONFIG_INET=n, mpls_valid_fib_dump_req()'s local strict-check loop
enters the RTA_OIF arm on the index alone and calls nla_get_u32(tb[i]).
Since nlmsg_parse_deprecated_strict() leaves tb[i] NULL for any omitted
attribute, a dump without RTA_OIF dereferences NULL and oopses.
Skip unset attributes before dispatching on the index, mirroring
ip_valid_fib_dump_req().
Oops: general protection fault, probably for non-canonical address
0xdffffc0000000000: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
RIP: 0010:mpls_valid_fib_dump_req (net/mpls/af_mpls.c:2189)
Call Trace:
mpls_dump_routes (net/mpls/af_mpls.c:2236)
netlink_dump (net/netlink/af_netlink.c:2331)
__netlink_dump_start (net/netlink/af_netlink.c:2446)
rtnetlink_rcv_msg (net/core/rtnetlink.c:7041)
netlink_rcv_skb (net/netlink/af_netlink.c:2556)
netlink_unicast (net/netlink/af_netlink.c:1345)
netlink_sendmsg (net/netlink/af_netlink.c:1900)
__sock_sendmsg (net/socket.c:790)
____sys_sendmsg (net/socket.c:2684)
___sys_sendmsg (net/socket.c:2738)
__sys_sendmsg (net/socket.c:2770)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)
Kernel panic - not syncing: Fatal exception
Fixes: 196cfebf8972 ("net/mpls: Handle kernel side filtering of route dumps")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
net/mpls/af_mpls.c | 5 ++++-
1 file changed, 4 insertions(+), 1 deletion(-)
diff --git a/net/mpls/af_mpls.c b/net/mpls/af_mpls.c
index ca504d9626cf..1ad07df89d5b 100644
--- a/net/mpls/af_mpls.c
+++ b/net/mpls/af_mpls.c
@@ -2185,13 +2185,16 @@ static int mpls_valid_fib_dump_req(struct net *net, const struct nlmsghdr *nlh,
for (i = 0; i <= RTA_MAX; ++i) {
int ifindex;
+ if (!tb[i])
+ continue;
+
if (i == RTA_OIF) {
ifindex = nla_get_u32(tb[i]);
filter->dev = dev_get_by_index_rcu(net, ifindex);
if (!filter->dev)
return -ENODEV;
filter->filter_set = 1;
- } else if (tb[i]) {
+ } else {
NL_SET_ERR_MSG_MOD(extack, "Unsupported attribute in dump request");
return -EINVAL;
}
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net] nfc: llcp: reject PDUs shorter than the LLCP header
From: Vadim Fedorenko @ 2026-07-12 22:14 UTC (permalink / raw)
To: Doruk (0sec); +Cc: david, oe-linux-nfc, netdev, linux-kernel, stable
In-Reply-To: <CAPdMp1p=72WXe-8w5Y9viBuB6YvZWZomNc9xQzXEg-qe1WVN0A@mail.gmail.com>
On 12/07/2026 17:02, Doruk (0sec) wrote:
> Hi Vadim
>
> this was reproduced from userspace on unmodified
> linux-next (bee763d5f341) without RF hardware.
>
> It's the peer-RX path, not a local command skb:
>
> virtual_ncidev_write (peer NCI DATA) -> nci_rx_data_packet
> -> nfc_tm_data_received -> nfc_llcp_data_received
> -> rx_work -> nfc_llcp_rx_skb -> nfc_llcp_recv_connect
Ok, fair, but in this case it's better to check skb->len in
nfc_llcp_data_received - no need to setup a worker when skb is not
correct.
>
> Bring the LLCP link up via a normal NFC-DEP activation, then send
> one NCI DATA packet with a 1-byte CONNECT PDU. skb->len - 2 wraps
> to 0xffffffff and the TLV walk runs off the end:
>
> BUG: KFENCE: out-of-bounds read in nfc_llcp_recv_connect+0x9f6/0xf80
> nfc_llcp_recv_connect+0x9f6 -> nfc_llcp_rx_work -> process_one_work
> read 4219B past a 704B skbuff_small_head from virtual_ncidev_write
> R14: 00000000ffffffff (wrapped tlv_array_len)
>
> With the guard: rx_skb runs for all 600 short PDUs, recv_connect
> reached 0 times, 0 reports.
>
> The bound stays "<", not "<=" -- a header-only SYMM/DISC/DM is
> exactly 2 bytes and must still dispatch; AGF uses "<=" only
> because an AGF frame must also carry a sub-PDU. I'll drop the
> "same guard as AGF" line from the commit message.
>
> Instantiating /dev/virtual_nci needs privilege, but that's just
> the syzbot transport; the 1-byte CONNECT is what a remote NFC-DEP
> peer emits, and the DEP layer imposes no minimum LLCP length.
> Impact is a proximity OOB read (DoS).
>
> I can send the full reproducer if you'd like.
>
> best
> Doruk
>
> On Sun, Jul 12, 2026 02:01 PM, Vadim Fedorenko
> <vadim.fedorenko@linux.dev> wrote:
>>
>> On 11/07/2026 08:27, Doruk Tan Ozturk wrote:
>>> nfc_llcp_rx_skb() reads the two-byte LLCP header (DSAP/SSAP/PTYPE) and
>>> dispatches by PDU type; several handlers then derive a TLV-array length as
>>> skb->len - LLCP_HEADER_SIZE. Neither nfc_llcp_rx_skb() nor its callers
>>> guarantee the frame is at least LLCP_HEADER_SIZE bytes, and a sub-header
>>
>> that's not correct. there are 2 ways to get to nfc_llcp_rx_skb() - via
>> nfc_llcp_recv_agf() or through commands/locally generated skbs. The
>> first one checks against LLCP_HEADER_SIZE, while latter one creates skb
>> payload with correct LLCP header size. Do you have a reproducer to
>> trigger the issue?
>>
>>
>>> PDU does reach it: digital_in_recv_dep_res() and digital_tg_recv_dep_req()
>>> strip the DEP header with skb_pull() after only checking the DEP header
>>> size, so a DEP I-PDU carrying a 0- or 1-byte LLCP payload is handed up as
>>> a sub-2-byte skb.
>>>
>>> For a CONNECT or CC PDU, nfc_llcp_recv_connect() and nfc_llcp_recv_cc()
>>> then pass skb->len - LLCP_HEADER_SIZE to nfc_llcp_parse_connection_tlv().
>>> For skb->len < 2 that subtraction underflows: truncated into the u16
>>> tlv_array_len parameter it becomes ~0xFFFE, and for a CONNECT to the SDP
>>> SAP, nfc_llcp_connect_sn() uses a size_t and underflows to SIZE_MAX. The
>>> TLV parsers bound their walk relative to that length, so they read far
>>> past the end of the skb.
>>>
>>> The aggregated-frame path (nfc_llcp_recv_agf()) already drops sub-PDUs
>>> shorter than the header. Apply the same guard once, in the dispatcher, so
>>
>> that not exactly correct, it drops skbs which are shorter or equal to
>> the header, the check added in this patch is not correct then.
>>
>>> every PDU type is covered.
>>>
>>> Found by 0sec (https://0sec.ai) using automated source analysis; the
>>> missing guard is evident from source. Compile-tested.
>>>
>>> Fixes: d646960f7986 ("NFC: Initial LLCP support")
>>> Cc: stable@vger.kernel.org
>>> Assisted-by: 0sec:claude-opus-4-8
>>> Signed-off-by: Doruk Tan Ozturk <doruk@0sec.ai>
>>> ---
>>> net/nfc/llcp_core.c | 3 +++
>>> 1 file changed, 3 insertions(+)
>>>
>>> diff --git a/net/nfc/llcp_core.c b/net/nfc/llcp_core.c
>>> index aed5fe1afef0..e3b3077e0e83 100644
>>> --- a/net/nfc/llcp_core.c
>>> +++ b/net/nfc/llcp_core.c
>>> @@ -1481,6 +1481,9 @@ static void nfc_llcp_rx_skb(struct nfc_llcp_local *local, struct sk_buff *skb)
>>> {
>>> u8 dsap, ssap, ptype;
>>>
>>> + if (skb->len < LLCP_HEADER_SIZE)
>>> + return;
>>> +
>>> ptype = nfc_llcp_ptype(skb);
>>> dsap = nfc_llcp_dsap(skb);
>>> ssap = nfc_llcp_ssap(skb);
>>
^ permalink raw reply
* Re: [PATCH net] net: rnpgbe: Pass an expression directly in rnpgbe_rm_adapter()
From: Vadim Fedorenko @ 2026-07-12 22:19 UTC (permalink / raw)
To: Markus Elfring, netdev, Andrew Lunn, David S. Miller,
Eric Dumazet, Jakub Kicinski, MD Danish Anwar, Michael Grzeschik,
Paolo Abeni, Uwe Kleine-König, Yibo Dong
Cc: LKML, kernel-janitors
In-Reply-To: <7958e26e-a4f9-48ee-8d79-3797016944c5@web.de>
On 12/07/2026 19:35, Markus Elfring wrote:
> From: Markus Elfring <elfring@users.sourceforge.net>
> Date: Sun, 12 Jul 2026 20:25:10 +0200
>
> The address of a data structure member was determined before
> a corresponding null pointer check in the implementation of
> the function “rnpgbe_rm_adapter”.
The null check in rnpgbe_rm_adapter() looks more like defensive
programming, which got into the code unnoticed. pdev will not exist if
netdev is not allocated, where mucse is netdev private data.
^ permalink raw reply
* Re: Failed to reinit phy of spacemit-dwmac when reset-gpio is present
From: Inochi Amaoto @ 2026-07-12 22:30 UTC (permalink / raw)
To: Andrew Lunn, Maxime Chevallier
Cc: Inochi Amaoto, Andrew Lunn, Eric Dumazet, David S. Miller,
Jakub Kicinski, Paolo Abeni, Yixun Lan, Maxime Coquelin,
Alexandre Torgue, netdev, linux-riscv, spacemit, linux-stm32,
linux-arm-kernel, linux-kernel, E Shattow, Han Gao
In-Reply-To: <8689bf7d-e00d-4097-bd3c-4d7d7844d1d2@lunn.ch>
On Sun, Jul 12, 2026 at 03:49:43PM +0200, Andrew Lunn wrote:
> > > --- a/arch/riscv/boot/dts/spacemit/k3-pico-itx.dts
> > > +++ b/arch/riscv/boot/dts/spacemit/k3-pico-itx.dts
> > > @@ -196,7 +196,8 @@ ð0 {
> > >
> > > mdio {
> > > phy0: phy@1 {
> > > - compatible = "ethernet-phy-ieee802.3-c22";
> > > + compatible = "ethernet-phy-id001c.c916",
> > > + "ethernet-phy-ieee802.3-c22";
> >
> > Indeed that's merely a workaround :(
>
> Despite is being a workaround, there has not been much progress on a
> generic framework for dealing with clocks, resets, regulators etc,
> before probing PHYs. So this is probably what you want to do.
>
> Andrew
OK, I think I should accept the fact and let this workaround
solve the problem.
Regards,
Inochi
^ permalink raw reply
* Re: Failed to reinit phy of spacemit-dwmac when reset-gpio is present
From: Inochi Amaoto @ 2026-07-12 22:32 UTC (permalink / raw)
To: Maxime Chevallier, Inochi Amaoto, Andrew Lunn, Eric Dumazet,
David S. Miller, Jakub Kicinski, Paolo Abeni, Yixun Lan,
Maxime Coquelin, Alexandre Torgue
Cc: netdev, linux-riscv, spacemit, linux-stm32, linux-arm-kernel,
linux-kernel, E Shattow, Han Gao
In-Reply-To: <bc78469c-3f45-4234-88b0-49f050d651db@bootlin.com>
On Sun, Jul 12, 2026 at 10:55:51AM +0200, Maxime Chevallier wrote:
> Hi Inochi,
>
> On 7/12/26 06:52, Inochi Amaoto wrote:
> > TL;DR:
> >
> > The DWMAC on Spacemit K3 is failled to register phy after the reload
> > the driver module (rmmod then insmod). Because the reset-gpio is
> > asserted while unloading the driver and is not desserted before reading
> > the c22 id, which leads to a fault.
>
> You're not the first one facing this type of issues, this is a long standing
> source of issues. The problem is partially hidden by the fact that often times
> the bootloader deals with the PHY reset (like the case you're facing)
>
> Take a look at these discussions :
>
> https://lore.kernel.org/netdev/cover.1761732347.git.buday.csaba@prolan.hu/
>
> and maybe more intersting, Russell suggested an approach on how we could potentially
> address this here :
>
> https://lore.kernel.org/all/aTBeVTlsElGXUCSN@shell.armlinux.org.uk/
>
>
Yeah, I have found these links, but it is something more than I want,
so I think I should deal with this carefully. I will have a try if I
have enough time, but currently I will send this workaround to dlan
to solve the problem....
Regards,
Inochi
> > ---
> > --- a/arch/riscv/boot/dts/spacemit/k3-pico-itx.dts
> > +++ b/arch/riscv/boot/dts/spacemit/k3-pico-itx.dts
> > @@ -196,7 +196,8 @@ ð0 {
> >
> > mdio {
> > phy0: phy@1 {
> > - compatible = "ethernet-phy-ieee802.3-c22";
> > + compatible = "ethernet-phy-id001c.c916",
> > + "ethernet-phy-ieee802.3-c22";
>
> Indeed that's merely a workaround :(
>
> Maxime
^ permalink raw reply
* [PATCH] mailmap: fix wrong canonical name for mgr@kernel.org
From: Michael Grzeschik @ 2026-07-12 22:51 UTC (permalink / raw)
To: netdev; +Cc: Jakub Kicinski, Michael Grzeschik
After picking up some pending patches for the kernel to work on, I
realized my name in the mailmap file somehow got mixed up. When
switching to my kernel.org Address some time ago, I had never the
intention to use a scrambled variant of Polish and German used for my
first name to be found in this file. However, so here we are. Lets fix
it for good.
Fixes: 85fac50b58ca ('MAINTAINERS: Update address for Michael Grzeschik')
Cc: Jakub Kicinski <kuba@kernel.org>
Cc: netdev@vger.kernel.org
Signed-off-by: Michael Grzeschik <mgr@kernel.org>
---
.mailmap | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/.mailmap b/.mailmap
index 12f3acdebd72..0596bd04b1c7 100644
--- a/.mailmap
+++ b/.mailmap
@@ -594,8 +594,8 @@ Mayuresh Janorkar <mayur@ti.com>
Md Sadre Alam <quic_mdalam@quicinc.com> <mdalam@codeaurora.org>
Miaoqing Pan <quic_miaoqing@quicinc.com> <miaoqing@codeaurora.org>
Michael Buesch <m@bues.ch>
-Michal Grzeschik <mgr@kernel.org> <m.grzeschik@pengutronix.de>
-Michal Grzeschik <mgr@kernel.org> <mgr@pengutronix.de>
+Michael Grzeschik <mgr@kernel.org> <m.grzeschik@pengutronix.de>
+Michael Grzeschik <mgr@kernel.org> <mgr@pengutronix.de>
Michael Riesch <michael.riesch@collabora.com> <michael.riesch@wolfvision.net>
Michal Simek <michal.simek@amd.com> <michal.simek@xilinx.com>
Michel Dänzer <michel@tungstengraphics.com>
---
base-commit: a13c140cc289c0b7b3770bce5b3ad42ab35074aa
change-id: 20260713-mailmap-b66496a59368
Best regards,
--
Michael Grzeschik <mgr@kernel.org>
^ permalink raw reply related
* [PATCH nf] netfilter: nf_conntrack_sip: widen NAT rewrite delta to s32 in sip_help_tcp()
From: Xiang Mei @ 2026-07-12 23:42 UTC (permalink / raw)
To: Pablo Neira Ayuso, Florian Westphal, Phil Sutter,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
Cc: netfilter-devel, coreteam, netdev, linux-kernel, Patrick McHardy,
Weiming Shi, Xiang Mei
sip_help_tcp() stores the size change of each NAT-rewritten SIP message
in s16 diff and accumulates it in s16 tdiff, but a single message can
grow by more than S16_MAX while the packet stays under the 65535
enlarge_skb() limit: nf_nat_sip() rewrites every matching URI, and a long
Contact list expands the message by tens of kilobytes. diff then wraps,
and "datalen = datalen + diff - msglen" yields a huge unsigned datalen,
so the next iteration's ct_sip_get_header() reads past the linearized skb
tail.
Widen diff, tdiff and the seq_adjust hook to s32. Both are bounded by the
65535 byte packet limit, and the seqadj core is already s32
(nf_ct_seqadj_set() takes s32), so no previously accepted input is
rejected.
BUG: KASAN: use-after-free in ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
Read of size 1 at addr ffff888010800000 by task ksoftirqd/1/25
ct_sip_get_header (net/netfilter/nf_conntrack_sip.c:464)
sip_help_tcp (net/netfilter/nf_conntrack_sip.c:1694)
nf_confirm (net/netfilter/nf_conntrack_proto.c:183)
nf_hook_slow (net/netfilter/core.c:619)
ip6_output (net/ipv6/ip6_output.c:246)
ip6_forward (net/ipv6/ip6_output.c:690)
ipv6_rcv (net/ipv6/ip6_input.c:351)
__netif_receive_skb_one_core (net/core/dev.c:6212)
process_backlog (net/core/dev.c:6676)
__napi_poll (net/core/dev.c:7735)
net_rx_action (net/core/dev.c:7955)
handle_softirqs (kernel/softirq.c:622)
run_ksoftirqd (kernel/softirq.c:1076)
...
Fixes: f5b321bd37fb ("netfilter: nf_conntrack_sip: add TCP support")
Reported-by: Weiming Shi <bestswngs@gmail.com>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Xiang Mei <xmei5@asu.edu>
---
include/linux/netfilter/nf_conntrack_sip.h | 2 +-
net/netfilter/nf_conntrack_sip.c | 2 +-
net/netfilter/nf_nat_sip.c | 2 +-
3 files changed, 3 insertions(+), 3 deletions(-)
diff --git a/include/linux/netfilter/nf_conntrack_sip.h b/include/linux/netfilter/nf_conntrack_sip.h
index dbc614dfe0d5..aafa0c04f917 100644
--- a/include/linux/netfilter/nf_conntrack_sip.h
+++ b/include/linux/netfilter/nf_conntrack_sip.h
@@ -115,7 +115,7 @@ struct nf_nat_sip_hooks {
unsigned int *datalen);
void (*seq_adjust)(struct sk_buff *skb,
- unsigned int protoff, s16 off);
+ unsigned int protoff, s32 off);
unsigned int (*expect)(struct sk_buff *skb,
unsigned int protoff,
diff --git a/net/netfilter/nf_conntrack_sip.c b/net/netfilter/nf_conntrack_sip.c
index f3f90a866338..e4a70d1d77b0 100644
--- a/net/netfilter/nf_conntrack_sip.c
+++ b/net/netfilter/nf_conntrack_sip.c
@@ -1663,7 +1663,7 @@ static int sip_help_tcp(struct sk_buff *skb, unsigned int protoff,
unsigned int matchoff, matchlen;
unsigned int msglen, origlen;
const char *dptr, *end;
- s16 diff, tdiff = 0;
+ s32 diff, tdiff = 0;
int ret = NF_ACCEPT;
unsigned long clen;
bool term;
diff --git a/net/netfilter/nf_nat_sip.c b/net/netfilter/nf_nat_sip.c
index aea02f6aff09..a93eaf0f7d30 100644
--- a/net/netfilter/nf_nat_sip.c
+++ b/net/netfilter/nf_nat_sip.c
@@ -321,7 +321,7 @@ static unsigned int nf_nat_sip(struct sk_buff *skb, unsigned int protoff,
}
static void nf_nat_sip_seq_adjust(struct sk_buff *skb, unsigned int protoff,
- s16 off)
+ s32 off)
{
enum ip_conntrack_info ctinfo;
struct nf_conn *ct = nf_ct_get(skb, &ctinfo);
--
2.43.0
^ permalink raw reply related
* Re: [PATCH net] amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN
From: Patrick Oppenlander @ 2026-07-13 0:30 UTC (permalink / raw)
To: Prashanth Kumar KR
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, netdev, linux-kernel, stable, Shyam Sundar S K,
Thorsten Leemhuis
In-Reply-To: <CAEg67Gk9zaFd1KZaffy04VgrRb86TnpDfBtH4Z_jkqQG9bOPcQ@mail.gmail.com>
On Fri, 10 Jul 2026 at 09:16, Patrick Oppenlander
<patrick.oppenlander@gmail.com> wrote:
>
> Hi Prashanth,
>
> thank you for addressing the bug. I will test your patch on our
> hardware next week.
Tested working on 7.0.1 with your patch applied. Thank you.
Patrick
> On Thu, 9 Jul 2026 at 19:50, Prashanth Kumar KR
> <prashanthkumar.k.r@amd.com> wrote:
> >
> > From: Prashanth Kumar KR <PrashanthKumar.K.R@amd.com>
> >
> > MAC_AUTO_SW (VR_MII_DIG_CTRL1 bit 9) enables automatic XPCS speed
> > mode switching after CL37 auto-negotiation and is only meaningful in
> > SGMII MAC mode. The original code unconditionally set this bit on
> > every call to xgbe_an37_set(), including when called from
> > xgbe_an37_disable() with enable=false. This left MAC_AUTO_SW=1 after
> > AN was disabled, causing the XPCS to autonomously switch speed from
> > stale AN state during subsequent mode changes, breaking SGMII speed
> > negotiation on 1G copper SFP modules.
>
> In my testing this was breaking negotiation for all 1G SFP modules,
> not just copper modules.
>
> Patrick
>
> > Fixes: 42fd432fe6d3 ("amd-xgbe: align CL37 AN sequence as per databook")
> > Reported-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
> > Link: https://lore.kernel.org/netdev/CAEg67GmFS0Q4oSZkz8zWdOzckSth9_vBPiOy6a7-d697C2w2Xg@mail.gmail.com
> > Signed-off-by: Prashanth Kumar KR <PrashanthKumar.K.R@amd.com>
Tested-by: Patrick Oppenlander <patrick.oppenlander@gmail.com>
> > ---
> > drivers/net/ethernet/amd/xgbe/xgbe-mdio.c | 11 ++++++++---
> > 1 file changed, 8 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
> > index fa0df6181207..12770af031eb 100644
> > --- a/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
> > +++ b/drivers/net/ethernet/amd/xgbe/xgbe-mdio.c
> > @@ -267,9 +267,14 @@ static void xgbe_an37_set(struct xgbe_prv_data *pdata, bool enable,
> >
> > XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_CTRL1, reg);
> >
> > - reg = XMDIO_READ(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL);
> > - reg |= XGBE_VEND2_MAC_AUTO_SW;
> > - XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL, reg);
> > + if (pdata->an_mode == XGBE_AN_MODE_CL37_SGMII) {
> > + reg = XMDIO_READ(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL);
> > + if (enable)
> > + reg |= XGBE_VEND2_MAC_AUTO_SW;
> > + else
> > + reg &= ~XGBE_VEND2_MAC_AUTO_SW;
> > + XMDIO_WRITE(pdata, MDIO_MMD_VEND2, MDIO_PCS_DIG_CTRL, reg);
> > + }
> > }
> >
> > static void xgbe_an37_restart(struct xgbe_prv_data *pdata)
> > --
> > 2.34.1
> >
^ permalink raw reply
* [PATCH] vhost/net: Fill virtio_net_hdr GSO/csum metadata on RX
From: weimin xiong @ 2026-07-13 1:04 UTC (permalink / raw)
To: mst; +Cc: jasowang, virtualization, netdev, xiongweimin
From: xiongweimin <xiongweimin@kylinos.cn>
When VHOST_NET_F_VIRTIO_NET_HDR is set, vhost supplies virtio_net_hdr to
the guest but previously always wrote a zeroed header (GSO_NONE). Guests
that rely on GUEST_TSO*/GUEST_CSUM therefore never saw offload metadata.
Peek the socket skb before recvmsg and populate the header with
virtio_net_hdr_from_skb(). Also advertise the corresponding guest offload
feature bits from VHOST_GET_FEATURES.
TX TSO toward backends without IFF_VNET_HDR is intentionally left for a
follow-up series.
Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Cc: virtualization@vger.kernel.org
Cc: netdev@vger.kernel.org
---
--- a/drivers/vhost/net.c
+++ b/drivers/vhost/net.c
@@ -73,6 +73,10 @@
VHOST_FEATURES,
VHOST_NET_F_VIRTIO_NET_HDR,
VIRTIO_NET_F_MRG_RXBUF,
+ VIRTIO_NET_F_GUEST_CSUM,
+ VIRTIO_NET_F_GUEST_TSO4,
+ VIRTIO_NET_F_GUEST_TSO6,
+ VIRTIO_NET_F_GUEST_ECN,
VIRTIO_F_ACCESS_PLATFORM,
VIRTIO_F_RING_RESET,
VIRTIO_F_IN_ORDER,
@@ -644,7 +648,7 @@
static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter,
size_t hdr_size, int out)
{
- /* Skip header. TODO: support TSO. */
+ /* Skip guest virtio_net_hdr; TX TSO handled in a follow-up. */
size_t len = iov_length(vq->iov, out);
iov_iter_init(iter, ITER_SOURCE, vq->iov, out, len);
@@ -1025,6 +1029,35 @@
return len;
}
+/*
+ * When VHOST_NET_F_VIRTIO_NET_HDR is set, vhost supplies virtio_net_hdr.
+ * Populate GSO/checksum metadata from the socket skb so guests that
+ * negotiated GUEST_TSO*/GUEST_CSUM receive correct offload information.
+ */
+static int vhost_net_hdr_from_sock(struct vhost_virtqueue *vq, struct sock *sk,
+ struct virtio_net_hdr *hdr)
+{
+ struct sk_buff *skb;
+ unsigned long flags;
+ int vlan_hlen = 0;
+ int ret;
+
+ spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
+ skb = skb_peek(&sk->sk_receive_queue);
+ if (!skb) {
+ spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
+ memset(hdr, 0, sizeof(*hdr));
+ hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
+ return 0;
+ }
+ if (skb_vlan_tag_present(skb))
+ vlan_hlen = VLAN_HLEN;
+ ret = virtio_net_hdr_from_skb(skb, hdr, vhost_is_little_endian(vq),
+ true, vlan_hlen);
+ spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
+ return ret;
+}
+
static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk,
bool *busyloop_intr, unsigned int *count)
{
@@ -1239,10 +1272,18 @@
/* We don't need to be notified again. */
iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, in, vhost_len);
fixup = msg.msg_iter;
- if (unlikely((vhost_hlen))) {
- /* We will supply the header ourselves
- * TODO: support TSO.
+ if (unlikely(vhost_hlen)) {
+ /*
+ * Build virtio_net_hdr from the socket skb before
+ * recvmsg consumes it. Skip for ptr_ring backends
+ * where the skb is not on sk_receive_queue.
*/
+ if (!nvq->rx_ring &&
+ vhost_net_hdr_from_sock(vq, sock->sk, &hdr)) {
+ vq_err(vq, "Failed to build vnet_hdr from skb\n");
+ vhost_discard_vq_desc(vq, headcount, ndesc);
+ continue;
+ }
iov_iter_advance(&msg.msg_iter, vhost_hlen);
}
err = sock->ops->recvmsg(sock, &msg,
@@ -1270,7 +1311,6 @@
*/
iov_iter_advance(&fixup, sizeof(hdr));
}
- /* TODO: Should check and handle checksum. */
num_buffers = cpu_to_vhost16(vq, headcount);
if (likely(set_num_buffers) &&
^ permalink raw reply
* [PATCH net] nfc: llcp: Fix raw socket local ref leak on rebind
From: Shuangpeng Bai @ 2026-07-13 1:21 UTC (permalink / raw)
To: David Heidelberg
Cc: David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman, Samuel Ortiz, oe-linux-nfc, netdev, linux-kernel,
stable, Shuangpeng Bai
Raw LLCP sockets own the reference returned by nfc_llcp_find_local().
When the bound NFC device is unregistered, nfc_llcp_socket_release()
sets raw sockets back to LLCP_CLOSED. It also unlinks them from
local->raw_sockets, but leaves llcp_sock->local pointing at that local.
A subsequent successful bind on the same socket gets a new local reference
and overwrites llcp_sock->local. The old local reference is then lost, and
the final socket release only drops the new local.
Drop any stale local reference after the new target local has been found,
but before overwriting llcp_sock->local. This keeps failed bind attempts
from changing the old reference while preventing a successful rebind from
leaking it.
Fixes: e6a3a4bb856a ("NFC: llcp: Clean raw sockets from nfc_llcp_socket_release")
Cc: stable@vger.kernel.org
Signed-off-by: Shuangpeng Bai <shuangpeng.kernel@gmail.com>
---
net/nfc/llcp_sock.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/nfc/llcp_sock.c b/net/nfc/llcp_sock.c
index feab29fc6..0c00cdaab 100644
--- a/net/nfc/llcp_sock.c
+++ b/net/nfc/llcp_sock.c
@@ -152,6 +152,7 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr_unsized *addr
struct sock *sk = sock->sk;
struct nfc_llcp_sock *llcp_sock = nfc_llcp_sock(sk);
struct nfc_llcp_local *local;
+ struct nfc_llcp_local *old_local;
struct nfc_dev *dev;
struct sockaddr_nfc_llcp llcp_addr;
int len, ret = 0;
@@ -185,6 +186,11 @@ static int llcp_raw_sock_bind(struct socket *sock, struct sockaddr_unsized *addr
goto put_dev;
}
+ old_local = llcp_sock->local;
+ llcp_sock->local = NULL;
+ llcp_sock->dev = NULL;
+ nfc_llcp_local_put(old_local);
+
llcp_sock->dev = dev;
llcp_sock->local = local;
llcp_sock->nfc_protocol = llcp_addr.nfc_protocol;
--
2.43.0
^ permalink raw reply related
* Re: [PATCH iproute] ss: Don't re-print an SCTP listen socket as an assoc
From: Jamie Bainbridge @ 2026-07-13 1:48 UTC (permalink / raw)
To: Xin Long; +Cc: netdev, Stephen Hemminger, Phil Sutter, Rustam Kovhaev
In-Reply-To: <CADvbK_efrY+6jj=J7kQ7+k82wOJa+eABdZBK3Ou725M4hTZa5A@mail.gmail.com>
On Thu, 9 Jul 2026 at 09:34, Xin Long <lucien.xin@gmail.com> wrote:
>
> On Tue, Jul 7, 2026 at 2:48 AM Jamie Bainbridge
> <jamie.bainbridge@gmail.com> wrote:
> >
> > "ss -Sa" prints a LISTEN-state SCTP sock once as a non-assoc when
> > is_sctp_assoc() correctly returns false, then again when we have cached
> > the inode in sctp_ino, so is_sctp_assoc() returns true.
> >
> > On the second pass, we try to print the socket state with
> > sctp_sstate_name[s->state], but s->state == 10 (SCTP_SS_LISTENING)
> > but sctp_sstate_name[] only has 8 entries, so we illegally access beyond
> > the end of the name array.
> >
> > If you are lucky, the space beyond the array is NULL and the argument to
> > the print format is printed as "(null)" by the C library:
> >
> > $ ./misc/ss -San
> > State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:*
> > `- (null) 0 5 192.0.2.10:9001 0.0.0.0:*
> > `- ESTAB 0 0 192.0.2.10%net1:9001 192.0.2.9:11111
> >
> > If you are unlucky, the space beyond the array is non-NULL and you
> > pass an invalid address to the print format:
> >
> > $ ./misc/ss -San
> > Segmentation fault (core dumped)
> >
> > The inode is correctly cached at the bottom of inet_show_sock(), so
> > check if we've already processed this SCTP LISTEN inode and exit early.
> >
> > $ ./misc/ss -San
> > State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:*
> > `- ESTAB 0 0 192.0.2.10%net1:9001 192.0.2.9:11111
> >
> > We cannot exit later than this (eg: in sock_state_print()) because by
> > then we're already halfway through a new line in inet_stats_print().
> >
> > Keep the existing check in is_sctp_assoc() because that is needed to
> > differentiate related assocs from new endpoints.
> >
> > Note: there is still a chance of double-printing a listen socket (now
> > with the correct format if netlink delivers us listen sockets and their
> > assocs with something else in between:
> >
> > $ ./misc/ss -Sane
> > State Recv-Q Send-Q Local Address:Port Peer Address:Port
> > > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:* ino:36518
> > LISTEN 0 5 192.0.2.10:9002 0.0.0.0:* ino:44485
> > `- ESTAB 0 0 192.0.2.10%net1:9002 192.0.2.9:22222 ino:44485
> > > LISTEN 0 5 192.0.2.10:9001 0.0.0.0:* ino:36518
> > `- ESTAB 0 0 192.0.2.10%net1:9001 122.0.2.9:11111 ino:36518
> >
> > This behaviour existed before this commit. I don't see a way around this
> > except to pre-sort the results from netlink which seems unrealistic.
> >
> > Fixes: f89d46ad63f6f ("ss: Add support for SCTP protocol")
> > Reported-by: Rustam Kovhaev <rkovhaev@gmail.com>
> > Signed-off-by: Jamie Bainbridge <jamie.bainbridge@gmail.com>
> > ---
> > misc/ss.c | 8 ++++++++
> > 1 file changed, 8 insertions(+)
> >
> > diff --git a/misc/ss.c b/misc/ss.c
> > index 14e9f27a75321556240a5f290b8bcf51c605a4c2..7e94160f7590c35aa187fe00902be8def7593608 100644
> > --- a/misc/ss.c
> > +++ b/misc/ss.c
> > @@ -3764,6 +3764,14 @@ static bool bpf_map_opts_is_enabled(void)
> > static int inet_show_sock(struct nlmsghdr *nlh,
> > struct sockstat *s)
> > {
> > + /* SCTP assocs share the same inode number with their parent endpoint.
> > + * If we've seen a LISTEN socket inode before, we've already printed it
> > + * and cached the inode at the bottom of this function. We don't want
> > + * to re-print the LISTEN socket again. so exit early.
> > + */
> > + if (s->type == IPPROTO_SCTP && s->state == SS_LISTEN && sctp_ino == s->ino)
> > + return 0;
> > +
> > struct rtattr *tb[INET_DIAG_MAX+1];
> > struct inet_diag_msg *r = NLMSG_DATA(nlh);
> > unsigned char v6only = 0;
> > --
> > 2.47.3
> >
> Hi, Jamie, thanks for identifying the issue.
>
> The same listen was dumped twice continuously, which is abnormal.
>
> I think the issue was introduced in kernel by:
>
> 1ba8d77f410d ("sctp_diag: Respect ss adding TCPF_CLOSE to idiag_states")
>
> where the check against TCPF_LISTEN in sctp_ep_dump() is incorrect.
>
> and got fixed (unintentionally) by:
>
> 7d8297e26b4e ("sctp: hold socket lock when dumping endpoints in sctp_diag")
Fix confirmed by cherry-pick onto an affected recent kernel. Many thanks Xin!
iproute patch can be disregarded.
Jamie
^ permalink raw reply
* Re: [PATCH net v2] bnxt_en: Handle partially initialized auxiliary devices
From: Pavan Chebbi @ 2026-07-13 2:29 UTC (permalink / raw)
To: Ruoyu Wang
Cc: Michael Chan, Andrew Lunn, davem, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Jacob Keller, Andy Gospodarek, Vikas Gupta, netdev,
linux-kernel
In-Reply-To: <20260711163716.3996929-1-ruoyuw560@gmail.com>
[-- Attachment #1: Type: text/plain, Size: 1588 bytes --]
On Sat, Jul 11, 2026 at 10:07 PM Ruoyu Wang <ruoyuw560@gmail.com> wrote:
>
> bnxt_aux_devices_init() calls auxiliary_device_init() before all fields
> used by bnxt_aux_dev_release() are initialized. After
> auxiliary_device_init() succeeds, later errors must unwind with
> auxiliary_device_uninit(), which invokes the release callback.
>
> The release callback assumes that aux_priv->id, aux_priv->edev,
> edev->net and edev->ulp_tbl are all populated. If allocation fails
> after auxiliary_device_init(), the release path can otherwise dereference
> or clear partially initialized state.
>
> Allocate and attach the bnxt_en_dev and ULP table before calling
> auxiliary_device_init(), so the release callback only sees a fully
> initialized auxiliary private object. If auxiliary_device_init() itself
> fails, free those allocations directly because device_initialize() has not
> run and the release callback will not be invoked.
>
> This issue was found by a static analysis checker and confirmed by manual
> source review.
>
> Fixes: 194fad5b2781 ("bnxt_en: Refactor bnxt_rdma_aux_device_init/uninit functions")
> Signed-off-by: Ruoyu Wang <ruoyuw560@gmail.com>
> ---
> v2:
> - Allocate edev and ulp before auxiliary_device_init(), as suggested by
> Pavan Chebbi.
> v1: https://lore.kernel.org/netdev/20260708143401.3167477-1-ruoyuw560@gmail.com/
>
> drivers/net/ethernet/broadcom/bnxt/bnxt_ulp.c | 39 ++++++++++---------
> 1 file changed, 20 insertions(+), 19 deletions(-)
>
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Thank you.
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5469 bytes --]
^ permalink raw reply
* Re: [PATCH net-next v7 1/2] net: libwx: add support for set_ringparam in wx_ethtool_ops_vf
From: mengyuanlou @ 2026-07-13 2:44 UTC (permalink / raw)
To: Przemek Kitszel; +Cc: jiawenwu, duanqiangwen, netdev, horms, kuba, pabeni
In-Reply-To: <a12bf43b-1cb2-4ca6-b2bb-f4618bc4e8b1@intel.com>
Sorry for the late reply.
> 2026年7月10日 18:19，Przemek Kitszel <przemyslaw.kitszel@intel.com> 写道：
>
> On 7/10/26 03:59, Mengyuan Lou wrote:
>> Add support for the set_ringparam in wx_ethtool_ops_vf,
>> which is used to set ring sizes for ngbevf and txgbevf.
>> Signed-off-by: Mengyuan Lou <mengyuanlou@net-swift.com>
>> ---
>> .../net/ethernet/wangxun/libwx/wx_ethtool.c | 61 +++++++++++++++++++
>> drivers/net/ethernet/wangxun/libwx/wx_lib.c | 9 +--
>> drivers/net/ethernet/wangxun/libwx/wx_lib.h | 4 +-
>> .../net/ethernet/wangxun/libwx/wx_vf_common.c | 4 +-
>> .../net/ethernet/wangxun/libwx/wx_vf_common.h | 2 +
>> 5 files changed, 72 insertions(+), 8 deletions(-)
>> diff --git a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
>> index 5df971aca9e3..eae038df6875 100644
>> --- a/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
>> +++ b/drivers/net/ethernet/wangxun/libwx/wx_ethtool.c
>> @@ -9,6 +9,7 @@
>> #include "wx_ethtool.h"
>> #include "wx_hw.h"
>> #include "wx_lib.h"
>> +#include "wx_vf_common.h"
>> struct wx_stats {
>> char stat_string[ETH_GSTRING_LEN];
>> @@ -775,6 +776,65 @@ static int wx_get_link_ksettings_vf(struct net_device *netdev,
>> return 0;
>> }
>> +static int wx_set_ringparam_vf(struct net_device *netdev,
>> + struct ethtool_ringparam *ring,
>> + struct kernel_ethtool_ringparam *kernel_ring,
>> + struct netlink_ext_ack *extack)
>> +{
>> + struct wx *wx = netdev_priv(netdev);
>> + u32 new_rx_count, new_tx_count;
>> + struct wx_ring *temp_ring;
>> + int i, err = 0;
>> +
>> + new_tx_count = clamp_t(u32, ring->tx_pending, WX_MIN_TXD, WX_MAX_TXD);
>> + new_tx_count = ALIGN(new_tx_count, WX_REQ_TX_DESCRIPTOR_MULTIPLE);
>> +
>> + new_rx_count = clamp_t(u32, ring->rx_pending, WX_MIN_RXD, WX_MAX_RXD);
>> + new_rx_count = ALIGN(new_rx_count, WX_REQ_RX_DESCRIPTOR_MULTIPLE);
>> +
>> + if (new_tx_count == wx->tx_ring_count &&
>> + new_rx_count == wx->rx_ring_count)
>> + return 0;
>> +
>> + mutex_lock(&wx->reset_lock);
>> + set_bit(WX_STATE_RESETTING, wx->state);
>> +
>> + if (!netif_running(wx->netdev)) {
>> + for (i = 0; i < wx->num_tx_queues; i++)
>> + wx->tx_ring[i]->count = new_tx_count;
>> + for (i = 0; i < wx->num_rx_queues; i++)
>> + wx->rx_ring[i]->count = new_rx_count;
>> + wx->tx_ring_count = new_tx_count;
>> + wx->rx_ring_count = new_rx_count;
>> +
>> + goto clear_reset;
>> + }
>> +
>> + /* allocate temporary buffer to store rings in */
>> + i = max_t(int, wx->num_tx_queues, wx->num_rx_queues);
>> + temp_ring = kvmalloc_objs(struct wx_ring, i);
>> + if (!temp_ring) {
>> + err = -ENOMEM;
>> + goto clear_reset;
>> + }
>
> would be much better to move tempbuf allocation into the helper,
> and just do it at the beginning there
>
> in the unlikely event of -ENOMEM, you will just call the "up"
> in the unroll path
This change touches wx_set_ring(), which is shared with PF drivers (ngbe/txgbe).
To keep this patch focused on VF ringparam support, I will cleanup it a follow-up patch.
>
>> +
>> + wxvf_down(wx);
>> + /* wx_set_ring() may partially apply changes before
>> + * returning an error. The error indicates that not all
>> + * requested ring parameters could be configured.
>> + */
>> + err = wx_set_ring(wx, new_tx_count, new_rx_count, temp_ring);
>> + if (err)
>> + wx_err(wx, "failed to set ring parameters: %d", err);
>> + wx_configure_vf(wx);
>> + wxvf_up_complete(wx);
>> + kvfree(temp_ring);
>> +clear_reset:
>> + clear_bit(WX_STATE_RESETTING, wx->state);
>> + mutex_unlock(&wx->reset_lock);
>> + return err;
>> +}
>
>
^ permalink raw reply
* [PATCH 6.1.y] net: Drop the lock in skb_may_tx_timestamp()
From: Philo Lu @ 2026-07-13 2:49 UTC (permalink / raw)
To: stable
Cc: bigeasy, willemb, kerneljasonxing, edumazet, pabeni, lulie, davem,
kuba, netdev, linux-kernel, dust.li, heiko.stuebner
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 upstream.
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ adapted sk_set_socket() in include/net/sock.h to fix the conflict from
not having commit 5d6b58c932ec ("net: lockless sock_i_ino()") and the
additional previous changes required by it.
It comes down to just now having the lines of
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
}
below the changed line. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
---
This patch is same as that in 6.12 (c770217044d9)
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 1e7096e9bc484..9fe621f985740 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2181,7 +2181,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
}
static inline wait_queue_head_t *sk_sleep(struct sock *sk)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index f41dd20991c3d..6575a76a312e1 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4948,15 +4948,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index f2b4cf9b09a32..8bf415a59e55c 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -666,7 +666,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.47.3
^ permalink raw reply related
* [PATCH 5.15.y] net: Drop the lock in skb_may_tx_timestamp()
From: Philo Lu @ 2026-07-13 2:49 UTC (permalink / raw)
To: stable
Cc: bigeasy, willemb, kerneljasonxing, edumazet, pabeni, lulie, davem,
kuba, netdev, linux-kernel, dust.li, heiko.stuebner
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 upstream.
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ adapted sk_set_socket() in include/net/sock.h to fix the conflict from
not having commit 5d6b58c932ec ("net: lockless sock_i_ino()") and the
additional previous changes required by it.
It comes down to just now having the lines of
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
}
below the changed line. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
---
This patch is same as that in 6.12 (c770217044d9)
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index 962acf4a644da..2b13a41cd99a9 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -2070,7 +2070,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
}
static inline wait_queue_head_t *sk_sleep(struct sock *sk)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 82add06ca935f..6281cfed03bb2 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4953,15 +4953,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index 24dd5f26585aa..0c87e99c8e69a 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -663,7 +663,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.47.3
^ permalink raw reply related
* [PATCH 5.10.y] net: Drop the lock in skb_may_tx_timestamp()
From: Philo Lu @ 2026-07-13 2:50 UTC (permalink / raw)
To: stable
Cc: bigeasy, willemb, kerneljasonxing, edumazet, pabeni, lulie, davem,
kuba, netdev, linux-kernel, dust.li, heiko.stuebner
From: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
commit 983512f3a87fd8dc4c94dfa6b596b6e57df5aad7 upstream.
skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must
not be taken in IRQ context, only softirq is okay. A few drivers receive
the timestamp via a dedicated interrupt and complete the TX timestamp
from that handler. This will lead to a deadlock if the lock is already
write-locked on the same CPU.
Taking the lock can be avoided. The socket (pointed by the skb) will
remain valid until the skb is released. The ->sk_socket and ->file
member will be set to NULL once the user closes the socket which may
happen before the timestamp arrives.
If we happen to observe the pointer while the socket is closing but
before the pointer is set to NULL then we may use it because both
pointer (and the file's cred member) are RCU freed.
Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a
matching WRITE_ONCE() where the pointer are cleared.
Link: https://lore.kernel.org/all/20260205145104.iWinkXHv@linutronix.de
Fixes: b245be1f4db1a ("net-timestamp: no-payload only sysctl")
Signed-off-by: Sebastian Andrzej Siewior <bigeasy@linutronix.de>
Reviewed-by: Willem de Bruijn <willemb@google.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Reviewed-by: Eric Dumazet <edumazet@google.com>
Link: https://patch.msgid.link/20260220183858.N4ERjFW6@linutronix.de
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
[ adapted sk_set_socket() in include/net/sock.h to fix the conflict from
not having commit 5d6b58c932ec ("net: lockless sock_i_ino()") and the
additional previous changes required by it.
It comes down to just now having the lines of
if (sock) {
WRITE_ONCE(sk->sk_uid, SOCK_INODE(sock)->i_uid);
WRITE_ONCE(sk->sk_ino, SOCK_INODE(sock)->i_ino);
}
below the changed line. ]
Signed-off-by: Philo Lu <lulie@linux.alibaba.com>
---
This patch is same as that in 6.12 (c770217044d9)
---
include/net/sock.h | 2 +-
net/core/skbuff.c | 23 ++++++++++++++++++-----
net/socket.c | 2 +-
3 files changed, 20 insertions(+), 7 deletions(-)
diff --git a/include/net/sock.h b/include/net/sock.h
index f0e391afb511d..b9c44e47cb7a7 100644
--- a/include/net/sock.h
+++ b/include/net/sock.h
@@ -1981,7 +1981,7 @@ static inline int sk_rx_queue_get(const struct sock *sk)
static inline void sk_set_socket(struct sock *sk, struct socket *sock)
{
- sk->sk_socket = sock;
+ WRITE_ONCE(sk->sk_socket, sock);
}
static inline wait_queue_head_t *sk_sleep(struct sock *sk)
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index e4a39e0f55f24..90a63c356affb 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -4772,15 +4772,28 @@ static void __skb_complete_tx_timestamp(struct sk_buff *skb,
static bool skb_may_tx_timestamp(struct sock *sk, bool tsonly)
{
- bool ret;
+ struct socket *sock;
+ struct file *file;
+ bool ret = false;
if (likely(READ_ONCE(sysctl_tstamp_allow_data) || tsonly))
return true;
- read_lock_bh(&sk->sk_callback_lock);
- ret = sk->sk_socket && sk->sk_socket->file &&
- file_ns_capable(sk->sk_socket->file, &init_user_ns, CAP_NET_RAW);
- read_unlock_bh(&sk->sk_callback_lock);
+ /* The sk pointer remains valid as long as the skb is. The sk_socket and
+ * file pointer may become NULL if the socket is closed. Both structures
+ * (including file->cred) are RCU freed which means they can be accessed
+ * within a RCU read section.
+ */
+ rcu_read_lock();
+ sock = READ_ONCE(sk->sk_socket);
+ if (!sock)
+ goto out;
+ file = READ_ONCE(sock->file);
+ if (!file)
+ goto out;
+ ret = file_ns_capable(file, &init_user_ns, CAP_NET_RAW);
+out:
+ rcu_read_unlock();
return ret;
}
diff --git a/net/socket.c b/net/socket.c
index de838c3b00486..eb157ea2a3efb 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -608,7 +608,7 @@ static void __sock_release(struct socket *sock, struct inode *inode)
iput(SOCK_INODE(sock));
return;
}
- sock->file = NULL;
+ WRITE_ONCE(sock->file, NULL);
}
/**
--
2.47.3
^ permalink raw reply related
* Re: [PATCH nf] netfilter: ip6tables: set hotdrop for malformed extension header matches
From: Zhixing Chen @ 2026-07-13 3:10 UTC (permalink / raw)
To: Phil Sutter
Cc: Florian Westphal, Pablo Neira Ayuso, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
netfilter-devel, coreteam, netdev
In-Reply-To: <ak9_wZz054a6JMb5@orbyte.nwl.cc>
Hi Phil,
Thanks a lot for the review.
> There is another candidate for hotdrop in there, e.g. the "Packet
> smaller than it's length field" check in line 76. Or is this a
> legitimate non-match?
This should already be covered in the current nf/net tree by the previous
IPv6 extension header hotdrop fix, but I will double-check the base before
sending v2.
> Given the many common blocks, maybe introduce a 'hotdrop' goto label to
> jump to instead of break/return?
That makes sense to me for the repeated hbh error paths. I will look at
the flow again and use a hotdrop label where it keeps the code clearer.
> I think the 'srh->segments_left > srh->first_segment' case is also a
> candidate:
I will revisit this one and check it against RFC8200/RFC8754. My current
understanding is that this looks more like malformed input than a normal
rule mismatch, so I will account for it in v2 if the check fits cleanly.
Thanks,
Zhixing
^ permalink raw reply
* Re: [PATCH net-next] net: dsa: realtek: rtl8366rb: Fix up port isolation
From: Luiz Angelo Daros de Luca @ 2026-07-13 3:14 UTC (permalink / raw)
To: Linus Walleij
Cc: Alvin Šipraga, Andrew Lunn, Vladimir Oltean, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, netdev
In-Reply-To: <CAD++jLkS67rEytYFhb6057Q1QyKhaK+fU+iJ7cebRT7gHw=LKQ@mail.gmail.com>
> > > - /* Start with all ports completely isolated */
> > > - ret = rtl8366rb_port_set_isolation(priv, dp->index, 0);
> > > - if (ret)
> > > - return ret;
> >
> > If you don't isolate the ports, what is the default port status?
>
> Hm as I wrote in the commit message:
>
> "the next loop in the setup code, over the
> user ports, isolate all the ports from each other, so only the CPU
> port can see them."
>
> It looks like this:
>
> /* Configure user ports */
> dsa_switch_for_each_port(dp, ds) {
> if (!dsa_port_is_user(dp))
> continue;
>
> /* Forward only to the CPU, isolate from all other ports */
> ret = rtl8366rb_port_set_isolation(priv, dp->index,
> upports_mask);
> if (ret)
> return ret;
>
> /* If we support cascade switches, it should also include the
> * downstream DSA ports.
> */
> downports_mask |= BIT(dp->index);
> }
>
> upports_mask is the bitmask for all CPU ports, so that should do what is
> expected?
The first loop originally acted as a catch-all to isolate all ports
upfront (whether unused, dsa, cpu, or user). The second and third
loops then explicitly opened the forwarding paths for user and CPU
ports.
If you exclude the isolation step from the initial loop, unused ports
isolation won't be touched by the subsequent configuration loops
either. As a result, those unused ports will remain in their hardware
default isolation state.
If the hardware default is to allow forwarding (which is common for
unconfigured ports), those unused ports could potentially forward
traffic between themselves, or even leak to active ports (user or
CPU). Even if the DSA core currently disables unused ports at the
MAC/PHY level, relying on that as the sole layer of defense is risky
if that behavior ever changes or if a port is briefly enabled during
setup.
We shouldn't leave the hardware forwarding matrix in an unknown or
default state for unused ports. It should explicitly disable
forwarding by setting a 0 mask for ports that are unused (or all of
them as intended).
Looking at the current implementation,
rtl8366rb_port_set_isolation(priv, port, mask) should not use mask ==
0 as a way to disable isolation. It breaks the expected semantics and
completely prevents a caller from isolating a port entirely. This also
causes a collision of meaning, where passing a mask of 0 is equivalent
as if you passed a mask of ALL_PORTS.
The function is currently trying to do two things at once:
1) Enable or disable the hardware isolation feature itself.
2) Set the isolation destination bitmask.
We should either remove the feature's enable/disable logic from this
function entirely, or expand its signature to include an explicit
boolean argument, like: rtl8366rb_port_set_isolation(priv, port, bool
enable, u32 mask)
For the newer RTL8367C family (and some other variants), Realtek
actually dropped this dedicated "enable" bit entirely, allowing
isolation to be controlled purely by setting all target port bits to 0
or 1. However, for this specific older hardware where the explicit bit
exists, we shouldn't mash both concepts into a single mask parameter.
Regards,
Luiz
^ permalink raw reply
* [PATCH v2] sctp: fix auth_chunk_list capacity check in sctp_auth_ep_add_chunkid
From: 寒泉 @ 2026-07-13 3:20 UTC (permalink / raw)
To: marcelo.leitner, lucien.xin
Cc: davem, edumazet, kuba, pabeni, horms, linux-sctp, netdev,
linux-kernel, HanQuan
From: HanQuan <eilaimemedsnaimel@gmail.com>
sctp_auth_ep_add_chunkid() uses SCTP_NUM_CHUNK_TYPES (20) as the
capacity limit for ep->auth_chunk_list, allowing it to hold up to
20 chunk entries (param_hdr.length up to 24). However, the copy
destination asoc->c.auth_chunks in struct sctp_cookie is only
SCTP_AUTH_MAX_CHUNKS (16) entries (20 bytes). When more than 16
chunks are added, sctp_association_init() memcpy overflows the
destination by up to 4 bytes.
Fix by using SCTP_AUTH_MAX_CHUNKS as the capacity limit, matching
the destination capacity.
Fixes: 1f485649f529 ("[SCTP]: Implement SCTP-AUTH internals")
Signed-off-by: HanQuan <eilaimemedsnaimel@gmail.com>
---
net/sctp/auth.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/net/sctp/auth.c b/net/sctp/auth.c
index be9782760f50..c901d373af80 100644
--- a/net/sctp/auth.c
+++ b/net/sctp/auth.c
@@ -672,7 +672,7 @@ int sctp_auth_ep_add_chunkid(struct sctp_endpoint *ep, __u8 chunk_id)
/* Check if we can add this chunk to the array */
param_len = ntohs(p->param_hdr.length);
nchunks = param_len - sizeof(struct sctp_paramhdr);
- if (nchunks == SCTP_NUM_CHUNK_TYPES)
+ if (nchunks == SCTP_AUTH_MAX_CHUNKS)
return -EINVAL;
p->chunks[nchunks] = chunk_id;
--
2.43.0
^ permalink raw reply related
* [PATCH] crypto: pcrypt - Remove pcrypt
From: Eric Biggers @ 2026-07-13 3:26 UTC (permalink / raw)
To: linux-crypto, Herbert Xu
Cc: netdev, linux-kernel, Steffen Klassert, Thomas Huth, Eric Biggers
pcrypt was originally intended to improve IPsec performance. However,
it's no longer useful for that. Reports from the rare cases that anyone
has actually tried to use it over the years indicate that it actually
reduces IPsec performance, e.g.:
* https://github.com/libreswan/libreswan/wiki/Internals:-Cryptographic-Acceleration#obsoleted-ipsec-accelerations
* https://users.strongswan.narkive.com/liqTaTq8/strongswan-problem-with-pcrypt
* https://unix.stackexchange.com/questions/594336/ipsec-multithreading-via-pcrypt-worse-than-single-thread
It's also undocumented and quite difficult to actually use. Its design
is also broken, in that any unprivileged program can enable pcrypt
systemwide at any time (by instantiating it using AF_ALG).
Meanwhile, pcrypt has been a regular source of bugs, including at least
four that have received CVEs.
Let's just remove it. No one seems to care about it anymore other than
people looking for vulnerabilities.
Cc: Steffen Klassert <steffen.klassert@secunet.com>
Signed-off-by: Eric Biggers <ebiggers@kernel.org>
---
This patch is targeting cryptodev/master
Documentation/core-api/padata.rst | 6 +-
MAINTAINERS | 7 -
arch/loongarch/configs/loongson32_defconfig | 1 -
arch/loongarch/configs/loongson64_defconfig | 1 -
arch/s390/configs/debug_defconfig | 1 -
arch/s390/configs/defconfig | 1 -
crypto/Kconfig | 10 -
crypto/Makefile | 1 -
crypto/pcrypt.c | 394 --------------------
include/crypto/pcrypt.h | 39 --
tools/crypto/tcrypt/tcrypt_speed_compare.py | 7 +-
11 files changed, 5 insertions(+), 463 deletions(-)
delete mode 100644 crypto/pcrypt.c
delete mode 100644 include/crypto/pcrypt.h
diff --git a/Documentation/core-api/padata.rst b/Documentation/core-api/padata.rst
index 05b73c6c105f..b50df9768a5d 100644
--- a/Documentation/core-api/padata.rst
+++ b/Documentation/core-api/padata.rst
@@ -55,9 +55,9 @@ processors are allowed to be used as the serialization callback processor.
cpumask specifies the new cpumask to use.
There may be sysfs files for an instance's cpumasks. For example, pcrypt's
-live in /sys/kernel/pcrypt/<instance-name>. Within an instance's directory
-there are two files, parallel_cpumask and serial_cpumask, and either cpumask
-may be changed by echoing a bitmask into the file, for example::
+used to live in /sys/kernel/pcrypt/<instance-name>. Within an instance's
+directory there are two files, parallel_cpumask and serial_cpumask, and either
+cpumask may be changed by echoing a bitmask into the file, for example::
echo f > /sys/kernel/pcrypt/pencrypt/parallel_cpumask
diff --git a/MAINTAINERS b/MAINTAINERS
index d1dbf2f07104..803c8d719ed2 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -21084,13 +21084,6 @@ L: netdev@vger.kernel.org
S: Maintained
F: drivers/net/ethernet/amd/pcnet32.c
-PCRYPT PARALLEL CRYPTO ENGINE
-M: Steffen Klassert <steffen.klassert@secunet.com>
-L: linux-crypto@vger.kernel.org
-S: Maintained
-F: crypto/pcrypt.c
-F: include/crypto/pcrypt.h
-
PDS DSC VIRTIO DATA PATH ACCELERATOR
R: Brett Creeley <brett.creeley@amd.com>
F: drivers/vdpa/pds/
diff --git a/arch/loongarch/configs/loongson32_defconfig b/arch/loongarch/configs/loongson32_defconfig
index 7c8f01513ed2..cf97f4493573 100644
--- a/arch/loongarch/configs/loongson32_defconfig
+++ b/arch/loongarch/configs/loongson32_defconfig
@@ -1063,7 +1063,6 @@ CONFIG_SECURITY_YAMA=y
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_CRYPTO_USER=m
CONFIG_CRYPTO_SELFTESTS=y
-CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_ANUBIS=m
CONFIG_CRYPTO_BLOWFISH=m
diff --git a/arch/loongarch/configs/loongson64_defconfig b/arch/loongarch/configs/loongson64_defconfig
index 8e3906d3bd70..d0ece7920f21 100644
--- a/arch/loongarch/configs/loongson64_defconfig
+++ b/arch/loongarch/configs/loongson64_defconfig
@@ -1096,7 +1096,6 @@ CONFIG_SECURITY_YAMA=y
CONFIG_DEFAULT_SECURITY_DAC=y
CONFIG_CRYPTO_USER=m
CONFIG_CRYPTO_SELFTESTS=y
-CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_ANUBIS=m
CONFIG_CRYPTO_BLOWFISH=m
diff --git a/arch/s390/configs/debug_defconfig b/arch/s390/configs/debug_defconfig
index 54637be87fb7..15f51cb924db 100644
--- a/arch/s390/configs/debug_defconfig
+++ b/arch/s390/configs/debug_defconfig
@@ -765,7 +765,6 @@ CONFIG_CRYPTO_USER=m
CONFIG_CRYPTO_SELFTESTS=y
CONFIG_CRYPTO_SELFTESTS_FULL=y
CONFIG_CRYPTO_NULL=y
-CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_BENCHMARK=m
CONFIG_CRYPTO_DH=m
diff --git a/arch/s390/configs/defconfig b/arch/s390/configs/defconfig
index 5f5114a253cf..88257ff3c2c6 100644
--- a/arch/s390/configs/defconfig
+++ b/arch/s390/configs/defconfig
@@ -749,7 +749,6 @@ CONFIG_CRYPTO_FIPS=y
CONFIG_CRYPTO_USER=m
CONFIG_CRYPTO_SELFTESTS=y
CONFIG_CRYPTO_NULL=y
-CONFIG_CRYPTO_PCRYPT=m
CONFIG_CRYPTO_CRYPTD=m
CONFIG_CRYPTO_BENCHMARK=m
CONFIG_CRYPTO_DH=m
diff --git a/crypto/Kconfig b/crypto/Kconfig
index f1e372195273..228a7ac9f063 100644
--- a/crypto/Kconfig
+++ b/crypto/Kconfig
@@ -201,16 +201,6 @@ config CRYPTO_NULL
help
These are 'Null' algorithms, used by IPsec, which do nothing.
-config CRYPTO_PCRYPT
- tristate "Parallel crypto engine"
- depends on SMP
- select PADATA
- select CRYPTO_MANAGER
- select CRYPTO_AEAD
- help
- This converts an arbitrary crypto algorithm into a parallel
- algorithm that executes in kernel threads.
-
config CRYPTO_CRYPTD
tristate "Software async crypto daemon"
select CRYPTO_AEAD
diff --git a/crypto/Makefile b/crypto/Makefile
index 8386d55a9755..2e487c946e63 100644
--- a/crypto/Makefile
+++ b/crypto/Makefile
@@ -120,7 +120,6 @@ CFLAGS_aegis128-neon-inner.o += $(aegis128-cflags-y)
aegis128-$(CONFIG_CRYPTO_AEGIS128_SIMD) += aegis128-neon.o aegis128-neon-inner.o
endif
-obj-$(CONFIG_CRYPTO_PCRYPT) += pcrypt.o
obj-$(CONFIG_CRYPTO_CRYPTD) += cryptd.o
obj-$(CONFIG_CRYPTO_DES) += des_generic.o
obj-$(CONFIG_CRYPTO_BLOWFISH) += blowfish_generic.o
diff --git a/crypto/pcrypt.c b/crypto/pcrypt.c
deleted file mode 100644
index 9f372442981e..000000000000
--- a/crypto/pcrypt.c
+++ /dev/null
@@ -1,394 +0,0 @@
-// SPDX-License-Identifier: GPL-2.0-only
-/*
- * pcrypt - Parallel crypto wrapper.
- *
- * Copyright (C) 2009 secunet Security Networks AG
- * Copyright (C) 2009 Steffen Klassert <steffen.klassert@secunet.com>
- */
-
-#include <crypto/algapi.h>
-#include <crypto/internal/aead.h>
-#include <linux/atomic.h>
-#include <linux/err.h>
-#include <linux/init.h>
-#include <linux/module.h>
-#include <linux/slab.h>
-#include <linux/kobject.h>
-#include <linux/cpu.h>
-#include <crypto/pcrypt.h>
-
-static struct padata_instance *pencrypt;
-static struct padata_instance *pdecrypt;
-static struct kset *pcrypt_kset;
-
-struct pcrypt_instance_ctx {
- struct crypto_aead_spawn spawn;
- struct padata_shell *psenc;
- struct padata_shell *psdec;
- atomic_t tfm_count;
-};
-
-struct pcrypt_aead_ctx {
- struct crypto_aead *child;
- unsigned int cb_cpu;
-};
-
-static inline struct pcrypt_instance_ctx *pcrypt_tfm_ictx(
- struct crypto_aead *tfm)
-{
- return aead_instance_ctx(aead_alg_instance(tfm));
-}
-
-static int pcrypt_aead_setkey(struct crypto_aead *parent,
- const u8 *key, unsigned int keylen)
-{
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(parent);
-
- return crypto_aead_setkey(ctx->child, key, keylen);
-}
-
-static int pcrypt_aead_setauthsize(struct crypto_aead *parent,
- unsigned int authsize)
-{
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(parent);
-
- return crypto_aead_setauthsize(ctx->child, authsize);
-}
-
-static void pcrypt_aead_serial(struct padata_priv *padata)
-{
- struct pcrypt_request *preq = pcrypt_padata_request(padata);
- struct aead_request *req = pcrypt_request_ctx(preq);
-
- aead_request_complete(req->base.data, padata->info);
-}
-
-static void pcrypt_aead_done(void *data, int err)
-{
- struct aead_request *req = data;
- struct pcrypt_request *preq = aead_request_ctx(req);
- struct padata_priv *padata = pcrypt_request_padata(preq);
-
- if (err == -EINPROGRESS)
- return;
-
- padata->info = err;
-
- padata_do_serial(padata);
-}
-
-static void pcrypt_aead_enc(struct padata_priv *padata)
-{
- struct pcrypt_request *preq = pcrypt_padata_request(padata);
- struct aead_request *req = pcrypt_request_ctx(preq);
- int ret;
-
- ret = crypto_aead_encrypt(req);
-
- if (ret == -EINPROGRESS || ret == -EBUSY)
- return;
-
- padata->info = ret;
- padata_do_serial(padata);
-}
-
-static int pcrypt_aead_encrypt(struct aead_request *req)
-{
- int err;
- struct pcrypt_request *preq = aead_request_ctx(req);
- struct aead_request *creq = pcrypt_request_ctx(preq);
- struct padata_priv *padata = pcrypt_request_padata(preq);
- struct crypto_aead *aead = crypto_aead_reqtfm(req);
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(aead);
- u32 flags = aead_request_flags(req);
- struct pcrypt_instance_ctx *ictx;
-
- ictx = pcrypt_tfm_ictx(aead);
-
- memset(padata, 0, sizeof(struct padata_priv));
-
- padata->parallel = pcrypt_aead_enc;
- padata->serial = pcrypt_aead_serial;
-
- aead_request_set_tfm(creq, ctx->child);
- aead_request_set_callback(creq, flags & ~CRYPTO_TFM_REQ_MAY_SLEEP,
- pcrypt_aead_done, req);
- aead_request_set_crypt(creq, req->src, req->dst,
- req->cryptlen, req->iv);
- aead_request_set_ad(creq, req->assoclen);
-
- err = padata_do_parallel(ictx->psenc, padata, &ctx->cb_cpu);
- if (!err)
- return -EINPROGRESS;
- if (err == -EBUSY) {
- /* try non-parallel mode */
- aead_request_set_callback(creq, flags, req->base.complete,
- req->base.data);
- return crypto_aead_encrypt(creq);
- }
-
- return err;
-}
-
-static void pcrypt_aead_dec(struct padata_priv *padata)
-{
- struct pcrypt_request *preq = pcrypt_padata_request(padata);
- struct aead_request *req = pcrypt_request_ctx(preq);
- int ret;
-
- ret = crypto_aead_decrypt(req);
-
- if (ret == -EINPROGRESS || ret == -EBUSY)
- return;
-
- padata->info = ret;
- padata_do_serial(padata);
-}
-
-static int pcrypt_aead_decrypt(struct aead_request *req)
-{
- int err;
- struct pcrypt_request *preq = aead_request_ctx(req);
- struct aead_request *creq = pcrypt_request_ctx(preq);
- struct padata_priv *padata = pcrypt_request_padata(preq);
- struct crypto_aead *aead = crypto_aead_reqtfm(req);
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(aead);
- u32 flags = aead_request_flags(req);
- struct pcrypt_instance_ctx *ictx;
-
- ictx = pcrypt_tfm_ictx(aead);
-
- memset(padata, 0, sizeof(struct padata_priv));
-
- padata->parallel = pcrypt_aead_dec;
- padata->serial = pcrypt_aead_serial;
-
- aead_request_set_tfm(creq, ctx->child);
- aead_request_set_callback(creq, flags & ~CRYPTO_TFM_REQ_MAY_SLEEP,
- pcrypt_aead_done, req);
- aead_request_set_crypt(creq, req->src, req->dst,
- req->cryptlen, req->iv);
- aead_request_set_ad(creq, req->assoclen);
-
- err = padata_do_parallel(ictx->psdec, padata, &ctx->cb_cpu);
- if (!err)
- return -EINPROGRESS;
- if (err == -EBUSY) {
- /* try non-parallel mode */
- aead_request_set_callback(creq, flags, req->base.complete,
- req->base.data);
- return crypto_aead_decrypt(creq);
- }
-
- return err;
-}
-
-static int pcrypt_aead_init_tfm(struct crypto_aead *tfm)
-{
- int cpu_index;
- struct aead_instance *inst = aead_alg_instance(tfm);
- struct pcrypt_instance_ctx *ictx = aead_instance_ctx(inst);
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(tfm);
- struct crypto_aead *cipher;
-
- cpu_index = (unsigned int)atomic_inc_return(&ictx->tfm_count) %
- cpumask_weight(cpu_online_mask);
-
- ctx->cb_cpu = cpumask_nth(cpu_index, cpu_online_mask);
- cipher = crypto_spawn_aead(&ictx->spawn);
-
- if (IS_ERR(cipher))
- return PTR_ERR(cipher);
-
- ctx->child = cipher;
- crypto_aead_set_reqsize(tfm, sizeof(struct pcrypt_request) +
- sizeof(struct aead_request) +
- crypto_aead_reqsize(cipher));
-
- return 0;
-}
-
-static void pcrypt_aead_exit_tfm(struct crypto_aead *tfm)
-{
- struct pcrypt_aead_ctx *ctx = crypto_aead_ctx(tfm);
-
- crypto_free_aead(ctx->child);
-}
-
-static void pcrypt_free(struct aead_instance *inst)
-{
- struct pcrypt_instance_ctx *ctx = aead_instance_ctx(inst);
-
- crypto_drop_aead(&ctx->spawn);
- padata_free_shell(ctx->psdec);
- padata_free_shell(ctx->psenc);
- kfree(inst);
-}
-
-static int pcrypt_init_instance(struct crypto_instance *inst,
- struct crypto_alg *alg)
-{
- if (snprintf(inst->alg.cra_driver_name, CRYPTO_MAX_ALG_NAME,
- "pcrypt(%s)", alg->cra_driver_name) >= CRYPTO_MAX_ALG_NAME)
- return -ENAMETOOLONG;
-
- memcpy(inst->alg.cra_name, alg->cra_name, CRYPTO_MAX_ALG_NAME);
-
- inst->alg.cra_priority = alg->cra_priority + 100;
- inst->alg.cra_blocksize = alg->cra_blocksize;
- inst->alg.cra_alignmask = alg->cra_alignmask;
-
- return 0;
-}
-
-static int pcrypt_create_aead(struct crypto_template *tmpl, struct rtattr **tb,
- struct crypto_attr_type *algt)
-{
- struct pcrypt_instance_ctx *ctx;
- struct aead_instance *inst;
- struct aead_alg *alg;
- u32 mask = crypto_algt_inherited_mask(algt);
- int err;
-
- inst = kzalloc(sizeof(*inst) + sizeof(*ctx), GFP_KERNEL);
- if (!inst)
- return -ENOMEM;
-
- err = -ENOMEM;
-
- ctx = aead_instance_ctx(inst);
- ctx->psenc = padata_alloc_shell(pencrypt);
- if (!ctx->psenc)
- goto err_free_inst;
-
- ctx->psdec = padata_alloc_shell(pdecrypt);
- if (!ctx->psdec)
- goto err_free_inst;
-
- err = crypto_grab_aead(&ctx->spawn, aead_crypto_instance(inst),
- crypto_attr_alg_name(tb[1]), 0, mask);
- if (err)
- goto err_free_inst;
-
- alg = crypto_spawn_aead_alg(&ctx->spawn);
- err = pcrypt_init_instance(aead_crypto_instance(inst), &alg->base);
- if (err)
- goto err_free_inst;
-
- inst->alg.base.cra_flags |= CRYPTO_ALG_ASYNC;
-
- inst->alg.ivsize = crypto_aead_alg_ivsize(alg);
- inst->alg.maxauthsize = crypto_aead_alg_maxauthsize(alg);
-
- inst->alg.base.cra_ctxsize = sizeof(struct pcrypt_aead_ctx);
-
- inst->alg.init = pcrypt_aead_init_tfm;
- inst->alg.exit = pcrypt_aead_exit_tfm;
-
- inst->alg.setkey = pcrypt_aead_setkey;
- inst->alg.setauthsize = pcrypt_aead_setauthsize;
- inst->alg.encrypt = pcrypt_aead_encrypt;
- inst->alg.decrypt = pcrypt_aead_decrypt;
-
- inst->free = pcrypt_free;
-
- err = aead_register_instance(tmpl, inst);
- if (err) {
-err_free_inst:
- pcrypt_free(inst);
- }
- return err;
-}
-
-static int pcrypt_create(struct crypto_template *tmpl, struct rtattr **tb)
-{
- struct crypto_attr_type *algt;
-
- algt = crypto_get_attr_type(tb);
- if (IS_ERR(algt))
- return PTR_ERR(algt);
-
- switch (algt->type & algt->mask & CRYPTO_ALG_TYPE_MASK) {
- case CRYPTO_ALG_TYPE_AEAD:
- return pcrypt_create_aead(tmpl, tb, algt);
- }
-
- return -EINVAL;
-}
-
-static int pcrypt_sysfs_add(struct padata_instance *pinst, const char *name)
-{
- int ret;
-
- pinst->kobj.kset = pcrypt_kset;
- ret = kobject_add(&pinst->kobj, NULL, "%s", name);
- if (!ret)
- kobject_uevent(&pinst->kobj, KOBJ_ADD);
-
- return ret;
-}
-
-static int pcrypt_init_padata(struct padata_instance **pinst, const char *name)
-{
- int ret = -ENOMEM;
-
- *pinst = padata_alloc(name);
- if (!*pinst)
- return ret;
-
- ret = pcrypt_sysfs_add(*pinst, name);
- if (ret)
- padata_free(*pinst);
-
- return ret;
-}
-
-static struct crypto_template pcrypt_tmpl = {
- .name = "pcrypt",
- .create = pcrypt_create,
- .module = THIS_MODULE,
-};
-
-static int __init pcrypt_init(void)
-{
- int err = -ENOMEM;
-
- pcrypt_kset = kset_create_and_add("pcrypt", NULL, kernel_kobj);
- if (!pcrypt_kset)
- goto err;
-
- err = pcrypt_init_padata(&pencrypt, "pencrypt");
- if (err)
- goto err_unreg_kset;
-
- err = pcrypt_init_padata(&pdecrypt, "pdecrypt");
- if (err)
- goto err_deinit_pencrypt;
-
- return crypto_register_template(&pcrypt_tmpl);
-
-err_deinit_pencrypt:
- padata_free(pencrypt);
-err_unreg_kset:
- kset_unregister(pcrypt_kset);
-err:
- return err;
-}
-
-static void __exit pcrypt_exit(void)
-{
- crypto_unregister_template(&pcrypt_tmpl);
-
- padata_free(pencrypt);
- padata_free(pdecrypt);
-
- kset_unregister(pcrypt_kset);
-}
-
-module_init(pcrypt_init);
-module_exit(pcrypt_exit);
-
-MODULE_LICENSE("GPL");
-MODULE_AUTHOR("Steffen Klassert <steffen.klassert@secunet.com>");
-MODULE_DESCRIPTION("Parallel crypto wrapper");
-MODULE_ALIAS_CRYPTO("pcrypt");
diff --git a/include/crypto/pcrypt.h b/include/crypto/pcrypt.h
deleted file mode 100644
index 234d7cf3cf5e..000000000000
--- a/include/crypto/pcrypt.h
+++ /dev/null
@@ -1,39 +0,0 @@
-/* SPDX-License-Identifier: GPL-2.0-only */
-/*
- * pcrypt - Parallel crypto engine.
- *
- * Copyright (C) 2009 secunet Security Networks AG
- * Copyright (C) 2009 Steffen Klassert <steffen.klassert@secunet.com>
- */
-
-#ifndef _CRYPTO_PCRYPT_H
-#define _CRYPTO_PCRYPT_H
-
-#include <linux/container_of.h>
-#include <linux/crypto.h>
-#include <linux/padata.h>
-
-struct pcrypt_request {
- struct padata_priv padata;
- void *data;
- void *__ctx[] CRYPTO_MINALIGN_ATTR;
-};
-
-static inline void *pcrypt_request_ctx(struct pcrypt_request *req)
-{
- return req->__ctx;
-}
-
-static inline
-struct padata_priv *pcrypt_request_padata(struct pcrypt_request *req)
-{
- return &req->padata;
-}
-
-static inline
-struct pcrypt_request *pcrypt_padata_request(struct padata_priv *padata)
-{
- return container_of(padata, struct pcrypt_request, padata);
-}
-
-#endif
diff --git a/tools/crypto/tcrypt/tcrypt_speed_compare.py b/tools/crypto/tcrypt/tcrypt_speed_compare.py
index f3f5783cdc06..0bf38c073dbc 100755
--- a/tools/crypto/tcrypt/tcrypt_speed_compare.py
+++ b/tools/crypto/tcrypt/tcrypt_speed_compare.py
@@ -28,19 +28,16 @@ num_mb=8
mode=211
# base speed test
-lsmod | grep pcrypt && modprobe -r pcrypt
dmesg -C
-modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3
+modprobe tcrypt alg="rfc4106(gcm(aes))" type=3
modprobe tcrypt mode=${mode} sec=${sec} num_mb=${num_mb}
dmesg > ${seq_num}_base_dmesg.log
# new speed test
-lsmod | grep pcrypt && modprobe -r pcrypt
dmesg -C
-modprobe tcrypt alg="pcrypt(rfc4106(gcm(aes)))" type=3
+modprobe tcrypt alg="rfc4106(gcm(aes))" type=3
modprobe tcrypt mode=${mode} sec=${sec} num_mb=${num_mb}
dmesg > ${seq_num}_new_dmesg.log
-lsmod | grep pcrypt && modprobe -r pcrypt
tools/crypto/tcrypt/tcrypt_speed_compare.py \
${seq_num}_base_dmesg.log \
base-commit: e264401ce4776a288524e5b87593d4d864147115
--
2.55.0
^ permalink raw reply related
* Re: [PATCH] crypto: pcrypt - Remove pcrypt
From: Herbert Xu @ 2026-07-13 3:29 UTC (permalink / raw)
To: Eric Biggers
Cc: linux-crypto, netdev, linux-kernel, Steffen Klassert, Thomas Huth
In-Reply-To: <20260713032600.44355-1-ebiggers@kernel.org>
On Sun, Jul 12, 2026 at 11:26:00PM -0400, Eric Biggers wrote:
> pcrypt was originally intended to improve IPsec performance. However,
> it's no longer useful for that. Reports from the rare cases that anyone
> has actually tried to use it over the years indicate that it actually
> reduces IPsec performance, e.g.:
>
> * https://github.com/libreswan/libreswan/wiki/Internals:-Cryptographic-Acceleration#obsoleted-ipsec-accelerations
> * https://users.strongswan.narkive.com/liqTaTq8/strongswan-problem-with-pcrypt
> * https://unix.stackexchange.com/questions/594336/ipsec-multithreading-via-pcrypt-worse-than-single-thread
>
> It's also undocumented and quite difficult to actually use. Its design
> is also broken, in that any unprivileged program can enable pcrypt
> systemwide at any time (by instantiating it using AF_ALG).
>
> Meanwhile, pcrypt has been a regular source of bugs, including at least
> four that have received CVEs.
>
> Let's just remove it. No one seems to care about it anymore other than
> people looking for vulnerabilities.
>
> Cc: Steffen Klassert <steffen.klassert@secunet.com>
> Signed-off-by: Eric Biggers <ebiggers@kernel.org>
Looks good to me.
More than half of kernel/padata.c is only used by pcrypt and can
also be removed if pcrypt is removed.
Thanks,
--
Email: Herbert Xu <herbert@gondor.apana.org.au>
Home Page: http://gondor.apana.org.au/~herbert/
PGP Key: http://gondor.apana.org.au/~herbert/pubkey.txt
^ permalink raw reply
* Re: [PATCH] net: phy: marvell: Add soft reset for 88E1510
From: Ben Brown @ 2026-07-13 3:30 UTC (permalink / raw)
To: Andrew Lunn
Cc: hkallweit1@gmail.com, linux@armlinux.org.uk, davem@davemloft.net,
edumazet@google.com, kuba@kernel.org, pabeni@redhat.com,
linux-kernel@vger.kernel.org, netdev@vger.kernel.org,
Chris Packham
In-Reply-To: <0c9c5fe2-6b91-42d2-8582-80f9a47df827@lunn.ch>
On 7/9/26 01:04, Andrew Lunn wrote:
>>> Lets take a step back.
>>>
>>> What sort of reset are we talking about? Software or hardware?
>>>
>>> Andrew
>>
>> It is doing a hardware reset using a GPIO line.
>>
>> When linked down the phy gets put into reset using a hardware GPIO line,
>> during link up the phy initializes the hardware using phy_init_hw(),
>> which de-asserts that reset GPIO. Then trivial setup is done before
>> the driver specific config_init().
>>
>> When we are doing the marvell m88e1510_config_init() the first page
>> write is not applying so it ends up writing configuration to the wrong
>> registers. When testing fixes adding a 15us sleep before changing the
>> page also meant the page was updated correctly.
>
> reset-gpios:
> maxItems: 1
> description:
> The GPIO phandle and specifier for the PHY reset signal.
>
> reset-assert-us:
> description:
> Delay after the reset was asserted in microseconds. If this
> property is missing the delay will be skipped.
>
> reset-deassert-us:
> description:
> Delay after the reset was deasserted in microseconds. If
> this property is missing the delay will be skipped.
>
>
> What delays are you using?
>
> Andrew
We were not using any of those delays as I didn't see those options.
Adding a delay fixes our issue, so this patch is not needed.
Thank you for your time,
Ben
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox