* [PATCH v4 3/4] net: xilinx: axienet: Derive RX frame length from residue in dmaengine path
From: Srinivas Neeli @ 2026-07-13 7:21 UTC (permalink / raw)
To: Vinod Koul, Radhey Shyam Pandey
Cc: Frank Li, Michal Simek, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Suraj Gupta,
Marek Vasut, Tomi Valkeinen, Alex Bereza, Folker Schwesinger,
dmaengine, netdev, linux-arm-kernel, linux-kernel, git
In-Reply-To: <20260713072146.45269-1-srinivas.neeli@amd.com>
The dmaengine RX path derived the received frame length from the descriptor
APP metadata. That only works when the optional AXI4-Stream status/control
interface is present, because the hardware populates the APP fields solely
when that interface is enabled. On designs without it the length read back
is invalid.
The AXI DMA engine already reports how many bytes it wrote into the buffer
through the standard dmaengine residue mechanism. Compute the RX frame
length as the posted buffer length minus result->residue, which is
independent of the status/control interface and correct across all designs,
including multi-descriptor frames where the residue is summed over the
chain.
Drop the descriptor metadata lookup, which was only used for this purpose.
Detect a failed transfer from dmaengine_result.result instead of the
metadata pointer return value, and remove the now unused LEN_APP macro.
The transmit path is unaffected. It still passes APP metadata for checksum
offload and derives its length from the skb.
Signed-off-by: Srinivas Neeli <srinivas.neeli@amd.com>
---
Changes in V4:
- Renamed subject to "Derive RX frame length from residue in dmaengine
path".
- Condensed the commit message.
- Dropped the Fixes tag.
Changes in V3:
- New patch in this series.
- This patch enables axienet to work on designs where the AXI4-Stream
status/control interface is not present. By using the standard
dmaengine residue mechanism, the driver no longer depends on APP
fields being populated by hardware.
- This approach replaces the V2 xferred_bytes mechanism (V2 patch 5/5),
making the dt-bindings patch (V2 patch 4/5) for xlnx,include-stscntrl-strm
also unnecessary. Both V2 patches are dropped in this series.
---
drivers/net/ethernet/xilinx/xilinx_axienet_main.c | 14 +++++---------
1 file changed, 5 insertions(+), 9 deletions(-)
diff --git a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
index fcf517069d16..67d1b8e91d68 100644
--- a/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
+++ b/drivers/net/ethernet/xilinx/xilinx_axienet_main.c
@@ -53,7 +53,6 @@
#define TX_BD_NUM_MAX 4096
#define RX_BD_NUM_MAX 4096
#define DMA_NUM_APP_WORDS 5
-#define LEN_APP 4
#define RX_BUF_NUM_DEFAULT 128
/* Must be shorter than length of ethtool_drvinfo.driver field to fit */
@@ -1159,29 +1158,26 @@ axienet_start_xmit(struct sk_buff *skb, struct net_device *ndev)
static void axienet_dma_rx_cb(void *data, const struct dmaengine_result *result)
{
struct skbuf_dma_descriptor *skbuf_dma;
- size_t meta_len, meta_max_len, rx_len;
struct axienet_local *lp = data;
struct sk_buff *skb;
- u32 *app_metadata;
+ size_t rx_len;
int i;
skbuf_dma = axienet_get_rx_desc(lp, lp->rx_ring_tail++);
skb = skbuf_dma->skb;
- app_metadata = dmaengine_desc_get_metadata_ptr(skbuf_dma->desc, &meta_len,
- &meta_max_len);
dma_unmap_single(lp->dev, skbuf_dma->dma_address, lp->max_frm_size,
DMA_FROM_DEVICE);
- if (IS_ERR(app_metadata)) {
+ if (result->result != DMA_TRANS_NOERROR) {
if (net_ratelimit())
- netdev_err(lp->ndev, "Failed to get RX metadata pointer\n");
+ netdev_err(lp->ndev, "RX DMA transfer failed\n");
dev_kfree_skb_any(skb);
lp->ndev->stats.rx_dropped++;
goto rx_submit;
}
- /* TODO: Derive app word index programmatically */
- rx_len = (app_metadata[LEN_APP] & 0xFFFF);
+ /* Actual length = posted buffer length - residue. */
+ rx_len = lp->max_frm_size - result->residue;
skb_put(skb, rx_len);
skb->protocol = eth_type_trans(skb, lp->ndev);
skb->ip_summed = CHECKSUM_NONE;
--
2.25.1
^ permalink raw reply related
* [PATCH] mctp: check register_netdevice_notifier() error in mctp_device_init()
From: Minhong He @ 2026-07-13 7:39 UTC (permalink / raw)
To: netdev; +Cc: Jeremy Kerr, Matt Johnston
mctp_device_init() handles errors from rtnl_af_register() and
rtnl_register_many(), but ignores the return value of
register_netdevice_notifier(). If notifier registration fails, init can
still return success while the module is only partially initialized.
Check the notifier registration error and fail module init early.
Fixes: d51705614f66 ("mctp: Handle error of rtnl_register_module().")
Signed-off-by: Minhong He <heminhong@kylinos.cn>
---
net/mctp/device.c | 4 +++-
1 file changed, 3 insertions(+), 1 deletion(-)
diff --git a/net/mctp/device.c b/net/mctp/device.c
index 2c84df674669..822120e860c8 100644
--- a/net/mctp/device.c
+++ b/net/mctp/device.c
@@ -536,7 +536,9 @@ int __init mctp_device_init(void)
{
int err;
- register_netdevice_notifier(&mctp_dev_nb);
+ err = register_netdevice_notifier(&mctp_dev_nb);
+ if (err)
+ return err;
err = rtnl_af_register(&mctp_af_ops);
if (err)
--
2.25.1
^ permalink raw reply related
* Re: [PATCH net v2 00/16] rxrpc: Fix CHALLENGE packet handling
From: David Howells @ 2026-07-13 7:39 UTC (permalink / raw)
To: netdev
Cc: dhowells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel
In-Reply-To: <20260710192220.1922433-1-dhowells@redhat.com>
Patches 1 and 4 got obsoleted by fixes from someone else that went upstream
via a different path, so will drop those and repost.
David
^ permalink raw reply
* Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
From: Daehyeon Ko @ 2026-07-13 7:43 UTC (permalink / raw)
To: Tung Quang Nguyen
Cc: netdev, Jon Maloy, David S . Miller, Eric Dumazet, Jakub Kicinski,
Paolo Abeni, Simon Horman, tipc-discussion, linux-kernel,
Daehyeon Ko
In-Reply-To: <GV1P189MB1988AF0F2722101E30D902E1C6FA2@GV1P189MB1988.EURP189.PROD.OUTLOOK.COM>
Hi Tung,
Thanks for reproducing and testing. Decoded with scripts/decode_stacktrace.sh
(line numbers are current mainline net/tipc/socket.c / net/core/sock.c /
net/socket.c):
BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
Write of size 8 at addr ffff8880047cdc38 by task init/1
Call Trace:
lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839)
tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638) // lock_sock(sk)
__sock_release (net/socket.c:710)
sock_close (net/socket.c:1501)
__fput (fs/file_table.c:512)
Allocated by task 1:
sk_alloc (net/core/sock.c:2308)
tipc_sk_create (net/tipc/socket.c:487) // sk = sk_alloc(...)
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)
Freed by task 1:
__sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
tipc_sk_create (net/tipc/socket.c:504) // sk_free(sk) on the tipc_sk_insert() failure path
tipc_accept (net/tipc/socket.c:2744)
do_accept (net/socket.c:2034)
So the same sk is allocated at socket.c:487, freed at socket.c:504 (the
sk_free() right before the line this patch adds), and then written at
socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup.
Thanks,
Daehyeon
^ permalink raw reply
* [PATCH net v3] net: stmmac: enable the MAC on link up for all supported speeds
From: vadik likholetov @ 2026-07-13 7:49 UTC (permalink / raw)
To: netdev
Cc: maxime.chevallier, andrew, andrew+netdev, davem, edumazet, kuba,
pabeni, thierry.reding, jonathanh, vbhadram, linux-tegra,
linux-kernel
stmmac_mac_link_down() clears the MAC's transmit and receive enable bits.
stmmac_mac_link_up() is expected to set them again through
stmmac_mac_set(..., true), but it first switches on the negotiated speed
and returns early for a speed the switch does not list. The MAC is then
left gated off.
The speed selection is split into three switches, keyed on the interface.
The generic branch -- taken for everything that is neither USXGMII nor
XLGMII, so including PHY_INTERFACE_MODE_10GBASER -- lists only SPEED_2500,
SPEED_1000, SPEED_100 and SPEED_10.
MGBE on Tegra234 runs 10GBASE-R into an Aquantia AQR113C. That PHY does
rate matching, so phylink_link_up() replaces the media speed with the
MAC-side interface speed before calling into the MAC:
case RATE_MATCH_PAUSE:
speed = phylink_interface_max_speed(link_state.interface);
duplex = DUPLEX_FULL;
The driver is therefore called as
stmmac_mac_link_up(interface=10GBASER, speed=10000, duplex=1)
which falls through to "default: return;". The interface stops passing
traffic after the first link flap.
The failure is easy to misread. The link still comes up, because the PHY
is polled over MDIO and needs no MAC, so the interface reports carrier 1
at the media speed. The DMA is untouched, so its start bits stay set and
descriptors are still consumed. Only the MAC itself is gated off: the
receiver counts nothing (mmc_rx_framecount_gb stops advancing, RE is 0)
and nothing reaches the wire (TE is 0). The interface survives boot only
because stmmac_hw_setup(), called from ndo_open, enables the MAC
unconditionally -- so the problem appears only once the cable has been
unplugged and plugged back in, and "ip link set dev <ethX> down && ip
link set dev <ethX> up" appears to fix it.
The interface is not what the speed bits depend on: with the single
exception of 2.5G, which is selected through the XGMII block on USXGMII
and through the regular speed bits otherwise, each speed maps to one
field of struct mac_link. The per-interface switches are speed
validation, and phylink already validates the speed against
priv->hw->link.caps. So collapse the three switches into one keyed on the
speed alone, keeping the interface test only for the 2.5G case. This
covers 10G on 10GBASE-R, and equally 5G, and 1G/100/10 on USXGMII, all of
which hit "default: return;" today.
A core that does not support a speed leaves the corresponding mac_link
field at 0, and phylink will not offer it that speed in the first place.
For dwxgmac2 at 10G, link.xgmii.speed10000 is XGMAC_CONFIG_SS_10000,
which is 0 and is the correct speed selection for a 10GBASE-R MAC: ctrl
then equals old_ctrl, the register write is skipped, and execution
reaches stmmac_mac_set(..., true).
Log an error in the default case, since a speed with no entry here leaves
the MAC disabled and the symptom does not point at the cause.
Fixes: d8ca113724e7 ("net: stmmac: tegra: Add MGBE support")
Suggested-by: Maxime Chevallier <maxime.chevallier@bootlin.com>
Signed-off-by: vadik likholetov <vadikas@gmail.com>
---
v3:
- Use phy_speed_to_str() rather than %d for the speed in the error
message (Maxime).
- Resend as a standalone thread rather than a reply to v1 (Maxime).
v2:
- Collapse the three per-interface switches into a single switch on the
speed, rather than adding SPEED_10000 to the generic branch, which
left SPEED_5000 and the USXGMII sub-1G speeds broken (Maxime).
- netdev_err() in the default case (Andrew).
Fixes tag: the missing speeds predate the commit cited above. I picked
d8ca113724e7 because MGBE is the first in-tree user to reach it -- it
needs a 10GBASE-R interface driven by a rate-matching PHY, so that
phylink hands the MAC a 10G speed. Happy to re-target it.
Verified on an AGX Orin devkit (Tegra234 MGBE0 + AQR113C), before and
after, on the same board and cable. MAC registers read with `ethtool -d`,
after a physical unplug and replug:
stock MAC_TX_CONFIG 0x00010000 (TE=0)
MAC_RX_CONFIG 0x3ff022c0 (RE=0)
rx_packets frozen, DHCP lease lost
patched MAC_TX_CONFIG 0x00010001 (TE=1)
MAC_RX_CONFIG 0x3ff022c1 (RE=1)
rx_packets keeps climbing, DHCP lease retained
Only the 10GBASE-R path is covered by hardware here; the other speeds are
by inspection. Testing was done with MGBE0 handed to a VM via
vfio-platform, so the driver ran in a guest; the MAC register evidence
above is read from the device itself and the code path is not
virtualisation-specific.
.../net/ethernet/stmicro/stmmac/stmmac_main.c | 92 ++++++++-----------
1 file changed, 37 insertions(+), 55 deletions(-)
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 2a0d7eff8..8d3d87549 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -1083,63 +1083,45 @@ static void stmmac_mac_link_up(struct phylink_config *config,
old_ctrl = readl(priv->ioaddr + MAC_CTRL_REG);
ctrl = old_ctrl & ~priv->hw->link.speed_mask;
- if (interface == PHY_INTERFACE_MODE_USXGMII) {
- switch (speed) {
- case SPEED_10000:
- ctrl |= priv->hw->link.xgmii.speed10000;
- break;
- case SPEED_5000:
- ctrl |= priv->hw->link.xgmii.speed5000;
- break;
- case SPEED_2500:
+ switch (speed) {
+ case SPEED_100000:
+ ctrl |= priv->hw->link.xlgmii.speed100000;
+ break;
+ case SPEED_50000:
+ ctrl |= priv->hw->link.xlgmii.speed50000;
+ break;
+ case SPEED_40000:
+ ctrl |= priv->hw->link.xlgmii.speed40000;
+ break;
+ case SPEED_25000:
+ ctrl |= priv->hw->link.xlgmii.speed25000;
+ break;
+ case SPEED_10000:
+ ctrl |= priv->hw->link.xgmii.speed10000;
+ break;
+ case SPEED_5000:
+ ctrl |= priv->hw->link.xgmii.speed5000;
+ break;
+ case SPEED_2500:
+ if (interface == PHY_INTERFACE_MODE_USXGMII)
ctrl |= priv->hw->link.xgmii.speed2500;
- break;
- default:
- return;
- }
- } else if (interface == PHY_INTERFACE_MODE_XLGMII) {
- switch (speed) {
- case SPEED_100000:
- ctrl |= priv->hw->link.xlgmii.speed100000;
- break;
- case SPEED_50000:
- ctrl |= priv->hw->link.xlgmii.speed50000;
- break;
- case SPEED_40000:
- ctrl |= priv->hw->link.xlgmii.speed40000;
- break;
- case SPEED_25000:
- ctrl |= priv->hw->link.xlgmii.speed25000;
- break;
- case SPEED_10000:
- ctrl |= priv->hw->link.xgmii.speed10000;
- break;
- case SPEED_2500:
- ctrl |= priv->hw->link.speed2500;
- break;
- case SPEED_1000:
- ctrl |= priv->hw->link.speed1000;
- break;
- default:
- return;
- }
- } else {
- switch (speed) {
- case SPEED_2500:
+ else
ctrl |= priv->hw->link.speed2500;
- break;
- case SPEED_1000:
- ctrl |= priv->hw->link.speed1000;
- break;
- case SPEED_100:
- ctrl |= priv->hw->link.speed100;
- break;
- case SPEED_10:
- ctrl |= priv->hw->link.speed10;
- break;
- default:
- return;
- }
+ break;
+ case SPEED_1000:
+ ctrl |= priv->hw->link.speed1000;
+ break;
+ case SPEED_100:
+ ctrl |= priv->hw->link.speed100;
+ break;
+ case SPEED_10:
+ ctrl |= priv->hw->link.speed10;
+ break;
+ default:
+ netdev_err(priv->dev,
+ "unsupported speed %s on %s, leaving the MAC disabled\n",
+ phy_speed_to_str(speed), phy_modes(interface));
+ return;
}
if (priv->plat->fix_mac_speed)
--
2.53.0
^ permalink raw reply related
* [PATCH] phonet: check register_netdevice_notifier() error in phonet_device_init()
From: Minhong He @ 2026-07-13 7:52 UTC (permalink / raw)
To: netdev; +Cc: Remi Denis-Courmont
phonet_device_init() registers a netdevice notifier before calling
phonet_netlink_register(), but does not check whether notifier
registration succeeded. On failure, netlink setup still proceeds and
init may return success without the notifier in place.
Check the notifier registration error and unwind through
phonet_device_exit() on failure.
Signed-off-by: Minhong He <heminhong@kylinos.cn>
---
net/phonet/pn_dev.c | 6 +++++-
1 file changed, 5 insertions(+), 1 deletion(-)
diff --git a/net/phonet/pn_dev.c b/net/phonet/pn_dev.c
index ad44831d6745..0445f7ef0320 100644
--- a/net/phonet/pn_dev.c
+++ b/net/phonet/pn_dev.c
@@ -356,7 +356,11 @@ int __init phonet_device_init(void)
proc_create_net("pnresource", 0, init_net.proc_net, &pn_res_seq_ops,
sizeof(struct seq_net_private));
- register_netdevice_notifier(&phonet_device_notifier);
+ err = register_netdevice_notifier(&phonet_device_notifier);
+ if (err) {
+ phonet_device_exit();
+ return err;
+ }
err = phonet_netlink_register();
if (err)
phonet_device_exit();
--
2.25.1
^ permalink raw reply related
* RE: [PATCH net] tipc: clear sock->sk on the failed-insert path in tipc_sk_create()
From: Tung Quang Nguyen @ 2026-07-13 7:52 UTC (permalink / raw)
To: Daehyeon Ko
Cc: netdev@vger.kernel.org, Jon Maloy, David S . Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman,
tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org
In-Reply-To: <20260713074324.3577116-1-4ncienth@gmail.com>
>Subject: Re: [PATCH net] tipc: clear sock->sk on the failed-insert path in
>tipc_sk_create()
>
>Hi Tung,
>
>Thanks for reproducing and testing. Decoded with
>scripts/decode_stacktrace.sh (line numbers are current mainline
>net/tipc/socket.c / net/core/sock.c /
>net/socket.c):
>
>BUG: KASAN: slab-use-after-free in lock_sock_nested (net/core/sock.c:3839)
>Write of size 8 at addr ffff8880047cdc38 by task init/1 Call Trace:
> lock_sock_nested (include/linux/instrumented.h:112 net/core/sock.c:3839)
> tipc_release (include/net/sock.h:1713 net/tipc/socket.c:638) // lock_sock(sk)
> __sock_release (net/socket.c:710)
> sock_close (net/socket.c:1501)
> __fput (fs/file_table.c:512)
>
>Allocated by task 1:
> sk_alloc (net/core/sock.c:2308)
> tipc_sk_create (net/tipc/socket.c:487) // sk = sk_alloc(...)
> tipc_accept (net/tipc/socket.c:2744)
> do_accept (net/socket.c:2034)
>
>Freed by task 1:
> __sk_destruct (net/core/sock.c:2289 net/core/sock.c:2391)
> tipc_sk_create (net/tipc/socket.c:504) // sk_free(sk) on the tipc_sk_insert()
>failure path
> tipc_accept (net/tipc/socket.c:2744)
> do_accept (net/socket.c:2034)
>
>So the same sk is allocated at socket.c:487, freed at socket.c:504 (the
>sk_free() right before the line this patch adds), and then written at
>socket.c:638 (lock_sock()) from tipc_release() on the accept() fput cleanup.
I meant to say please send V2 with above decoded stack trace in your changelog.
>
>Thanks,
>Daehyeon
^ permalink raw reply
* RE: [PATCH net-next v6 2/7] net: phy: phylink: add helper to modify pause
From: Javen @ 2026-07-13 7:51 UTC (permalink / raw)
To: Maxime Chevallier, hkallweit1@gmail.com, nic_swsd@realtek.com,
andrew+netdev@lunn.ch, davem@davemloft.net, edumazet@google.com,
kuba@kernel.org, pabeni@redhat.com, horms@kernel.org
Cc: netdev@vger.kernel.org, linux-kernel@vger.kernel.org,
daniel@makrotopia.org, linux@armlinux.org.uk,
enelsonmoore@gmail.com, daniel@thingy.jp
In-Reply-To: <0c188a7d-3637-4e08-9ac8-c1d824b461ed@bootlin.com>
Hi,
>There's a change in the MAC's ability to support Pause, so we should :
>
> - Recompute the pl->supported field. Update the config.mac_capabilities with
>the
> new pause settings, calling phylink_validate() should do the trick I think, this
> will rebuild the capability list:
>
> phylink_validate(pl, pl->supported, &pl->link_config);
>
> - Then update the pl->link_config.pause,
>
> - Then update the pause advertising, like done in phylink_setpauseparam
> ( I think, everything that comes after pl->state_mutex gets released in
> phylink_ethtool_set_pauseparam)
>
>Ideally, the logic to update the advertising and re-trigger a negociation should
>be factored out in a private helper, then reused from both this path (MAC
>updates pause support) and the phylink_ethtool_set_pauseparam path.
>
>Maxime
Thanks for review and helpful suggestions.
I agree with your suggestion to factor out the logic into a private helper and reuse it for both phylink_ethtool_set_pauseparam() and phylink_update_mac_pause_capabilities().
Here is the refactored logic. I want to share this specific part with you for a quick check before I submit v7 patch.
---
drivers/net/phy/phylink.c | 164 ++++++++++++++++++++++++++------------
include/linux/phylink.h | 2 +
2 files changed, 116 insertions(+), 50 deletions(-)
diff --git a/drivers/net/phy/phylink.c b/drivers/net/phy/phylink.c
index 59dfe35afa54..596a94387a56 100644
--- a/drivers/net/phy/phylink.c
+++ b/drivers/net/phy/phylink.c
@@ -1828,6 +1828,119 @@ int phylink_set_fixed_link(struct phylink *pl,
}
EXPORT_SYMBOL_GPL(phylink_set_fixed_link);
+static void phylink_update_pause_state(struct phylink *pl, int pause_state)
+{
+ struct phylink_link_state *config = &pl->link_config;
+ bool tx_pause = !!(pause_state & MLO_PAUSE_TX);
+ bool rx_pause = !!(pause_state & MLO_PAUSE_RX);
+ bool manual_changed;
+
+ mutex_lock(&pl->state_mutex);
+
+ /*
+ * See the comments for linkmode_set_pause(), wrt the deficiencies
+ * with the current implementation. A solution to this issue would
+ * be:
+ * ethtool Local device
+ * rx tx Pause AsymDir
+ * 0 0 0 0
+ * 1 0 1 1
+ * 0 1 0 1
+ * 1 1 1 1
+ * and then use the ethtool rx/tx enablement status to mask the
+ * rx/tx pause resolution.
+ */
+ linkmode_set_pause(config->advertising, tx_pause,
+ rx_pause);
+
+ manual_changed = (config->pause ^ pause_state) & MLO_PAUSE_AN ||
+ (!(pause_state & MLO_PAUSE_AN) &&
+ (config->pause ^ pause_state) & MLO_PAUSE_TXRX_MASK);
+
+ config->pause = pause_state;
+
+ /* Update our in-band advertisement, triggering a renegotiation if
+ * the advertisement changed.
+ */
+ if (!pl->phydev)
+ phylink_change_inband_advert(pl);
+
+ mutex_unlock(&pl->state_mutex);
+
+ /* If we have a PHY, a change of the pause frame advertisement will
+ * cause phylib to renegotiate (if AN is enabled) which will in turn
+ * call our phylink_phy_change() and trigger a resolve. Note that
+ * we can't hold our state mutex while calling phy_set_asym_pause().
+ */
+ if (pl->phydev)
+ phy_set_asym_pause(pl->phydev, rx_pause, tx_pause);
+
+ /* If the manual pause settings changed, make sure we trigger a
+ * resolve to update their state; we can not guarantee that the
+ * link will cycle.
+ */
+ if (manual_changed) {
+ pl->link_failed = true;
+ phylink_run_resolve(pl);
+ }
+}
+
+/**
+ * phylink_update_mac_pause_capabilities() - Dynamically update MAC pause
+ * @pl: a pointer to a &struct phylink returned from phylink_create()
+ * @mac_pause: the new MAC pause capabilities mask
+ *
+ * This function allows a MAC driver to dynamically change its pause state,
+ * such as losing/gaining Pause frame support based on MTU size.
+ * It recalculates supported link modes and triggers renegotiation if needed.
+ */
+void phylink_update_mac_pause_capabilities(struct phylink *pl, unsigned long mac_pause)
+{
+ struct phylink_link_state *config = &pl->link_config;
+ unsigned long old_pause;
+ int pause_state;
+
+ ASSERT_RTNL();
+
+ if (mac_pause & ~(MAC_SYM_PAUSE | MAC_ASYM_PAUSE)) {
+ phylink_err(pl, "Attempted to dynamically change non-pause MAC capabilities\n");
+ return;
+ }
+
+ old_pause = pl->config->mac_capabilities & (MAC_SYM_PAUSE | MAC_ASYM_PAUSE);
+ if (old_pause == mac_pause)
+ return;
+
+ mutex_lock(&pl->state_mutex);
+
+ pl->config->mac_capabilities &= ~(MAC_SYM_PAUSE | MAC_ASYM_PAUSE);
+ pl->config->mac_capabilities |= mac_pause;
+
When changing to MTU 9000, phylink_validate() clears the Pause and Asym_Pause bits in pl->supported because mac_pause becomes 0. When reverting to MTU 1500, we update mac_pause back to 1. But if we directly call phylink_validate() at this point, it uses the current pl->supported (where Pause is 0) as input. Thus, the Pause capability is permanently lost and never restored.
To fix this, I forcefully set the Pause bits in pl->supported before calling phylink_validate(). But to prevent faking capabilities that the PHY doesn't actually support, we can safely use linkmode_and() with the media (PHY/SFP) capabilities before the final validation.
+ phylink_set(pl->supported, Pause);
+ phylink_set(pl->supported, Asym_Pause);
+
+ if (pl->phydev)
+ linkmode_and(pl->supported, pl->supported, pl->phydev->supported);
+ else if (pl->sfp_bus)
+ linkmode_and(pl->supported, pl->supported, pl->sfp_support);
+
+ phylink_validate(pl, pl->supported, config);
+
+ pause_state = config->pause;
+
+ if (!phylink_test(pl->supported, Pause)) {
+ pause_state &= ~(MLO_PAUSE_RX | MLO_PAUSE_TX);
+ } else if (!phylink_test(pl->supported, Asym_Pause)) {
+ if ((pause_state & MLO_PAUSE_RX) ^ (pause_state & MLO_PAUSE_TX))
+ pause_state &= ~(MLO_PAUSE_RX | MLO_PAUSE_TX);
+ }
+
+ mutex_unlock(&pl->state_mutex);
+
+ phylink_update_pause_state(pl, pause_state);
+}
+EXPORT_SYMBOL_GPL(phylink_update_mac_pause_capabilities);
+
/**
* phylink_create() - create a phylink instance
* @config: a pointer to the target &struct phylink_config
@@ -3190,8 +3303,6 @@ EXPORT_SYMBOL_GPL(phylink_ethtool_get_pauseparam);
int phylink_ethtool_set_pauseparam(struct phylink *pl,
struct ethtool_pauseparam *pause)
{
- struct phylink_link_state *config = &pl->link_config;
- bool manual_changed;
int pause_state;
ASSERT_RTNL();
@@ -3215,54 +3326,7 @@ int phylink_ethtool_set_pauseparam(struct phylink *pl,
if (pause->tx_pause)
pause_state |= MLO_PAUSE_TX;
- mutex_lock(&pl->state_mutex);
- /*
- * See the comments for linkmode_set_pause(), wrt the deficiencies
- * with the current implementation. A solution to this issue would
- * be:
- * ethtool Local device
- * rx tx Pause AsymDir
- * 0 0 0 0
- * 1 0 1 1
- * 0 1 0 1
- * 1 1 1 1
- * and then use the ethtool rx/tx enablement status to mask the
- * rx/tx pause resolution.
- */
- linkmode_set_pause(config->advertising, pause->tx_pause,
- pause->rx_pause);
-
- manual_changed = (config->pause ^ pause_state) & MLO_PAUSE_AN ||
- (!(pause_state & MLO_PAUSE_AN) &&
- (config->pause ^ pause_state) & MLO_PAUSE_TXRX_MASK);
-
- config->pause = pause_state;
-
- /* Update our in-band advertisement, triggering a renegotiation if
- * the advertisement changed.
- */
- if (!pl->phydev)
- phylink_change_inband_advert(pl);
-
- mutex_unlock(&pl->state_mutex);
-
- /* If we have a PHY, a change of the pause frame advertisement will
- * cause phylib to renegotiate (if AN is enabled) which will in turn
- * call our phylink_phy_change() and trigger a resolve. Note that
- * we can't hold our state mutex while calling phy_set_asym_pause().
- */
- if (pl->phydev)
- phy_set_asym_pause(pl->phydev, pause->rx_pause,
- pause->tx_pause);
-
- /* If the manual pause settings changed, make sure we trigger a
- * resolve to update their state; we can not guarantee that the
- * link will cycle.
- */
- if (manual_changed) {
- pl->link_failed = true;
- phylink_run_resolve(pl);
- }
+ phylink_update_pause_state(pl, pause_state);
return 0;
}
diff --git a/include/linux/phylink.h b/include/linux/phylink.h
index 2bc0db3d52ac..e3c7822100ab 100644
--- a/include/linux/phylink.h
+++ b/include/linux/phylink.h
@@ -842,4 +842,6 @@ void phylink_replay_link_begin(struct phylink *pl);
void phylink_replay_link_end(struct phylink *pl);
+void phylink_update_mac_pause_capabilities(struct phylink *pl, unsigned long mac_pause);
+
#endif
--
2.43.0
As a side note, I have practically verified this logic on my hardware using ethtool and ip link. When changing the MTU to 9000, pause capabilities are correctly dropped. When reverting to MTU 1500, the capability successfully comes back, and I can manually re-enable RX/TX pause via ethtool -A. The dynamic switching works perfectly as expected.
Thanks again for your time. Any suggestion would be greatly appreciated..
BRs,
Javen
^ permalink raw reply related
* Re: [PATCH bpf-next v6 1/3] bpf: Add BPF_FIB_LOOKUP_VLAN flag to bpf_fib_lookup() helper
From: Toke Høiland-Jørgensen @ 2026-07-13 7:56 UTC (permalink / raw)
To: Avinash Duduskar, andrii, ast, daniel
Cc: a.s.protopopov, ameryhung, bpf, davem, dsahern, eddyz87, edumazet,
emil, eyal.birger, hawk, horms, john.fastabend, jolsa, kpsingh,
kuba, leon.hwang, linux-kernel, linux-kselftest, martin.lau,
memxor, netdev, pabeni, rongtao, sdf, shuah, song, yatsenko,
yonghong.song
In-Reply-To: <20260708080434.732503-1-avinash.duduskar@gmail.com>
Avinash Duduskar <avinash.duduskar@gmail.com> writes:
> The bpf ci bot flagged the VLAN_FAILURE re-issue advice in the uapi doc
> here, and the finding is real. By the time the lookup fails,
> params->tbid is gone (the h_vlan fields it shares storage with are
> zeroed on entry to bpf_fib_set_fwd_params()) and params->mark is gone
> on the resolved-neighbour path (overwritten by the smac output). A
> program that follows the advice with the same struct and DIRECT|TBID or
> MARK set runs the second lookup with a zero tbid or a garbage mark. The
> selftests did not catch it because every arm re-initializes params,
> which is the safe pattern.
>
> Toke, the re-issue recovery came from
> https://lore.kernel.org/all/87jyrwf9g1.fsf@toke.dk/, so before I
> respin: my preference is to keep the mechanics and fix the sentence,
> "repeat the lookup without the flag, re-initializing *params* first;
> output fields overwrite the inputs they share storage with".
> Overwriting inputs on the way out is the helper's existing behaviour on
> every path (rt_metric lands on top of tos/flowinfo even on NO_NEIGH),
> so one rule, re-initialize before any reuse, seems better than making
> VLAN_FAILURE the only return code that preserves inputs.
Sure, SGTM :)
-Toke
^ permalink raw reply
* Re:Re: [PATCH] vhost/net: Fill virtio_net_hdr GSO/csum metadata on RX
From: Xiong Weimin @ 2026-07-13 8:04 UTC (permalink / raw)
To: Michael S. Tsirkin; +Cc: jasowang, xiongweimin, netdev, virtualization
In-Reply-To: <20260713025549-mutt-send-email-mst@kernel.org>
Hi Michael,
Thanks for the review.
On why VHOST_NET_F_VIRTIO_NET_HDR:
We hit this with vhost-user backends that do not expose IFF_VNET_HDR
(e.g. DPDK/custom socket backends). When the guest negotiates
VHOST_NET_F_VIRTIO_NET_HDR, vhost is responsible for supplying
virtio_net_hdr on RX. The current code always zeroes the header
(GSO_NONE), so guests that negotiated GUEST_TSO*/GUEST_CSUM never
receive correct offload metadata even when the socket skb has it.
The goal is to make RX offload metadata correct for that configuration.
TX TSO is intentionally left for a follow-up series.
On the race you pointed out:
You're right — peeking the skb under sk_receive_queue.lock and then
building the header after dropping the lock is racy if another context
can dequeue the skb before recvmsg() runs. I see why the header filling
ended up in tun, where the backend owns the skb lifecycle.
I can think of a few options:
a) Drop this approach and not use VHOST_NET_F_VIRTIO_NET_HDR for
these backends (keep zeroed headers / no guest offload).
b) Move the metadata extraction to the backend (similar to tun).
c) Hold the receive-queue lock across peek + recvmsg if that is
acceptable for this path (I need to check whether recvmsg can
be called under that lock).
Could you suggest which direction you'd prefer? I'm happy to respin
once we agree on the right integration point.
I'll also fix the multiline comment to follow the net convention:
/* When VHOST_NET_F_VIRTIO_NET_HDR is set, vhost supplies virtio_net_hdr.
* Populate GSO/checksum metadata from the socket skb ...
*/
Thanks,
Weimin
At 2026-07-13 15:03:39, "Michael S. Tsirkin" <mst@redhat.com> wrote:
>On Mon, Jul 13, 2026 at 09:04:42AM +0800, weimin xiong wrote:
>> From: xiongweimin <xiongweimin@kylinos.cn>
>>
>> When VHOST_NET_F_VIRTIO_NET_HDR is set, vhost supplies virtio_net_hdr to
>> the guest but previously always wrote a zeroed header (GSO_NONE). Guests
>> that rely on GUEST_TSO*/GUEST_CSUM therefore never saw offload metadata.
>
>Right. Question is why are you using VHOST_NET_F_VIRTIO_NET_HDR?
>
>>
>> Peek the socket skb before recvmsg and populate the header with
>> virtio_net_hdr_from_skb(). Also advertise the corresponding guest offload
>> feature bits from VHOST_GET_FEATURES.
>>
>> TX TSO toward backends without IFF_VNET_HDR is intentionally left for a
>> follow-up series.
>>
>> Signed-off-by: xiongweimin <xiongweimin@kylinos.cn>
>> Cc: Michael S. Tsirkin <mst@redhat.com>
>> Cc: Jason Wang <jasowang@redhat.com>
>> Cc: virtualization@vger.kernel.org
>> Cc: netdev@vger.kernel.org
>> ---
>>
>> --- a/drivers/vhost/net.c
>> +++ b/drivers/vhost/net.c
>> @@ -73,6 +73,10 @@
>> VHOST_FEATURES,
>> VHOST_NET_F_VIRTIO_NET_HDR,
>> VIRTIO_NET_F_MRG_RXBUF,
>> + VIRTIO_NET_F_GUEST_CSUM,
>> + VIRTIO_NET_F_GUEST_TSO4,
>> + VIRTIO_NET_F_GUEST_TSO6,
>> + VIRTIO_NET_F_GUEST_ECN,
>> VIRTIO_F_ACCESS_PLATFORM,
>> VIRTIO_F_RING_RESET,
>> VIRTIO_F_IN_ORDER,
>> @@ -644,7 +648,7 @@
>> static size_t init_iov_iter(struct vhost_virtqueue *vq, struct iov_iter *iter,
>> size_t hdr_size, int out)
>> {
>> - /* Skip header. TODO: support TSO. */
>> + /* Skip guest virtio_net_hdr; TX TSO handled in a follow-up. */
>> size_t len = iov_length(vq->iov, out);
>>
>> iov_iter_init(iter, ITER_SOURCE, vq->iov, out, len);
>> @@ -1025,6 +1029,35 @@
>> return len;
>> }
>>
>> +/*
>> + * When VHOST_NET_F_VIRTIO_NET_HDR is set, vhost supplies virtio_net_hdr.
>> + * Populate GSO/checksum metadata from the socket skb so guests that
>> + * negotiated GUEST_TSO*/GUEST_CSUM receive correct offload information.
>> + */
>
>this is a wrong type of multiline comment. this file follows net
>convention:
>
>/* AAA
> * BBB
> */
>
>> +static int vhost_net_hdr_from_sock(struct vhost_virtqueue *vq, struct sock *sk,
>> + struct virtio_net_hdr *hdr)
>> +{
>> + struct sk_buff *skb;
>> + unsigned long flags;
>> + int vlan_hlen = 0;
>> + int ret;
>> +
>> + spin_lock_irqsave(&sk->sk_receive_queue.lock, flags);
>> + skb = skb_peek(&sk->sk_receive_queue);
>> + if (!skb) {
>> + spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
>> + memset(hdr, 0, sizeof(*hdr));
>> + hdr->gso_type = VIRTIO_NET_HDR_GSO_NONE;
>> + return 0;
>> + }
>> + if (skb_vlan_tag_present(skb))
>> + vlan_hlen = VLAN_HLEN;
>> + ret = virtio_net_hdr_from_skb(skb, hdr, vhost_is_little_endian(vq),
>> + true, vlan_hlen);
>> + spin_unlock_irqrestore(&sk->sk_receive_queue.lock, flags);
>> + return ret;
>> +}
>
>
>This means the header will be wrong if something consumes
>the skb after we drop the lock, no?
>
>That's why in the end we put the header filling logic
>in tun, it can avoid races there.
>
>
>> +
>> static int vhost_net_rx_peek_head_len(struct vhost_net *net, struct sock *sk,
>> bool *busyloop_intr, unsigned int *count)
>> {
>> @@ -1239,10 +1272,18 @@
>> /* We don't need to be notified again. */
>> iov_iter_init(&msg.msg_iter, ITER_DEST, vq->iov, in, vhost_len);
>> fixup = msg.msg_iter;
>> - if (unlikely((vhost_hlen))) {
>> - /* We will supply the header ourselves
>> - * TODO: support TSO.
>> + if (unlikely(vhost_hlen)) {
>> + /*
>> + * Build virtio_net_hdr from the socket skb before
>> + * recvmsg consumes it. Skip for ptr_ring backends
>> + * where the skb is not on sk_receive_queue.
>> */
>> + if (!nvq->rx_ring &&
>> + vhost_net_hdr_from_sock(vq, sock->sk, &hdr)) {
>> + vq_err(vq, "Failed to build vnet_hdr from skb\n");
>> + vhost_discard_vq_desc(vq, headcount, ndesc);
>> + continue;
>> + }
>> iov_iter_advance(&msg.msg_iter, vhost_hlen);
>> }
>> err = sock->ops->recvmsg(sock, &msg,
>> @@ -1270,7 +1311,6 @@
>> */
>> iov_iter_advance(&fixup, sizeof(hdr));
>> }
>> - /* TODO: Should check and handle checksum. */
>>
>> num_buffers = cpu_to_vhost16(vq, headcount);
>> if (likely(set_num_buffers) &&
^ permalink raw reply
* Re: [PATCH net] net: rnpgbe: Pass an expression directly in rnpgbe_rm_adapter()
From: Dan Carpenter @ 2026-07-13 8:04 UTC (permalink / raw)
To: Markus Elfring
Cc: netdev, Andrew Lunn, David S. Miller, Eric Dumazet,
Jakub Kicinski, MD Danish Anwar, Michael Grzeschik, Paolo Abeni,
Uwe Kleine-König, Vadim Fedorenko, Yibo Dong, LKML,
kernel-janitors
In-Reply-To: <7958e26e-a4f9-48ee-8d79-3797016944c5@web.de>
On Sun, Jul 12, 2026 at 08:35:21PM +0200, Markus Elfring wrote:
> From: Markus Elfring <elfring@users.sourceforge.net>
> Date: Sun, 12 Jul 2026 20:25:10 +0200
>
> The address of a data structure member was determined before
> a corresponding null pointer check in the implementation of
> the function “rnpgbe_rm_adapter”.
>
> Thus avoid the risk for undefined behaviour by omitting the variable “hw”.
> Pass the required address directly to a function call.
>
> This issue was detected by using the Coccinelle software.
>
> Fixes: 2ee95ec17e97c58b65e978a08b75fa8cb6424e4e ("net: rnpgbe: Add register_netdev")
There is no NULL dereference here. It's just pointer math.
No need for a Fixes tag.
regards,
dan carpenter
^ permalink raw reply
* Re: [PATCH] net/sched: act_tunnel_key: Defer dst_release to RCU callback
From: Davide Caratti @ 2026-07-13 8:07 UTC (permalink / raw)
To: Jamal Hadi Salim
Cc: netdev, davem, edumazet, kuba, pabeni, horms, zdi-disclosures,
security, victor, jiri
In-Reply-To: <20260711150537.7946-1-jhs@mojatatu.com>
On Sat, Jul 11, 2026 at 11:05:37AM -0400, Jamal Hadi Salim wrote:
> Fix a race-condition use-after-free in tunnel_key_release_params().
>
> The function releases the metadata_dst of the old params synchronously
> via dst_release() while deferring the params struct free with
> kfree_rcu(). A concurrent tunnel_key_act() reader on the datapath may
> still hold the old params pointer (under rcu_read_lock_bh) and proceed
> to call dst_clone(¶ms->tcft_enc_metadata->dst) after the writer's
> dst_release has already pushed the dst's rcuref to RCUREF_DEAD.
hello Jamal and Victor,
[...]
> Fix by moving dst_release() into a custom RCU callback that runs
> after the grace period, matching the lifetime of the containing
> params struct. Readers in the datapath therefore always find a live
> rcuref when calling dst_clone().
>
> Fixes: 9174c3df1cd18 ("net/sched: act_tunnel_key: fix memory leak in case of action replace")
> Reported-by: zdi-disclosures@trendmicro.com
> Tested-by: Victor Nogueira <victor@mojatatu.com>
> Signed-off-by: Jamal Hadi Salim <jhs@mojatatu.com>
> ---
> net/sched/act_tunnel_key.c | 14 ++++++++++----
> 1 file changed, 10 insertions(+), 4 deletions(-)
Thanks for this patch, LGTM!
Reviewed-by: Davide Caratti <dcaratti@redhat.com>
^ permalink raw reply
* Re: [PATCH net v2] net/mlx5: free mlx5_st_idx_data on final dealloc
From: Leon Romanovsky @ 2026-07-13 8:08 UTC (permalink / raw)
To: Paolo Abeni
Cc: Zhiping Zhang, Jason Gunthorpe, Saeed Mahameed Michael,
Tariq Toukan, Mark Bloch, Michael Guralnik, netdev, linux-rdma,
linux-kernel, stable
In-Reply-To: <9e4e455b-c10b-447e-9fe6-80672f26fd8a@redhat.com>
On Fri, Jul 10, 2026 at 01:25:45PM +0200, Paolo Abeni wrote:
> On 7/3/26 12:24 AM, Zhiping Zhang wrote:
> > Workloads that repeatedly allocate and release mkeys carrying TPH
> > steering-tag hints (e.g. churning RDMA MRs) leak one
> > struct mlx5_st_idx_data per cycle; kmemleak flags it as unreferenced
> > and the kmalloc slab grows over time.
> >
> > When the last reference to an ST table entry is dropped,
> > mlx5_st_dealloc_index() removed the entry from idx_xa but the backing
> > mlx5_st_idx_data allocation was never freed.
> >
> > Free idx_data after the xa_erase() so the lifetime of the bookkeeping
> > struct matches the lifetime of the ST entry it tracks.
> >
> > Cc: stable@vger.kernel.org
> > Fixes: 888a7776f4fb ("net/mlx5: Add support for device steering tag")
> > Reviewed-by: Michael Gur <michaelgur@nvidia.com>
> > Signed-off-by: Zhiping Zhang <zhipingz@meta.com>
> @Leon, @Saeed, @Tariq: just in case this fell under the radar, it's
> waiting for your ack.
Tariq and I completed this on Jul 5 and Jul 6.
https://lore.kernel.org/linux-rdma/20260705141920.GI15188@unreal/
https://lore.kernel.org/linux-rdma/0bb37f75-c94a-4a10-b115-186b71daf14f@nvidia.com/
Thanks
>
> Thanks,
>
> Paolo
>
^ permalink raw reply
* Re: [PATCH net v2 12/16] keys: Add refcounting to user-defined key type payload
From: David Howells @ 2026-07-13 8:09 UTC (permalink / raw)
To: Jarkko Sakkinen
Cc: dhowells, netdev, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, keyrings, stable
In-Reply-To: <alKCl7ZxPIeTyHHD@kernel.org>
Jarkko Sakkinen <jarkko@kernel.org> wrote:
> I get the relaxing part when it comes to RCU read lock but why does it
> carry fixes tag? The commit message does not do a great job on
> explaining this part.
It's the first part of a multipatch fix (it was originally in one patch and I
just duplicated the Fixes). I can remove the Fixes line though - as you point
out, this patch is not technically a fix in itself.
David
^ permalink raw reply
* [PATCH net v3 01/14] rxrpc: Fix sendmsg to not return an error if last packet queued
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Fix AF_RXRPC sendmsg() so that it doesn't return an error if it has
successfully queued the last packet of a call, but the call has seen to
have completed after it did that. Rather, leave it to recvmsg() to report
the completion (which it will do anyway).
The problem with trying to report the error twice is that the caller may
try to clean up the dead call twice.
Fixes: d41b3f5b9688 ("rxrpc: Wrap accesses to get call state to put the barrier in one place")
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
---
net/rxrpc/sendmsg.c | 11 +++++++----
1 file changed, 7 insertions(+), 4 deletions(-)
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index ed2c9a51005a..4c754f78ece9 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -453,9 +453,6 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
success:
ret = copied;
- if (rxrpc_call_is_complete(call) &&
- call->error < 0)
- ret = call->error;
out:
call->tx_pending = txb;
_leave(" = %d", ret);
@@ -467,8 +464,14 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
return call->error;
maybe_error:
- if (copied)
+ if (copied) {
+ if (rxrpc_call_is_complete(call) &&
+ call->error < 0) {
+ ret = call->error;
+ goto out;
+ }
goto success;
+ }
goto out;
efault:
^ permalink raw reply related
* [PATCH net v3 02/14] afs: Fix UAF when sending a message
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
In afs_make_call(), there's a race with async call reception and
destruction. If a call is dispatched that doesn't have call->write_iter
set (used to specify the data content for FS.StoreData), then the first
rxrpc_kernel_send_data() will not set MSG_MORE in the msghdr.
Once rxrpc_send_data() queues the last request packet, the response could
come in at any time and cause the call to be completed and put. However,
afs_make_call() will look at the call again to see it ->write_iter should
be handled - something it's only allowed to do if it has its own ref on the
call. Whilst this is the case for synchronous calls, it isn't true for
async calls such as FS.FetchData.
generic/650 plays games with randomly taking CPUs offline, and can
interject a significant delay such that the call is deallocated before
afs_make_call() gets to check call->write_iter - and a UAF ensues (caught
by KASAN).
BUG: KASAN: slab-use-after-free in afs_make_call+0x1c90/0x2210 [kafs]
Read of size 8 at addr ffff888035e050e8 by task fsstress/1409
Fix this by caching the call->write_iter and call->debug_id so that neither
variable needs to be accessed after the first send.
Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation")
Reported-by: Marc Dionne <marc.dionne@auristor.com>
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
fs/afs/rxrpc.c | 12 ++++++++----
include/trace/events/afs.h | 6 +++---
2 files changed, 11 insertions(+), 7 deletions(-)
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index d82916657a3d..06c711c75f55 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -347,7 +347,9 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
struct rxrpc_call *rxcall;
struct msghdr msg;
struct kvec iov[1];
+ unsigned int debug_id = call->debug_id;
size_t len;
+ bool write_iter = call->write_iter;
s64 tx_total_len;
int ret;
@@ -410,7 +412,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
iov_iter_kvec(&msg.msg_iter, ITER_SOURCE, iov, 1, call->request_size);
msg.msg_control = NULL;
msg.msg_controllen = 0;
- msg.msg_flags = MSG_WAITALL | (call->write_iter ? MSG_MORE : 0);
+ msg.msg_flags = MSG_WAITALL | (write_iter ? MSG_MORE : 0);
ret = rxrpc_kernel_send_data(call->net->socket, rxcall,
&msg, call->request_size,
@@ -418,7 +420,9 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
if (ret < 0)
goto error_do_abort;
- if (call->write_iter) {
+ /* We lost our ref on call if MSG_MORE was not set and ret >= 0. */
+
+ if (write_iter) {
msg.msg_iter = *call->write_iter;
msg.msg_flags &= ~MSG_MORE;
trace_afs_send_data(call, &msg);
@@ -427,9 +431,9 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
call->rxcall, &msg,
iov_iter_count(&msg.msg_iter),
afs_notify_end_request_tx);
- *call->write_iter = msg.msg_iter;
+ /* We lost our ref on call if ret >= 0. */
- trace_afs_sent_data(call, &msg, ret);
+ trace_afs_sent_data(debug_id, &msg, ret);
if (ret < 0)
goto error_do_abort;
}
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index 1b3c48b5591d..cf7218efb861 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -937,9 +937,9 @@ TRACE_EVENT(afs_send_data,
);
TRACE_EVENT(afs_sent_data,
- TP_PROTO(struct afs_call *call, struct msghdr *msg, int ret),
+ TP_PROTO(unsigned int call_debug_id, struct msghdr *msg, int ret),
- TP_ARGS(call, msg, ret),
+ TP_ARGS(call_debug_id, msg, ret),
TP_STRUCT__entry(
__field(unsigned int, call)
@@ -949,7 +949,7 @@ TRACE_EVENT(afs_sent_data,
),
TP_fast_assign(
- __entry->call = call->debug_id;
+ __entry->call = call_debug_id;
__entry->ret = ret;
__entry->offset = msg->msg_iter.xarray_start + msg->msg_iter.iov_offset;
__entry->count = iov_iter_count(&msg->msg_iter);
^ permalink raw reply related
* [PATCH net v3 03/14] afs: Fix afs_fs_fetch_data() to set call->async
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Fix afs_fs_fetch_data() to set call->async on an async operation as does
afs_fs_fetch_data64().
Fixes: eddf51f2bb2c ("afs: Make {Y,}FS.FetchData an asynchronous operation")
Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
fs/afs/fsclient.c | 3 +++
1 file changed, 3 insertions(+)
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index a2ffd60889f8..626e1d37b915 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -477,6 +477,9 @@ void afs_fs_fetch_data(struct afs_operation *op)
if (!call)
return afs_op_nomem(op);
+ if (op->flags & AFS_OPERATION_ASYNC)
+ call->async = true;
+
/* marshall the parameters */
bp = call->request;
bp[0] = htonl(FSFETCHDATA);
^ permalink raw reply related
* [PATCH net v3 04/14] rxrpc: Fix packet encryption error handling
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
In rxrpc_send_data(), if ->secure_packet() returns an error, the code
currently just jumps to out: and returns the error to the app on the
assumption that any error returned by this is automatically fatal for the
call, and may even have corrupted the transmission queue - but leaving it
to userspace to deal with. Nothing stops the application from retrying the
sendmsg(), which will try to encrypt the buffer again, and might succeed
with a corrupt buffer.
Fix rxrpc_send_data() in the following ways:
(1) If -ENOMEM is returned, assume we never got as far as the encryption
and that the operation is retryable. In which case, jump to
maybe_error.
(2) If any other error occurs, set the TX_ERROR flag on the call and
return that error directly; on all subsequent attempts to add data to
the call, return -EIO. The app must then abort the call to get rid of
it (this allows the app to choose the abort code to use).
Fixes: 17926a79320a ("[AF_RXRPC]: Provide secure RxRPC sockets for use by userspace and kernel both")
Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
include/trace/events/rxrpc.h | 1 +
net/rxrpc/ar-internal.h | 1 +
net/rxrpc/sendmsg.c | 25 ++++++++++++++++++++-----
3 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/include/trace/events/rxrpc.h b/include/trace/events/rxrpc.h
index 704a10de6670..8f3e3967885a 100644
--- a/include/trace/events/rxrpc.h
+++ b/include/trace/events/rxrpc.h
@@ -148,6 +148,7 @@
EM(rxrpc_eproto_wrong_security, "wrong-sec") \
EM(rxrpc_recvmsg_excess_data, "recvmsg-excess") \
EM(rxrpc_recvmsg_short_data, "recvmsg-short") \
+ EM(rxrpc_sendmsg_tx_error, "tx-error") \
E_(rxrpc_sendmsg_late_send, "sendmsg-late")
#define rxrpc_call_poke_traces \
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index ce946b0a03e2..b6e7e8c5e96f 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -642,6 +642,7 @@ enum rxrpc_call_flag {
RXRPC_CALL_TX_LAST, /* Last packet in Tx buffer (at rxtx_top) */
RXRPC_CALL_TX_ALL_ACKED, /* Last packet has been hard-acked */
RXRPC_CALL_TX_NO_MORE, /* No more data to transmit (MSG_MORE deasserted) */
+ RXRPC_CALL_TX_ERROR, /* Terminal error; call needs abort */
RXRPC_CALL_SEND_PING, /* A ping will need to be sent */
RXRPC_CALL_RETRANS_TIMEOUT, /* Retransmission due to timeout occurred */
RXRPC_CALL_BEGAN_RX_TIMER, /* We began the expect_rx_by timer */
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 4c754f78ece9..d5060fd9631a 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -330,12 +330,18 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
bool more = msg->msg_flags & MSG_MORE;
int ret, copied = 0;
- if (test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags)) {
+ if (unlikely(test_bit(RXRPC_CALL_TX_NO_MORE, &call->flags))) {
trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send,
call->cid, call->call_id, call->rx_consumed,
0, -EPROTO);
return -EPROTO;
}
+ if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) {
+ trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error,
+ call->cid, call->call_id, call->rx_consumed,
+ 0, -EIO);
+ return -EIO;
+ }
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
@@ -440,12 +446,21 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
/* add the packet to the send queue if it's now full */
if (!txb->space ||
(msg_data_left(msg) == 0 && !more)) {
- if (msg_data_left(msg) == 0 && !more)
- txb->flags |= RXRPC_LAST_PACKET;
-
+ /* Do any required crypto. If this fails, it could
+ * have corrupted the txbuf content with a partial
+ * encrypt. Assume that ENOMEM is retryable, but
+ * everything else is terminal.
+ */
ret = call->security->secure_packet(call, txb);
- if (ret < 0)
+ if (ret < 0) {
+ if (ret == -ENOMEM)
+ goto maybe_error;
+ set_bit(RXRPC_CALL_TX_ERROR, &call->flags);
goto out;
+ }
+
+ if (msg_data_left(msg) == 0 && !more)
+ txb->flags |= RXRPC_LAST_PACKET;
rxrpc_queue_packet(rx, call, txb, notify_end_tx);
txb = NULL;
}
^ permalink raw reply related
* [PATCH net v3 05/14] rxrpc: Fix update of call->tx_pending without holding lock
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Currently, rxrpc_send_data() updates call->tx_pending just before it
returns - but it won't be holding the call->lock when it does this if a
wait was interrupted by a signal. This would allow a parallel sendmsg() to
race.
Further, both the callers of rxrpc_send_data() call it with the lock held,
and then it returns an indication through the parameter list to say whether
it has dropped the lock or not - after which the callers both just drop the
lock if it's still held.
Fix this by:
(1) Moving the release of call->lock down into rxrpc_send_data() and get
rid of the indicator parameter. This makes it easier to see where the
lock is held.
(2) Make the wait_for_space path move the value in txb back into
call->tx_pending before dropping the lock prior to the wait.
(3) After waiting, if the attempt to reacquire the mutex is interrupted,
just return directly there rather than going to out_unlock
Fixes: b0f571ecd794 ("rxrpc: Fix locking in rxrpc's sendmsg")
Closes: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
net/rxrpc/sendmsg.c | 52 +++++++++++++++++++++++++--------------------
1 file changed, 29 insertions(+), 23 deletions(-)
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index d5060fd9631a..71343998b87d 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -320,8 +320,8 @@ static int rxrpc_alloc_txqueue(struct sock *sk, struct rxrpc_call *call)
static int rxrpc_send_data(struct rxrpc_sock *rx,
struct rxrpc_call *call,
struct msghdr *msg, size_t len,
- rxrpc_notify_end_tx_t notify_end_tx,
- bool *_dropped_lock)
+ rxrpc_notify_end_tx_t notify_end_tx)
+ __releases(&call->user_mutex)
{
struct rxrpc_txbuf *txb;
struct sock *sk = &rx->sk;
@@ -334,25 +334,27 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_late_send,
call->cid, call->call_id, call->rx_consumed,
0, -EPROTO);
- return -EPROTO;
+ ret = -EPROTO;
+ goto out_unlock;
}
if (unlikely(test_bit(RXRPC_CALL_TX_ERROR, &call->flags))) {
trace_rxrpc_abort(call->debug_id, rxrpc_sendmsg_tx_error,
call->cid, call->call_id, call->rx_consumed,
0, -EIO);
- return -EIO;
+ ret = -EIO;
+ goto out_unlock;
}
timeo = sock_sndtimeo(sk, msg->msg_flags & MSG_DONTWAIT);
ret = rxrpc_wait_to_be_connected(call, &timeo);
if (ret < 0)
- return ret;
+ goto out_unlock;
if (call->conn->state == RXRPC_CONN_CLIENT_UNSECURED) {
ret = rxrpc_init_client_conn_security(call->conn);
if (ret < 0)
- return ret;
+ goto out_unlock;
}
/* this should be in poll */
@@ -456,7 +458,7 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
if (ret == -ENOMEM)
goto maybe_error;
set_bit(RXRPC_CALL_TX_ERROR, &call->flags);
- goto out;
+ goto out_txb;
}
if (msg_data_left(msg) == 0 && !more)
@@ -468,51 +470,58 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
success:
ret = copied;
-out:
+out_txb:
call->tx_pending = txb;
+out_unlock:
+ mutex_unlock(&call->user_mutex);
_leave(" = %d", ret);
return ret;
call_terminated:
rxrpc_put_txbuf(txb, rxrpc_txbuf_put_send_aborted);
- _leave(" = %d", call->error);
- return call->error;
+ call->tx_pending = NULL;
+ ret = call->error;
+ goto out_unlock;
maybe_error:
if (copied) {
if (rxrpc_call_is_complete(call) &&
call->error < 0) {
ret = call->error;
- goto out;
+ goto out_unlock;
}
goto success;
}
- goto out;
+ goto out_txb;
efault:
ret = -EFAULT;
- goto out;
+ goto out_txb;
wait_for_space:
ret = -EAGAIN;
if (msg->msg_flags & MSG_DONTWAIT)
goto maybe_error;
+ call->tx_pending = txb;
+ txb = NULL;
mutex_unlock(&call->user_mutex);
- *_dropped_lock = true;
+
ret = rxrpc_wait_for_tx_window(rx, call, &timeo,
msg->msg_flags & MSG_WAITALL);
if (ret < 0)
- goto maybe_error;
+ goto out_nolock;
if (call->interruptibility == RXRPC_INTERRUPTIBLE) {
if (mutex_lock_interruptible(&call->user_mutex) < 0) {
ret = sock_intr_errno(timeo);
- goto maybe_error;
+ goto out_nolock;
}
} else {
mutex_lock(&call->user_mutex);
}
- *_dropped_lock = false;
goto reload;
+out_nolock:
+ _leave(" = %d [intr]", ret);
+ return copied ?: ret;
}
/*
@@ -787,8 +796,8 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
ret = 0;
break;
case RXRPC_CMD_SEND_DATA:
- ret = rxrpc_send_data(rx, call, msg, len, NULL, &dropped_lock);
- break;
+ ret = rxrpc_send_data(rx, call, msg, len, NULL);
+ goto error_put;
default:
ret = -EINVAL;
break;
@@ -826,7 +835,6 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
struct msghdr *msg, size_t len,
rxrpc_notify_end_tx_t notify_end_tx)
{
- bool dropped_lock = false;
int ret;
_enter("{%d},", call->debug_id);
@@ -837,12 +845,10 @@ int rxrpc_kernel_send_data(struct socket *sock, struct rxrpc_call *call,
mutex_lock(&call->user_mutex);
ret = rxrpc_send_data(rxrpc_sk(sock->sk), call, msg, len,
- notify_end_tx, &dropped_lock);
+ notify_end_tx);
if (ret == -ESHUTDOWN)
ret = call->error;
- if (!dropped_lock)
- mutex_unlock(&call->user_mutex);
_leave(" = %d", ret);
return ret;
}
^ permalink raw reply related
* [PATCH net v3 07/14] afs: Simplify call refcounting
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Simplify afs_call refcounting so that a queued work item doesn't hold a ref
on the call. Rather, for async calls, put the retaining ref when the call
completes. For synchronous calls, the caller of afs_make_call() holds its
own ref. This means that queuing a call's async work doesn't require a ref
to be taken first on a call - and then there's no need to try and revert
the ref taken from the context of the rxrpc I/O thread if the call is
already queued.
Further, the AFS cache manager server RPC handler functions (SRXAFSCB_*)
are then called directly from afs_deliver_to_call() rather then being
dispatched to a different workqueue. With that, call->work is changed to
a function pointer.
Also, there is no longer a need to keep an extra ref on an async call and
call->drop_ref can be removed.
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
---
fs/afs/cmservice.c | 33 ++++++------------
fs/afs/file.c | 10 +++---
fs/afs/internal.h | 18 ++--------
fs/afs/rxrpc.c | 69 +++++++++++---------------------------
include/trace/events/afs.h | 1 +
5 files changed, 39 insertions(+), 92 deletions(-)
diff --git a/fs/afs/cmservice.c b/fs/afs/cmservice.c
index db394f101fc6..32120bc1dcb0 100644
--- a/fs/afs/cmservice.c
+++ b/fs/afs/cmservice.c
@@ -23,11 +23,11 @@ static int afs_deliver_cb_callback(struct afs_call *);
static int afs_deliver_cb_probe_uuid(struct afs_call *);
static int afs_deliver_cb_tell_me_about_yourself(struct afs_call *);
static void afs_cm_destructor(struct afs_call *);
-static void SRXAFSCB_CallBack(struct work_struct *);
-static void SRXAFSCB_InitCallBackState(struct work_struct *);
-static void SRXAFSCB_Probe(struct work_struct *);
-static void SRXAFSCB_ProbeUuid(struct work_struct *);
-static void SRXAFSCB_TellMeAboutYourself(struct work_struct *);
+static void SRXAFSCB_CallBack(struct afs_call *call);
+static void SRXAFSCB_InitCallBackState(struct afs_call *call);
+static void SRXAFSCB_Probe(struct afs_call *call);
+static void SRXAFSCB_ProbeUuid(struct afs_call *call);
+static void SRXAFSCB_TellMeAboutYourself(struct afs_call *call);
static int afs_deliver_yfs_cb_callback(struct afs_call *);
@@ -161,10 +161,8 @@ static void afs_abort_service_call(struct afs_call *call, u32 abort_code, int er
/*
* The server supplied a list of callbacks that it wanted to break.
*/
-static void SRXAFSCB_CallBack(struct work_struct *work)
+static void SRXAFSCB_CallBack(struct afs_call *call)
{
- struct afs_call *call = container_of(work, struct afs_call, work);
-
_enter("");
/* We need to break the callbacks before sending the reply as the
@@ -180,7 +178,6 @@ static void SRXAFSCB_CallBack(struct work_struct *work)
}
afs_send_empty_reply(call);
- afs_put_call(call);
_leave("");
}
@@ -284,16 +281,13 @@ static int afs_deliver_cb_callback(struct afs_call *call)
/*
* allow the fileserver to request callback state (re-)initialisation
*/
-static void SRXAFSCB_InitCallBackState(struct work_struct *work)
+static void SRXAFSCB_InitCallBackState(struct afs_call *call)
{
- struct afs_call *call = container_of(work, struct afs_call, work);
-
_enter("{%p}", call->server);
if (call->server)
afs_init_callback_state(call->server);
afs_send_empty_reply(call);
- afs_put_call(call);
_leave("");
}
@@ -380,13 +374,10 @@ static int afs_deliver_cb_init_call_back_state3(struct afs_call *call)
/*
* allow the fileserver to see if the cache manager is still alive
*/
-static void SRXAFSCB_Probe(struct work_struct *work)
+static void SRXAFSCB_Probe(struct afs_call *call)
{
- struct afs_call *call = container_of(work, struct afs_call, work);
-
_enter("");
afs_send_empty_reply(call);
- afs_put_call(call);
_leave("");
}
@@ -413,9 +404,8 @@ static int afs_deliver_cb_probe(struct afs_call *call)
* Allow the fileserver to quickly find out if the cache manager has been
* rebooted.
*/
-static void SRXAFSCB_ProbeUuid(struct work_struct *work)
+static void SRXAFSCB_ProbeUuid(struct afs_call *call)
{
- struct afs_call *call = container_of(work, struct afs_call, work);
struct afs_uuid *r = call->request;
_enter("");
@@ -425,7 +415,6 @@ static void SRXAFSCB_ProbeUuid(struct work_struct *work)
else
afs_abort_service_call(call, 1, 1, afs_abort_probeuuid_negative);
- afs_put_call(call);
_leave("");
}
@@ -489,9 +478,8 @@ static int afs_deliver_cb_probe_uuid(struct afs_call *call)
/*
* allow the fileserver to ask about the cache manager's capabilities
*/
-static void SRXAFSCB_TellMeAboutYourself(struct work_struct *work)
+static void SRXAFSCB_TellMeAboutYourself(struct afs_call *call)
{
- struct afs_call *call = container_of(work, struct afs_call, work);
int loop;
struct {
@@ -523,7 +511,6 @@ static void SRXAFSCB_TellMeAboutYourself(struct work_struct *work)
reply.cap.capcount = htonl(1);
reply.cap.caps[0] = htonl(AFS_CAP_ERROR_TRANSLATION);
afs_send_simple_reply(call, &reply, sizeof(reply));
- afs_put_call(call);
_leave("");
}
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 0467742bfeee..35d68f7f498d 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -316,15 +316,17 @@ void afs_fetch_data_async_rx(struct work_struct *work)
struct afs_call *call = container_of(work, struct afs_call, async_work);
afs_read_receive(call);
- afs_put_call(call);
+
+ if (call->state == AFS_CALL_COMPLETE) {
+ cancel_work(&call->async_work);
+ afs_put_call(call);
+ }
}
void afs_fetch_data_immediate_cancel(struct afs_call *call)
{
if (call->async) {
- afs_get_call(call, afs_call_trace_wake);
- if (!queue_work(afs_async_calls, &call->async_work))
- afs_deferred_put_call(call);
+ queue_work(afs_async_calls, &call->async_work);
flush_work(&call->async_work);
}
}
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 601f01e5c15f..e55363f1d5ab 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -129,7 +129,7 @@ struct afs_call {
const struct afs_call_type *type; /* type of call */
wait_queue_head_t waitq; /* processes awaiting completion */
struct work_struct async_work; /* async I/O processor */
- struct work_struct work; /* actual work processor */
+ void (*work)(struct afs_call *call); /* Worker function */
struct work_struct free_work; /* Deferred free processor */
struct rxrpc_call *rxcall; /* RxRPC call handle */
struct rxrpc_peer *peer; /* Remote endpoint */
@@ -169,7 +169,6 @@ struct afs_call {
unsigned reply_max; /* maximum size of reply */
unsigned count2; /* count used in unmarshalling */
unsigned char unmarshall; /* unmarshalling phase */
- bool drop_ref; /* T if need to drop ref for incoming call */
bool need_attention; /* T if RxRPC poked us */
bool async; /* T if asynchronous */
bool upgrade; /* T to request service upgrade */
@@ -208,7 +207,7 @@ struct afs_call_type {
void (*async_rx)(struct work_struct *work);
/* Work function */
- void (*work)(struct work_struct *work);
+ void (*work)(struct afs_call *call);
/* Call done function (gets called immediately on success or failure) */
void (*done)(struct afs_call *call);
@@ -1381,7 +1380,6 @@ extern int __net_init afs_open_socket(struct afs_net *);
extern void __net_exit afs_close_socket(struct afs_net *);
extern void afs_charge_preallocation(struct work_struct *);
extern void afs_put_call(struct afs_call *);
-void afs_deferred_put_call(struct afs_call *call);
void afs_make_call(struct afs_call *call, gfp_t gfp);
void afs_deliver_to_call(struct afs_call *call);
void afs_wait_for_call_to_complete(struct afs_call *call);
@@ -1494,7 +1492,6 @@ static inline void afs_set_call_complete(struct afs_call *call,
int error, u32 remote_abort)
{
enum afs_call_state state;
- bool ok = false;
spin_lock_bh(&call->state_lock);
state = call->state;
@@ -1504,19 +1501,8 @@ static inline void afs_set_call_complete(struct afs_call *call,
call->state = AFS_CALL_COMPLETE;
trace_afs_call_state(call, state, AFS_CALL_COMPLETE,
error, remote_abort);
- ok = true;
}
spin_unlock_bh(&call->state_lock);
- if (ok) {
- trace_afs_call_done(call);
-
- /* Asynchronous calls have two refs to release - one from the alloc and
- * one queued with the work item - and we can't just deallocate the
- * call because the work item may be queued again.
- */
- if (call->drop_ref)
- afs_put_call(call);
- }
}
/*
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 06c711c75f55..a404b6f0cc7c 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -177,7 +177,6 @@ static struct afs_call *afs_alloc_call(struct afs_net *net,
call->debug_id = atomic_inc_return(&rxrpc_debug_id);
refcount_set(&call->ref, 1);
INIT_WORK(&call->async_work, type->async_rx ?: afs_process_async_call);
- INIT_WORK(&call->work, call->type->work);
INIT_WORK(&call->free_work, afs_deferred_free_worker);
init_waitqueue_head(&call->waitq);
spin_lock_init(&call->state_lock);
@@ -244,37 +243,6 @@ static void afs_deferred_free_worker(struct work_struct *work)
afs_free_call(call);
}
-/*
- * Dispose of a reference on a call, deferring the cleanup to a workqueue
- * to avoid lock recursion.
- */
-void afs_deferred_put_call(struct afs_call *call)
-{
- struct afs_net *net = call->net;
- unsigned int debug_id = call->debug_id;
- bool zero;
- int r, o;
-
- zero = __refcount_dec_and_test(&call->ref, &r);
- o = atomic_read(&net->nr_outstanding_calls);
- trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
- __builtin_return_address(0));
- if (zero)
- schedule_work(&call->free_work);
-}
-
-/*
- * Queue the call for actual work.
- */
-static void afs_queue_call_work(struct afs_call *call)
-{
- if (call->type->work) {
- afs_get_call(call, afs_call_trace_work);
- if (!queue_work(afs_wq, &call->work))
- afs_put_call(call);
- }
-}
-
/*
* allocate a call with flat request and reply buffers
*/
@@ -375,10 +343,8 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
/* If the call is going to be asynchronous, we need an extra ref for
* the call to hold itself so the caller need not hang on to its ref.
*/
- if (call->async) {
+ if (call->async)
afs_get_call(call, afs_call_trace_get);
- call->drop_ref = true;
- }
/* create a call */
rxcall = rxrpc_kernel_begin_call(call->net->socket, call->peer, call->key,
@@ -479,8 +445,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
if (call->rxcall)
rxrpc_kernel_shutdown_call(call->net->socket, call->rxcall);
if (call->async) {
- if (cancel_work_sync(&call->async_work))
- afs_put_call(call);
+ cancel_work_sync(&call->async_work);
afs_set_call_complete(call, ret, 0);
}
@@ -566,7 +531,8 @@ void afs_deliver_to_call(struct afs_call *call)
switch (ret) {
case 0:
call->responded = true;
- afs_queue_call_work(call);
+ if (call->work)
+ call->work(call);
if (state == AFS_CALL_CL_PROC_REPLY) {
if (call->op)
set_bit(AFS_SERVER_FL_MAY_HAVE_CB,
@@ -616,6 +582,7 @@ void afs_deliver_to_call(struct afs_call *call)
}
done:
+ trace_afs_call_done(call);
if (call->type->done)
call->type->done(call);
out:
@@ -704,19 +671,16 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
unsigned long call_user_ID)
{
struct afs_call *call = (struct afs_call *)call_user_ID;
- int r;
trace_afs_notify_call(rxcall, call);
call->need_attention = true;
- if (__refcount_inc_not_zero(&call->ref, &r)) {
- trace_afs_call(call->debug_id, afs_call_trace_wake, r + 1,
- atomic_read(&call->net->nr_outstanding_calls),
- __builtin_return_address(0));
+ trace_afs_call(call->debug_id, afs_call_trace_wake,
+ refcount_read(&call->ref),
+ atomic_read(&call->net->nr_outstanding_calls),
+ __builtin_return_address(0));
- if (!queue_work(afs_async_calls, &call->async_work))
- afs_deferred_put_call(call);
- }
+ queue_work(afs_async_calls, &call->async_work);
}
/*
@@ -729,12 +693,20 @@ static void afs_process_async_call(struct work_struct *work)
_enter("");
+ trace_afs_call(call->debug_id, afs_call_trace_async_process,
+ refcount_read(&call->ref),
+ atomic_read(&call->net->nr_outstanding_calls),
+ __builtin_return_address(0));
+
if (call->state < AFS_CALL_COMPLETE && call->need_attention) {
call->need_attention = false;
afs_deliver_to_call(call);
}
- afs_put_call(call);
+ if (call->state == AFS_CALL_COMPLETE) {
+ cancel_work(&call->async_work);
+ afs_put_call(call);
+ }
_leave("");
}
@@ -760,7 +732,6 @@ void afs_charge_preallocation(struct work_struct *work)
if (!call)
break;
- call->drop_ref = true;
call->async = true;
call->state = AFS_CALL_SV_AWAIT_OP_ID;
init_waitqueue_head(&call->waitq);
@@ -836,7 +807,7 @@ static int afs_deliver_cm_op_id(struct afs_call *call)
&call->enctype);
trace_afs_cb_call(call);
- call->work.func = call->type->work;
+ call->work = call->type->work;
/* pass responsibility for the remainder of this message off to the
* cache manager op */
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index cf7218efb861..4f18a2a5b9f6 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -123,6 +123,7 @@ enum yfs_cm_operation {
EM(afs_call_trace_alloc, "ALLOC") \
EM(afs_call_trace_async_abort, "ASYAB") \
EM(afs_call_trace_async_kill, "ASYKL") \
+ EM(afs_call_trace_async_process, "ASYPR") \
EM(afs_call_trace_free, "FREE ") \
EM(afs_call_trace_get, "GET ") \
EM(afs_call_trace_put, "PUT ") \
^ permalink raw reply related
* [PATCH net v3 08/14] afs: Make afs_put_call() take trace argument
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Make afs_put_call() take trace argument to display in the afs_call trace
line and stop showing the function return address (which isn't unique due
to inlining and tail-calling).
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
---
fs/afs/file.c | 4 ++--
fs/afs/fs_operation.c | 2 +-
fs/afs/fsclient.c | 4 ++--
fs/afs/internal.h | 8 +++-----
fs/afs/rxrpc.c | 39 ++++++++++++++------------------------
fs/afs/vl_probe.c | 2 +-
fs/afs/vlclient.c | 8 ++++----
include/trace/events/afs.h | 38 +++++++++++++++++++++----------------
8 files changed, 49 insertions(+), 56 deletions(-)
diff --git a/fs/afs/file.c b/fs/afs/file.c
index 35d68f7f498d..625dc67f79f3 100644
--- a/fs/afs/file.c
+++ b/fs/afs/file.c
@@ -298,7 +298,7 @@ static void afs_read_receive(struct afs_call *call)
op->call_responded = call->responded;
op->call = NULL;
call->op = NULL;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_read_op);
/* If the call failed, then we need to crank the server rotation
* handle and try the next.
@@ -319,7 +319,7 @@ void afs_fetch_data_async_rx(struct work_struct *work)
if (call->state == AFS_CALL_COMPLETE) {
cancel_work(&call->async_work);
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_read_complete);
}
}
diff --git a/fs/afs/fs_operation.c b/fs/afs/fs_operation.c
index 20801b29521d..b887047398b9 100644
--- a/fs/afs/fs_operation.c
+++ b/fs/afs/fs_operation.c
@@ -296,7 +296,7 @@ void afs_wait_for_operation(struct afs_operation *op)
op->call_abort_code = op->call->abort_code;
op->call_error = op->call->error;
op->call_responded = op->call->responded;
- afs_put_call(op->call);
+ afs_put_call(op->call, afs_call_trace_put_wait_op);
}
}
diff --git a/fs/afs/fsclient.c b/fs/afs/fsclient.c
index 626e1d37b915..9acad5017fba 100644
--- a/fs/afs/fsclient.c
+++ b/fs/afs/fsclient.c
@@ -1662,7 +1662,7 @@ int afs_fs_give_up_all_callbacks(struct afs_net *net, struct afs_server *server,
ret = call->error;
if (call->responded)
set_bit(AFS_SERVER_FL_RESPONDING, &server->flags);
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_giveupcallbacks);
return ret;
}
@@ -1778,7 +1778,7 @@ bool afs_fs_get_capabilities(struct afs_net *net, struct afs_server *server,
trace_afs_make_fs_call(call, NULL);
afs_make_call(call, GFP_NOFS);
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_get_capabilities);
return true;
}
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index e55363f1d5ab..4901d0acbe14 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1379,7 +1379,7 @@ extern struct workqueue_struct *afs_async_calls;
extern int __net_init afs_open_socket(struct afs_net *);
extern void __net_exit afs_close_socket(struct afs_net *);
extern void afs_charge_preallocation(struct work_struct *);
-extern void afs_put_call(struct afs_call *);
+void afs_put_call(struct afs_call *call, enum afs_call_trace trace);
void afs_make_call(struct afs_call *call, gfp_t gfp);
void afs_deliver_to_call(struct afs_call *call);
void afs_wait_for_call_to_complete(struct afs_call *call);
@@ -1400,8 +1400,7 @@ static inline struct afs_call *afs_get_call(struct afs_call *call,
__refcount_inc(&call->ref, &r);
trace_afs_call(call->debug_id, why, r + 1,
- atomic_read(&call->net->nr_outstanding_calls),
- __builtin_return_address(0));
+ atomic_read(&call->net->nr_outstanding_calls));
return call;
}
@@ -1410,8 +1409,7 @@ static inline void afs_see_call(struct afs_call *call, enum afs_call_trace why)
int r = refcount_read(&call->ref);
trace_afs_call(call->debug_id, why, r,
- atomic_read(&call->net->nr_outstanding_calls),
- __builtin_return_address(0));
+ atomic_read(&call->net->nr_outstanding_calls));
}
static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call,
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index a404b6f0cc7c..a1b9ced4e0f4 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -138,7 +138,7 @@ void afs_close_socket(struct afs_net *net)
cancel_work_sync(&net->charge_preallocation_work);
if (net->spare_incoming_call) {
- afs_put_call(net->spare_incoming_call);
+ afs_put_call(net->spare_incoming_call, afs_call_trace_put_spare_svc);
net->spare_incoming_call = NULL;
}
@@ -183,14 +183,14 @@ static struct afs_call *afs_alloc_call(struct afs_net *net,
call->iter = &call->def_iter;
o = atomic_inc_return(&net->nr_outstanding_calls);
- trace_afs_call(call->debug_id, afs_call_trace_alloc, 1, o,
- __builtin_return_address(0));
+ trace_afs_call(call->debug_id, afs_call_trace_alloc, 1, o);
return call;
}
static void afs_free_call(struct afs_call *call)
{
struct afs_net *net = call->net;
+ unsigned int debug_id = call->debug_id;
int o;
ASSERT(!work_pending(&call->async_work));
@@ -207,13 +207,10 @@ static void afs_free_call(struct afs_call *call)
afs_unuse_server_notime(call->net, call->server, afs_server_trace_unuse_call);
kfree(call->request);
-
- o = atomic_read(&net->nr_outstanding_calls);
- trace_afs_call(call->debug_id, afs_call_trace_free, 0, o,
- __builtin_return_address(0));
kfree(call);
o = atomic_dec_return(&net->nr_outstanding_calls);
+ trace_afs_call(debug_id, afs_call_trace_free, 0, o);
if (o == 0)
wake_up_var(&net->nr_outstanding_calls);
}
@@ -221,7 +218,7 @@ static void afs_free_call(struct afs_call *call)
/*
* Dispose of a reference on a call.
*/
-void afs_put_call(struct afs_call *call)
+void afs_put_call(struct afs_call *call, enum afs_call_trace trace)
{
struct afs_net *net = call->net;
unsigned int debug_id = call->debug_id;
@@ -230,8 +227,7 @@ void afs_put_call(struct afs_call *call)
zero = __refcount_dec_and_test(&call->ref, &r);
o = atomic_read(&net->nr_outstanding_calls);
- trace_afs_call(debug_id, afs_call_trace_put, r - 1, o,
- __builtin_return_address(0));
+ trace_afs_call(debug_id, trace, r - 1, o);
if (zero)
afs_free_call(call);
}
@@ -276,7 +272,7 @@ struct afs_call *afs_alloc_flat_call(struct afs_net *net,
return call;
nomem_free:
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_oom);
nomem_call:
return NULL;
}
@@ -344,7 +340,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
* the call to hold itself so the caller need not hang on to its ref.
*/
if (call->async)
- afs_get_call(call, afs_call_trace_get);
+ afs_get_call(call, afs_call_trace_get_make_async_call);
/* create a call */
rxcall = rxrpc_kernel_begin_call(call->net->socket, call->peer, call->key,
@@ -418,7 +414,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
RX_USER_ABORT, ret,
afs_abort_send_data_error);
if (call->async) {
- afs_see_call(call, afs_call_trace_async_abort);
+ afs_see_call(call, afs_call_trace_see_async_abort);
return;
}
@@ -434,7 +430,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
trace_afs_call_done(call);
error_kill_call:
if (call->async)
- afs_see_call(call, afs_call_trace_async_kill);
+ afs_see_call(call, afs_call_trace_see_async_kill);
if (call->type->immediate_cancel)
call->type->immediate_cancel(call);
@@ -675,11 +671,7 @@ static void afs_wake_up_async_call(struct sock *sk, struct rxrpc_call *rxcall,
trace_afs_notify_call(rxcall, call);
call->need_attention = true;
- trace_afs_call(call->debug_id, afs_call_trace_wake,
- refcount_read(&call->ref),
- atomic_read(&call->net->nr_outstanding_calls),
- __builtin_return_address(0));
-
+ afs_see_call(call, afs_call_trace_see_async_wake);
queue_work(afs_async_calls, &call->async_work);
}
@@ -693,10 +685,7 @@ static void afs_process_async_call(struct work_struct *work)
_enter("");
- trace_afs_call(call->debug_id, afs_call_trace_async_process,
- refcount_read(&call->ref),
- atomic_read(&call->net->nr_outstanding_calls),
- __builtin_return_address(0));
+ afs_see_call(call, afs_call_trace_see_async_process);
if (call->state < AFS_CALL_COMPLETE && call->need_attention) {
call->need_attention = false;
@@ -705,7 +694,7 @@ static void afs_process_async_call(struct work_struct *work)
if (call->state == AFS_CALL_COMPLETE) {
cancel_work(&call->async_work);
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_async_complete);
}
_leave("");
}
@@ -758,7 +747,7 @@ static void afs_rx_discard_new_call(struct rxrpc_call *rxcall,
struct afs_call *call = (struct afs_call *)user_call_ID;
call->rxcall = NULL;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_discard_prealloc);
}
/*
diff --git a/fs/afs/vl_probe.c b/fs/afs/vl_probe.c
index 3d2e0c925460..1d70887c9f31 100644
--- a/fs/afs/vl_probe.c
+++ b/fs/afs/vl_probe.c
@@ -186,7 +186,7 @@ static bool afs_do_probe_vlserver(struct afs_net *net,
server_index);
if (!IS_ERR(call)) {
afs_prioritise_error(_e, call->error, call->abort_code);
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_vl_get_caps);
in_progress = true;
} else {
afs_prioritise_error(_e, PTR_ERR(call), 0);
diff --git a/fs/afs/vlclient.c b/fs/afs/vlclient.c
index a40b43464cfa..8a4c8c9a1e39 100644
--- a/fs/afs/vlclient.c
+++ b/fs/afs/vlclient.c
@@ -153,7 +153,7 @@ struct afs_vldb_entry *afs_vl_get_entry_by_name_u(struct afs_vl_cursor *vc,
vc->call_abort_code = call->abort_code;
vc->call_error = call->error;
vc->call_responded = call->responded;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_vl_call);
if (vc->call_error) {
kfree(entry);
return ERR_PTR(vc->call_error);
@@ -303,7 +303,7 @@ struct afs_addr_list *afs_vl_get_addrs_u(struct afs_vl_cursor *vc,
vc->call_error = call->error;
vc->call_responded = call->responded;
alist = call->ret_alist;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_vl_call);
if (vc->call_error) {
afs_put_addrlist(alist, afs_alist_trace_put_getaddru);
return ERR_PTR(vc->call_error);
@@ -666,7 +666,7 @@ struct afs_addr_list *afs_yfsvl_get_endpoints(struct afs_vl_cursor *vc,
vc->call_error = call->error;
vc->call_responded = call->responded;
alist = call->ret_alist;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_vl_call);
if (vc->call_error) {
afs_put_addrlist(alist, afs_alist_trace_put_getaddru);
return ERR_PTR(vc->call_error);
@@ -784,7 +784,7 @@ char *afs_yfsvl_get_cell_name(struct afs_vl_cursor *vc)
vc->call_error = call->error;
vc->call_responded = call->responded;
cellname = call->ret_str;
- afs_put_call(call);
+ afs_put_call(call, afs_call_trace_put_vl_call);
if (vc->call_error) {
kfree(cellname);
return ERR_PTR(vc->call_error);
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index 4f18a2a5b9f6..df397c11df85 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -120,15 +120,24 @@ enum yfs_cm_operation {
* Declare tracing information enums and their string mappings for display.
*/
#define afs_call_traces \
- EM(afs_call_trace_alloc, "ALLOC") \
- EM(afs_call_trace_async_abort, "ASYAB") \
- EM(afs_call_trace_async_kill, "ASYKL") \
- EM(afs_call_trace_async_process, "ASYPR") \
- EM(afs_call_trace_free, "FREE ") \
- EM(afs_call_trace_get, "GET ") \
- EM(afs_call_trace_put, "PUT ") \
- EM(afs_call_trace_wake, "WAKE ") \
- E_(afs_call_trace_work, "QUEUE")
+ EM(afs_call_trace_alloc, "ALLOC ") \
+ EM(afs_call_trace_free, "FREE ") \
+ EM(afs_call_trace_get_make_async_call, "GET a-make ") \
+ EM(afs_call_trace_put_async_complete, "PUT a-cmpl ") \
+ EM(afs_call_trace_put_discard_prealloc, "PUT dis-pre") \
+ EM(afs_call_trace_put_get_capabilities, "PUT get-cap") \
+ EM(afs_call_trace_put_giveupcallbacks, "PUT gvup-cb") \
+ EM(afs_call_trace_put_oom, "PUT oom ") \
+ EM(afs_call_trace_put_read_complete, "PUT rd-cpl ") \
+ EM(afs_call_trace_put_read_op, "PUT rd-op ") \
+ EM(afs_call_trace_put_spare_svc, "PUT spare-s") \
+ EM(afs_call_trace_put_vl_call, "PUT vl-call") \
+ EM(afs_call_trace_put_vl_get_caps, "PUT vl-gcap") \
+ EM(afs_call_trace_put_wait_op, "PUT wt-op ") \
+ EM(afs_call_trace_see_async_abort, "SEE a-abort") \
+ EM(afs_call_trace_see_async_kill, "SEE a-kill ") \
+ EM(afs_call_trace_see_async_process, "SEE a-proc ") \
+ E_(afs_call_trace_see_async_wake, "SEE a-wake ")
#define afs_server_traces \
EM(afs_server_trace_callback, "CALLBACK ") \
@@ -694,16 +703,15 @@ TRACE_EVENT(afs_cb_call,
TRACE_EVENT(afs_call,
TP_PROTO(unsigned int call_debug_id, enum afs_call_trace op,
- int ref, int outstanding, const void *where),
+ int ref, int outstanding),
- TP_ARGS(call_debug_id, op, ref, outstanding, where),
+ TP_ARGS(call_debug_id, op, ref, outstanding),
TP_STRUCT__entry(
__field(unsigned int, call)
__field(int, op)
__field(int, ref)
__field(int, outstanding)
- __field(const void *, where)
),
TP_fast_assign(
@@ -711,15 +719,13 @@ TRACE_EVENT(afs_call,
__entry->op = op;
__entry->ref = ref;
__entry->outstanding = outstanding;
- __entry->where = where;
),
- TP_printk("c=%08x %s r=%d o=%d sp=%pSR",
+ TP_printk("c=%08x %s r=%d o=%d",
__entry->call,
__print_symbolic(__entry->op, afs_call_traces),
__entry->ref,
- __entry->outstanding,
- __entry->where)
+ __entry->outstanding)
);
TRACE_EVENT(afs_make_fs_call,
^ permalink raw reply related
* [PATCH net v3 09/14] afs: Fix UAF in afs_make_call()
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
There's a potential UAF in afs_make_call() in the event that an
asynchronous call is being sent, but the call fails in some way (e.g. it
gets aborted from the server). The problem is that afs_make_call() tries
to abort a call if the rxrpc send fails, but the asynchronous notification
from rxrpc may have caused the afs_call to be torn down.
Fix this making afs_make_op_call() give the op->call its own ref rather
than transferring the caller's ref to it and then dropping the ref when
afs_make_call() returns.
This also means that the afs_make_call() func never loses its ref on the
call now.
Fixes: e49c7b2f6de7 ("afs: Build an abstraction around an "operation" concept")
Link: https://sashiko.dev/#/patchset/20260702144919.172295-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: linux-afs@lists.infradead.org
cc: stable@kernel.org
---
fs/afs/internal.h | 3 ++-
fs/afs/rxrpc.c | 3 ---
include/trace/events/afs.h | 2 ++
3 files changed, 4 insertions(+), 4 deletions(-)
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 4901d0acbe14..645fe2f12dc5 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1417,7 +1417,7 @@ static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *c
{
struct afs_addr_list *alist = op->estate->addresses;
- op->call = call;
+ op->call = afs_get_call(call, afs_call_trace_get_op_call);
op->type = call->type;
call->op = op;
call->key = op->key;
@@ -1425,6 +1425,7 @@ static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *c
call->peer = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer);
call->service_id = op->server->service_id;
afs_make_call(call, gfp);
+ afs_put_call(call, afs_call_trace_put_made_call);
}
static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t size)
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index a1b9ced4e0f4..6dc6fd853832 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -382,8 +382,6 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
if (ret < 0)
goto error_do_abort;
- /* We lost our ref on call if MSG_MORE was not set and ret >= 0. */
-
if (write_iter) {
msg.msg_iter = *call->write_iter;
msg.msg_flags &= ~MSG_MORE;
@@ -393,7 +391,6 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
call->rxcall, &msg,
iov_iter_count(&msg.msg_iter),
afs_notify_end_request_tx);
- /* We lost our ref on call if ret >= 0. */
trace_afs_sent_data(debug_id, &msg, ret);
if (ret < 0)
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index df397c11df85..a1963e21f034 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -122,8 +122,10 @@ enum yfs_cm_operation {
#define afs_call_traces \
EM(afs_call_trace_alloc, "ALLOC ") \
EM(afs_call_trace_free, "FREE ") \
+ EM(afs_call_trace_get_op_call, "GET op ") \
EM(afs_call_trace_get_make_async_call, "GET a-make ") \
EM(afs_call_trace_put_async_complete, "PUT a-cmpl ") \
+ EM(afs_call_trace_put_made_call, "PUT made ") \
EM(afs_call_trace_put_discard_prealloc, "PUT dis-pre") \
EM(afs_call_trace_put_get_capabilities, "PUT get-cap") \
EM(afs_call_trace_put_giveupcallbacks, "PUT gvup-cb") \
^ permalink raw reply related
* [PATCH net v3 10/14] keys: Add refcounting to user-defined key type payload
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, Jarkko Sakkinen, keyrings, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Add refcounting to user-defined key type payload so that a kernel service
wanting to use such a key can hold onto the payload without the RCU read
lock held in order that it can do an allocation without having to be
concerned with the key getting updated.
This is the first part of the fix for the AF_RXRPC challenge response
generation code.
Link: https://sashiko.dev/#/patchset/20260624163819.3017002-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: linux-afs@lists.infradead.org
cc: keyrings@vger.kernel.org
cc: stable@kernel.org
---
include/keys/user-type.h | 2 ++
net/dns_resolver/dns_key.c | 1 +
security/keys/user_defined.c | 23 ++++++++++++++++-------
3 files changed, 19 insertions(+), 7 deletions(-)
diff --git a/include/keys/user-type.h b/include/keys/user-type.h
index 386c31432789..7002a993a472 100644
--- a/include/keys/user-type.h
+++ b/include/keys/user-type.h
@@ -26,6 +26,7 @@
*/
struct user_key_payload {
struct rcu_head rcu; /* RCU destructor */
+ refcount_t ref;
unsigned short datalen; /* length of this data */
char data[] __aligned(__alignof__(u64)); /* actual data */
};
@@ -37,6 +38,7 @@ struct key_preparsed_payload;
extern int user_preparse(struct key_preparsed_payload *prep);
extern void user_free_preparse(struct key_preparsed_payload *prep);
+void put_user_key_payload(struct user_key_payload *payload);
extern int user_update(struct key *key, struct key_preparsed_payload *prep);
extern void user_revoke(struct key *key);
extern void user_destroy(struct key *key);
diff --git a/net/dns_resolver/dns_key.c b/net/dns_resolver/dns_key.c
index c3c8c3240ef9..aa3c058f4095 100644
--- a/net/dns_resolver/dns_key.c
+++ b/net/dns_resolver/dns_key.c
@@ -208,6 +208,7 @@ dns_resolver_preparse(struct key_preparsed_payload *prep)
kleave(" = -ENOMEM");
return -ENOMEM;
}
+ refcount_set(&upayload->ref, 1);
upayload->datalen = result_len;
memcpy(upayload->data, data, result_len);
diff --git a/security/keys/user_defined.c b/security/keys/user_defined.c
index 6f88b507f927..90c1bd5d7dfe 100644
--- a/security/keys/user_defined.c
+++ b/security/keys/user_defined.c
@@ -67,6 +67,7 @@ int user_preparse(struct key_preparsed_payload *prep)
upayload = kmalloc_flex(*upayload, data, datalen);
if (!upayload)
return -ENOMEM;
+ refcount_set(&upayload->ref, 1);
/* attach the data */
prep->quotalen = datalen;
@@ -88,12 +89,22 @@ EXPORT_SYMBOL_GPL(user_free_preparse);
static void user_free_payload_rcu(struct rcu_head *head)
{
- struct user_key_payload *payload;
+ struct user_key_payload *payload =
+ container_of(head, struct user_key_payload, rcu);
- payload = container_of(head, struct user_key_payload, rcu);
kfree_sensitive(payload);
}
+/*
+ * Free a user defined key payload.
+ */
+void put_user_key_payload(struct user_key_payload *payload)
+{
+ if (payload && refcount_dec_and_test(&payload->ref))
+ call_rcu(&payload->rcu, user_free_payload_rcu);
+}
+EXPORT_SYMBOL_GPL(put_user_key_payload);
+
/*
* update a user defined key
* - the key's semaphore is write-locked
@@ -115,8 +126,7 @@ int user_update(struct key *key, struct key_preparsed_payload *prep)
rcu_assign_keypointer(key, prep->payload.data[0]);
prep->payload.data[0] = NULL;
- if (zap)
- call_rcu(&zap->rcu, user_free_payload_rcu);
+ put_user_key_payload(zap);
return ret;
}
EXPORT_SYMBOL_GPL(user_update);
@@ -134,7 +144,7 @@ void user_revoke(struct key *key)
if (upayload) {
rcu_assign_keypointer(key, NULL);
- call_rcu(&upayload->rcu, user_free_payload_rcu);
+ put_user_key_payload(upayload);
}
}
@@ -147,9 +157,8 @@ void user_destroy(struct key *key)
{
struct user_key_payload *upayload = key->payload.data[0];
- kfree_sensitive(upayload);
+ put_user_key_payload(upayload);
}
-
EXPORT_SYMBOL_GPL(user_destroy);
/*
^ permalink raw reply related
* [PATCH net v3 11/14] afs: Create a server appdata key
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, Jarkko Sakkinen, keyrings, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Currently, when a CHALLENGE packet comes in, it's queued in an OOB queue on
the AF_RXRPC socket that generated one of the calls on that connection for
the application (which might be in userspace) to service. The application
then picks up the CHALLENGE and requests a RESPONSE packet be generated,
allowing the app to include app-specific data in it if appropriate. There
is, however, no actual limit on the capacity of the CHALLENGE queue, and
this could be abused remotely - and also getting the OOB mechanism right
has proven tricky.
Further, by analogy with other AFS codebases, it's not actually necessary
to generate the application data in response to the CHALLENGE. The reason
I did this was to set the encryption on the app-data to be the same as that
specified in the CHALLENGE as the server must be able to handle that.
However, it's sufficient to use the encoding type set in the token that is
going to be sent to the server; presumably the kerberos server knows that
the fileserver can handle that type - otherwise why tell the client to use
it?
This is a part of the fix. With this, the AFS filesystem creates an
appdata key for each fileserver it talks to with RxGK and attaches it to
the afs_server record.
Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260624163819.3017002-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: linux-afs@lists.infradead.org
cc: keyrings@vger.kernel.org
cc: stable@kernel.org
---
fs/afs/cm_security.c | 232 +++++++++++++++++++++++++++++++++++++++++
fs/afs/fs_probe.c | 5 +
fs/afs/internal.h | 2 +
fs/afs/server.c | 1 +
include/net/af_rxrpc.h | 2 +
net/rxrpc/key.c | 37 +++++++
6 files changed, 279 insertions(+)
diff --git a/fs/afs/cm_security.c b/fs/afs/cm_security.c
index 103168c70dd4..36907a04efd0 100644
--- a/fs/afs/cm_security.c
+++ b/fs/afs/cm_security.c
@@ -6,7 +6,9 @@
*/
#include <linux/slab.h>
+#include <linux/key-type.h>
#include <crypto/krb5.h>
+#include <keys/user-type.h>
#include "internal.h"
#include "afs_cm.h"
#include "afs_fs.h"
@@ -23,6 +25,236 @@ static int afs_create_yfs_cm_token(struct sk_buff *challenge,
struct afs_server *server);
#endif
+#ifdef CONFIG_RXGK
+/*
+ * As the YFS RxGK appdata to be passed in the YFS.FS-service RESPONSE packet,
+ * create a GSS token to use as a ticket to the specified fileserver.
+ */
+static int afs_create_yfs_rxgk_cm_appdata(struct afs_server *server, u32 enctype)
+{
+ const struct krb5_enctype *conn_krb5, *token_krb5;
+ const struct krb5_buffer *token_key;
+ struct crypto_aead *aead;
+ struct scatterlist sg;
+ struct afs_net *net = server->cell->net;
+ const struct key *cm_key = net->fs_cm_token_key;
+ struct key *appdata_key = NULL;
+ size_t keysize, uuidsize, authsize, toksize, encsize, contsize;
+ size_t adatasize, offset;
+ __be32 caps[1] = {
+ [0] = htonl(AFS_CAP_ERROR_TRANSLATION),
+ };
+ __be32 *xdr;
+ void *appdata, *K0, *encbase;
+ int ret;
+
+ if (!cm_key)
+ return -ENOKEY;
+
+ /* Assume that the fileserver is happy to use the same encoding type as
+ * we were told to use by the token obtained by the user.
+ */
+ conn_krb5 = crypto_krb5_find_enctype(enctype);
+ if (!conn_krb5)
+ return -ENOPKG;
+ token_krb5 = cm_key->payload.data[0];
+ token_key = (const struct krb5_buffer *)&cm_key->payload.data[2];
+
+ /* struct rxgk_key {
+ * afs_uint32 enctype;
+ * opaque key<>;
+ * };
+ */
+ keysize = 4 + xdr_len_object(conn_krb5->key_len);
+
+ /* struct RXGK_AuthName {
+ * afs_int32 kind;
+ * opaque data<AUTHDATAMAX>;
+ * opaque display<AUTHPRINTABLEMAX>;
+ * };
+ */
+ uuidsize = sizeof(server->uuid);
+ authsize = 4 + xdr_len_object(uuidsize) + xdr_len_object(0);
+
+ /* struct RXGK_Token {
+ * rxgk_key K0;
+ * RXGK_Level level;
+ * rxgkTime starttime;
+ * afs_int32 lifetime;
+ * afs_int32 bytelife;
+ * rxgkTime expirationtime;
+ * struct RXGK_AuthName identities<>;
+ * };
+ */
+ toksize = keysize + 8 + 4 + 4 + 8 + xdr_len_object(authsize);
+
+ offset = 0;
+ encsize = crypto_krb5_how_much_buffer(token_krb5, KRB5_ENCRYPT_MODE, toksize, &offset);
+
+ /* struct RXGK_TokenContainer {
+ * afs_int32 kvno;
+ * afs_int32 enctype;
+ * opaque encrypted_token<>;
+ * };
+ */
+ contsize = 4 + 4 + xdr_len_object(encsize);
+
+ /* struct YFSAppData {
+ * opr_uuid initiatorUuid;
+ * opr_uuid acceptorUuid;
+ * Capabilities caps;
+ * afs_int32 enctype;
+ * opaque callbackKey<>;
+ * opaque callbackToken<>;
+ * };
+ */
+ adatasize = 16 + 16 +
+ xdr_len_object(sizeof(caps)) +
+ 4 +
+ xdr_len_object(conn_krb5->key_len) +
+ xdr_len_object(contsize);
+
+ ret = -ENOMEM;
+ appdata = kzalloc(adatasize, GFP_KERNEL);
+ if (!appdata)
+ goto out;
+ xdr = appdata;
+
+ memcpy(xdr, &net->uuid, 16); /* appdata.initiatorUuid */
+ xdr += 16 / 4;
+ memcpy(xdr, &server->uuid, 16); /* appdata.acceptorUuid */
+ xdr += 16 / 4;
+ *xdr++ = htonl(ARRAY_SIZE(caps)); /* appdata.caps.len */
+ memcpy(xdr, &caps, sizeof(caps)); /* appdata.caps */
+ xdr += ARRAY_SIZE(caps);
+ *xdr++ = htonl(conn_krb5->etype); /* appdata.enctype */
+
+ *xdr++ = htonl(conn_krb5->key_len); /* appdata.callbackKey.len */
+ K0 = xdr;
+ get_random_bytes(K0, conn_krb5->key_len); /* appdata.callbackKey.data */
+ xdr += xdr_round_up(conn_krb5->key_len) / 4;
+
+ *xdr++ = htonl(contsize); /* appdata.callbackToken.len */
+ *xdr++ = htonl(1); /* cont.kvno */
+ *xdr++ = htonl(token_krb5->etype); /* cont.enctype */
+ *xdr++ = htonl(encsize); /* cont.encrypted_token.len */
+
+ encbase = xdr;
+ xdr += offset / 4;
+ *xdr++ = htonl(conn_krb5->etype); /* token.K0.enctype */
+ *xdr++ = htonl(conn_krb5->key_len); /* token.K0.key.len */
+ memcpy(xdr, K0, conn_krb5->key_len); /* token.K0.key.data */
+ xdr += xdr_round_up(conn_krb5->key_len) / 4;
+
+ *xdr++ = htonl(RXRPC_SECURITY_ENCRYPT); /* token.level */
+ *xdr++ = htonl(0); /* token.starttime */
+ *xdr++ = htonl(0); /* " */
+ *xdr++ = htonl(0); /* token.lifetime */
+ *xdr++ = htonl(0); /* token.bytelife */
+ *xdr++ = htonl(0); /* token.expirationtime */
+ *xdr++ = htonl(0); /* " */
+ *xdr++ = htonl(1); /* token.identities.count */
+ *xdr++ = htonl(0); /* token.identities[0].kind */
+ *xdr++ = htonl(uuidsize); /* token.identities[0].data.len */
+ memcpy(xdr, &server->uuid, uuidsize);
+ xdr += xdr_round_up(uuidsize) / 4;
+ *xdr++ = htonl(0); /* token.identities[0].display.len */
+
+ xdr = encbase + xdr_round_up(encsize);
+
+ if ((unsigned long)xdr - (unsigned long)appdata != adatasize)
+ pr_err("Appdata size incorrect %lx != %zx\n",
+ (unsigned long)xdr - (unsigned long)appdata, adatasize);
+
+ aead = crypto_krb5_prepare_encryption(token_krb5, token_key, RXGK_SERVER_ENC_TOKEN,
+ GFP_KERNEL);
+ if (IS_ERR(aead)) {
+ ret = PTR_ERR(aead);
+ goto out_token;
+ }
+
+ sg_init_one(&sg, encbase, encsize);
+ ret = crypto_krb5_encrypt(token_krb5, aead, &sg, 1, encsize, offset, toksize, false);
+ if (ret < 0)
+ goto out_aead;
+
+ appdata_key = key_alloc(&key_type_user, "rxrpc: afs rxgk appdata",
+ GLOBAL_ROOT_UID, GLOBAL_ROOT_GID, current_cred(),
+ KEY_POS_VIEW | KEY_POS_SEARCH | KEY_USR_VIEW,
+ KEY_ALLOC_NOT_IN_QUOTA, NULL);
+ if (IS_ERR(appdata_key)) {
+ ret = PTR_ERR(appdata_key);
+ goto out_aead;
+ }
+
+ ret = key_instantiate_and_link(appdata_key, appdata, adatasize, NULL, NULL);
+ if (ret < 0) {
+ key_put(appdata_key);
+ goto out_aead;
+ }
+
+ /* Store the appdata before the key pointer */
+ smp_store_release(&server->yfs_rxgk_appdata, appdata_key);
+
+out_aead:
+ crypto_free_aead(aead);
+out_token:
+ kfree(appdata);
+out:
+ return ret;
+}
+#endif /* CONFIG_RXGK */
+
+/*
+ * Create the application data to go in a RESPONSE packet a server's CHALLENGE
+ * from the parameters contained in a key. The key specifies the security
+ * index and other appropriate parameters such as the encoding type for RxGK.
+ */
+int afs_create_server_appdata(struct afs_server *server, struct key *key)
+{
+ u32 krb5_enctype;
+ int ret;
+ u8 security_index;
+
+ if (!key)
+ return 0;
+
+ rxrpc_kernel_query_key(key, &security_index, &krb5_enctype);
+
+ _enter("%u,%u", security_index, krb5_enctype);
+
+ switch (security_index) {
+#ifdef CONFIG_RXGK
+ case RXRPC_SECURITY_YFS_RXGK:
+ /* Read the key pointer before the appdata */
+ if (smp_load_acquire(&server->yfs_rxgk_appdata))
+ return 0;
+ break;
+#endif
+ default:
+ return 0;
+ }
+
+ ret = 0;
+ mutex_lock(&server->cm_token_lock);
+
+ switch (security_index) {
+#ifdef CONFIG_RXGK
+ case RXRPC_SECURITY_YFS_RXGK:
+ /* Read the key pointer before the appdata */
+ if (smp_load_acquire(&server->yfs_rxgk_appdata))
+ break;
+ ret = afs_create_yfs_rxgk_cm_appdata(server, krb5_enctype);
+ break;
+#endif
+ default:
+ break;
+ }
+
+ mutex_unlock(&server->cm_token_lock);
+ return ret;
+}
+
/*
* Respond to an RxGK challenge, adding appdata.
*/
diff --git a/fs/afs/fs_probe.c b/fs/afs/fs_probe.c
index a91ad1938d07..e26f7f1e30a2 100644
--- a/fs/afs/fs_probe.c
+++ b/fs/afs/fs_probe.c
@@ -241,9 +241,14 @@ int afs_fs_probe_fileserver(struct afs_net *net, struct afs_server *server,
struct afs_endpoint_state *estate, *old;
struct afs_addr_list *old_alist = NULL, *alist;
unsigned long unprobed;
+ int ret;
_enter("%pU", &server->uuid);
+ ret = afs_create_server_appdata(server, key);
+ if (ret < 0)
+ return ret;
+
estate = kzalloc_obj(*estate);
if (!estate)
return -ENOMEM;
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index 645fe2f12dc5..d1c29593c5d0 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -548,6 +548,7 @@ struct afs_server {
struct timer_list timer; /* Management timer */
struct mutex cm_token_lock; /* Lock governing creation of appdata */
struct krb5_buffer cm_rxgk_appdata; /* Appdata to be included in RESPONSE packet */
+ struct key *yfs_rxgk_appdata; /* Appdata to be included in RESPONSE packet */
time64_t unuse_time; /* Time at which last unused */
unsigned long flags;
#define AFS_SERVER_FL_RESPONDING 0 /* The server is responding */
@@ -1088,6 +1089,7 @@ extern bool afs_cm_incoming_call(struct afs_call *);
/*
* cm_security.c
*/
+int afs_create_server_appdata(struct afs_server *server, struct key *key);
void afs_process_oob_queue(struct work_struct *work);
#ifdef CONFIG_RXGK
int afs_create_token_key(struct afs_net *net, struct socket *socket);
diff --git a/fs/afs/server.c b/fs/afs/server.c
index 0fe162ea2a36..b08d9080b0c5 100644
--- a/fs/afs/server.c
+++ b/fs/afs/server.c
@@ -399,6 +399,7 @@ static void afs_server_rcu(struct rcu_head *rcu)
afs_estate_trace_put_server);
afs_put_cell(server->cell, afs_cell_trace_put_server);
kfree(server->cm_rxgk_appdata.data);
+ key_put(server->yfs_rxgk_appdata);
kfree(server);
}
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index 0fb4c41c9bbf..c4b68049c06f 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -109,6 +109,8 @@ int rxkad_kernel_respond_to_challenge(struct sk_buff *challenge);
u32 rxgk_kernel_query_challenge(struct sk_buff *challenge);
int rxgk_kernel_respond_to_challenge(struct sk_buff *challenge,
struct krb5_buffer *appdata);
+void rxrpc_kernel_query_key(const struct key *key, u8 *_security_index,
+ u32 *_krb5_enctype);
u8 rxrpc_kernel_query_call_security(struct rxrpc_call *call,
u16 *_service_id, u32 *_enctype);
diff --git a/net/rxrpc/key.c b/net/rxrpc/key.c
index a0aa78d89289..16bab72e6f07 100644
--- a/net/rxrpc/key.c
+++ b/net/rxrpc/key.c
@@ -893,3 +893,40 @@ static long rxrpc_read(const struct key *key,
_leave(" = %zu", size);
return size;
}
+
+/**
+ * rxrpc_kernel_query_key - Query parameters from an rxrpc key
+ * @key: The key to query
+ * @_security_index: Where to return the security index
+ * @_krb5_enctype: Where to return the krb5 encryption type if applicable
+ *
+ * Query an rxrpc authentication key, extracting the security index from the
+ * first token therein.
+ */
+void rxrpc_kernel_query_key(const struct key *key, u8 *_security_index,
+ u32 *_krb5_enctype)
+{
+ const struct rxrpc_key_token *token;
+
+ token = key->payload.data[0];
+ if (!token) {
+ *_security_index = 0;
+ *_krb5_enctype = 0;
+ return;
+ }
+
+ *_security_index = token->security_index;
+ switch (token->security_index) {
+ case RXRPC_SECURITY_RXKAD:
+ *_krb5_enctype = 0;
+ break;
+ case RXRPC_SECURITY_YFS_RXGK:
+ *_krb5_enctype = token->rxgk->enctype;
+ break;
+ default:
+ WARN_ON_ONCE(1);
+ *_krb5_enctype = 0;
+ break;
+ }
+}
+EXPORT_SYMBOL(rxrpc_kernel_query_key);
^ permalink raw reply related
* [PATCH net v3 12/14] rxrpc: Pass appdata key to rxrpc_call and thence to rxrpc_bundle
From: David Howells @ 2026-07-13 8:10 UTC (permalink / raw)
To: netdev
Cc: David Howells, Marc Dionne, Jakub Kicinski, David S. Miller,
Eric Dumazet, Paolo Abeni, Simon Horman, linux-afs, linux-kernel,
Jeffrey Altman, Jarkko Sakkinen, keyrings, stable
In-Reply-To: <20260713081022.2186481-1-dhowells@redhat.com>
Currently, when a CHALLENGE packet comes in, it's queued in an OOB queue on
the AF_RXRPC socket that generated one of the calls on that connection for
the application (which might be in userspace) to service. The application
then picks up the CHALLENGE and requests a RESPONSE packet be generated,
allowing the app to include app-specific data in it if appropriate. There
is, however, no actual limit on the capacity of the CHALLENGE queue, and
this could be abused remotely - and also getting the OOB mechanism right
has proven tricky.
Further, by analogy with other AFS codebases, it's not actually necessary
to generate the application data in response to the CHALLENGE. The reason
I did this was to set the encryption on the app-data to be the same as that
specified in the CHALLENGE as the server must be able to handle that.
However, it's sufficient to use the encoding type set in the token that is
going to be sent to the server; presumably the kerberos server knows that
the fileserver can handle that type - otherwise why tell the client to use
it?
This is a part of the fix. With this, the appdata key created by the AFS
filesystem or passed in via sendmsg CMSG to a user AF_RXRPC socket is added
to an rxrpc_call struct and will then be added to an rxrpc_bundle struct.
Note that afs_make_op_call() has to be moved so that it can call
afs_use_server(). afs_operation-based calls did not heretofore 'use' the
server and server will be 'un-used' by afs_free_call().
Fixes: 5800b1cf3fd8 ("rxrpc: Allow CHALLENGEs to the passed to the app for a RESPONSE")
Link: https://sashiko.dev/#/patchset/20260624163819.3017002-1-dhowells%40redhat.com
Signed-off-by: David Howells <dhowells@redhat.com>
cc: Marc Dionne <marc.dionne@auristor.com>
cc: Jeffrey Altman <jaltman@auristor.com>
cc: Eric Dumazet <edumazet@google.com>
cc: "David S. Miller" <davem@davemloft.net>
cc: Jakub Kicinski <kuba@kernel.org>
cc: Paolo Abeni <pabeni@redhat.com>
cc: Simon Horman <horms@kernel.org>
cc: Jarkko Sakkinen <jarkko@kernel.org>
cc: linux-afs@lists.infradead.org
cc: keyrings@vger.kernel.org
cc: stable@kernel.org
---
fs/afs/internal.h | 33 +++++++++++++++++----------------
fs/afs/rxrpc.c | 21 ++++++++++++++++++++-
include/net/af_rxrpc.h | 1 +
include/trace/events/afs.h | 1 +
include/uapi/linux/rxrpc.h | 1 +
net/rxrpc/af_rxrpc.c | 3 +++
net/rxrpc/ar-internal.h | 3 +++
net/rxrpc/call_object.c | 2 ++
net/rxrpc/conn_client.c | 2 ++
net/rxrpc/sendmsg.c | 25 ++++++++++++++++++++++++-
10 files changed, 74 insertions(+), 18 deletions(-)
diff --git a/fs/afs/internal.h b/fs/afs/internal.h
index d1c29593c5d0..57519888b978 100644
--- a/fs/afs/internal.h
+++ b/fs/afs/internal.h
@@ -1414,22 +1414,6 @@ static inline void afs_see_call(struct afs_call *call, enum afs_call_trace why)
atomic_read(&call->net->nr_outstanding_calls));
}
-static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call,
- gfp_t gfp)
-{
- struct afs_addr_list *alist = op->estate->addresses;
-
- op->call = afs_get_call(call, afs_call_trace_get_op_call);
- op->type = call->type;
- call->op = op;
- call->key = op->key;
- call->intr = !(op->flags & AFS_OPERATION_UNINTR);
- call->peer = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer);
- call->service_id = op->server->service_id;
- afs_make_call(call, gfp);
- afs_put_call(call, afs_call_trace_put_made_call);
-}
-
static inline void afs_extract_begin(struct afs_call *call, void *buf, size_t size)
{
call->iov_len = size;
@@ -1749,6 +1733,23 @@ static inline struct inode *AFS_VNODE_TO_I(struct afs_vnode *vnode)
return &vnode->netfs.inode;
}
+static inline void afs_make_op_call(struct afs_operation *op, struct afs_call *call,
+ gfp_t gfp)
+{
+ struct afs_addr_list *alist = op->estate->addresses;
+
+ op->call = afs_get_call(call, afs_call_trace_get_op_call);
+ op->type = call->type;
+ call->op = op;
+ call->server = afs_use_server(op->server, false, afs_server_trace_use_call);
+ call->key = op->key;
+ call->intr = !(op->flags & AFS_OPERATION_UNINTR);
+ call->peer = rxrpc_kernel_get_peer(alist->addrs[op->addr_index].peer);
+ call->service_id = op->server->service_id;
+ afs_make_call(call, gfp);
+ afs_put_call(call, afs_call_trace_put_made_call);
+}
+
/*
* Note that a dentry got changed. We need to set d_fsdata to the data version
* number derived from the result of the operation. It doesn't matter if
diff --git a/fs/afs/rxrpc.c b/fs/afs/rxrpc.c
index 6dc6fd853832..1a110448dbdb 100644
--- a/fs/afs/rxrpc.c
+++ b/fs/afs/rxrpc.c
@@ -312,6 +312,7 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
struct msghdr msg;
struct kvec iov[1];
unsigned int debug_id = call->debug_id;
+ struct key *app_data = NULL;
size_t len;
bool write_iter = call->write_iter;
s64 tx_total_len;
@@ -342,8 +343,26 @@ void afs_make_call(struct afs_call *call, gfp_t gfp)
if (call->async)
afs_get_call(call, afs_call_trace_get_make_async_call);
+ if (call->key && call->server) {
+ u32 krb5_enctype = 0;
+ u8 security_index = 0;
+
+ rxrpc_kernel_query_key(call->key, &security_index, &krb5_enctype);
+ switch (security_index) {
+#ifdef CONFIG_RXGK
+ case RXRPC_SECURITY_YFS_RXGK:
+ /* Read the key pointer before the appdata */
+ app_data = smp_load_acquire(&call->server->yfs_rxgk_appdata);
+ break;
+#endif
+ default:
+ break;
+ }
+ }
+
/* create a call */
- rxcall = rxrpc_kernel_begin_call(call->net->socket, call->peer, call->key,
+ rxcall = rxrpc_kernel_begin_call(call->net->socket, call->peer,
+ call->key, app_data,
(unsigned long)call,
tx_total_len,
call->max_lifespan,
diff --git a/include/net/af_rxrpc.h b/include/net/af_rxrpc.h
index c4b68049c06f..19c61a2f5af3 100644
--- a/include/net/af_rxrpc.h
+++ b/include/net/af_rxrpc.h
@@ -55,6 +55,7 @@ void rxrpc_kernel_set_notifications(struct socket *sock,
struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
struct rxrpc_peer *peer,
struct key *key,
+ struct key *app_data,
unsigned long user_call_ID,
s64 tx_total_len,
u32 hard_timeout,
diff --git a/include/trace/events/afs.h b/include/trace/events/afs.h
index a1963e21f034..a4f57414d527 100644
--- a/include/trace/events/afs.h
+++ b/include/trace/events/afs.h
@@ -160,6 +160,7 @@ enum yfs_cm_operation {
EM(afs_server_trace_unuse_slist_isort, "UNU isort") \
EM(afs_server_trace_update, "UPDATE ") \
EM(afs_server_trace_use_by_uuid, "USE uuid ") \
+ EM(afs_server_trace_use_call, "USE call ") \
EM(afs_server_trace_use_cm_call, "USE cm-cl") \
EM(afs_server_trace_use_get_caps, "USE gcaps") \
EM(afs_server_trace_use_give_up_cb, "USE gvupc") \
diff --git a/include/uapi/linux/rxrpc.h b/include/uapi/linux/rxrpc.h
index d9735abd4c79..bcdfdf9c67a1 100644
--- a/include/uapi/linux/rxrpc.h
+++ b/include/uapi/linux/rxrpc.h
@@ -63,6 +63,7 @@ enum rxrpc_cmsg_type {
RXRPC_RESPOND = 17, /* Cs-: Respond to a challenge */
RXRPC_RESPONDED = 18, /* S-r: Data received in RESPONSE */
RXRPC_RESP_RXGK_APPDATA = 19, /* Cs-: RESPONSE: RxGK app data to include */
+ RXRPC_RESPONSE_APPDATA = 20, /* Cs-: User key holding app data for RESPONSE */
RXRPC__SUPPORTED
};
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index 9ab0f22c881e..a19c0fd3c51a 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -318,6 +318,7 @@ EXPORT_SYMBOL(rxrpc_kernel_put_peer);
* @sock: The socket on which to make the call
* @peer: The peer to contact
* @key: The security context to use (defaults to socket setting)
+ * @app_data: The security response application data (or NULL)
* @user_call_ID: The ID to use
* @tx_total_len: Total length of data to transmit during the call (or -1)
* @hard_timeout: The maximum lifespan of the call in sec
@@ -340,6 +341,7 @@ EXPORT_SYMBOL(rxrpc_kernel_put_peer);
struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
struct rxrpc_peer *peer,
struct key *key,
+ struct key *app_data,
unsigned long user_call_ID,
s64 tx_total_len,
u32 hard_timeout,
@@ -368,6 +370,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
key = NULL; /* a no-security key */
memset(&p, 0, sizeof(p));
+ p.app_data = app_data;
p.user_call_ID = user_call_ID;
p.tx_total_len = tx_total_len;
p.interruptibility = interruptibility;
diff --git a/net/rxrpc/ar-internal.h b/net/rxrpc/ar-internal.h
index b6e7e8c5e96f..20c10428a50e 100644
--- a/net/rxrpc/ar-internal.h
+++ b/net/rxrpc/ar-internal.h
@@ -516,6 +516,7 @@ struct rxrpc_bundle {
struct rxrpc_local *local; /* Representation of local endpoint */
struct rxrpc_peer *peer; /* Remote endpoint */
struct key *key; /* Security details */
+ struct key *app_data; /* Security response app data */
struct list_head proc_link; /* Link in net->bundle_proc_list */
const struct rxrpc_security *security; /* applied security module */
refcount_t ref;
@@ -720,6 +721,7 @@ struct rxrpc_call {
struct rxrpc_sock __rcu *socket; /* socket responsible */
struct rxrpc_net *rxnet; /* Network namespace to which call belongs */
struct key *key; /* Security details */
+ struct key *app_data; /* Security response app data */
const struct rxrpc_security *security; /* applied security module */
struct mutex user_mutex; /* User access mutex */
struct sockaddr_rxrpc dest_srx; /* Destination address */
@@ -914,6 +916,7 @@ enum rxrpc_command {
};
struct rxrpc_call_params {
+ struct key *app_data; /* Security response app data */
s64 tx_total_len; /* Total Tx data length (if send data) */
unsigned long user_call_ID; /* User's call ID */
struct {
diff --git a/net/rxrpc/call_object.c b/net/rxrpc/call_object.c
index 817ed9acb91e..9f6130d90c4c 100644
--- a/net/rxrpc/call_object.c
+++ b/net/rxrpc/call_object.c
@@ -211,6 +211,7 @@ static struct rxrpc_call *rxrpc_alloc_client_call(struct rxrpc_sock *rx,
call->interruptibility = p->interruptibility;
call->tx_total_len = p->tx_total_len;
call->key = key_get(cp->key);
+ call->app_data = key_get(p->app_data);
call->peer = rxrpc_get_peer(cp->peer, rxrpc_peer_get_call);
call->local = rxrpc_get_local(cp->local, rxrpc_local_get_call);
call->security_level = cp->security_level;
@@ -697,6 +698,7 @@ static void rxrpc_destroy_call(struct work_struct *work)
rxrpc_put_peer(call->peer, rxrpc_peer_put_call);
rxrpc_put_local(call->local, rxrpc_local_put_call);
key_put(call->key);
+ key_put(call->app_data);
call_rcu(&call->rcu, rxrpc_rcu_free_call);
}
diff --git a/net/rxrpc/conn_client.c b/net/rxrpc/conn_client.c
index 48519f0de185..5cbfa7b223e0 100644
--- a/net/rxrpc/conn_client.c
+++ b/net/rxrpc/conn_client.c
@@ -81,6 +81,7 @@ static struct rxrpc_bundle *rxrpc_alloc_bundle(struct rxrpc_call *call,
bundle->local = call->local;
bundle->peer = rxrpc_get_peer(call->peer, rxrpc_peer_get_bundle);
bundle->key = key_get(call->key);
+ bundle->app_data = key_get(call->app_data);
bundle->security = call->security;
bundle->exclusive = test_bit(RXRPC_CALL_EXCLUSIVE, &call->flags);
bundle->upgrade = test_bit(RXRPC_CALL_UPGRADE, &call->flags);
@@ -118,6 +119,7 @@ static void rxrpc_free_bundle(struct rxrpc_bundle *bundle)
write_unlock(&bundle->local->rxnet->conn_lock);
rxrpc_put_peer(bundle->peer, rxrpc_peer_put_bundle);
key_put(bundle->key);
+ key_put(bundle->app_data);
kfree(bundle);
}
diff --git a/net/rxrpc/sendmsg.c b/net/rxrpc/sendmsg.c
index 71343998b87d..cdf35440317d 100644
--- a/net/rxrpc/sendmsg.c
+++ b/net/rxrpc/sendmsg.c
@@ -12,6 +12,7 @@
#include <linux/skbuff.h>
#include <linux/export.h>
#include <linux/sched/signal.h>
+#include <keys/user-type.h>
#include <net/sock.h>
#include <net/af_rxrpc.h>
@@ -530,6 +531,8 @@ static int rxrpc_send_data(struct rxrpc_sock *rx,
static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
{
struct cmsghdr *cmsg;
+ key_serial_t key_id;
+ key_ref_t key;
bool got_user_ID = false;
int len;
@@ -614,6 +617,22 @@ static int rxrpc_sendmsg_cmsg(struct msghdr *msg, struct rxrpc_send_params *p)
return -ERANGE;
break;
+ case RXRPC_RESPONSE_APPDATA:
+ if (len != sizeof(key_serial_t))
+ return -EINVAL;
+ if (p->call.app_data)
+ return -EINVAL;
+ key_id = *(key_serial_t *)CMSG_DATA(cmsg);
+ key = lookup_user_key(key_id, 0, KEY_NEED_SEARCH);
+ if (IS_ERR(key))
+ return PTR_ERR(key);
+ if (key_ref_to_ptr(key)->type == &key_type_user) {
+ key_ref_put(key);
+ return -EINVAL;
+ }
+ p->call.app_data = key_ref_to_ptr(key);
+ break;
+
default:
return -EINVAL;
}
@@ -722,8 +741,10 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
goto error_release_sock;
call = rxrpc_new_client_call_for_sendmsg(rx, msg, &p);
/* The socket is now unlocked... */
- if (IS_ERR(call))
+ if (IS_ERR(call)) {
+ key_put(p.call.app_data);
return PTR_ERR(call);
+ }
/* ... and we have the call lock. */
p.call.nr_timeouts = 0;
ret = 0;
@@ -808,11 +829,13 @@ int rxrpc_do_sendmsg(struct rxrpc_sock *rx, struct msghdr *msg, size_t len)
mutex_unlock(&call->user_mutex);
error_put:
rxrpc_put_call(call, rxrpc_call_put_sendmsg);
+ key_put(p.call.app_data);
_leave(" = %d", ret);
return ret;
error_release_sock:
release_sock(&rx->sk);
+ key_put(p.call.app_data);
return ret;
}
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox