* [PATCH net-next] selftests/xsk: decouple xskxceiver and xdp apps from test_progs objects
From: Tushar Vyavahare @ 2026-07-18 13:44 UTC (permalink / raw)
To: netdev, magnus.karlsson, maciej.fijalkowski, stfomichev,
kernelxing, davem, kuba, pabeni, ast, daniel, tirthendu.sarkar,
tushar.vyavahare
Cc: bpf
Build xskxceiver, xdp_hw_metadata, and xdp_features from explicit source
lists instead of reusing helper objects produced by test_progs rules.
Reusing shared objects such as network_helpers.o and xsk.o can pull in
test_progs-only dependency chains and trigger unrelated libarena builds
when invoking a single target.
Keep these standalone binaries self-contained so each target builds only
its own required sources and BPF skeleton dependencies.
Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com>
---
tools/testing/selftests/bpf/Makefile | 20 +++++++++++++++-----
1 file changed, 15 insertions(+), 5 deletions(-)
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index b642ee489ea6..a6f0ed10ccb4 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -934,17 +934,27 @@ $(OUTPUT)/test_verifier: test_verifier.c verifier/tests.h $(BPFOBJ) | $(OUTPUT)
$(call msg,BINARY,,$@)
$(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
-# Include find_bit.c to compile xskxceiver.
-EXTRA_SRC := $(TOOLSDIR)/lib/find_bit.c prog_tests/test_xsk.c prog_tests/test_xsk.h
-$(OUTPUT)/xskxceiver: $(EXTRA_SRC) xskxceiver.c xskxceiver.h $(OUTPUT)/network_helpers.o $(OUTPUT)/xsk.o $(OUTPUT)/xsk_xdp_progs.skel.h $(BPFOBJ) | $(OUTPUT)
+# Keep xskxceiver independent from test_progs object dependencies.
+XSKXCEIVER_SRC := xskxceiver.c xsk.c network_helpers.c \
+ $(TOOLSDIR)/lib/find_bit.c prog_tests/test_xsk.c
+$(OUTPUT)/xskxceiver: $(XSKXCEIVER_SRC) xskxceiver.h xsk.h network_helpers.h \
+ prog_tests/test_xsk.h test_progs.h bpf_util.h \
+ $(OUTPUT)/xsk_xdp_progs.skel.h $(BPFOBJ) | $(OUTPUT)
$(call msg,BINARY,,$@)
$(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
-$(OUTPUT)/xdp_hw_metadata: xdp_hw_metadata.c $(OUTPUT)/network_helpers.o $(OUTPUT)/xsk.o $(OUTPUT)/xdp_hw_metadata.skel.h | $(OUTPUT)
+XDP_HW_METADATA_SRC := xdp_hw_metadata.c xsk.c network_helpers.c \
+ $(TOOLSDIR)/lib/find_bit.c
+$(OUTPUT)/xdp_hw_metadata: $(XDP_HW_METADATA_SRC) xdp_metadata.h \
+ xsk.h network_helpers.h test_progs.h bpf_util.h \
+ $(OUTPUT)/xdp_hw_metadata.skel.h $(BPFOBJ) | $(OUTPUT)
$(call msg,BINARY,,$@)
$(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
-$(OUTPUT)/xdp_features: xdp_features.c $(OUTPUT)/network_helpers.o $(OUTPUT)/xdp_features.skel.h | $(OUTPUT)
+XDP_FEATURES_SRC := xdp_features.c network_helpers.c
+$(OUTPUT)/xdp_features: $(XDP_FEATURES_SRC) xdp_features.h network_helpers.h \
+ test_progs.h bpf_util.h $(OUTPUT)/xdp_features.skel.h \
+ $(BPFOBJ) | $(OUTPUT)
$(call msg,BINARY,,$@)
$(Q)$(CC) $(CFLAGS) $(filter %.a %.o %.c,$^) $(LDLIBS) -o $@
--
2.43.0
^ permalink raw reply related
* Re: [REGRESSION][BISECTED] stmmac: suspend hangs since 1b9707e6f1a9 ("net: stmmac: enable RPS and RBU interrupts")
From: tresonic @ 2026-07-18 13:32 UTC (permalink / raw)
To: Maxime Chevallier, Andrew Lunn; +Cc: netdev, regressions, rmk+kernel, kuba
In-Reply-To: <46e90a47-4507-40fe-b74e-efef932e9b62@bootlin.com>
Hi, thanks for testing and feedback!
> I've given this patch a test on imx8mp (that has a dwmac4.10), no regressions found
> from running basic tests :) I think this is a good fix, if you submit it can you
> address both dwmac410 and dwmac4 ? They both should be impacted by that problem.
I've added the deinit_chan for dwmac4.
Sorry for the noob question, how would I submit this fix?
Just commit and separately git send-email to netdev@vger.kernel.org?
These are my currernt changes:
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index 829a23bdad01..23ffe1adcd0d 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -106,6 +106,17 @@ static void dwmac4_dma_init_channel(struct stmmac_priv *priv,
ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
}
+static void dwmac4_dma_deinit_channel(struct stmmac_priv *priv,
+ void __iomem *ioaddr, u32 chan)
+{
+ const struct dwmac4_addrs *dwmac4_addrs = priv->plat->dwmac4_addrs;
+ u32 value;
+
+ value = readl(ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+ value &= ~DMA_CHAN_INTR_DEFAULT_MASK;
+ writel(value, ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+}
+
static void dwmac410_dma_init_channel(struct stmmac_priv *priv,
void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg, u32 chan)
@@ -125,6 +136,17 @@ static void dwmac410_dma_init_channel(struct stmmac_priv *priv,
ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
}
+static void dwmac410_dma_deinit_channel(struct stmmac_priv *priv,
+ void __iomem *ioaddr, u32 chan)
+{
+ const struct dwmac4_addrs *dwmac4_addrs = priv->plat->dwmac4_addrs;
+ u32 value;
+
+ value = readl(ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+ value &= ~DMA_CHAN_INTR_DEFAULT_MASK_4_10;
+ writel(value, ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+}
+
static void dwmac4_dma_init(void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg)
{
@@ -548,6 +570,7 @@ const struct stmmac_dma_ops dwmac4_dma_ops = {
.reset = dwmac4_dma_reset,
.init = dwmac4_dma_init,
.init_chan = dwmac4_dma_init_channel,
+ .deinit_chan = dwmac4_dma_deinit_channel,
.init_rx_chan = dwmac4_dma_init_rx_chan,
.init_tx_chan = dwmac4_dma_init_tx_chan,
.axi = dwmac4_dma_axi,
@@ -577,6 +600,7 @@ const struct stmmac_dma_ops dwmac410_dma_ops = {
.reset = dwmac4_dma_reset,
.init = dwmac4_dma_init,
.init_chan = dwmac410_dma_init_channel,
+ .deinit_chan = dwmac410_dma_deinit_channel,
.init_rx_chan = dwmac4_dma_init_rx_chan,
.init_tx_chan = dwmac4_dma_init_tx_chan,
.axi = dwmac4_dma_axi,
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index e6317b94fff7..04dafec021b4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -170,6 +170,8 @@ struct stmmac_dma_ops {
void (*init)(void __iomem *ioaddr, struct stmmac_dma_cfg *dma_cfg);
void (*init_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg, u32 chan);
+ void (*deinit_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
+ u32 chan);
void (*init_rx_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg,
dma_addr_t phy, u32 chan);
@@ -235,6 +237,8 @@ struct stmmac_dma_ops {
stmmac_do_void_callback(__priv, dma, init, __args)
#define stmmac_init_chan(__priv, __args...) \
stmmac_do_void_callback(__priv, dma, init_chan, __priv, __args)
+#define stmmac_deinit_chan(__priv, __args...) \
+ stmmac_do_void_callback(__priv, dma, deinit_chan, __priv, __args)
#define stmmac_init_rx_chan(__priv, __args...) \
stmmac_do_void_callback(__priv, dma, init_rx_chan, __priv, __args)
#define stmmac_init_tx_chan(__priv, __args...) \
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 2a0d7eff88d3..8504ecc3dbeb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2560,13 +2560,16 @@ static void stmmac_stop_all_dma(struct stmmac_priv *priv)
{
u8 rx_channels_count = priv->plat->rx_queues_to_use;
u8 tx_channels_count = priv->plat->tx_queues_to_use;
+ u8 max_chan = max(rx_channels_count, tx_channels_count);
u8 chan;
- for (chan = 0; chan < rx_channels_count; chan++)
- stmmac_stop_rx_dma(priv, chan);
-
- for (chan = 0; chan < tx_channels_count; chan++)
- stmmac_stop_tx_dma(priv, chan);
+ for (chan = 0; chan < max_chan; chan++) {
+ if (chan < rx_channels_count)
+ stmmac_stop_rx_dma(priv, chan);
+ if (chan < tx_channels_count)
+ stmmac_stop_tx_dma(priv, chan);
+ stmmac_deinit_chan(priv, priv->ioaddr, chan);
+ }
}
/**
tresonic
^ permalink raw reply related
* Re: [REGRESSION][BISECTED] stmmac: suspend hangs since 1b9707e6f1a9 ("net: stmmac: enable RPS and RBU interrupts")
From: Maxime Chevallier @ 2026-07-18 13:11 UTC (permalink / raw)
To: tresonic, Andrew Lunn; +Cc: netdev, regressions, rmk+kernel, kuba
In-Reply-To: <97d803a5-ca6e-4d4a-adc2-f97cabfded65@mail.de>
Hi,
On 7/18/26 09:35, tresonic wrote:
> Thank you for you explanations!
>
>> The interrupt is being enabled in the init_chan call in
>> stmmac_dma_ops. Ideally, it should be disabled in a mirror function,
>> which currently does not exist. So maybe deinit_chan() needs
>> adding. But where to call it from? init_chan() is called from
>> stmmac_init_dma_engine(), from stmmac_hw_setup(). stmmac_resume() does
>> call this. So we need something in stmmac_suspend(). Maybe in
>> stmmac_stop_all_dma()?
>>
>> stmmac is messy, there are often not mirror functions. If there is a
>> stmmac_init_dma_engine() there should be
>> stmmac_deinit_dma_engine(). If there is stmmac_hw_setup() there should
>> be stmmac_hw_tairdown(). But none of these seem to exist.
>>
(sorry I missed that thread, I was on my way back from netdev)
>> Anyway, do you want to try to implement deinit_chan() and call it from
>> stmmac_stop_all_dma()?
> Yes I'd really like to implement a solution here.
> This is my try, but I still have some questions:
> - is it ok to disable all interrupts on deinit_chan()?
It mirrors the init, so it should be fine. Now I'm not sure how that
will interfere with things like WoL though, I've yet to test this.
> - maybe the interrupt could also just be disabled in stop_rx?
I don't think so, if something is missing w.r.t the interrupts being
enabled when they shouldn't, that would need to be addressed in the
xdp part, as this seems to be the only place where stop_rx is called
without the dma_chan interrupts being masked.
>
> diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
> index 829a23bdad01..65c243fb829f 100644
> --- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
> +++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
[...]
I've given this patch a test on imx8mp (that has a dwmac4.10), no regressions found
from running basic tests :) I think this is a good fix, if you submit it can you
address both dwmac410 and dwmac4 ? They both should be impacted by that problem.
Maxime
^ permalink raw reply
* Re: [PATCH] ieee802154: hwsim: serialize pib updates to fix double-free
From: Yousef Alhouseen @ 2026-07-18 12:20 UTC (permalink / raw)
To: miquel.raynal, devnexen
Cc: alex.aring, stable, syzbot+60332fd095f8bb2946ad, stefan,
andrew+netdev, davem, edumazet, kuba, pabeni, linux-wpan, netdev,
linux-kernel
In-Reply-To: <87h5m2g70l.fsf@bootlin.com>
Yes. I'll send v2 of my teardown patch with rcu_access_pointer(). It
is separate from David's patch: mine moves the final PIB free after
unregister, while David's serializes concurrent runtime PIB
replacements. I don't think his patch is superseded by mine.
Thanks,
Yousef
On Mon, 13 Jul 2026 18:59:38 +0200, Miquel Raynal
<miquel.raynal@bootlin.com> wrote:
> Hello David,
>
> On 09/07/2026 at 23:18:58 +01, David Carlier <devnexen@gmail.com> wrote:
>
> > hwsim_update_pib() does an unserialized read-swap-free of phy->pib:
> >
> > pib_old = rtnl_dereference(phy->pib);
> > ...
> > rcu_assign_pointer(phy->pib, pib);
> > kfree_rcu(pib_old, rcu);
> >
> > It assumes the RTNL is held, but ->set_channel is not always called
> > under it: the mac802154 scan worker changes channels via
> > drv_set_channel() without the RTNL. Such an update can race an
> > RTNL-held one on the same phy; both read the same pib_old and both
> > kfree_rcu() it, double-freeing the object. With SLUB percpu sheaves
> > batching kfree_rcu(), this surfaces as a KASAN invalid-free in
> > rcu_free_sheaf().
> >
> > struct hwsim_phy has no lock for pib. Add one and make the swap atomic
> > with rcu_replace_pointer() under it, dropping the misleading
> > rtnl_dereference().
> >
> > Reported-by: syzbot+60332fd095f8bb2946ad@syzkaller.appspotmail.com
> > Closes: https://syzkaller.appspot.com/bug?extid=60332fd095f8bb2946ad
> > Fixes: f25da51fdc38 ("ieee802154: hwsim: add replacement for fakelb")
> > Signed-off-by: David Carlier <devnexen@gmail.com>
> > Cc: <stable@vger.kernel.org>
>
> Thank you for the patch, but I think Yousef already provided a similar
> patch:
>
> https://lore.kernel.org/all/20260627235805.17310-1-alhouseenyousef@gmail.com/
>
> Yousef, can you confirm you will send v2 soon?
>
> Thanks,
> Miquèl
^ permalink raw reply
* Re: [PATCH net] ieee802154: hwsim: free PIB after unregistering hardware
From: Yousef Alhouseen @ 2026-07-18 12:20 UTC (permalink / raw)
To: miquel.raynal
Cc: alex.aring, stefan, andrew+netdev, davem, edumazet, kuba, pabeni,
linux-wpan, netdev, linux-kernel, stable,
syzbot+4707bb8a43a42fca2b97
In-Reply-To: <87jyr8jgr8.fsf@bootlin.com>
Agreed. I'll use rcu_access_pointer() in v2; it expresses the final
pointer fetch more directly once unregister has quiesced the updaters.
Thanks,
Yousef
On Mon, 06 Jul 2026 17:10:35 +0200, Miquel Raynal
<miquel.raynal@bootlin.com> wrote:
> Hello Yousef,
>
> On 03/07/2026 at 04:19:42 -07, Yousef Alhouseen <alhouseenyousef@gmail.com> wrote:
>
> > Hello Miquel,
> >
> > After ieee802154_unregister_hw() returns, the driver callbacks that
> > can replace phy->pib have been quiesced, and hwsim_del() has exclusive
> > ownership of the final teardown. The pointer is no longer being
> > fetched inside an RCU read-side critical section, so rcu_dereference()
> > is not appropriate there.
>
> That's right.
>
> > rcu_dereference_protected(phy->pib, 1) expresses that there can no
> > longer be a concurrent updater at that point; the protection condition
> > is the completed unregister rather than a locally held lock. The value
> > is only fetched so the final object can be passed to kfree_rcu().
>
> While I believe this is indeed true, it actually feels slightly overkill
> since there is no updater anymore and, as far as I understand, the only
> thing that we need here is to get the pointer value for freeing, right?
>
> > rcu_access_pointer() would also be sufficient for that limited use if
> > you prefer it, and I can use that spelling in a v2.
>
> If you don't mind, I feel like rcu_access_pointer() is exactly what we
> need here. It is also more understandable, even though I agree in
> practice there are no differences in this case.
>
> Thanks,
> Miquèl
^ permalink raw reply
* [bug report] net: udp_tunnel_nic: reference count leak during network namespace migration
From: Tetsuo Handa @ 2026-07-18 12:03 UTC (permalink / raw)
To: Network Development, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman
[-- Attachment #1: Type: text/plain, Size: 3565 bytes --]
Description:
syzbot is reporting a reference count leak when a netdevsim device configured with
UDP tunnel offloads is moved to another network namespace, and then the target
namespace is destroyed.
Cause of the Leak:
The root cause is a structural mismatch between the namespace migration logic in
__dev_change_net_namespace() and the unregistration path in udp_tunnel_nic_unregister().
1. During __dev_change_net_namespace(), it triggers a temporary NETDEV_UNREGISTER event
to flush old configurations:
/* net/core/dev.c: __dev_change_net_namespace() */
----------
/* Notify protocols, that we are about to destroy
* this device. They should clean all the things.
*
* Note that dev->reg_state stays at NETREG_REGISTERED.
* This is wanted because this way 8021q and macvlan know
* the device is just moving and can keep their slaves up.
*/
call_netdevice_notifiers(NETDEV_UNREGISTER, dev);
rcu_barrier(); // <== Proceeds immediately to the new namespace setup without any retries or loops.
----------
2. This event is handled by udp_tunnel_nic_netdevice_event(), which correctly
invokes udp_tunnel_nic_unregister().
3. Inside udp_tunnel_nic_unregister(), there is an asynchronous work-pending check
designed for normal device destruction paths:
/* net/ipv4/udp_tunnel_nic.c: udp_tunnel_nic_unregister() */
----------
/* Wait for the work to be done using the state, netdev core will
* retry unregister until we give up our reference on this device.
*/
if (utn->work_pending)
return;
udp_tunnel_nic_free(utn);
release_dev:
dev->udp_tunnel_nic = NULL;
dev_put(dev); // <== Will not be called if we returned early, for NETDEV_UNREGISTER is fired only once.
----------
For a standard unregister_netdevice() flow, this early return is perfectly fine
because the netdev core loop (netdev_wait_allrefs()) will continually retry
unregistration until all references are dropped.
4. However, __dev_change_net_namespace() does not have a retry loop for NETDEV_UNREGISTER.
It fires the notification exactly once. If utn->work_pending happens to be true at that
precise moment, udp_tunnel_nic_unregister() returns early and silently skips the mandatory
dev_put(dev).
5. Consequently, the old instance's refcount is never decremented, while the device
completes its move and calls NETDEV_REGISTER in the new namespace-eventually leading to
an unfreeable netdev balance when the interface is finally dismantled.
Custom refcount tracker Analysis Summary:
Attached log (obtained using next-20260714 which carries linux-next only patch) shows
an unbalanced +1 from the UDP tunnel subsystem across the namespace migration lifecycle:
* netdevsim3[12]: +1 at udp_tunnel_nic_register (Initial registration)
* netdevsim3[59]: +1 at udp_tunnel_nic_register (Post-migration re-registration)
* netdevsim3[69]: -1 at udp_tunnel_nic_unregister (Final destruction)
* Result: Total sum for udp_tunnel_nic is +1, leaving balance is 1 for the device
registration tracker. The NETDEV_UNREGISTER notice fired inside
__dev_change_net_namespace() was completely skipped due to the early return path.
Reported-by: syzbot+e2af46126e0644cbebdd@syzkaller.appspotmail.com
Analyzed-by: AI mode in Google search (no mail address)
[-- Attachment #2: 15f44cb9580000.txt --]
[-- Type: text/plain, Size: 83210 bytes --]
unregister_netdevice: waiting for netdevsim3 to become free. Usage count = 2
balance for netdevsim3@dst_entry is unknown
Call trace for netdevsim3[1] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
rx_queue_add_kobject net/core/net-sysfs.c:1236 [inline]
net_rx_queue_update_kobjects+0x166/0x790 net/core/net-sysfs.c:1301
register_queue_kobjects net/core/net-sysfs.c:2093 [inline]
netdev_register_kobject+0x21f/0x310 net/core/net-sysfs.c:2341
register_netdevice+0x1455/0x1ed0 net/core/dev.c:11452
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
Call trace for netdevsim3[2] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
netdev_queue_add_kobject net/core/net-sysfs.c:1973 [inline]
netdev_queue_update_kobjects+0x16d/0x6b0 net/core/net-sysfs.c:2035
register_queue_kobjects net/core/net-sysfs.c:2098 [inline]
netdev_register_kobject+0x258/0x310 net/core/net-sysfs.c:2341
register_netdevice+0x1455/0x1ed0 net/core/dev.c:11452
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
Call trace for netdevsim3[3] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold+0x27/0xc0 include/linux/netdevice.h:4566
register_netdevice+0x176b/0x1ed0 net/core/dev.c:11476
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
Call trace for netdevsim3[4] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline]
netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
Call trace for netdevsim3[5] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline]
netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
Call trace for netdevsim3[6] -11 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dev_put include/linux/netdevice.h:4601 [inline]
netdevice_event_work_handler+0x136/0x270 drivers/infiniband/core/roce_gid_mgmt.c:652
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[7] -11 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dev_put include/linux/netdevice.h:4601 [inline]
netdevice_event_work_handler+0x1c1/0x270 drivers/infiniband/core/roce_gid_mgmt.c:653
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[8] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773
inetdev_init+0x117/0x4e0 net/ipv4/devinet.c:280
inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
Call trace for netdevsim3[9] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
inetdev_init+0x19a/0x4e0 net/ipv4/devinet.c:286
inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
Call trace for netdevsim3[10] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773
ipv6_add_dev+0x44b/0x1420 net/ipv6/addrconf.c:403
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
Call trace for netdevsim3[11] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
ipv6_add_dev+0x4ec/0x1420 net/ipv6/addrconf.c:411
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
Call trace for netdevsim3[12] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
udp_tunnel_nic_netdevice_event+0xb21/0x1870 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
register_netdevice+0x18c0/0x1ed0 net/core/dev.c:11490
nsim_init_netdevsim drivers/net/netdevsim/netdev.c:1070 [inline]
nsim_create+0xbe9/0x1160 drivers/net/netdevsim/netdev.c:1152
__nsim_dev_port_add+0x7f8/0xcd0 drivers/net/netdevsim/dev.c:1509
nsim_dev_port_add_all+0x37/0xf0 drivers/net/netdevsim/dev.c:1570
nsim_drv_probe+0x8d6/0xc00 drivers/net/netdevsim/dev.c:1731
call_driver_probe drivers/base/dd.c:-1 [inline]
really_probe+0x254/0xae0 drivers/base/dd.c:706
__driver_probe_device+0x1e8/0x360 drivers/base/dd.c:868
driver_probe_device+0x4f/0x240 drivers/base/dd.c:898
__device_attach_driver+0x270/0x410 drivers/base/dd.c:1026
bus_for_each_drv+0x25b/0x2f0 drivers/base/bus.c:500
__device_attach+0x2c7/0x450 drivers/base/dd.c:1098
device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1153
bus_probe_device+0x12d/0x220 drivers/base/bus.c:620
device_add+0x7d7/0xb80 drivers/base/core.c:3772
nsim_bus_dev_new drivers/net/netdevsim/bus.c:471 [inline]
new_device_store+0x37b/0x710 drivers/net/netdevsim/bus.c:191
kernfs_fop_write_iter+0x3a5/0x540 fs/kernfs/file.c:345
new_sync_write fs/read_write.c:595 [inline]
vfs_write+0x61e/0xbb0 fs/read_write.c:687
ksys_write+0x156/0x270 fs/read_write.c:739
Call trace for netdevsim3[13] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
netdev_work_enqueue+0x15e/0x2b0 net/core/netdev_work.c:36
dev_set_rx_mode+0x66/0xa0 net/core/dev_addr_lists.c:1393
__dev_open+0x691/0x850 net/core/dev.c:1710
__dev_change_flags+0x329/0x820 net/core/dev.c:9764
netif_change_flags+0x7c/0x1b0 net/core/dev.c:9829
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
__sock_sendmsg net/socket.c:825 [inline]
__sys_sendto+0x41e/0x5d0 net/socket.c:2292
__do_sys_sendto net/socket.c:2299 [inline]
__se_sys_sendto net/socket.c:2295 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2295
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim3[14] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
qdisc_alloc+0x682/0xa00 net/sched/sch_generic.c:1030
qdisc_create_dflt+0x8e/0x4e0 net/sched/sch_generic.c:1053
attach_one_default_qdisc net/sched/sch_generic.c:1219 [inline]
netdev_for_each_tx_queue include/linux/netdevice.h:2745 [inline]
attach_default_qdiscs net/sched/sch_generic.c:1237 [inline]
dev_activate+0x37a/0x1150 net/sched/sch_generic.c:1296
__dev_open+0x699/0x850 net/core/dev.c:1711
__dev_change_flags+0x329/0x820 net/core/dev.c:9764
netif_change_flags+0x7c/0x1b0 net/core/dev.c:9829
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[15] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline]
netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[16] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline]
netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[17] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025
fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914
ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966
addrconf_add_mroute+0x2d1/0x370 net/ipv6/addrconf.c:2568
addrconf_add_dev net/ipv6/addrconf.c:2586 [inline]
addrconf_dev_config net/ipv6/addrconf.c:3507 [inline]
addrconf_init_auto_addrs+0x4d7/0xa50 net/ipv6/addrconf.c:3595
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[18] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025
fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914
addrconf_f6i_alloc+0x3b7/0x630 net/ipv6/route.c:4706
ipv6_add_addr+0x59c/0x11b0 net/ipv6/addrconf.c:1132
addrconf_add_linklocal+0x209/0x490 net/ipv6/addrconf.c:3334
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[19] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:903
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
ipv6_add_addr+0xeb6/0x11b0 net/ipv6/addrconf.c:1193
addrconf_add_linklocal+0x209/0x490 net/ipv6/addrconf.c:3334
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[20] -2 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dev_put include/linux/netdevice.h:4601 [inline]
update_gid_event_work_handler+0x84/0xf0 drivers/infiniband/core/roce_gid_mgmt.c:834
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[21] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
dev_get_by_index+0x1ae/0x2e0 net/core/dev.c:1002
netdev_get_by_index+0x25/0xb0 net/core/dev.c:1025
fib6_nh_init+0x285/0x1e60 net/ipv6/route.c:3615
ip6_route_info_create_nh+0x16a/0xad0 net/ipv6/route.c:3914
ip6_route_add+0x6e/0x1d0 net/ipv6/route.c:3966
addrconf_prefix_route+0x3a2/0x480 net/ipv6/addrconf.c:2504
addrconf_add_linklocal+0x262/0x490 net/ipv6/addrconf.c:3336
addrconf_addr_gen+0x2f8/0x360 net/ipv6/addrconf.c:3470
addrconf_notify+0xb1e/0x1050 net/ipv6/addrconf.c:3775
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_notify_flags+0x31e/0x510 net/core/dev.c:9805
netif_change_flags+0xde/0x1b0 net/core/dev.c:9834
do_setlink+0xdd6/0x4670 net/core/rtnetlink.c:3246
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[22] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
netdev_work_dequeue+0x23e/0x2d0 net/core/netdev_work.c:57
netif_rx_mode_sync+0x1c/0x50 net/core/dev_addr_lists.c:1410
do_setlink+0x3c9f/0x4670 net/core/rtnetlink.c:3500
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
__sock_sendmsg net/socket.c:825 [inline]
__sys_sendto+0x41e/0x5d0 net/socket.c:2292
__do_sys_sendto net/socket.c:2299 [inline]
__se_sys_sendto net/socket.c:2295 [inline]
__x64_sys_sendto+0xde/0x100 net/socket.c:2295
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
entry_SYSCALL_64_after_hwframe+0x77/0x7f
Call trace for netdevsim3[23] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
netdev_work_enqueue+0x15e/0x2b0 net/core/netdev_work.c:36
__dev_mc_add net/core/dev_addr_lists.c:1002 [inline]
dev_mc_add+0xd2/0x140 net/core/dev_addr_lists.c:1016
igmp6_group_added+0x22b/0x7c0 net/ipv6/mcast.c:681
__ipv6_dev_mc_inc+0x88e/0xa40 net/ipv6/mcast.c:973
addrconf_join_solict net/ipv6/addrconf.c:2262 [inline]
addrconf_dad_begin net/ipv6/addrconf.c:4134 [inline]
addrconf_dad_work+0x5dd/0x16e0 net/ipv6/addrconf.c:4262
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[24] +2 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859
mld_send_cr net/ipv6/mcast.c:2171 [inline]
mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[25] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325
mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870
mld_send_cr net/ipv6/mcast.c:2171 [inline]
mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[26] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
netdev_work_proc+0xdc/0x7f0 net/core/netdev_work.c:136
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[27] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
netdev_work_proc+0x3c5/0x7f0 net/core/netdev_work.c:148
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[28] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
netdev_work_proc+0x64e/0x7f0 net/core/netdev_work.c:158
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[29] -11 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dst_destroy+0x13e/0x590 net/core/dst.c:192
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core kernel/rcu/tree.c:2897 [inline]
rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985
smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[30] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
ndisc_send_skb+0x42f/0x1650 net/ipv6/ndisc.c:491
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:671
addrconf_dad_work+0xc37/0x16e0 net/ipv6/addrconf.c:4317
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[31] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:512
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:671
addrconf_dad_work+0xc37/0x16e0 net/ipv6/addrconf.c:4317
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[32] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859
ipv6_mc_dad_complete+0x87/0x410 net/ipv6/mcast.c:2296
addrconf_dad_completed+0x622/0xe60 net/ipv6/addrconf.c:4375
addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[33] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
ndisc_send_skb+0x42f/0x1650 net/ipv6/ndisc.c:491
addrconf_dad_completed+0x6e3/0xe60 net/ipv6/addrconf.c:4395
addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[34] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:512
addrconf_dad_completed+0x6e3/0xe60 net/ipv6/addrconf.c:4395
addrconf_dad_work+0xdda/0x16e0 net/ipv6/addrconf.c:-1
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[35] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
mld_sendpack+0x697/0xe10 net/ipv6/mcast.c:1859
mld_dad_work+0x3d/0x480 net/ipv6/mcast.c:2311
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[36] +5 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dst_init+0x59/0x490 net/core/dst.c:128
dst_alloc+0x12a/0x170 net/core/dst.c:171
ip6_dst_alloc net/ipv6/route.c:342 [inline]
icmp6_dst_alloc+0x75/0x450 net/ipv6/route.c:3346
ndisc_send_skb+0x42f/0x1650 net/ipv6/ndisc.c:491
addrconf_rs_timer+0x2d2/0x6c0 net/ipv6/addrconf.c:4072
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
Call trace for netdevsim3[37] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937
neigh_remove_one+0x44c/0x4a0 net/core/neighbour.c:249
neigh_forced_gc net/core/neighbour.c:280 [inline]
neigh_alloc net/core/neighbour.c:509 [inline]
___neigh_create+0x4ac/0x23a0 net/core/neighbour.c:652
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:512
ndisc_send_ns+0xd7/0x160 net/ipv6/ndisc.c:671
addrconf_dad_work+0xc37/0x16e0 net/ipv6/addrconf.c:4317
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[38] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937
neigh_remove_one+0x44c/0x4a0 net/core/neighbour.c:249
neigh_forced_gc net/core/neighbour.c:280 [inline]
neigh_alloc net/core/neighbour.c:509 [inline]
___neigh_create+0x4ac/0x23a0 net/core/neighbour.c:652
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK+0x177/0x4f0 include/linux/netfilter.h:325
mld_sendpack+0x890/0xe10 net/ipv6/mcast.c:1870
mld_send_cr net/ipv6/mcast.c:2171 [inline]
mld_ifc_work+0x842/0xd60 net/ipv6/mcast.c:2711
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[39] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937
neigh_remove_one+0x44c/0x4a0 net/core/neighbour.c:249
neigh_forced_gc net/core/neighbour.c:280 [inline]
neigh_alloc net/core/neighbour.c:509 [inline]
___neigh_create+0x4ac/0x23a0 net/core/neighbour.c:652
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x2d2/0x6c0 net/ipv6/addrconf.c:4072
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
Call trace for netdevsim3[40] +2 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
___neigh_create+0xd54/0x23a0 net/core/neighbour.c:661
ip6_finish_output2+0x6d6/0x1410 net/ipv6/ip6_output.c:128
NF_HOOK_COND include/linux/netfilter.h:314 [inline]
ip6_output+0x337/0x540 net/ipv6/ip6_output.c:246
dst_output include/net/dst.h:489 [inline]
NF_HOOK include/linux/netfilter.h:325 [inline]
ndisc_send_skb+0xcb2/0x1650 net/ipv6/ndisc.c:512
addrconf_rs_timer+0x2d2/0x6c0 net/ipv6/addrconf.c:4072
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
Call trace for netdevsim3[41] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937
neigh_periodic_work+0xb7b/0xe90 net/core/neighbour.c:1026
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
process_scheduled_works kernel/workqueue.c:3462 [inline]
worker_thread+0xb05/0x10d0 kernel/workqueue.c:3543
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[42] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
linkwatch_add_event net/core/link_watch.c:131 [inline]
linkwatch_fire_event+0x157/0x210 net/core/link_watch.c:324
nsim_stop+0x88/0x430 drivers/net/netdevsim/netdev.c:550
__dev_close_many+0x366/0x6e0 net/core/dev.c:1776
netif_close_many+0x249/0x660 net/core/dev.c:1802
netif_close net/core/dev.c:1820 [inline]
__dev_change_net_namespace+0x8d9/0x1de0 net/core/dev.c:12753
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[43] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_destroy+0x383/0x5f0 net/core/neighbour.c:937
neigh_flush_dev net/core/neighbour.c:433 [inline]
__neigh_ifdown+0x1f9/0x8f0 net/core/neighbour.c:466
neigh_ifdown+0x1f/0x30 net/core/neighbour.c:489
rt6_disable_ip+0x7af/0x820 net/ipv6/route.c:5035
addrconf_ifdown+0x157/0x1a00 net/ipv6/addrconf.c:3888
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
netif_close_many+0x463/0x660 net/core/dev.c:1807
netif_close net/core/dev.c:1820 [inline]
__dev_change_net_namespace+0x8d9/0x1de0 net/core/dev.c:12753
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
__sock_sendmsg net/socket.c:825 [inline]
____sys_sendmsg+0x565/0x870 net/socket.c:2727
___sys_sendmsg+0x2a5/0x360 net/socket.c:2781
__sys_sendmsg net/socket.c:2813 [inline]
__do_sys_sendmsg net/socket.c:2818 [inline]
__se_sys_sendmsg net/socket.c:2816 [inline]
__x64_sys_sendmsg+0x1b7/0x290 net/socket.c:2816
do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]
do_syscall_64+0x17b/0x530 arch/x86/entry/syscall_64.c:85
Call trace for netdevsim3[44] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
addr_event+0x302/0x480 drivers/infiniband/core/roce_gid_mgmt.c:870
inet6addr_event+0x9f/0xd0 drivers/infiniband/core/roce_gid_mgmt.c:903
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223
addrconf_ifdown+0xfcf/0x1a00 net/ipv6/addrconf.c:4013
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
netif_close_many+0x463/0x660 net/core/dev.c:1807
netif_close net/core/dev.c:1820 [inline]
__dev_change_net_namespace+0x8d9/0x1de0 net/core/dev.c:12753
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[45] -3 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
fib_nh_common_release+0x5c/0x430 net/ipv4/fib_semantics.c:204
fib6_info_destroy_rcu+0xca/0x1c0 net/ipv6/ip6_fib.c:177
rcu_do_batch kernel/rcu/tree.c:2645 [inline]
rcu_core kernel/rcu/tree.c:2897 [inline]
rcu_cpu_kthread+0x950/0x1480 kernel/rcu/tree.c:2985
smpboot_thread_fn+0x57c/0xa80 kernel/smpboot.c:160
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[46] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
__qdisc_destroy+0x20e/0x480 net/sched/sch_generic.c:1126
qdisc_put net/sched/sch_generic.c:1150 [inline]
dev_shutdown+0x352/0x450 net/sched/sch_generic.c:1515
__dev_change_net_namespace+0xbc1/0x1de0 net/core/dev.c:12766
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[47] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline]
netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[48] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline]
netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[49] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812
inetdev_destroy net/ipv4/devinet.c:335 [inline]
inetdev_event+0x7d6/0x15e0 net/ipv4/devinet.c:1655
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[50] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
in_dev_put include/linux/inetdevice.h:290 [inline]
inetdev_destroy net/ipv4/devinet.c:338 [inline]
inetdev_event+0x81d/0x15e0 net/ipv4/devinet.c:1655
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[51] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812
addrconf_ifdown+0x173a/0x1a00 net/ipv6/addrconf.c:4042
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[52] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:176
in6_dev_put include/net/addrconf.h:426 [inline]
addrconf_ifdown+0x178c/0x1a00 net/ipv6/addrconf.c:4044
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0xcbb/0x1de0 net/core/dev.c:12776
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[53] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline]
netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[54] +3 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline]
netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[55] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773
inetdev_init+0x117/0x4e0 net/ipv4/devinet.c:280
inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[56] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
inetdev_init+0x19a/0x4e0 net/ipv4/devinet.c:286
inetdev_event+0x307/0x15e0 net/ipv4/devinet.c:1590
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[57] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
neigh_parms_alloc+0x192/0x540 net/core/neighbour.c:1773
ipv6_add_dev+0x44b/0x1420 net/ipv6/addrconf.c:403
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[58] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
ipv6_add_dev+0x4ec/0x1420 net/ipv6/addrconf.c:411
addrconf_notify+0x771/0x1050 net/ipv6/addrconf.c:3685
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[59] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
udp_tunnel_nic_register net/ipv4/udp_tunnel_nic.c:850 [inline]
udp_tunnel_nic_netdevice_event+0xb21/0x1870 net/ipv4/udp_tunnel_nic.c:931
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
__dev_change_net_namespace+0x18af/0x1de0 net/core/dev.c:12838
do_setlink+0x2d1/0x4670 net/core/rtnetlink.c:3148
rtnl_changelink net/core/rtnetlink.c:3885 [inline]
__rtnl_newlink net/core/rtnetlink.c:4056 [inline]
rtnl_newlink+0x15a3/0x1c30 net/core/rtnetlink.c:4195
rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7112
netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2556
netlink_unicast_kernel net/netlink/af_netlink.c:1319 [inline]
netlink_unicast+0x7f5/0x990 net/netlink/af_netlink.c:1345
netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1900
sock_sendmsg_nosec+0x13a/0x180 net/socket.c:810
Call trace for netdevsim3[60] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
__linkwatch_run_queue+0x608/0x810 net/core/link_watch.c:246
linkwatch_event+0x4c/0x60 net/core/link_watch.c:314
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[61] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
aoecmd_cfg_pkts drivers/block/aoe/aoecmd.c:424 [inline]
aoecmd_cfg+0x217/0x840 drivers/block/aoe/aoecmd.c:1374
call_timer_fn+0x192/0x5e0 kernel/time/timer.c:1748
expire_timers kernel/time/timer.c:1799 [inline]
__run_timers kernel/time/timer.c:2374 [inline]
__run_timer_base+0x67b/0x9b0 kernel/time/timer.c:2386
run_timer_base kernel/time/timer.c:2395 [inline]
run_timer_softirq+0xb7/0x170 kernel/time/timer.c:2405
handle_softirqs+0x1d9/0x6c0 kernel/softirq.c:626
Call trace for netdevsim3[62] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dev_put include/linux/netdevice.h:4601 [inline]
tx+0xc6/0x190 drivers/block/aoe/aoenet.c:66
kthread+0x1ed/0x420 drivers/block/aoe/aoecmd.c:1241
kthread+0x388/0x470 kernel/kthread.c:436
ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158
ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245
Call trace for netdevsim3[63] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:674 [inline]
netdevice_event+0x4e1/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[64] +1 at
__dev_hold include/linux/netdevice.h:4523 [inline]
netdev_hold include/linux/netdevice.h:4566 [inline]
dev_hold include/linux/netdevice.h:4589 [inline]
netdevice_queue_work drivers/infiniband/core/roce_gid_mgmt.c:675 [inline]
netdevice_event+0x592/0x8c0 drivers/infiniband/core/roce_gid_mgmt.c:822
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[65] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812
inetdev_destroy net/ipv4/devinet.c:335 [inline]
inetdev_event+0x7d6/0x15e0 net/ipv4/devinet.c:1655
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[66] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
in_dev_finish_destroy+0xa7/0x1a0 net/ipv4/devinet.c:258
in_dev_put include/linux/inetdevice.h:290 [inline]
inetdev_destroy net/ipv4/devinet.c:338 [inline]
inetdev_event+0x81d/0x15e0 net/ipv4/devinet.c:1655
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[67] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
neigh_parms_release+0x1b0/0x240 net/core/neighbour.c:1812
addrconf_ifdown+0x173a/0x1a00 net/ipv6/addrconf.c:4042
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[68] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
in6_dev_finish_destroy+0xdd/0x1e0 net/ipv6/addrconf_core.c:176
in6_dev_put include/net/addrconf.h:426 [inline]
addrconf_ifdown+0x178c/0x1a00 net/ipv6/addrconf.c:4044
addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[69] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
dev_put include/linux/netdevice.h:4601 [inline]
udp_tunnel_nic_unregister net/ipv4/udp_tunnel_nic.c:913 [inline]
udp_tunnel_nic_netdevice_event+0x1601/0x1870 net/ipv4/udp_tunnel_nic.c:942
notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85
call_netdevice_notifiers_extack net/core/dev.c:2292 [inline]
call_netdevice_notifiers net/core/dev.c:2306 [inline]
unregister_netdevice_many_notify+0x17de/0x2120 net/core/dev.c:12482
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[70] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
rx_queue_release+0x11d/0x190 net/core/net-sysfs.c:1160
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
net_rx_queue_update_kobjects+0x6d0/0x790 net/core/net-sysfs.c:1317
remove_queue_kobjects net/core/net-sysfs.c:2148 [inline]
netdev_unregister_kobject+0xff/0x450 net/core/net-sysfs.c:2304
unregister_netdevice_many_notify+0x1bb1/0x2120 net/core/dev.c:12515
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[71] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
netdev_queue_release+0x6a/0xd0 net/core/net-sysfs.c:1910
kobject_cleanup lib/kobject.c:689 [inline]
kobject_release lib/kobject.c:720 [inline]
kref_put include/linux/kref.h:65 [inline]
kobject_put+0x222/0x550 lib/kobject.c:737
netdev_queue_update_kobjects+0x5d1/0x6b0 net/core/net-sysfs.c:2052
remove_queue_kobjects net/core/net-sysfs.c:2149 [inline]
netdev_unregister_kobject+0x10b/0x450 net/core/net-sysfs.c:2304
unregister_netdevice_many_notify+0x1bb1/0x2120 net/core/dev.c:12515
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
Call trace for netdevsim3[72] -1 at
__dev_put include/linux/netdevice.h:4509 [inline]
netdev_put include/linux/netdevice.h:4576 [inline]
unregister_netdevice_many_notify+0x1df8/0x2120 net/core/dev.c:12535
unregister_netdevice_many net/core/dev.c:12553 [inline]
unregister_netdevice_queue+0x2f5/0x340 net/core/dev.c:12355
unregister_netdevice include/linux/netdevice.h:3483 [inline]
nsim_destroy+0x275/0x800 drivers/net/netdevsim/netdev.c:1196
__nsim_dev_port_del+0x14e/0x200 drivers/net/netdevsim/dev.c:1547
nsim_dev_port_del_all drivers/net/netdevsim/dev.c:1561 [inline]
nsim_dev_reload_destroy+0x288/0x490 drivers/net/netdevsim/dev.c:1785
nsim_dev_reload_down+0x8a/0xc0 drivers/net/netdevsim/dev.c:1038
devlink_reload+0x1c5/0x890 net/devlink/dev.c:462
devlink_pernet_pre_exit+0x1ff/0x420 net/devlink/core.c:578
ops_pre_exit_list net/core/net_namespace.c:161 [inline]
ops_undo_list+0x17d/0x8d0 net/core/net_namespace.c:235
cleanup_net+0x575/0x810 net/core/net_namespace.c:706
process_one_work+0xaaf/0x1480 kernel/workqueue.c:3379
balance as of netdevsim3[72] is 1
^ permalink raw reply
* Re: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Weiming Shi @ 2026-07-18 9:28 UTC (permalink / raw)
To: Tung Quang Nguyen
Cc: netdev@vger.kernel.org, tipc-discussion@lists.sourceforge.net,
linux-kernel@vger.kernel.org, xmei5@asu.edu, Jon Maloy,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Simon Horman
In-Reply-To: <CANgPUi31G4DvrBPDRGniPDzWTUKo_3HQL8W1nq8BMmtnp8Fa+g@mail.gmail.com>
Weiming Shi <bestswngs@gmail.com> 于2026年7月18日周六 03:00写道：
>
> Weiming Shi <bestswngs@gmail.com> 于2026年7月18日周六 02:34写道：
> >
> > Tung Quang Nguyen <tung.quang.nguyen@est.tech> 于2026年7月17日周五 17:48写道：
> > >
> > > >Subject: [PATCH net v4 2/2] tipc: fix NULL deref in tipc_named_node_up() on
> > > >empty publication list
> > > >
> > > >named_distribute() ends by stamping the last_bulk flag on the tail skb via
> > > >buf_msg(skb_peek_tail(list)). When the publication list is empty no skb is
> > > >enqueued, skb_peek_tail() returns NULL, and buf_msg(NULL) is dereferenced.
> > > >
> > > >tipc_named_node_up() runs this on &nt->cluster_scope. With a node-id
> > > >configuration cluster_scope is populated only later by tipc_net_finalize(), so a
> > > >peer link that comes up first reaches named_distribute() with an empty list. It
> > > >is reachable by an unprivileged user (TIPC genl ops use
> > > >GENL_UNS_ADMIN_PERM) over a UDP bearer in a user+net namespace:
> > > >
> > > > KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
> > > > RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196)
> > > > tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221)
> > > > tipc_node_write_unlock (net/tipc/node.c:428)
> > > > tipc_rcv (net/tipc/node.c:2185)
> > > > tipc_udp_recv (net/tipc/udp_media.c:392) Kernel panic - not syncing: Fatal
> > > >exception in interrupt
> > > >
> > > >The peer holds back this node's later name updates until it sees a bulk with the
> > > >last_bulk flag, so simply skipping the send would stall it. Emit an item-less bulk
> > > >when the publication list is empty, so the peer still receives the last_bulk flag
> > > >and opens.
> > > >
> > > >Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
> > > >Reported-by: Xiang Mei <xmei5@asu.edu>
> > > >Assisted-by: Claude:claude-opus-4-8
> > > >Signed-off-by: Weiming Shi <bestswngs@gmail.com>
> > > >---
> > > > net/tipc/name_distr.c | 14 ++++++++++++++
> > > > 1 file changed, 14 insertions(+)
> > > >
> > > >diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c index
> > > >ba4f4906e13b..a8bb7bd101ea 100644
> > > >--- a/net/tipc/name_distr.c
> > > >+++ b/net/tipc/name_distr.c
> > > >@@ -192,6 +192,20 @@ static void named_distribute(struct net *net, struct
> > > >sk_buff_head *list,
> > > > skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));
> > > > __skb_queue_tail(list, skb);
> > > > }
> > > >+
> > > >+ if (skb_queue_empty(list)) {
> > > >+ skb = named_prepare_buf(net, PUBLICATION, 0, dnode);
> > > >+ if (!skb) {
> > > >+ pr_warn("Bulk publication failure\n");
> > > >+ return;
> > > >+ }
> > > >+ hdr = buf_msg(skb);
> > > >+ msg_set_bc_ack_invalid(hdr, true);
> > > >+ msg_set_bulk(hdr);
> > > >+ msg_set_non_legacy(hdr);
> > > >+ __skb_queue_tail(list, skb);
> > > >+ }
> > > As I explained before, this approach is wrong because
> > > 1. It does not handle memory allocation failure.
> > > 2. It breaks receiving peer by sending non-data message to that peer in case skb is not NULL.
> > >
> > > Could you please test below patch to see if it fixes the NULL dereference issue you reported ?
> >
> > Hi ,
> > Tested your patch, it fixes the NULL dereference I reported. No more
> > panic with an empty cluster_scope .
> >
> > One new bug found during testing: if tipc_nametbl_publish() fails in
> > tipc_net_finalize(), the node is
> > still marked finalized, so the deferred worker wakes up and calls
> > named_distribute() with an empty list,
> > hitting the same NULL dereference.
> >
> > I have the fix ready and sent it out:
> >
> > https://lore.kernel.org/all/20260717183047.2725959-1-bestswngs@gmail.com/
> > https://lore.kernel.org/all/20260717183047.2725959-2-bestswngs@gmail.com/
> > https://lore.kernel.org/all/20260717183047.2725959-3-bestswngs@gmail.com/
> >
> > Thanks,
> > Weiming Shi
> >
>
> Hi,
> The v5 I sent earlier was incomplete. It only carried the two
> follow-up patches and depended on Tung's
> patch from this thread as its base, which made the series hard to
> apply on its own.
>
> I have resent the series as v6:
> https://lore.kernel.org/all/20260717185701.2828080-1-bestswngs@gmail.com/
>
> Sorry for the noise.
Sorry for the noise. This is the latest version, with some modifications made.
https://lore.kernel.org/all/20260718092544.785289-1-bestswngs@gmail.com/
> > >
> > > ---
> > > net/tipc/core.c | 1 +
> > > net/tipc/core.h | 2 ++
> > > net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++----
> > > net/tipc/name_distr.h | 3 ++-
> > > net/tipc/net.c | 2 ++
> > > net/tipc/node.c | 34 ++++++++++++++++++++++++++++--
> > > 6 files changed, 83 insertions(+), 7 deletions(-)
> > >
> > > diff --git a/net/tipc/core.c b/net/tipc/core.c
> > > index 315975c3be81..9e81be4f01cf 100644
> > > --- a/net/tipc/core.c
> > > +++ b/net/tipc/core.c
> > > @@ -61,6 +61,7 @@ static int __net_init tipc_init_net(struct net *net)
> > > tn->trial_addr = 0;
> > > tn->addr_trial_end = 0;
> > > tn->capabilities = TIPC_NODE_CAPABILITIES;
> > > + atomic_set(&tn->finalized, 0);
> > > INIT_WORK(&tn->work, tipc_net_finalize_work);
> > > memset(tn->node_id, 0, sizeof(tn->node_id));
> > > memset(tn->node_id_string, 0, sizeof(tn->node_id_string));
> > > diff --git a/net/tipc/core.h b/net/tipc/core.h
> > > index 9ce5f9ff6cc0..76768844c808 100644
> > > --- a/net/tipc/core.h
> > > +++ b/net/tipc/core.h
> > > @@ -145,6 +145,8 @@ struct tipc_net {
> > > struct work_struct work;
> > > /* The numbers of work queues in schedule */
> > > atomic_t wq_count;
> > > + /* flag to indicate work has finished */
> > > + atomic_t finalized;
> > > };
> > >
> > > static inline struct tipc_net *tipc_net(struct net *net)
> > > diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
> > > index ba5f4906e13b..8a1692dbd243 100644
> > > --- a/net/tipc/name_distr.c
> > > +++ b/net/tipc/name_distr.c
> > > @@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)
> > > * @pls: linked list of publication items to be packed into buffer chain
> > > * @seqno: sequence number for this message
> > > */
> > > -static void named_distribute(struct net *net, struct sk_buff_head *list,
> > > +static int named_distribute(struct net *net, struct sk_buff_head *list,
> > > u32 dnode, struct list_head *pls, u16 seqno)
> > > {
> > > struct publication *publ;
> > > @@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
> > > skb = named_prepare_buf(net, PUBLICATION, msg_rem,
> > > dnode);
> > > if (!skb) {
> > > + __skb_queue_purge(list);
> > > pr_warn("Bulk publication failure\n");
> > > - return;
> > > + return 1;
> > > }
> > > hdr = buf_msg(skb);
> > > msg_set_bc_ack_invalid(hdr, true);
> > > @@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
> > > hdr = buf_msg(skb_peek_tail(list));
> > > msg_set_last_bulk(hdr);
> > > msg_set_named_seqno(hdr, seqno);
> > > +
> > > + return 0;
> > > }
> > >
> > > /**
> > > @@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
> > > * @dnode: destination node
> > > * @capabilities: peer node's capabilities
> > > */
> > > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
> > > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
> > > {
> > > struct name_table *nt = tipc_name_table(net);
> > > struct tipc_net *tn = tipc_net(net);
> > > @@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
> > > spin_unlock_bh(&tn->nametbl_lock);
> > >
> > > read_lock_bh(&nt->cluster_scope_lock);
> > > - named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
> > > + /* tipc_net_finalize_work() has not finished inserting self address to
> > > + * name table yet.
> > > + */
> > > + if (unlikely(list_empty(&nt->cluster_scope))) {
> > > + read_unlock_bh(&nt->cluster_scope_lock);
> > > + return 1;
> > > + }
> > > +
> > > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
> > > + read_unlock_bh(&nt->cluster_scope_lock);
> > > + return -ENOBUFS;
> > > + }
> > > +
> > > tipc_node_xmit(net, &head, dnode, 0);
> > > read_unlock_bh(&nt->cluster_scope_lock);
> > > + return 0;
> > > +}
> > > +
> > > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
> > > +{
> > > + struct name_table *nt = tipc_name_table(net);
> > > + struct tipc_net *tn = tipc_net(net);
> > > + struct sk_buff_head head;
> > > + u16 seqno;
> > > +
> > > + __skb_queue_head_init(&head);
> > > + wait_var_event(&tn->finalized, atomic_read(&tn->finalized));
> > > + spin_lock_bh(&tn->nametbl_lock);
> > > + seqno = nt->snd_nxt;
> > > + spin_unlock_bh(&tn->nametbl_lock);
> > > +
> > > + read_lock_bh(&nt->cluster_scope_lock);
> > > + if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
> > > + read_unlock_bh(&nt->cluster_scope_lock);
> > > + return -ENOBUFS;
> > > + }
> > > + tipc_node_xmit(net, &head, dnode, 0);
> > > + read_unlock_bh(&nt->cluster_scope_lock);
> > > +
> > > + return 0;
> > > }
> > >
> > > /**
> > > diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
> > > index c677f6f082df..cadf4e8c3e66 100644
> > > --- a/net/tipc/name_distr.h
> > > +++ b/net/tipc/name_distr.h
> > > @@ -69,7 +69,8 @@ struct distr_item {
> > >
> > > struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);
> > > struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);
> > > -void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
> > > +int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
> > > +int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);
> > > void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,
> > > u16 *rcv_nxt, bool *open);
> > > void tipc_named_reinit(struct net *net);
> > > diff --git a/net/tipc/net.c b/net/tipc/net.c
> > > index 7e65d0b0c4a8..4c144e720ac1 100644
> > > --- a/net/tipc/net.c
> > > +++ b/net/tipc/net.c
> > > @@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
> > > tipc_sk_reinit(net);
> > > tipc_mon_reinit_self(net);
> > > tipc_nametbl_publish(net, &ua, &sk, addr);
> > > + atomic_inc(&tn->finalized);
> > > + wake_up_var(&tn->finalized);
> > > }
> > >
> > > void tipc_net_finalize_work(struct work_struct *work)
> > > diff --git a/net/tipc/node.c b/net/tipc/node.c
> > > index 8e4ef2630ae4..c5b0a98324c3 100644
> > > --- a/net/tipc/node.c
> > > +++ b/net/tipc/node.c
> > > @@ -145,6 +145,8 @@ struct tipc_node {
> > > #ifdef CONFIG_TIPC_CRYPTO
> > > struct tipc_crypto *crypto_rx;
> > > #endif
> > > + /* Work item for bulk distribution of cluster scope publications */
> > > + struct work_struct work;
> > > };
> > >
> > > /* Node FSM states and events:
> > > @@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)
> > > #ifdef CONFIG_TIPC_CRYPTO
> > > tipc_crypto_stop(&n->crypto_rx);
> > > #endif
> > > + cancel_work_sync(&n->work);
> > > kfree(n);
> > > }
> > >
> > > @@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)
> > > write_unlock_bh(&n->lock);
> > > }
> > >
> > > +static void tipc_node_dist_bulk(struct work_struct *work)
> > > +{
> > > + struct tipc_node *node = container_of(work, struct tipc_node, work);
> > > +
> > > + if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) {
> > > + u32 bearer_id = node->link_id & 0xffff;
> > > +
> > > + tipc_node_link_down(node, bearer_id, false);
> > > + }
> > > +
> > > + tipc_node_put(node);
> > > +}
> > > +
> > > static void tipc_node_write_unlock(struct tipc_node *n)
> > > __releases(n->lock)
> > > {
> > > @@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n)
> > > if (flags & TIPC_NOTIFY_NODE_DOWN)
> > > tipc_publ_notify(net, publ_list, node, n->capabilities);
> > >
> > > - if (flags & TIPC_NOTIFY_NODE_UP)
> > > - tipc_named_node_up(net, node, n->capabilities);
> > > + if (flags & TIPC_NOTIFY_NODE_UP) {
> > > + int rc = 0;
> > > +
> > > + rc = tipc_named_node_up(net, node, n->capabilities);
> > > + /* Defer bulk distribution to work queue */
> > > + if (rc > 0) {
> > > + tipc_node_get(n);
> > > + schedule_work(&n->work);
> > > + } else if (rc < 0) {
> > > + /* Bring the link down to start over bulk distribution
> > > + * when the link is up again.
> > > + */
> > > + tipc_node_link_down(n, bearer_id, false);
> > > + }
> > > + }
> > >
> > > if (flags & TIPC_NOTIFY_LINK_UP) {
> > > tipc_mon_peer_up(net, node, bearer_id);
> > > @@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
> > > INIT_LIST_HEAD(&n->list);
> > > INIT_LIST_HEAD(&n->publ_list);
> > > INIT_LIST_HEAD(&n->conn_sks);
> > > + INIT_WORK(&n->work, tipc_node_dist_bulk);
> > > skb_queue_head_init(&n->bc_entry.namedq);
> > > skb_queue_head_init(&n->bc_entry.inputq1);
> > > __skb_queue_head_init(&n->bc_entry.arrvq);
^ permalink raw reply
* [PATCH net v8 3/3] tipc: fix node reference leak when defer work is already pending
From: Weiming Shi @ 2026-07-18 9:25 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, linux-kernel
In-Reply-To: <20260718092544.785289-1-bestswngs@gmail.com>
In tipc_node_write_unlock(), TIPC_NOTIFY_NODE_UP with an empty
cluster_scope takes a node reference and schedules n->work. If the
link flaps down and up while that work is still pending, the next
NODE_UP takes another reference, but schedule_work() returns false
and the extra reference is never dropped. The tipc_node structure
leaks.
Verified by flapping the bearer while the work is pending: one
reference is leaked per repeated NODE_UP, while the work is put only
once when it finally runs.
Drop the reference when the work was already queued.
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/node.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index f757722d15be..f826347b5870 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -447,7 +447,8 @@ static void tipc_node_write_unlock(struct tipc_node *n)
/* Defer bulk distribution to work queue */
if (rc > 0) {
tipc_node_get(n);
- schedule_work(&n->work);
+ if (!schedule_work(&n->work))
+ tipc_node_put(n);
} else if (rc < 0) {
/* Bring the link down to start over bulk distribution
* when the link is up again.
--
2.43.0
^ permalink raw reply related
* [PATCH net v8 2/3] tipc: fix NULL deref in deferred bulk distribution on publish failure
From: Weiming Shi @ 2026-07-18 9:25 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, kernel test robot,
Hoang Huu Le, linux-kernel
In-Reply-To: <20260718092544.785289-1-bestswngs@gmail.com>
tipc_net_finalize() does not check the return value of
tipc_nametbl_publish(). If the publish fails, for example on a
GFP_ATOMIC allocation failure, the node state name never lands in
cluster_scope, but tn->finalized is still set. A worker deferred by
tipc_named_node_up() then wakes and calls named_distribute() with an
empty list. That replays the same unguarded buf_msg(skb_peek_tail(list))
tail stamp, this time on the tipc_node_dist_bulk workqueue:
KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
RIP: 0010:named_distribute (net/tipc/name_distr.c:200)
Workqueue: events tipc_node_dist_bulk
Call Trace:
tipc_named_dist_cluster_scope (net/tipc/name_distr.c:267)
tipc_node_dist_bulk (net/tipc/node.c:403)
process_one_work
worker_thread
Kernel panic - not syncing: Fatal exception in interrupt
Check the publish result and warn on failure, but still set finalized,
otherwise deferred workers would sleep forever. In
tipc_named_dist_cluster_scope() re-check cluster_scope after the wait
and skip the distribution when it is empty. This is a permanent
condition, so return 0 instead of an error, otherwise the link would
be bounced forever. Also guard the tail stamp in named_distribute()
itself, so a caller that misses the precondition gets a warning and a
link reset through the existing -ENOBUFS path instead of a crash.
Reproducing this needs an allocation failure during finalize, so I
verified it by stubbing out the publish call: both nodes log the
failure, the workers skip the distribution, no crash, no link flap.
The normal path is unchanged with the same two-node test.
Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/name_distr.c | 11 +++++++++++
net/tipc/net.c | 3 ++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index b764274df758..5b0fb09226fc 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -193,6 +193,10 @@ static int named_distribute(struct net *net, struct sk_buff_head *list,
skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));
__skb_queue_tail(list, skb);
}
+ if (skb_queue_empty(list)) {
+ pr_warn("Bulk publication list empty, nothing to distribute\n");
+ return 1;
+ }
hdr = buf_msg(skb_peek_tail(list));
msg_set_last_bulk(hdr);
msg_set_named_seqno(hdr, seqno);
@@ -253,6 +257,13 @@ int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
spin_unlock_bh(&tn->nametbl_lock);
read_lock_bh(&nt->cluster_scope_lock);
+ if (unlikely(list_empty(&nt->cluster_scope))) {
+ /* finalize is done but nothing was published (publish
+ * failed): a permanent state, nothing to synchronize.
+ */
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return 0;
+ }
if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
read_unlock_bh(&nt->cluster_scope_lock);
return -ENOBUFS;
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 4c144e720ac1..2aa8812c551a 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -138,7 +138,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
tipc_named_reinit(net);
tipc_sk_reinit(net);
tipc_mon_reinit_self(net);
- tipc_nametbl_publish(net, &ua, &sk, addr);
+ if (!tipc_nametbl_publish(net, &ua, &sk, addr))
+ pr_warn("Failed to publish own node state\n");
atomic_inc(&tn->finalized);
wake_up_var(&tn->finalized);
}
--
2.43.0
^ permalink raw reply related
* [PATCH net v8 1/3] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Weiming Shi @ 2026-07-18 9:25 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, kernel test robot, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Hoang Huu Le, linux-kernel
In-Reply-To: <20260718092544.785289-1-bestswngs@gmail.com>
[The defer-to-workqueue approach is by Tung Nguyen. He posted it
on the thread and asked us to test it, as the replacement for the
item-less bulk approach. Since the RFC only exists as an inline
diff in the thread, it is folded into this series so the fix is
self-contained.]
named_distribute() stamps the last_bulk flag on the tail skb of the
publication list. When the list is empty no skb is enqueued and the
tail access dereferences NULL. tipc_named_node_up() hits this on an
empty cluster_scope, which happens with a node-id configuration where
cluster_scope is populated only later by tipc_net_finalize(). It is
reachable by an unprivileged user over a UDP bearer in a user+net
namespace. The reported crash:
KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196)
tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221)
tipc_node_write_unlock (net/tipc/node.c:428)
tipc_rcv (net/tipc/node.c:2185)
tipc_udp_recv (net/tipc/udp_media.c:392)
Kernel panic - not syncing: Fatal exception in interrupt
When cluster_scope is empty at node-up, defer the bulk distribution
to a workqueue and wait for tipc_net_finalize() to publish the
node-state name, so named_distribute() always runs on a non-empty
list. On allocation failure, purge the partially built queue and
bring the link down so the bulk distribution restarts when the link
comes up again.
Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607180730.TwVgASDI-lkp@intel.com/
Signed-off-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Tested-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/core.c | 1 +
net/tipc/core.h | 2 ++
net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++----
net/tipc/name_distr.h | 3 ++-
net/tipc/net.c | 2 ++
net/tipc/node.c | 34 ++++++++++++++++++++++++++++--
6 files changed, 83 insertions(+), 7 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 434e70eabe08..ce164509d9e2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -60,6 +60,7 @@ static int __net_init tipc_init_net(struct net *net)
tn->trial_addr = 0;
tn->addr_trial_end = 0;
tn->capabilities = TIPC_NODE_CAPABILITIES;
+ atomic_set(&tn->finalized, 0);
INIT_WORK(&tn->work, tipc_net_finalize_work);
memset(tn->node_id, 0, sizeof(tn->node_id));
memset(tn->node_id_string, 0, sizeof(tn->node_id_string));
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 9ce5f9ff6cc0..76768844c808 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -145,6 +145,8 @@ struct tipc_net {
struct work_struct work;
/* The numbers of work queues in schedule */
atomic_t wq_count;
+ /* flag to indicate work has finished */
+ atomic_t finalized;
};
static inline struct tipc_net *tipc_net(struct net *net)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 190b49c5cbc3..b764274df758 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)
* @pls: linked list of publication items to be packed into buffer chain
* @seqno: sequence number for this message
*/
-static void named_distribute(struct net *net, struct sk_buff_head *list,
+static int named_distribute(struct net *net, struct sk_buff_head *list,
u32 dnode, struct list_head *pls, u16 seqno)
{
struct publication *publ;
@@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
skb = named_prepare_buf(net, PUBLICATION, msg_rem,
dnode);
if (!skb) {
+ __skb_queue_purge(list);
pr_warn("Bulk publication failure\n");
- return;
+ return 1;
}
hdr = buf_msg(skb);
msg_set_bc_ack_invalid(hdr, true);
@@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
hdr = buf_msg(skb_peek_tail(list));
msg_set_last_bulk(hdr);
msg_set_named_seqno(hdr, seqno);
+
+ return 0;
}
/**
@@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
* @dnode: destination node
* @capabilities: peer node's capabilities
*/
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
{
struct name_table *nt = tipc_name_table(net);
struct tipc_net *tn = tipc_net(net);
@@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
spin_unlock_bh(&tn->nametbl_lock);
read_lock_bh(&nt->cluster_scope_lock);
- named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
+ /* tipc_net_finalize_work() has not finished inserting self address to
+ * name table yet.
+ */
+ if (unlikely(list_empty(&nt->cluster_scope))) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return 1;
+ }
+
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+
tipc_node_xmit(net, &head, dnode, 0);
read_unlock_bh(&nt->cluster_scope_lock);
+ return 0;
+}
+
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
+{
+ struct name_table *nt = tipc_name_table(net);
+ struct tipc_net *tn = tipc_net(net);
+ struct sk_buff_head head;
+ u16 seqno;
+
+ __skb_queue_head_init(&head);
+ wait_var_event(&tn->finalized, atomic_read(&tn->finalized));
+ spin_lock_bh(&tn->nametbl_lock);
+ seqno = nt->snd_nxt;
+ spin_unlock_bh(&tn->nametbl_lock);
+
+ read_lock_bh(&nt->cluster_scope_lock);
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+ tipc_node_xmit(net, &head, dnode, 0);
+ read_unlock_bh(&nt->cluster_scope_lock);
+
+ return 0;
}
/**
diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
index c677f6f082df..cadf4e8c3e66 100644
--- a/net/tipc/name_distr.h
+++ b/net/tipc/name_distr.h
@@ -69,7 +69,8 @@ struct distr_item {
struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);
struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);
void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,
u16 *rcv_nxt, bool *open);
void tipc_named_reinit(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7e65d0b0c4a8..4c144e720ac1 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
tipc_sk_reinit(net);
tipc_mon_reinit_self(net);
tipc_nametbl_publish(net, &ua, &sk, addr);
+ atomic_inc(&tn->finalized);
+ wake_up_var(&tn->finalized);
}
void tipc_net_finalize_work(struct work_struct *work)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 97aa970a0d83..f757722d15be 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -111,6 +111,7 @@ struct tipc_bclink_entry {
* @peer_net: peer's net namespace
* @peer_hash_mix: hash for this peer (FIXME)
* @crypto_rx: RX crypto handler
+ * @work: work item for bulk distribution of cluster scope publications
*/
struct tipc_node {
u32 addr;
@@ -145,6 +146,7 @@ struct tipc_node {
#ifdef CONFIG_TIPC_CRYPTO
struct tipc_crypto *crypto_rx;
#endif
+ struct work_struct work;
};
/* Node FSM states and events:
@@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)
#ifdef CONFIG_TIPC_CRYPTO
tipc_crypto_stop(&n->crypto_rx);
#endif
+ cancel_work_sync(&n->work);
kfree(n);
}
@@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)
write_unlock_bh(&n->lock);
}
+static void tipc_node_dist_bulk(struct work_struct *work)
+{
+ struct tipc_node *node = container_of(work, struct tipc_node, work);
+
+ if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) {
+ u32 bearer_id = node->link_id & 0xffff;
+
+ tipc_node_link_down(node, bearer_id, false);
+ }
+
+ tipc_node_put(node);
+}
+
static void tipc_node_write_unlock(struct tipc_node *n)
__releases(n->lock)
{
@@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n)
if (flags & TIPC_NOTIFY_NODE_DOWN)
tipc_publ_notify(net, publ_list, node, n->capabilities);
- if (flags & TIPC_NOTIFY_NODE_UP)
- tipc_named_node_up(net, node, n->capabilities);
+ if (flags & TIPC_NOTIFY_NODE_UP) {
+ int rc = 0;
+
+ rc = tipc_named_node_up(net, node, n->capabilities);
+ /* Defer bulk distribution to work queue */
+ if (rc > 0) {
+ tipc_node_get(n);
+ schedule_work(&n->work);
+ } else if (rc < 0) {
+ /* Bring the link down to start over bulk distribution
+ * when the link is up again.
+ */
+ tipc_node_link_down(n, bearer_id, false);
+ }
+ }
if (flags & TIPC_NOTIFY_LINK_UP) {
tipc_mon_peer_up(net, node, bearer_id);
@@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
INIT_LIST_HEAD(&n->list);
INIT_LIST_HEAD(&n->publ_list);
INIT_LIST_HEAD(&n->conn_sks);
+ INIT_WORK(&n->work, tipc_node_dist_bulk);
skb_queue_head_init(&n->bc_entry.namedq);
skb_queue_head_init(&n->bc_entry.inputq1);
__skb_queue_head_init(&n->bc_entry.arrvq);
--
2.43.0
^ permalink raw reply related
* [PATCH net v8 0/3] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Weiming Shi @ 2026-07-18 9:25 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion; +Cc: Xiang Mei, Weiming Shi
This series continues the fix for the NULL dereference in
tipc_named_node_up() on an empty publication list.
Patch 1/3 carries Tung Nguyen's defer-to-workqueue approach, which
he posted on the thread as the replacement for the item-less bulk
from v2 and asked us to test. Tung's RFC only exists as an inline
diff in the thread, so I folded it into this series, keeping his
Signed-off-by. I tested it in our two-node QEMU setup (veth pair,
UDP bearers, node-id addressing), both with an unprivileged user
namespace and as root: the unpatched kernel panics on the first run
of the same reproducer, the patched one distributes normally with a
non-empty list.
While testing we found two residual issues in the approach, fixed by
patches 2/3 and 3/3.
Patch 2/3: tipc_net_finalize() does not check the return value of
tipc_nametbl_publish(). If the publish fails, for example on a
GFP_ATOMIC allocation failure, the node is finalized but cluster_scope
stays empty. The deferred worker then calls named_distribute() with
an empty list and hits the same NULL dereference, this time on the
workqueue. With this patch the worker re-checks the list and skips
cleanly, no crash and no link flap. The tail stamp in
named_distribute() also gets an empty-queue guard.
Patch 3/3: a repeated NODE_UP while the bulk work is pending takes a
node reference that is never dropped, because schedule_work() returns
false when the work is already queued. Found by flapping the bearer
during the defer window. One reference is leaked per repeated
NODE_UP.
Changes in v8:
- Attribution text fix only, no code changes. The defer approach
is Tung Nguyen's work; earlier versions wrongly credited
Jon Maloy.
Changes in v7:
- Patch 1/3: add the missing kernel-doc description for the new work
member of struct tipc_node, fixing the W=1 build warning reported
by the kernel test robot. No code change.
- https://lore.kernel.org/all/20260718090931.724303-1-bestswngs@gmail.com/
Changes in v6:
- Make the series self-contained: fold Tung Nguyen's base patch into
the series (1/3), keeping his Signed-off-by. The version sent as
v5 only carried the two follow-ups and depended on his patch from
the thread; the code changes in 2/3 and 3/3 are unchanged from
that version.
- https://lore.kernel.org/all/20260717185701.2828080-1-bestswngs@gmail.com/
Changes in v5:
- Replace the item-less bulk approach with Tung Nguyen's
defer-to-workqueue RFC, which fixes the reported bug in our
testing.
- Fix two residual issues found during testing (patches 2/3, 3/3).
Weiming Shi (3):
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
tipc: fix NULL deref in deferred bulk distribution on publish failure
tipc: fix node reference leak when defer work is already pending
net/tipc/core.c | 1 +
net/tipc/core.h | 2 ++
net/tipc/name_distr.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++----
net/tipc/name_distr.h | 3 ++-
net/tipc/net.c | 5 ++++-
net/tipc/node.c | 35 ++++++++++++++++++++++++++++++--
6 files changed, 97 insertions(+), 8 deletions(-)
--
2.43.0
^ permalink raw reply
* Re: [PATCH iproute2-next] ipmaddr: use RTM_GETMULTICAST to list multicast addresses
From: Yuyang Huang @ 2026-07-18 9:11 UTC (permalink / raw)
To: David Ahern; +Cc: netdev
In-Reply-To: <CA+7S2v+BUmfHQpS7U8xhdiHr=EMt-S5F+oEPFiBLXQUOuX6Z6A@mail.gmail.com>
> The kernel replies to a RTM_GETMULTICAST dump request with
> RTM_NEWMULTICAST messages — it never sends RTM_GETMULTICAST in a
> response.
Hmm I just realized It's the other way around. The dump path puts
RTM_GETMULTICAST on the wire:
net/ipv4/devinet.c:
return inet_dump_addr(skb, cb, RTM_GETMULTICAST);
IPv6 does the same (in6_dump_addrs() sets fillargs->event =
RTM_GETMULTICAST). RTM_NEWMULTICAST is only used for the
RTNLGRP_*_MCADDR notifications, never in dump replies.
So my v2 patch has a bug, I will send the v3 patch to fix it.
Thanks,
Yuyang
^ permalink raw reply
* [PATCH net v7 3/3] tipc: fix node reference leak when defer work is already pending
From: Weiming Shi @ 2026-07-18 9:09 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, linux-kernel
In-Reply-To: <20260718090931.724303-1-bestswngs@gmail.com>
In tipc_node_write_unlock(), TIPC_NOTIFY_NODE_UP with an empty
cluster_scope takes a node reference and schedules n->work. If the
link flaps down and up while that work is still pending, the next
NODE_UP takes another reference, but schedule_work() returns false
and the extra reference is never dropped. The tipc_node structure
leaks.
Verified by flapping the bearer while the work is pending: one
reference is leaked per repeated NODE_UP, while the work is put only
once when it finally runs.
Drop the reference when the work was already queued.
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/node.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index f757722d15be..f826347b5870 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -447,7 +447,8 @@ static void tipc_node_write_unlock(struct tipc_node *n)
/* Defer bulk distribution to work queue */
if (rc > 0) {
tipc_node_get(n);
- schedule_work(&n->work);
+ if (!schedule_work(&n->work))
+ tipc_node_put(n);
} else if (rc < 0) {
/* Bring the link down to start over bulk distribution
* when the link is up again.
--
2.43.0
^ permalink raw reply related
* [PATCH net v7 2/3] tipc: fix NULL deref in deferred bulk distribution on publish failure
From: Weiming Shi @ 2026-07-18 9:09 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, David S. Miller, Eric Dumazet,
Jakub Kicinski, Paolo Abeni, Simon Horman, kernel test robot,
Hoang Huu Le, linux-kernel
In-Reply-To: <20260718090931.724303-1-bestswngs@gmail.com>
tipc_net_finalize() does not check the return value of
tipc_nametbl_publish(). If the publish fails, for example on a
GFP_ATOMIC allocation failure, the node state name never lands in
cluster_scope, but tn->finalized is still set. A worker deferred by
tipc_named_node_up() then wakes and calls named_distribute() with an
empty list. That replays the same unguarded buf_msg(skb_peek_tail(list))
tail stamp, this time on the tipc_node_dist_bulk workqueue:
KASAN: null-ptr-deref in range [0x00000000000000c8-0x00000000000000cf]
RIP: 0010:named_distribute (net/tipc/name_distr.c:200)
Workqueue: events tipc_node_dist_bulk
Call Trace:
tipc_named_dist_cluster_scope (net/tipc/name_distr.c:267)
tipc_node_dist_bulk (net/tipc/node.c:403)
process_one_work
worker_thread
Kernel panic - not syncing: Fatal exception in interrupt
Check the publish result and warn on failure, but still set finalized,
otherwise deferred workers would sleep forever. In
tipc_named_dist_cluster_scope() re-check cluster_scope after the wait
and skip the distribution when it is empty. This is a permanent
condition, so return 0 instead of an error, otherwise the link would
be bounced forever. Also guard the tail stamp in named_distribute()
itself, so a caller that misses the precondition gets a warning and a
link reset through the existing -ENOBUFS path instead of a crash.
Reproducing this needs an allocation failure during finalize, so I
verified it by stubbing out the publish call: both nodes log the
failure, the workers skip the distribution, no crash, no link flap.
The normal path is unchanged with the same two-node test.
Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Assisted-by: Claude:claude-opus-4-8
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/name_distr.c | 11 +++++++++++
net/tipc/net.c | 3 ++-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index b764274df758..5b0fb09226fc 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -193,6 +193,10 @@ static int named_distribute(struct net *net, struct sk_buff_head *list,
skb_trim(skb, INT_H_SIZE + (msg_dsz - msg_rem));
__skb_queue_tail(list, skb);
}
+ if (skb_queue_empty(list)) {
+ pr_warn("Bulk publication list empty, nothing to distribute\n");
+ return 1;
+ }
hdr = buf_msg(skb_peek_tail(list));
msg_set_last_bulk(hdr);
msg_set_named_seqno(hdr, seqno);
@@ -253,6 +257,13 @@ int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
spin_unlock_bh(&tn->nametbl_lock);
read_lock_bh(&nt->cluster_scope_lock);
+ if (unlikely(list_empty(&nt->cluster_scope))) {
+ /* finalize is done but nothing was published (publish
+ * failed): a permanent state, nothing to synchronize.
+ */
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return 0;
+ }
if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
read_unlock_bh(&nt->cluster_scope_lock);
return -ENOBUFS;
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 4c144e720ac1..2aa8812c551a 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -138,7 +138,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
tipc_named_reinit(net);
tipc_sk_reinit(net);
tipc_mon_reinit_self(net);
- tipc_nametbl_publish(net, &ua, &sk, addr);
+ if (!tipc_nametbl_publish(net, &ua, &sk, addr))
+ pr_warn("Failed to publish own node state\n");
atomic_inc(&tn->finalized);
wake_up_var(&tn->finalized);
}
--
2.43.0
^ permalink raw reply related
* [PATCH net v7 1/3] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Weiming Shi @ 2026-07-18 9:09 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion
Cc: Xiang Mei, Weiming Shi, kernel test robot, David S. Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni, Simon Horman,
Hoang Huu Le, linux-kernel
In-Reply-To: <20260718090931.724303-1-bestswngs@gmail.com>
[The defer-to-workqueue approach is by Tung Nguyen, suggested by
Jon Maloy on the thread as the replacement for the item-less bulk
approach. Since the RFC only exists as an inline diff in the thread,
it is folded into this series so the fix is self-contained.]
named_distribute() stamps the last_bulk flag on the tail skb of the
publication list. When the list is empty no skb is enqueued and the
tail access dereferences NULL. tipc_named_node_up() hits this on an
empty cluster_scope, which happens with a node-id configuration where
cluster_scope is populated only later by tipc_net_finalize(). It is
reachable by an unprivileged user over a UDP bearer in a user+net
namespace. The reported crash:
KASAN: null-ptr-deref in range [0x00000000000000d8-0x00000000000000df]
RIP: 0010:tipc_named_node_up (net/tipc/name_distr.c:196)
tipc_named_node_up (net/tipc/name_distr.c:196 net/tipc/name_distr.c:221)
tipc_node_write_unlock (net/tipc/node.c:428)
tipc_rcv (net/tipc/node.c:2185)
tipc_udp_recv (net/tipc/udp_media.c:392)
Kernel panic - not syncing: Fatal exception in interrupt
When cluster_scope is empty at node-up, defer the bulk distribution
to a workqueue and wait for tipc_net_finalize() to publish the
node-state name, so named_distribute() always runs on a non-empty
list. On allocation failure, purge the partially built queue and
bring the link down so the bulk distribution restarts when the link
comes up again.
Fixes: cad2929dc432 ("tipc: update a binding service via broadcast")
Reported-by: Xiang Mei <xmei5@asu.edu>
Reported-by: kernel test robot <lkp@intel.com>
Closes: https://lore.kernel.org/oe-kbuild-all/202607180730.TwVgASDI-lkp@intel.com/
Signed-off-by: Tung Nguyen <tung.quang.nguyen@est.tech>
Tested-by: Weiming Shi <bestswngs@gmail.com>
Signed-off-by: Weiming Shi <bestswngs@gmail.com>
---
net/tipc/core.c | 1 +
net/tipc/core.h | 2 ++
net/tipc/name_distr.c | 48 +++++++++++++++++++++++++++++++++++++++----
net/tipc/name_distr.h | 3 ++-
net/tipc/net.c | 2 ++
net/tipc/node.c | 34 ++++++++++++++++++++++++++++--
6 files changed, 83 insertions(+), 7 deletions(-)
diff --git a/net/tipc/core.c b/net/tipc/core.c
index 434e70eabe08..ce164509d9e2 100644
--- a/net/tipc/core.c
+++ b/net/tipc/core.c
@@ -60,6 +60,7 @@ static int __net_init tipc_init_net(struct net *net)
tn->trial_addr = 0;
tn->addr_trial_end = 0;
tn->capabilities = TIPC_NODE_CAPABILITIES;
+ atomic_set(&tn->finalized, 0);
INIT_WORK(&tn->work, tipc_net_finalize_work);
memset(tn->node_id, 0, sizeof(tn->node_id));
memset(tn->node_id_string, 0, sizeof(tn->node_id_string));
diff --git a/net/tipc/core.h b/net/tipc/core.h
index 9ce5f9ff6cc0..76768844c808 100644
--- a/net/tipc/core.h
+++ b/net/tipc/core.h
@@ -145,6 +145,8 @@ struct tipc_net {
struct work_struct work;
/* The numbers of work queues in schedule */
atomic_t wq_count;
+ /* flag to indicate work has finished */
+ atomic_t finalized;
};
static inline struct tipc_net *tipc_net(struct net *net)
diff --git a/net/tipc/name_distr.c b/net/tipc/name_distr.c
index 190b49c5cbc3..b764274df758 100644
--- a/net/tipc/name_distr.c
+++ b/net/tipc/name_distr.c
@@ -147,7 +147,7 @@ struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *p)
* @pls: linked list of publication items to be packed into buffer chain
* @seqno: sequence number for this message
*/
-static void named_distribute(struct net *net, struct sk_buff_head *list,
+static int named_distribute(struct net *net, struct sk_buff_head *list,
u32 dnode, struct list_head *pls, u16 seqno)
{
struct publication *publ;
@@ -164,8 +164,9 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
skb = named_prepare_buf(net, PUBLICATION, msg_rem,
dnode);
if (!skb) {
+ __skb_queue_purge(list);
pr_warn("Bulk publication failure\n");
- return;
+ return 1;
}
hdr = buf_msg(skb);
msg_set_bc_ack_invalid(hdr, true);
@@ -195,6 +196,8 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
hdr = buf_msg(skb_peek_tail(list));
msg_set_last_bulk(hdr);
msg_set_named_seqno(hdr, seqno);
+
+ return 0;
}
/**
@@ -203,7 +206,7 @@ static void named_distribute(struct net *net, struct sk_buff_head *list,
* @dnode: destination node
* @capabilities: peer node's capabilities
*/
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
{
struct name_table *nt = tipc_name_table(net);
struct tipc_net *tn = tipc_net(net);
@@ -218,9 +221,46 @@ void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities)
spin_unlock_bh(&tn->nametbl_lock);
read_lock_bh(&nt->cluster_scope_lock);
- named_distribute(net, &head, dnode, &nt->cluster_scope, seqno);
+ /* tipc_net_finalize_work() has not finished inserting self address to
+ * name table yet.
+ */
+ if (unlikely(list_empty(&nt->cluster_scope))) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return 1;
+ }
+
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+
tipc_node_xmit(net, &head, dnode, 0);
read_unlock_bh(&nt->cluster_scope_lock);
+ return 0;
+}
+
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode)
+{
+ struct name_table *nt = tipc_name_table(net);
+ struct tipc_net *tn = tipc_net(net);
+ struct sk_buff_head head;
+ u16 seqno;
+
+ __skb_queue_head_init(&head);
+ wait_var_event(&tn->finalized, atomic_read(&tn->finalized));
+ spin_lock_bh(&tn->nametbl_lock);
+ seqno = nt->snd_nxt;
+ spin_unlock_bh(&tn->nametbl_lock);
+
+ read_lock_bh(&nt->cluster_scope_lock);
+ if (named_distribute(net, &head, dnode, &nt->cluster_scope, seqno)) {
+ read_unlock_bh(&nt->cluster_scope_lock);
+ return -ENOBUFS;
+ }
+ tipc_node_xmit(net, &head, dnode, 0);
+ read_unlock_bh(&nt->cluster_scope_lock);
+
+ return 0;
}
/**
diff --git a/net/tipc/name_distr.h b/net/tipc/name_distr.h
index c677f6f082df..cadf4e8c3e66 100644
--- a/net/tipc/name_distr.h
+++ b/net/tipc/name_distr.h
@@ -69,7 +69,8 @@ struct distr_item {
struct sk_buff *tipc_named_publish(struct net *net, struct publication *publ);
struct sk_buff *tipc_named_withdraw(struct net *net, struct publication *publ);
-void tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_node_up(struct net *net, u32 dnode, u16 capabilities);
+int tipc_named_dist_cluster_scope(struct net *net, u32 dnode);
void tipc_named_rcv(struct net *net, struct sk_buff_head *namedq,
u16 *rcv_nxt, bool *open);
void tipc_named_reinit(struct net *net);
diff --git a/net/tipc/net.c b/net/tipc/net.c
index 7e65d0b0c4a8..4c144e720ac1 100644
--- a/net/tipc/net.c
+++ b/net/tipc/net.c
@@ -139,6 +139,8 @@ static void tipc_net_finalize(struct net *net, u32 addr)
tipc_sk_reinit(net);
tipc_mon_reinit_self(net);
tipc_nametbl_publish(net, &ua, &sk, addr);
+ atomic_inc(&tn->finalized);
+ wake_up_var(&tn->finalized);
}
void tipc_net_finalize_work(struct work_struct *work)
diff --git a/net/tipc/node.c b/net/tipc/node.c
index 97aa970a0d83..f757722d15be 100644
--- a/net/tipc/node.c
+++ b/net/tipc/node.c
@@ -111,6 +111,7 @@ struct tipc_bclink_entry {
* @peer_net: peer's net namespace
* @peer_hash_mix: hash for this peer (FIXME)
* @crypto_rx: RX crypto handler
+ * @work: work item for bulk distribution of cluster scope publications
*/
struct tipc_node {
u32 addr;
@@ -145,6 +146,7 @@ struct tipc_node {
#ifdef CONFIG_TIPC_CRYPTO
struct tipc_crypto *crypto_rx;
#endif
+ struct work_struct work;
};
/* Node FSM states and events:
@@ -303,6 +305,7 @@ static void tipc_node_free(struct rcu_head *rp)
#ifdef CONFIG_TIPC_CRYPTO
tipc_crypto_stop(&n->crypto_rx);
#endif
+ cancel_work_sync(&n->work);
kfree(n);
}
@@ -393,6 +396,19 @@ static void tipc_node_write_unlock_fast(struct tipc_node *n)
write_unlock_bh(&n->lock);
}
+static void tipc_node_dist_bulk(struct work_struct *work)
+{
+ struct tipc_node *node = container_of(work, struct tipc_node, work);
+
+ if (tipc_named_dist_cluster_scope(node->net, node->addr) < 0) {
+ u32 bearer_id = node->link_id & 0xffff;
+
+ tipc_node_link_down(node, bearer_id, false);
+ }
+
+ tipc_node_put(node);
+}
+
static void tipc_node_write_unlock(struct tipc_node *n)
__releases(n->lock)
{
@@ -424,8 +440,21 @@ static void tipc_node_write_unlock(struct tipc_node *n)
if (flags & TIPC_NOTIFY_NODE_DOWN)
tipc_publ_notify(net, publ_list, node, n->capabilities);
- if (flags & TIPC_NOTIFY_NODE_UP)
- tipc_named_node_up(net, node, n->capabilities);
+ if (flags & TIPC_NOTIFY_NODE_UP) {
+ int rc = 0;
+
+ rc = tipc_named_node_up(net, node, n->capabilities);
+ /* Defer bulk distribution to work queue */
+ if (rc > 0) {
+ tipc_node_get(n);
+ schedule_work(&n->work);
+ } else if (rc < 0) {
+ /* Bring the link down to start over bulk distribution
+ * when the link is up again.
+ */
+ tipc_node_link_down(n, bearer_id, false);
+ }
+ }
if (flags & TIPC_NOTIFY_LINK_UP) {
tipc_mon_peer_up(net, node, bearer_id);
@@ -564,6 +593,7 @@ struct tipc_node *tipc_node_create(struct net *net, u32 addr, u8 *peer_id,
INIT_LIST_HEAD(&n->list);
INIT_LIST_HEAD(&n->publ_list);
INIT_LIST_HEAD(&n->conn_sks);
+ INIT_WORK(&n->work, tipc_node_dist_bulk);
skb_queue_head_init(&n->bc_entry.namedq);
skb_queue_head_init(&n->bc_entry.inputq1);
__skb_queue_head_init(&n->bc_entry.arrvq);
--
2.43.0
^ permalink raw reply related
* [PATCH net v7 0/3] tipc: fix NULL deref in tipc_named_node_up() on empty publication list
From: Weiming Shi @ 2026-07-18 9:09 UTC (permalink / raw)
To: Jon Maloy, Tung Nguyen, netdev, tipc-discussion; +Cc: Xiang Mei, Weiming Shi
This series continues the fix for the NULL dereference in
tipc_named_node_up() on an empty publication list.
Patch 1/3 carries Tung Nguyen's defer-to-workqueue approach, suggested
by Jon Maloy on the thread as the replacement for the item-less bulk
from v2. Tung's RFC only exists as an inline diff in the thread, so I
folded it into this series, keeping his Signed-off-by. I tested it in
our two-node QEMU setup (veth pair, UDP bearers, node-id addressing),
both with an unprivileged user namespace and as root: the unpatched
kernel panics on the first run of the same reproducer, the patched one
distributes normally with a non-empty list.
While testing we found two residual issues in the approach, fixed by
patches 2/3 and 3/3.
Patch 2/3: tipc_net_finalize() does not check the return value of
tipc_nametbl_publish(). If the publish fails, for example on a
GFP_ATOMIC allocation failure, the node is finalized but cluster_scope
stays empty. The deferred worker then calls named_distribute() with
an empty list and hits the same NULL dereference, this time on the
workqueue. With this patch the worker re-checks the list and skips
cleanly, no crash and no link flap. The tail stamp in
named_distribute() also gets an empty-queue guard.
Patch 3/3: a repeated NODE_UP while the bulk work is pending takes a
node reference that is never dropped, because schedule_work() returns
false when the work is already queued. Found by flapping the bearer
during the defer window. One reference is leaked per repeated
NODE_UP.
Changes in v7:
- Patch 1/3: add the missing kernel-doc description for the new work
member of struct tipc_node, fixing the W=1 build warning reported
by the kernel test robot. No code change.
Changes in v6:
- Make the series self-contained: fold Tung Nguyen's base patch into
the series (1/3), keeping his Signed-off-by. The version sent as
v5 only carried the two follow-ups and depended on his patch from
the thread; the code changes in 2/3 and 3/3 are unchanged from
that version.
Changes in v5:
- Replace the item-less bulk approach with Tung Nguyen's
defer-to-workqueue RFC, which fixes the reported bug in our
testing.
- Fix two residual issues found during testing (patches 2/3, 3/3).
Weiming Shi (3):
tipc: fix NULL deref in tipc_named_node_up() on empty publication list
tipc: fix NULL deref in deferred bulk distribution on publish failure
tipc: fix node reference leak when defer work is already pending
net/tipc/core.c | 1 +
net/tipc/core.h | 2 ++
net/tipc/name_distr.c | 59 +++++++++++++++++++++++++++++++++++++++++++++++----
net/tipc/name_distr.h | 3 ++-
net/tipc/net.c | 5 ++++-
net/tipc/node.c | 35 ++++++++++++++++++++++++++++++--
6 files changed, 97 insertions(+), 8 deletions(-)
--
2.43.0
^ permalink raw reply
* Re: [PATCH net-next v6 1/2] net: dsa: realtek: rtl8365mb: add SGMII support for RTL8367S
From: Stanislaw @ 2026-07-18 7:55 UTC (permalink / raw)
To: Johan Alvarado, Mieczyslaw Nalewaj
Cc: Linus Walleij, Alvin Sipraga, Andrew Lunn, Vladimir Oltean,
David S . Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni,
Russell King, Maxime Chevallier, Luiz Angelo Daros de Luca,
netdev, linux-kernel
In-Reply-To: <CAJq09z6bqVdtmuf0LVe_WjVYM9GmjaNiqjnOALLut4jCoZBLRQ@mail.gmail.com>
Hi Luiz, Mieczyslaw,
> Stanislaw, do you have a reset pin or a reset controller configured?
Yes - a reset GPIO, no reset controller:
reset-gpios = <&tlmm 33 GPIO_ACTIVE_LOW>;
on the switch node. So on this board the probe path does run both
resets: the GPIO hard reset from rtl83xx_probe() plus the soft reset
during setup. That is worth stressing, because the re-probe that cures
the cold-soak state performs *exactly the same sequence* - same GPIO
reset, same soft reset, same full init - as the probe that lands in
the bad state. The only difference is that it is the second run. So
it does not look like a missing reset; more like something about the
very first init pass on cold silicon.
On "loading too early": the driver is a module here and probes ~20 s
after power-on (rootfs mount), so the rails have long been up by then.
That said, 20 s of a cold board is a different thermal/electrical
state than the same board a minute after a reboot, and short
power-cycles (~1 min) never reproduce the issue - only a multi-hour
soak does.
Your reset-bit map is exactly the experiment this bench needs. Next
cold-bad morning I will try the individual reset bits (SDS_RST, SW_RST,
CHIP_RST, DW8051_RST...) on the degraded state, before falling back to
the full re-probe, to find the minimal action that cures it. I'll
report what I find.
> Please repeat the test only with the fix "the ~98 ms PLL-settle delay
> plus the 0x060C-0x060F Local Jam Table analog calibration".
Done - last night's cold soak ran an image with only those two changes
on top of the v6 series (busy-wait reverted). Result: the bad state
came up as usual, no improvement - consistent with Johan's analysis of
where those writes actually land.
This time I had ethtool on the box before curing it, so here is the
per-port MIB of the bad state (~35 min after the cold boot, switch
reporting 2.5G/Full link up on the SerDes, wan 1G/Full to the wire):
CPU -> switch direction (broken):
eth0 (SoC gmac1): 995 frames / 282,945 octets tx, no errors
switch port 6 (SerDes): dot3StatsFCSErrors: 506
etherStatsDropEvents: 506
wan wire egress: zero - no ifOut counters at all, although
the kernel handed ~990 frames for tx
switch -> CPU direction (clean):
p06_ifOutOctets: 172,231 == eth0 rx octet count: 172,231
byte-exact, zero errors - that's why ingress from upstream works
So the cold-soak bad state is now precisely characterized: over half of
the frames arriving from the SoC FCS-fail at the switch SerDes ingress
and are dropped (and nothing reaches the wan wire), while the switch's
transmit side is byte-exact clean. Since a full re-probe of the switch
alone cures it - the SoC side is never touched - the bad half is the
switch's SerDes receiver, left in that state by the first cold init.
Next cold morning I'll do the reset-bit isolation on the degraded
state, per Luiz's map, before falling back to the full re-probe.
Best regards,
Stanislaw
^ permalink raw reply
* [PATCH net] net: slip: serialize receive against buffer reallocation
From: Sungmin Kang @ 2026-07-18 7:36 UTC (permalink / raw)
To: netdev; +Cc: andrew+netdev, davem, edumazet, kuba, pabeni
sl_realloc_bufs() replaces rbuff and updates buffsize while holding
sl->lock. slip_receive_buf() reads those fields and writes through rbuff
without holding the lock.
An MTU change can therefore race with receive processing. An MTU shrink
can expose the new smaller rbuff with the old larger bound, causing an
out-of-bounds write. A receive callback which already loaded the old
rbuff can instead continue writing after that buffer has been freed.
Serialize receive processing with sl_realloc_bufs() by holding sl->lock
while consuming each receive batch.
Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2")
Cc: stable@vger.kernel.org
Signed-off-by: Sungmin Kang <726ksm@gmail.com>
---
Testing:
Before this change, a generic-KASAN guest reported both a
slab-out-of-bounds write and a slab-use-after-free in slip_receive_buf()
while receive data was raced with MTU changes. A non-KASAN build with
SLUB redzone and poisoning also detected cross-object corruption.
With this change, the same KASAN stress test ran for 180 seconds and
completed 38,137,741 receive-writer iterations and 216,165 MTU changes
without a KASAN report, warning, or panic.
drivers/net/slip/slip.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/drivers/net/slip/slip.c b/drivers/net/slip/slip.c
index 820e1a8fc..faae711cf 100644
--- a/drivers/net/slip/slip.c
+++ b/drivers/net/slip/slip.c
@@ -693,6 +693,8 @@ static void slip_receive_buf(struct tty_struct *tty, const u8 *cp, const u8 *fp,
if (!sl || sl->magic != SLIP_MAGIC || !netif_running(sl->dev))
return;
+ spin_lock_bh(&sl->lock);
+
/* Read the characters out of the buffer */
while (count--) {
if (fp && *fp++) {
@@ -708,6 +710,8 @@ static void slip_receive_buf(struct tty_struct *tty, const u8 *cp, const u8 *fp,
#endif
slip_unesc(sl, *cp++);
}
+
+ spin_unlock_bh(&sl->lock);
}
/************************************
--
2.49.0.windows.1
^ permalink raw reply related
* Re: [PATCH net v3] net: dpaa: fix mode setting
From: Christian Zigotzky @ 2026-07-18 7:35 UTC (permalink / raw)
To: Sean Anderson
Cc: Michael Walle, Madalin Bucur, Andrew Lunn, David S Miller,
Eric Dumazet, Jakub Kicinski, Abeni Paolo, Christian Zigotzky,
netdev, linux-kernel, linuxppc-dev, Trevor Dickinson,
mad skateman, hypexed
In-Reply-To: <4f7497cf-83ed-47cd-2e7b-d06ebe319b61@linux.dev>
On 17 July 2026 at 11:11 am, Sean Anderson <sean.anderson@linux.dev> wrote:
On 7/17/26 09:20, Michael Walle wrote:
---
I didn't grab Sean's Rb tag as this is somewhat different.
Changes in v3:
- keep the mode setting also in .adjust_link().
- reword the commit message, to be (hopefully) more precise
- Link to v2: https://lore.kernel.org/r/20260710143430.2276141-1-mwalle@kernel.org/
Changes in v2:
- the setting is/was based on the maximum speed, not the current
speed. thus, move the setting into mac_config().
- Link to v1: https://lore.kernel.org/r/20260706121011.1948906-1-mwalle@kernel.org/
.../net/ethernet/freescale/fman/fman_dtsec.c | 17 ++++++++++++-----
1 file changed, 12 insertions(+), 5 deletions(-)
diff --git a/drivers/net/ethernet/freescale/fman/fman_dtsec.c b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
index fe35703c509e..b8d70c0ecb6c 100644
--- a/drivers/net/ethernet/freescale/fman/fman_dtsec.c
+++ b/drivers/net/ethernet/freescale/fman/fman_dtsec.c
@@ -900,22 +900,28 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
{
struct mac_device *mac_dev = fman_config_to_mac(config);
struct dtsec_regs __iomem *regs = mac_dev->fman_mac->regs;
- u32 tmp;
+ u32 ecntrl, maccfg2;
+
+ maccfg2 = ioread32be(®s->maccfg2);
+ maccfg2 &= ~(MACCFG2_NIBBLE_MODE | MACCFG2_BYTE_MODE);
switch (state->interface) {
case PHY_INTERFACE_MODE_RMII:
- tmp = DTSEC_ECNTRL_RMM;
+ ecntrl = DTSEC_ECNTRL_RMM;
+ maccfg2 |= MACCFG2_NIBBLE_MODE;
break;
case PHY_INTERFACE_MODE_RGMII:
case PHY_INTERFACE_MODE_RGMII_ID:
case PHY_INTERFACE_MODE_RGMII_RXID:
case PHY_INTERFACE_MODE_RGMII_TXID:
- tmp = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
+ ecntrl = DTSEC_ECNTRL_GMIIM | DTSEC_ECNTRL_RPM;
+ maccfg2 |= MACCFG2_BYTE_MODE;
break;
case PHY_INTERFACE_MODE_SGMII:
case PHY_INTERFACE_MODE_1000BASEX:
case PHY_INTERFACE_MODE_2500BASEX:
- tmp = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
+ ecntrl = DTSEC_ECNTRL_TBIM | DTSEC_ECNTRL_SGMIIM;
+ maccfg2 |= MACCFG2_BYTE_MODE;
break;
default:
dev_warn(mac_dev->dev, "cannot configure dTSEC for %s\n",
@@ -923,7 +929,8 @@ static void dtsec_mac_config(struct phylink_config *config, unsigned int mode,
return;
}
- iowrite32be(tmp, ®s->ecntrl);
+ iowrite32be(ecntrl, ®s->ecntrl);
+ iowrite32be(maccfg2, ®s->maccfg2);
}
static void dtsec_link_up(struct phylink_config *config, struct phy_device *phy,
Reviewed-by: Sean Anderson <sean.anderson@linux.dev>
Christian, can you test this patch with ethernet at 100/1G speed if you still have
access to those P5020/P5040 boards?
- - -
Yes, I will test it as soon as possible.
- Christian
^ permalink raw reply related
* Re: [REGRESSION][BISECTED] stmmac: suspend hangs since 1b9707e6f1a9 ("net: stmmac: enable RPS and RBU interrupts")
From: tresonic @ 2026-07-18 7:35 UTC (permalink / raw)
To: Andrew Lunn; +Cc: netdev, regressions, rmk+kernel, kuba, Maxime Chevallier
In-Reply-To: <09ee8651-4f29-4ae0-8e82-a32a1f7ad04a@lunn.ch>
Thank you for you explanations!
> The interrupt is being enabled in the init_chan call in
> stmmac_dma_ops. Ideally, it should be disabled in a mirror function,
> which currently does not exist. So maybe deinit_chan() needs
> adding. But where to call it from? init_chan() is called from
> stmmac_init_dma_engine(), from stmmac_hw_setup(). stmmac_resume() does
> call this. So we need something in stmmac_suspend(). Maybe in
> stmmac_stop_all_dma()?
>
> stmmac is messy, there are often not mirror functions. If there is a
> stmmac_init_dma_engine() there should be
> stmmac_deinit_dma_engine(). If there is stmmac_hw_setup() there should
> be stmmac_hw_tairdown(). But none of these seem to exist.
>
> Anyway, do you want to try to implement deinit_chan() and call it from
> stmmac_stop_all_dma()?
Yes I'd really like to implement a solution here.
This is my try, but I still have some questions:
- is it ok to disable all interrupts on deinit_chan()?
- maybe the interrupt could also just be disabled in stop_rx?
diff --git a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
index 829a23bdad01..65c243fb829f 100644
--- a/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
+++ b/drivers/net/ethernet/stmicro/stmmac/dwmac4_dma.c
@@ -125,6 +125,17 @@ static void dwmac410_dma_init_channel(struct stmmac_priv *priv,
ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
}
+static void dwmac410_dma_deinit_channel(struct stmmac_priv *priv,
+ void __iomem *ioaddr, u32 chan)
+{
+ const struct dwmac4_addrs *dwmac4_addrs = priv->plat->dwmac4_addrs;
+ u32 value;
+
+ value = readl(ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+ value &= ~DMA_CHAN_INTR_DEFAULT_MASK_4_10;
+ writel(value, ioaddr + DMA_CHAN_INTR_ENA(dwmac4_addrs, chan));
+}
+
static void dwmac4_dma_init(void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg)
{
@@ -577,6 +588,7 @@ const struct stmmac_dma_ops dwmac410_dma_ops = {
.reset = dwmac4_dma_reset,
.init = dwmac4_dma_init,
.init_chan = dwmac410_dma_init_channel,
+ .deinit_chan = dwmac410_dma_deinit_channel,
.init_rx_chan = dwmac4_dma_init_rx_chan,
.init_tx_chan = dwmac4_dma_init_tx_chan,
.axi = dwmac4_dma_axi,
diff --git a/drivers/net/ethernet/stmicro/stmmac/hwif.h b/drivers/net/ethernet/stmicro/stmmac/hwif.h
index e6317b94fff7..04dafec021b4 100644
--- a/drivers/net/ethernet/stmicro/stmmac/hwif.h
+++ b/drivers/net/ethernet/stmicro/stmmac/hwif.h
@@ -170,6 +170,8 @@ struct stmmac_dma_ops {
void (*init)(void __iomem *ioaddr, struct stmmac_dma_cfg *dma_cfg);
void (*init_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg, u32 chan);
+ void (*deinit_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
+ u32 chan);
void (*init_rx_chan)(struct stmmac_priv *priv, void __iomem *ioaddr,
struct stmmac_dma_cfg *dma_cfg,
dma_addr_t phy, u32 chan);
@@ -235,6 +237,8 @@ struct stmmac_dma_ops {
stmmac_do_void_callback(__priv, dma, init, __args)
#define stmmac_init_chan(__priv, __args...) \
stmmac_do_void_callback(__priv, dma, init_chan, __priv, __args)
+#define stmmac_deinit_chan(__priv, __args...) \
+ stmmac_do_void_callback(__priv, dma, deinit_chan, __priv, __args)
#define stmmac_init_rx_chan(__priv, __args...) \
stmmac_do_void_callback(__priv, dma, init_rx_chan, __priv, __args)
#define stmmac_init_tx_chan(__priv, __args...) \
diff --git a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
index 2a0d7eff88d3..8504ecc3dbeb 100644
--- a/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
+++ b/drivers/net/ethernet/stmicro/stmmac/stmmac_main.c
@@ -2560,13 +2560,16 @@ static void stmmac_stop_all_dma(struct stmmac_priv *priv)
{
u8 rx_channels_count = priv->plat->rx_queues_to_use;
u8 tx_channels_count = priv->plat->tx_queues_to_use;
+ u8 max_chan = max(rx_channels_count, tx_channels_count);
u8 chan;
- for (chan = 0; chan < rx_channels_count; chan++)
- stmmac_stop_rx_dma(priv, chan);
-
- for (chan = 0; chan < tx_channels_count; chan++)
- stmmac_stop_tx_dma(priv, chan);
+ for (chan = 0; chan < max_chan; chan++) {
+ if (chan < rx_channels_count)
+ stmmac_stop_rx_dma(priv, chan);
+ if (chan < tx_channels_count)
+ stmmac_stop_tx_dma(priv, chan);
+ stmmac_deinit_chan(priv, priv->ioaddr, chan);
+ }
}
/**
tresonic
^ permalink raw reply related
* [PATCH net 1/1] xfrm: drop ESP-in-TCP packets with no ingress device
From: Ren Wei @ 2026-07-18 7:12 UTC (permalink / raw)
To: netdev
Cc: steffen.klassert, herbert, davem, edumazet, pabeni, horms, sd,
vega, roxy520tt, enjou1224z
In-Reply-To: <cover.1784312563.git.roxy520tt@gmail.com>
From: Zhiling Zou <roxy520tt@gmail.com>
ESP-in-TCP receives records through the TCP strparser. handle_esp()
restores skb->dev from the saved skb_iif before passing the packet into
the XFRM input path.
Queued TCP data can be processed after the original ingress device has
been removed, for example during veth or net namespace teardown. In that
case dev_get_by_index_rcu() returns NULL. The XFRM IPv4 and IPv6 input
paths both expect skb->dev to be valid while building the route lookup,
so queued ESP-in-TCP data can dereference a NULL device.
Drop the packet if the saved ingress device can no longer be resolved.
Such a packet can no longer be routed through the normal XFRM receive
path, and this preserves the existing behaviour for packets whose ingress
device still exists.
Fixes: e27cca96cd68 ("xfrm: add espintcp (RFC 8229)")
Cc: stable@vger.kernel.org
Reported-by: Vega <vega@nebusec.ai>
Signed-off-by: Zhiling Zou <roxy520tt@gmail.com>
Assisted-by: Codex:gpt-5.4
Reviewed-by: Ren Wei <enjou1224z@gmail.com>
---
net/xfrm/espintcp.c | 6 ++++++
1 file changed, 6 insertions(+)
diff --git a/net/xfrm/espintcp.c b/net/xfrm/espintcp.c
index 374e1b964438..fc01ce89492a 100644
--- a/net/xfrm/espintcp.c
+++ b/net/xfrm/espintcp.c
@@ -37,6 +37,11 @@ static void handle_esp(struct sk_buff *skb, struct sock *sk)
rcu_read_lock();
skb->dev = dev_get_by_index_rcu(sock_net(sk), skb->skb_iif);
+ if (!skb->dev) {
+ XFRM_INC_STATS(sock_net(sk), LINUX_MIB_XFRMINERROR);
+ kfree_skb(skb);
+ goto out;
+ }
local_bh_disable();
#if IS_ENABLED(CONFIG_IPV6)
if (sk->sk_family == AF_INET6)
@@ -45,6 +50,7 @@ static void handle_esp(struct sk_buff *skb, struct sock *sk)
#endif
xfrm4_rcv_encap(skb, IPPROTO_ESP, 0, TCP_ENCAP_ESPINTCP);
local_bh_enable();
+out:
rcu_read_unlock();
}
--
2.43.0
^ permalink raw reply related
* [PATCH iproute2-next v3] ipmaddr: use RTM_GETMULTICAST to list multicast addresses
From: Yuyang Huang @ 2026-07-18 6:48 UTC (permalink / raw)
To: Yuyang Huang; +Cc: David Ahern, netdev
Replace /proc/net/igmp and /proc/net/igmp6 parsing in "ip maddr show"
with RTM_GETMULTICAST dumps. The kernel dumps IPv6 multicast addresses
via netlink since the beginning, IPv4 since v6.15 (eb4e17a1d915), and
reports the group users count via IFA_MC_USERS since kernel commits
7cb8198761e6 and e1d0f3f08391.
The netlink result is only used when it carries the same information
as procfs: if the dump fails (e.g. no IPv4 dump support) or any entry
lacks IFA_MC_USERS, the result is discarded and the procfs parsers
run as before, so output is unchanged on older kernels.
Link-layer multicast addresses are still read from
/proc/net/dev_mcast as there is no netlink API for them.
When a device is given, its ifindex is passed in the dump request so
strict-check kernels filter the dump server side; received entries
are checked against the ifindex again for kernels that ignore the
request field. An unknown device keeps printing an empty list.
Signed-off-by: Yuyang Huang <sigefriedhyy@gmail.com>
---
Changes in v2:
- accept_maddr(): only accept RTM_NEWMULTICAST; the kernel never sends
RTM_GETMULTICAST in dump replies
Changes in v3:
- accept_maddr(): match RTM_GETMULTICAST again, reverting the v2
change; dump replies do carry RTM_GETMULTICAST (RTM_NEWMULTICAST is
only used for notifications), confirmed by testing on a live kernel
include/libnetlink.h | 3 ++
ip/ipmaddr.c | 109 +++++++++++++++++++++++++++++++++++++++++--
lib/libnetlink.c | 26 +++++++++++
3 files changed, 134 insertions(+), 4 deletions(-)
diff --git a/include/libnetlink.h b/include/libnetlink.h
index e91505d9..518b8714 100644
--- a/include/libnetlink.h
+++ b/include/libnetlink.h
@@ -62,6 +62,9 @@ typedef int (*req_filter_fn_t)(struct nlmsghdr *nlh, int reqlen);
int rtnl_addrdump_req(struct rtnl_handle *rth, int family,
req_filter_fn_t filter_fn)
__attribute__((warn_unused_result));
+int rtnl_mcaddrdump_req(struct rtnl_handle *rth, int family,
+ req_filter_fn_t filter_fn)
+ __attribute__((warn_unused_result));
int rtnl_addrlbldump_req(struct rtnl_handle *rth, int family)
__attribute__((warn_unused_result));
int rtnl_routedump_req(struct rtnl_handle *rth, int family,
diff --git a/ip/ipmaddr.c b/ip/ipmaddr.c
index 462b409e..95b703d2 100644
--- a/ip/ipmaddr.c
+++ b/ip/ipmaddr.c
@@ -27,6 +27,7 @@
static struct {
char *dev;
+ int index;
int family;
} filter;
@@ -207,6 +208,93 @@ static void read_igmp6(struct ma_info **result_p)
fclose(fp);
}
+struct maddr_dump_ctx {
+ struct ma_info *list;
+ bool mc_users_missing;
+};
+
+static int maddr_dump_filter(struct nlmsghdr *nlh, int reqlen)
+{
+ struct ifaddrmsg *ifm = NLMSG_DATA(nlh);
+
+ ifm->ifa_index = filter.index;
+
+ return 0;
+}
+
+static int accept_maddr(struct nlmsghdr *n, void *arg)
+{
+ struct maddr_dump_ctx *ctx = arg;
+ struct ifaddrmsg *ifm = NLMSG_DATA(n);
+ int len = n->nlmsg_len - NLMSG_LENGTH(sizeof(*ifm));
+ struct rtattr *tb[IFA_MAX + 1];
+ struct ma_info *ma;
+
+ if (n->nlmsg_type != RTM_GETMULTICAST)
+ return 0;
+
+ if (len < 0)
+ return -1;
+
+ if (filter.index && filter.index != ifm->ifa_index)
+ return 0;
+
+ parse_rtattr(tb, IFA_MAX, IFA_RTA(ifm), len);
+
+ if (!tb[IFA_MULTICAST] ||
+ RTA_PAYLOAD(tb[IFA_MULTICAST]) > sizeof(ma->addr.data))
+ return 0;
+
+ if (!tb[IFA_MC_USERS]) {
+ ctx->mc_users_missing = true;
+ return 0;
+ }
+
+ ma = calloc(1, sizeof(*ma));
+ if (ma == NULL)
+ return -1;
+
+ ma->index = ifm->ifa_index;
+ strlcpy(ma->name, ll_index_to_name(ifm->ifa_index), sizeof(ma->name));
+ ma->addr.family = ifm->ifa_family;
+ ma->addr.bytelen = RTA_PAYLOAD(tb[IFA_MULTICAST]);
+ ma->addr.bitlen = ma->addr.bytelen << 3;
+ memcpy(ma->addr.data, RTA_DATA(tb[IFA_MULTICAST]), ma->addr.bytelen);
+ ma->users = rta_getattr_u32(tb[IFA_MC_USERS]);
+ maddr_ins(&ctx->list, ma);
+
+ return 0;
+}
+
+static int read_maddr_netlink(int family, struct ma_info **result_p)
+{
+ struct maddr_dump_ctx ctx = {};
+ struct ma_info *ma;
+ int err;
+
+ rth.flags |= RTNL_HANDLE_F_SUPPRESS_NLERR;
+ err = rtnl_mcaddrdump_req(&rth, family,
+ filter.index ? maddr_dump_filter : NULL);
+ if (err >= 0)
+ err = rtnl_dump_filter(&rth, accept_maddr, &ctx);
+ rth.flags &= ~RTNL_HANDLE_F_SUPPRESS_NLERR;
+
+ /* Kernels that dump multicast addresses but do not report the
+ * users count via IFA_MC_USERS cannot replace procfs.
+ */
+ if (err < 0 || ctx.mc_users_missing) {
+ maddr_clear(ctx.list);
+ return -1;
+ }
+
+ while ((ma = ctx.list) != NULL) {
+ ctx.list = ma->next;
+ maddr_ins(result_p, ma);
+ }
+
+ return 0;
+}
+
static void print_maddr(FILE *fp, struct ma_info *list)
{
print_string(PRINT_FP, NULL, "\t", NULL);
@@ -291,12 +379,25 @@ static int multiaddr_list(int argc, char **argv)
argv++; argc--;
}
+ if (filter.dev) {
+ filter.index = ll_name_to_index(filter.dev);
+ /* an unknown device has no multicast addresses */
+ if (!filter.index) {
+ print_mlist(stdout, NULL);
+ return 0;
+ }
+ }
+
if (!filter.family || filter.family == AF_PACKET)
read_dev_mcast(&list);
- if (!filter.family || filter.family == AF_INET)
- read_igmp(&list);
- if (!filter.family || filter.family == AF_INET6)
- read_igmp6(&list);
+ if (!filter.family || filter.family == AF_INET) {
+ if (read_maddr_netlink(AF_INET, &list) < 0)
+ read_igmp(&list);
+ }
+ if (!filter.family || filter.family == AF_INET6) {
+ if (read_maddr_netlink(AF_INET6, &list) < 0)
+ read_igmp6(&list);
+ }
print_mlist(stdout, list);
maddr_clear(list);
return 0;
diff --git a/lib/libnetlink.c b/lib/libnetlink.c
index 8905e297..edf3a8ba 100644
--- a/lib/libnetlink.c
+++ b/lib/libnetlink.c
@@ -336,6 +336,32 @@ int rtnl_addrdump_req(struct rtnl_handle *rth, int family,
return send(rth->fd, &req, sizeof(req), 0);
}
+int rtnl_mcaddrdump_req(struct rtnl_handle *rth, int family,
+ req_filter_fn_t filter_fn)
+{
+ struct {
+ struct nlmsghdr nlh;
+ struct ifaddrmsg ifm;
+ char buf[128];
+ } req = {
+ .nlh.nlmsg_len = NLMSG_LENGTH(sizeof(struct ifaddrmsg)),
+ .nlh.nlmsg_type = RTM_GETMULTICAST,
+ .nlh.nlmsg_flags = NLM_F_DUMP | NLM_F_REQUEST,
+ .nlh.nlmsg_seq = rth->dump = ++rth->seq,
+ .ifm.ifa_family = family,
+ };
+
+ if (filter_fn) {
+ int err;
+
+ err = filter_fn(&req.nlh, sizeof(req));
+ if (err)
+ return err;
+ }
+
+ return send(rth->fd, &req, sizeof(req), 0);
+}
+
int rtnl_addrlbldump_req(struct rtnl_handle *rth, int family)
{
struct {
--
2.43.0
^ permalink raw reply related
* [PATCH net-next] net: dsa: realtek: rtl8365mb: use devm_mutex_init
From: Luiz Angelo Daros de Luca @ 2026-07-18 5:59 UTC (permalink / raw)
To: Linus Walleij, Alvin Šipraga, Andrew Lunn, Vladimir Oltean,
David S. Miller, Eric Dumazet, Jakub Kicinski, Paolo Abeni
Cc: netdev, linux-kernel, Luiz Angelo Daros de Luca
mutex_destroy() is needed while debugging mutex. Instead of calling it
directly on driver .remove(), just use devm.
Signed-off-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
---
drivers/net/dsa/realtek/rtl8365mb_main.c | 15 ++++++++++++---
drivers/net/dsa/realtek/rtl83xx.c | 14 +++++++++++---
2 files changed, 23 insertions(+), 6 deletions(-)
diff --git a/drivers/net/dsa/realtek/rtl8365mb_main.c b/drivers/net/dsa/realtek/rtl8365mb_main.c
index 5ac091bf93c9..c787fdb75413 100644
--- a/drivers/net/dsa/realtek/rtl8365mb_main.c
+++ b/drivers/net/dsa/realtek/rtl8365mb_main.c
@@ -1988,16 +1988,19 @@ static void rtl8365mb_get_stats64(struct dsa_switch *ds, int port,
spin_unlock(&p->stats_lock);
}
-static void rtl8365mb_stats_setup(struct realtek_priv *priv)
+static int rtl8365mb_stats_setup(struct realtek_priv *priv)
{
struct rtl8365mb *mb = priv->chip_data;
struct dsa_switch *ds = &priv->ds;
struct dsa_port *dp;
+ int ret;
/* Per-chip global mutex to protect MIB counter access, since doing
* so requires accessing a series of registers in a particular order.
*/
- mutex_init(&mb->mib_lock);
+ ret = devm_mutex_init(priv->dev, &mb->mib_lock);
+ if (ret)
+ return ret;
dsa_switch_for_each_available_port(dp, ds) {
struct rtl8365mb_port *p = &mb->ports[dp->index];
@@ -2010,6 +2013,8 @@ static void rtl8365mb_stats_setup(struct realtek_priv *priv)
*/
INIT_DELAYED_WORK(&p->mib_work, rtl8365mb_stats_poll);
}
+
+ return 0;
}
static void rtl8365mb_stats_teardown(struct realtek_priv *priv)
@@ -2567,7 +2572,11 @@ static int rtl8365mb_setup(struct dsa_switch *ds)
}
/* Start statistics counter polling */
- rtl8365mb_stats_setup(priv);
+ ret = rtl8365mb_stats_setup(priv);
+ if (ret) {
+ dev_err(priv->dev, "failed to setup stats\n");
+ goto out_teardown_irq;
+ }
return 0;
diff --git a/drivers/net/dsa/realtek/rtl83xx.c b/drivers/net/dsa/realtek/rtl83xx.c
index 90843d52c5a8..35df809a5951 100644
--- a/drivers/net/dsa/realtek/rtl83xx.c
+++ b/drivers/net/dsa/realtek/rtl83xx.c
@@ -156,9 +156,17 @@ rtl83xx_probe(struct device *dev,
if (!priv)
return ERR_PTR(-ENOMEM);
- mutex_init(&priv->map_lock);
- mutex_init(&priv->vlan_lock);
- mutex_init(&priv->l2_lock);
+ ret = devm_mutex_init(dev, &priv->map_lock);
+ if (ret)
+ return ERR_PTR(ret);
+
+ ret = devm_mutex_init(dev, &priv->vlan_lock);
+ if (ret)
+ return ERR_PTR(ret);
+
+ ret = devm_mutex_init(dev, &priv->l2_lock);
+ if (ret)
+ return ERR_PTR(ret);
rc.lock_arg = priv;
priv->map = devm_regmap_init(dev, NULL, priv, &rc);
---
base-commit: ce6b4d3216b63f902bb8e9695ee6c10c83415f65
change-id: 20260718-realtek_mutext-41a072e5cd24
Best regards,
--
Luiz Angelo Daros de Luca <luizluca@gmail.com>
^ permalink raw reply related
* Re: [PATCH net-next v6 2/2] net: dsa: realtek: rtl8365mb: add HSGMII support for RTL8367S
From: Luiz Angelo Daros de Luca @ 2026-07-18 5:46 UTC (permalink / raw)
To: Johan Alvarado
Cc: Mieczyslaw Nalewaj, linusw, alsi, andrew, olteanv, kuba, davem,
edumazet, pabeni, linux, maxime.chevallier, kuncy7, netdev,
linux-kernel
In-Reply-To: <03309c370652c5ca36cf9972756efa5c@c127.dev>
The only model that could use (H)SGMII in a different interface is
RTL8370MB. However, that ASIC and RTL8310SR might need even more
changes in the driver. For now, the code looks good.
Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
^ permalink raw reply
* Re: [PATCH net-next v6 1/2] net: dsa: realtek: rtl8365mb: add SGMII support for RTL8367S
From: Luiz Angelo Daros de Luca @ 2026-07-18 5:40 UTC (permalink / raw)
To: Johan Alvarado
Cc: Mieczyslaw Nalewaj, linusw, alsi, andrew, olteanv, kuba, davem,
edumazet, pabeni, linux, maxime.chevallier, kuncy7, netdev,
linux-kernel
In-Reply-To: <db8f9fb11e7e250eab9c98eafab1ba3e@c127.dev>
If the cold-soak issue is indeed device-related, it might be that the
driver is loading too early in the boot process. Stanislaw reported
that reloading the module makes everything work as expected.
I don't see why the second reset would behave better than the first
one. In fact, if the reset pin is connected and configured, the driver
will reset the ASIC twice during the probe. Stanislaw, do you have a
reset pin or a reset controller configured? That might be related.
The driver currently performs a full software ASIC reset via bit(0),
but there are other reset bits available that you could try:
##### **Family B, C, D:**
```
15 14 13 12 11 10 9 8 7 6 5 4 3 2 1 0
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
| RESERVED |GPH|NIC|805|SDS|CFG|SW |CHP|
+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+---+
```
* **GPH (6:6)**: `GPHY_RESET`. Gigphy (Copper PHYs) Reset.
* **NIC (5:5)**: `NIC_RST`. Network Interface Controller Reset.
* **805 (4:4)**: `DW8051_RST`. Internal DW8051 MCU Reset.
* **SDS (3:3)**: `SDS_RST`. SerDes Reset.
* **CFG (2:2)**: `CONFIG_RST`. Configuration register soft reset.
* **SW (1:1)**: `SW_RST`. Software Reset (`0x0002`). Clears soft state.
* **CHP (0:0)**: `CHIP_RST`. Chip (ASIC) full reset (`0x0001`).
I would expect the CHIP_RST (bit 0) to clear everything, but you never
know... Also, keeping DW8051_RST asserted indefinitely might be
overkill.
This series adds a required feature for several devices. Even if it
introduces an edge-case issue for a few of them, lacking this feature
entirely is worse. If a patch is proposed to fix the cold-soak boot
issue, we can review it here as usual.
I would feel more comfortable if I could test this code myself, but my
device only uses RGMII. Anyway, everything looks good. Thanks, Johan.
Reviewed-by: Luiz Angelo Daros de Luca <luizluca@gmail.com>
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox