* Re: [PATCH net v2] bnge/bng_re: fix ring ID widths
From: Jakub Kicinski @ 2026-07-21 0:20 UTC (permalink / raw)
To: Vikas Gupta
Cc: davem, edumazet, pabeni, andrew+netdev, horms, netdev,
linux-kernel, linux-rdma, leonro, jgg, bhargava.marreddy,
rahul-rg.gupta, vsrama-krishna.nemani, rajashekar.hudumula,
ajit.khaparde, Siva Reddy Kallam, Dharmender Garg,
Yendapally Reddy Dhananjaya Reddy
In-Reply-To: <20260704164747.1995227-1-vikas.gupta@broadcom.com>
On Sat, 4 Jul 2026 22:17:47 +0530 Vikas Gupta wrote:
> Firmware requires more than 16 bits to address TX ring IDs for its
> internal QP management. Widen the associated HSI ring ID fields to
> 32 bits. The values firmware assigns remain within 24 bits, bounded
> by the hardware doorbell XID field.
>
> RX, completion, and NQ ring IDs are unaffected and remain 16-bit.
The netdev patch queue has overflown. Please repost.
^ permalink raw reply
* Re: [PATCH net-next v7 4/5] net: dsa: microchip: Support Microchip KSZ8995XA / KS8995XA
From: Jakub Kicinski @ 2026-07-21 0:22 UTC (permalink / raw)
To: Linus Walleij
Cc: Woojung Huh, UNGLinuxDriver, Andrew Lunn, Vladimir Oltean,
David S. Miller, Eric Dumazet, Paolo Abeni, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Marek Vasut, Simon Horman,
Russell King, netdev, devicetree
In-Reply-To: <20260704-ks8995-to-ksz8-v7-4-2af0eaa545a8@kernel.org>
On Sat, 04 Jul 2026 21:39:36 +0200 Linus Walleij wrote:
> This adds support for the Microchip KSZ8995XA also known as the
> Micrel KS8995XA switch to the KSZ driver.
>
> Notice: there are also KSZ8995E and KSZ8995MA. These are BOTH
> different from the KSZ8995XA.
>
> The helper macros are named ksz_is_ksz8995xa() to make it
> possible to add E and MA support in the future.
Clang says:
../drivers/net/dsa/microchip/ksz8.c:263:13: warning: variable 'reg_4q' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
263 | } else if (ksz_is_ksz8995xa(dev)) {
| ^~~~~~~~~~~~~~~~~~~~~
../drivers/net/dsa/microchip/ksz8.c:288:29: note: uninitialized use occurs here
288 | ret = ksz_prmw8(dev, port, reg_4q, mask_4q, data_4q);
| ^~~~~~
../drivers/net/dsa/microchip/ksz8.c:263:9: note: remove the 'if' if its condition is always false
263 | } else if (ksz_is_ksz8995xa(dev)) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
264 | /* This switch has no 4way split support */
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
265 | mask_2q = KSZ8795_PORT_2QUEUE_SPLIT_EN;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
266 | reg_2q = REG_PORT_CTRL_0;
| ~~~~~~~~~~~~~~~~~~~~~~~~~
267 | } else {
| ~~~~~~
../drivers/net/dsa/microchip/ksz8.c:237:11: note: initialize the variable 'reg_4q' to silence this warning
237 | u8 reg_4q, reg_2q;
| ^
| = '\0'
../drivers/net/dsa/microchip/ksz8.c:263:13: warning: variable 'mask_4q' is used uninitialized whenever 'if' condition is true [-Wsometimes-uninitialized]
263 | } else if (ksz_is_ksz8995xa(dev)) {
| ^~~~~~~~~~~~~~~~~~~~~
../drivers/net/dsa/microchip/ksz8.c:288:37: note: uninitialized use occurs here
288 | ret = ksz_prmw8(dev, port, reg_4q, mask_4q, data_4q);
| ^~~~~~~
../drivers/net/dsa/microchip/ksz8.c:263:9: note: remove the 'if' if its condition is always false
263 | } else if (ksz_is_ksz8995xa(dev)) {
| ^~~~~~~~~~~~~~~~~~~~~~~~~~~~
264 | /* This switch has no 4way split support */
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
265 | mask_2q = KSZ8795_PORT_2QUEUE_SPLIT_EN;
| ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
266 | reg_2q = REG_PORT_CTRL_0;
| ~~~~~~~~~~~~~~~~~~~~~~~~~
267 | } else {
| ~~~~~~
../drivers/net/dsa/microchip/ksz8.c:236:12: note: initialize the variable 'mask_4q' to silence this warning
236 | u8 mask_4q, mask_2q;
| ^
| = '\0'
^ permalink raw reply
* Re: [PATCH] net: pcs: xpcs-plat: fix runtime PM initialization
From: Jakub Kicinski @ 2026-07-21 0:24 UTC (permalink / raw)
To: Coia Prant
Cc: netdev, Andrew Lunn, Heiner Kallweit, Russell King,
David S . Miller, Eric Dumazet, Paolo Abeni, Serge Semin,
linux-kernel, stable
In-Reply-To: <20260704214808.1566710-1-coiaprant@gmail.com>
On Sun, 5 Jul 2026 05:48:08 +0800 Coia Prant wrote:
> The driver calls `pm_runtime_set_active()` before runtime PM is enabled,
> and before the clock is prepared and enabled.
>
> This causes the clock to be unprepared/disabled later in the suspend
> callback even though it was never prepared/enabled, resulting in warnings:
>
> clk_csr already disabled
> clk_csr already unprepared
>
> Fix this by setting the initial runtime PM status to SUSPENDED instead
> of ACTIVE.
>
> The clock will be properly enabled when the device is first resumed
> via runtime PM (e.g., during MDIO access).
Seems a bit odd that this hasn't been discovered until now.
Could you add more details about your platform and maybe
a hypothesis why we haven't noticed?
^ permalink raw reply
* Re: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
From: Jakub Kicinski @ 2026-07-21 0:25 UTC (permalink / raw)
To: Xiang Mei
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Paolo Abeni,
Roopa Prabhu, netdev, linux-kernel, Petr Machata, Andy Roulin,
David Yang, Kees Cook, Weiming Shi
In-Reply-To: <20260704222254.914567-1-xmei5@asu.edu>
On Sat, 4 Jul 2026 15:22:54 -0700 Xiang Mei wrote:
> The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address
> attributes as NLA_BINARY with only a maximum length, so validate_nla()
> accepts a payload shorter than the address. The GROUP consumer reads it
> with nla_get_in_addr(), an unconditional 4-byte load, so a short
> attribute over-reads up to 3 bytes of uninitialised slab data, which are
> stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing
> kernel memory.
>
> Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects
> any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is
> always sent at full width.
The netdev patch queue has overflown, if the patch is still needed
you'll have to repost, sorry.
^ permalink raw reply
* Re: [PATCH net v4 0/3] net/smc: bound wire-controlled CDC cursors against the local buffers
From: Jakub Kicinski @ 2026-07-21 0:28 UTC (permalink / raw)
To: Bryam Vargas via B4 Relay
Cc: hexlabsecurity, Dust Li, David S. Miller, Sidraya Jayagond,
Eric Dumazet, D. Wythe, Simon Horman, Wenjia Zhang, Paolo Abeni,
Stefan Raspl, Wen Gu, linux-kernel, netdev, Mahanta Jambigi,
Tony Lu, Ursula Braun, linux-s390, linux-rdma
In-Reply-To: <20260705-b4-disp-28a1bbca-v4-0-be089b98acc6@proton.me>
On Sun, 05 Jul 2026 02:54:04 -0500 Bryam Vargas via B4 Relay wrote:
> A peer's CDC producer/consumer cursors are copied from the wire and used,
> without an upper bound against the local buffers, as (a) a raw index into the
> RMB on the urgent path, (b) the receive length in smc_rx_recvmsg(), and (c) the
> send length in smc_tx_sendmsg() on the SMC-D DMB-merge path. A malicious or
> buggy peer can forge a cursor so each runs past the relevant buffer: an
> out-of-bounds read of adjacent kernel memory (disclosed to the peer) on the
> receive/urgent side, and, on the send side, an out-of-bounds write whose
> length the peer controls and whose overflowing bytes are the local sender's
> own outbound data.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next v5 2/3] selftests/net: ncdevmem: add -b option to set rx-buf-size on bind
From: Bobby Eshleman @ 2026-07-21 0:28 UTC (permalink / raw)
To: Mina Almasry
Cc: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan,
netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, matttbe, skhawaja, dw,
Joe Damato, Bobby Eshleman
In-Reply-To: <CAHS8izMz_S8K80EXn3oFXiDNkGuPUMzjecaJjAvaZVky-7O40Q@mail.gmail.com>
On Mon, Jul 20, 2026 at 02:15:42PM -0700, Mina Almasry wrote:
> On Wed, Jul 8, 2026 at 3:55 PM Bobby Eshleman <bobbyeshleman@gmail.com> wrote:
> >
> > From: Bobby Eshleman <bobbyeshleman@meta.com>
> >
> > Add -b <bytes> to request a non-default niov size via
> > NETDEV_A_DMABUF_RX_BUF_SIZE. When the value exceeds PAGE_SIZE,
> > udmabuf_alloc() switches to an MFD_HUGETLB-backed memfd so each 2 MB
> > hugepage produces one naturally-aligned sg entry.
> >
> > Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
> > Acked-by: Stanislav Fomichev <sdf@fomichev.me>
>
> Reviewed-by: Mina Almasry <almasrymina@google.com>
>
>
> > ---
> > tools/testing/selftests/drivers/net/hw/ncdevmem.c | 36 +++++++++++++++++++++--
> > 1 file changed, 33 insertions(+), 3 deletions(-)
> >
> > diff --git a/tools/testing/selftests/drivers/net/hw/ncdevmem.c b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > index d96e8a3b5a65..a16e55af51ee 100644
> > --- a/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > +++ b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > @@ -40,6 +40,7 @@
> >
> > #include <linux/uio.h>
> > #include <stdarg.h>
> > +#include <stdint.h>
> > #include <stdio.h>
> > #include <stdlib.h>
> > #include <unistd.h>
> > @@ -61,6 +62,7 @@
> > #include <sys/time.h>
> >
> > #include <linux/memfd.h>
> > +#include <sys/param.h>
> > #include <linux/dma-buf.h>
> > #include <linux/errqueue.h>
> > #include <linux/udmabuf.h>
> > @@ -79,6 +81,7 @@
> > #define PAGE_SHIFT 12
> > #define TEST_PREFIX "ncdevmem"
> > #define NUM_PAGES 16000
> > +#define MB(x) ((x) << 20)
> >
> > #ifndef MSG_SOCK_DEVMEM
> > #define MSG_SOCK_DEVMEM 0x2000000
> > @@ -100,6 +103,7 @@ static unsigned int dmabuf_id;
> > static uint32_t tx_dmabuf_id;
> > static int waittime_ms = 500;
> > static bool fail_on_linear;
> > +static uint32_t rx_buf_size;
> >
> > /* System state loaded by current_config_load() */
> > #define MAX_FLOWS 8
> > @@ -142,6 +146,7 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
> > {
> > struct udmabuf_create create;
> > struct memory_buffer *ctx;
> > + unsigned int memfd_flags;
> > int ret;
> >
> > ctx = malloc(sizeof(*ctx));
> > @@ -156,9 +161,14 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
> > goto err_free_ctx;
> > }
> >
> > - ctx->memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
> > + memfd_flags = MFD_ALLOW_SEALING;
> > + if (rx_buf_size > getpagesize())
> > + memfd_flags |= MFD_HUGETLB | MFD_HUGE_2MB;
> > +
>
> The fact that you are using HUGETLM and 2MB mappings here made me
> realize there is a pathological edge case in the code where the netmem
> size you're requesting is greater than the mapping size, so you
> actually get no netmems. So like if you ask for a 64KB netmem size but
> actually you did a normal udambuf mapping and all the maps (sg len
> entries) are 4K or something. IDK if the code already handles this
> well with an error or what not. Worth checking.
If I follow you correctly, in the case of sg len == 4K, and requested
size of 64K, it will fail the !IS_ALIGNED(len=4k, niov_size=64K) check
and return -EINVAL.
>
> --
> Thanks,
> Mina
Thanks for the review Mina!
Best,
Bobby
^ permalink raw reply
* Re: [PATCH net-next 0/2] net: sfp: quirk support for XGS-PON ONT sticks with unclean EEPROMs
From: Jakub Kicinski @ 2026-07-21 0:31 UTC (permalink / raw)
To: Martino Dell'Ambrogio
Cc: netdev, Russell King, Andrew Lunn, Heiner Kallweit,
David S . Miller, Eric Dumazet, Paolo Abeni, linux-kernel
In-Reply-To: <20260705185440.136496-1-tillo@tillo.ch>
On Sun, 5 Jul 2026 20:54:37 +0200 Martino Dell'Ambrogio wrote:
> Some clone XGS-PON ONT sticks ship EEPROMs where the vendor PN field is
> filled with non-printable garbage past the legitimate string instead of
> the SFF-8472 mandated space padding. sfp_strlen() then can't trim the
> field, the exact-length check in sfp_match() rejects the quirk entry
> before the string comparison runs, and the quirk silently never applies
> — so the kernel honors the module's spurious TX_FAULT and eventually
> disables it.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net] selftests: netfilter: conntrack_resize.sh: fix skip exit code
From: Jakub Kicinski @ 2026-07-21 0:33 UTC (permalink / raw)
To: Florian Westphal; +Cc: Dharmik Parmar, netdev
In-Reply-To: <aktQ5kLLtdG3pn3W@strlen.de>
On Mon, 6 Jul 2026 08:53:55 +0200 Florian Westphal wrote:
> Dharmik Parmar <dharmikparmar2004@yahoo.com> wrote:
> > When conntrack sysctls are unavailable, the test prints SKIP but exits
> > with $KSFT_SKIP. lib.sh defines ksft_skip instead, so the kselftest
> > runner did not see a proper skip.
>
> Acked-by: Florian Westphal <fw@strlen.de>
This is tagged for net but FWIW & AFAIU we haven't applied it.
^ permalink raw reply
* Re: [PATCH net] net: stmmac: raise TX completion interrupt at the end of an xmit burst
From: Jakub Kicinski @ 2026-07-21 0:35 UTC (permalink / raw)
To: Johan Alvarado
Cc: andrew+netdev, davem, edumazet, pabeni, mcoquelin.stm32,
alexandre.torgue, Jose.Abreu, pavel, netdev, linux-stm32,
linux-arm-kernel, linux-kernel
In-Reply-To: <0100019f35ea26e0-42ad009c-01ab-4a8f-b126-fa65fbacae5c-000000@email.amazonses.com>
On Mon, 6 Jul 2026 05:32:45 +0000 Johan Alvarado wrote:
> The TX mitigation logic only sets the Interrupt on Completion bit once
> every tx_coal_frames descriptors (STMMAC_TX_FRAMES = 25), with the
> tx_coal_timer hrtimer (STMMAC_COAL_TX_TIMER = 5000 us) as the only
> fallback. TX skbs are freed exclusively from the TX completion path,
> so any flow that keeps fewer than 25 frames in flight has all of its
> skbs held for up to 5 ms after transmission.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next] net: Convert %pK back to %p
From: Jakub Kicinski @ 2026-07-21 0:39 UTC (permalink / raw)
To: Sebastian Andrzej Siewior
Cc: linux-atm-general, linux-can, linux-sctp, netdev, David S. Miller,
Eric Dumazet, Herbert Xu, Kuniyuki Iwashima, Marc Kleine-Budde,
Marcelo Ricardo Leitner, Neal Cardwell, Oliver Hartkopp,
Paolo Abeni, Remi Denis-Courmont, Simon Horman, Steffen Klassert,
Willem de Bruijn, Xin Long, Petr Mladek, Thomas Weißschuh,
Kees Cook
In-Reply-To: <20260706073824.xixrLxoD@linutronix.de>
On Mon, 6 Jul 2026 09:38:24 +0200 Sebastian Andrzej Siewior wrote:
> This is a revert of commit 71338aa7d050c ("net: convert %p usage to
> %pK") which is from 2011. Back then the default behaviour for %p was to
> print the pointer. The %pK modifier was introduced to be able to control
> the behaviour of specific pointer output without changing the behaviour
> of %p for everyone. It was dedicated to avoid leaking pointers via
> /proc.
> There was also the idea to remove the check from formatting the string
> and move to the open callback (of the /proc file) with some helpers but
> this did not happen.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next] net: stmmac: Simplify ioctl handling
From: Andrew Lunn @ 2026-07-21 0:39 UTC (permalink / raw)
To: Vadim Fedorenko
Cc: Maxime Chevallier, Andrew Lunn, Jakub Kicinski, davem,
Eric Dumazet, Paolo Abeni, Simon Horman, Maxime Coquelin,
Alexandre Torgue, Russell King, thomas.petazzoni,
Alexis Lothoré, netdev, linux-kernel, linux-arm-kernel,
linux-stm32
In-Reply-To: <d4f606b9-d793-47c1-8c91-9c9da0e68b4a@linux.dev>
> looks like it won't work now. we have to create helpers in phy to fix it.
> I can work on it, but I don't have such HW combination to test. Do you have
> some HW to test this combination?
I don't. You should ask Richard Cochran. He added this code.
Andrew
^ permalink raw reply
* Re: [PATCH net] net: stmmac: intel: don't reconfigure SerDes on unchanged mode
From: Jakub Kicinski @ 2026-07-21 0:40 UTC (permalink / raw)
To: Markus Breitenberger
Cc: netdev, Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Choong Yong Liang, stable, Markus Breitenberger
In-Reply-To: <20260706061954.94842-1-bre@breiti.cc>
On Mon, 6 Jul 2026 08:19:54 +0200 Markus Breitenberger wrote:
> intel_mac_finish() is registered as the phylink mac_finish() callback
> for the Elkhart Lake SGMII ports. phylink calls mac_finish() at the end
> of every major link reconfiguration, including the initial one during
> probe, before any interface mode has actually changed.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH] net: mana: cap HWC init max message size to HW_CHANNEL_MAX_REQUEST_SIZE
From: Michael Bommarito @ 2026-07-21 0:40 UTC (permalink / raw)
To: Erni Sri Satya Vennela
Cc: Haiyang Zhang, Dexuan Cui, Long Li, K . Y . Srinivasan, Wei Liu,
Andrew Lunn, Jakub Kicinski, Paolo Abeni, netdev, linux-hyperv,
linux-kernel, stable
In-Reply-To: <al6ABAMHeE76yldL@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net>
On Mon, Jul 20, 2026 at 4:07 PM Erni Sri Satya Vennela
<ernis@linux.microsoft.com> wrote:
> I don't think the described data flow actually
> exists in the current tree, so the security framing looks inaccurate.
> Please check the comment below.
Agreed, I got mixed up on that. Sorry for the noise
Thanks,
Mike
^ permalink raw reply
* Re: [PATCH net-next v5 0/2] net: lan743x: add RMII support for PCI11x1x
From: Jakub Kicinski @ 2026-07-21 0:41 UTC (permalink / raw)
To: Thangaraj Samynathan
Cc: netdev, andrew+netdev, davem, edumazet, pabeni, horms,
bryan.whitehead, UNGLinuxDriver, linux-kernel
In-Reply-To: <20260706093150.9033-1-thangaraj.s@microchip.com>
On Mon, 6 Jul 2026 15:01:48 +0530 Thangaraj Samynathan wrote:
> This series adds RMII interface support for the Microchip PCI11x1x
> Ethernet controller.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net] net: phy: marvell: fix return code
From: Jakub Kicinski @ 2026-07-21 0:52 UTC (permalink / raw)
To: Michael Walle
Cc: Andrew Lunn, Heiner Kallweit, Russell King, David S . Miller,
Eric Dumazet, Paolo Abeni, Russell King, netdev, linux-kernel
In-Reply-To: <20260706120637.1947685-1-mwalle@kernel.org>
On Mon, 6 Jul 2026 14:06:27 +0200 Michael Walle wrote:
> Return the correct error code, not the value written to the register.
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net] selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
From: Jakub Kicinski @ 2026-07-21 0:59 UTC (permalink / raw)
To: Ricardo B. Marlière
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Simon Horman,
Shuah Khan, Xu Du, netdev, linux-kselftest, linux-kernel
In-Reply-To: <20260706-b4-net_tun_addr-v1-1-3d3cb2473560@suse.com>
On Mon, 06 Jul 2026 13:24:04 -0300 Ricardo B. Marlière wrote:
> The IPv6 addresses used for the tun_vnet_udptnl fixture currently fall in
> the 2002::/16 prefix, which is reserved for the 6to4 transition mechanism
> (RFC 3056).
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net] net: hsr: fix memory leak on slave unregistration by removing synced VLANs
From: Jakub Kicinski @ 2026-07-21 1:12 UTC (permalink / raw)
To: Fernando Fernandez Mancera
Cc: Eric Dumazet, David S . Miller, Paolo Abeni, Simon Horman,
Andrew Lunn, netdev, eric.dumazet, syzbot+456957213f32970c0762
In-Reply-To: <178406192459.16306.5204629050926533917.b4-review@b4>
On Tue, 14 Jul 2026 22:45:24 +0200 Fernando Fernandez Mancera wrote:
> > When an HSR master device is brought UP, it auto-adds VLAN 0 via
> > vlan_vid0_add(), which propagates VID 0 to its slave devices.
> >
> > If a slave device is later unregistered while HSR is active (e.g., during
> > netns cleanup or interface destruction), hsr_del_port() is called to
> > detach the slave port from the HSR master. However, hsr_del_port() currently
> > does not delete the VLAN IDs that were synced to the slave device by HSR.
> >
> > As a result, the slave device retains a refcount on VID 0 (and any other
> > synced VLANs). When the slave device is destroyed, its vlan_info /
> > vlan_vid_info structure remains allocated, leading to a memory leak.
> >
> > Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in
> > hsr_del_port() before unlinking the slave device, matching the cleanup
> > behavior in bonding and team drivers.
> >
> > Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support")
> > Reported-by: syzbot+456957213f32970c0762@syzkaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/6a4cb6ca.57639fcc.86d58.000b.GAE@google.com/T/#u
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>
> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Just to confirm - is the sashiko review a false positive?
https://sashiko.dev/#/patchset/20260707082327.3238690-1-edumazet%40google.com
^ permalink raw reply
* Re: [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
From: Jakub Kicinski @ 2026-07-21 1:18 UTC (permalink / raw)
To: zhangzl2013
Cc: Jay Vosburgh, Andrew Lunn, David S . Miller, Eric Dumazet,
Paolo Abeni, Hangbin Liu, netdev, linux-kernel, Qianheng Peng,
Zhaolong Zhang
In-Reply-To: <20260707010622.487333-1-zhangzl2013@126.com>
On Tue, 7 Jul 2026 09:06:22 +0800 zhangzl2013@126.com wrote:
> When booting with the 'ipv6.disable=1' parameter, the devconf_all is
> never initialized because inet6_init() exits before addrconf_init() is
> called which initializes it. bond_send_validate(), however, will still
> call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
> NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net v3] net/packet: avoid fanout hook re-registration after unregister
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: David Lee
Cc: willemdebruijn.kernel, davem, edumazet, kuba, pabeni, horms,
dominik.czarnota, netdev, linux-kernel, willemb
In-Reply-To: <20260707104440.833129-1-david.lee@trailofbits.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 10:44:37 +0000 you wrote:
> packet_set_ring() temporarily detaches a socket from packet delivery while
> reconfiguring its ring. It records the previous running state, clears
> po->num, unregisters the protocol hook when needed, drops po->bind_lock,
> and later restores po->num and re-registers the hook from the saved
> was_running value.
>
> That unlocked window can race with NETDEV_UNREGISTER. The notifier can
> observe the socket as not running, skip __unregister_prot_hook(), and
> invalidate the per-socket binding by setting po->ifindex to -1 and clearing
> po->prot_hook.dev. A one-member fanout group can still retain its shared
> fanout hook device pointer. When packet_set_ring() resumes, re-registering
> solely from the stale was_running state can re-add the fanout hook after
> the device has been unregistered.
>
> [...]
Here is the summary with links:
- [net,v3] net/packet: avoid fanout hook re-registration after unregister
https://git.kernel.org/netdev/net/c/50aff80475ab
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] netlink: specs: rt-link: convert bridge port flag attributes to u8
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: Danielle Ratson
Cc: netdev, donald.hunter, kuba, davem, edumazet, pabeni, horms,
razor, petrm, nikolay, idosch, bridge, linux-kernel
In-Reply-To: <a57cdfcfc4a6dcb92106c25b4dde5059fde2bd44.1783236731.git.danieller@nvidia.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 11:03:04 +0300 you wrote:
> A number of IFLA_BRPORT_* attributes are documented in the rt-link spec
> as having the "flag" type, i.e. a payload-less NLA_FLAG attribute whose
> meaning is presence-only. This does not match the kernel, which emits
> these attributes with nla_put_u8() and validates them as NLA_U8 in
> br_port_policy[]. The values are not mere presence flags but carry a u8
> payload (0/1).
>
> [...]
Here is the summary with links:
- [net] netlink: specs: rt-link: convert bridge port flag attributes to u8
https://git.kernel.org/netdev/net/c/f6e3b21608e9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 net] bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: Abdun Nihaal
Cc: skalluru, manishc, andrew+netdev, davem, edumazet, kuba, pabeni,
netdev, linux-kernel, horms, maciej.fijalkowski, stable,
sashiko-bot
In-Reply-To: <20260707054618.932108-1-nihaal@cse.iitm.ac.in>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 11:16:16 +0530 you wrote:
> In one of the error path in bnx2x_alloc_mem_bp(), bnx2x_free_mem_bp()
> may be called with bp->fp uninitialized. And so, there could be a null
> pointer dereference in bnx2x_free_mem_bp(). Fix that by initializing the
> fp_array_size after the bp->fp pointer is correctly initialized.
>
> Fixes: c3146eb676e7 ("bnx2x: Correct memory preparation and release")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
>
> [...]
Here is the summary with links:
- [v2,net] bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()
https://git.kernel.org/netdev/net-next/c/e354f7d60f14
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH v2 net 0/2] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting
tx->freq to ppb and comparing it against ops->max_adj. On 64-bit systems
that conversion can overflow s64 and wrap the result back into range, so
a crafted tx->freq bypasses the check and reaches ->adjfine() unclamped.
Patch 1 rejects the overflow in ptp_clock_adjtime().
Patch 2 adds a regression test that crafts struct timex.freq directly
(testptp's int-ppb path cannot express the value) and confirms it is
rejected with -ERANGE.
Changes in v2:
- patch 1: unchanged, added Reviewed-by from Vadim Fedorenko.
- patch 2 (all from Simon Horman's review):
- cast fd to unsigned before the shift in FD_TO_CLOCKID (UBSan)
- only set the 64-bit test value on 64-bit builds (32-bit -Woverflow)
- save and restore the clock frequency
- skip instead of fail on -EBUSY (free-running clock)
Link to v1:
https://lore.kernel.org/netdev/20260712040922.6403-1-deepshah146@gmail.com/
Deep Shah (2):
ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
selftests: ptp: add a regression test for the frequency adjustment
overflow
drivers/ptp/ptp_clock.c | 14 ++-
tools/testing/selftests/ptp/Makefile | 2 +-
.../testing/selftests/ptp/ptp_freq_overflow.c | 99 +++++++++++++++++++
3 files changed, 113 insertions(+), 2 deletions(-)
create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c
base-commit: 1c975de3343cdef506f2eecc833cc1f14b0401c4
--
2.43.0
^ permalink raw reply
* [PATCH v2 net 1/2] ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
In-Reply-To: <20260721014256.1876-1-deepshah146@gmail.com>
ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting the
requested scaled ppm to ppb and comparing it against ops->max_adj:
long ppb = scaled_ppm_to_ppb(tx->freq);
if (ppb > ops->max_adj || ppb < -ops->max_adj)
return -ERANGE;
scaled_ppm_to_ppb() computes (1 + ppm) * 125 >> 13 in s64. For a
sufficiently large tx->freq the multiplication overflows s64 and wraps,
so the resulting ppb can fall back within [-max_adj, max_adj] and pass
the check. The unclamped tx->freq is then handed to ->adjfine(), where
drivers scale it again (e.g. scaled_ppm * 762939453125 in ptp_idt82p33)
and program a bogus frequency word.
For example tx->freq = 147573952589676412 makes (1 + ppm) * 125 equal
2^64 + 9, which wraps to ppb == 0 and is accepted.
The caller already has write access to the PHC, so this hardens the
max_adj sanity check rather than crossing a privilege boundary, and
well-behaved user space (e.g. ptp4l) never requests such values. It is
a follow-up to commit 475b92f93216 ("ptp: improve max_adj check against
unreasonable values"), which handled the analogous s32 narrowing but not
this multiplication overflow.
Detect the overflow with check_*_overflow() and reject the request in
ptp_clock_adjtime() instead of acting on the wrapped value.
Fixes: d39a743511cd ("ptp: validate the requested frequency adjustment.")
Signed-off-by: Deep Shah <deepshah146@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
---
drivers/ptp/ptp_clock.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index d6f54ccaf93b..4111342d64f0 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -9,6 +9,7 @@
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/posix-clock.h>
#include <linux/pps_kernel.h>
#include <linux/property.h>
@@ -159,7 +160,18 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
delta = ktime_to_ns(kt);
err = ops->adjtime(ops, delta);
} else if (tx->modes & ADJ_FREQUENCY) {
- long ppb = scaled_ppm_to_ppb(tx->freq);
+ long ppb;
+ s64 tmp;
+
+ /*
+ * scaled_ppm_to_ppb() multiplies (1 + freq) by 125 in s64;
+ * reject a ->freq large enough to overflow that, which would
+ * otherwise wrap the result back into the max_adj range.
+ */
+ if (check_add_overflow((s64)tx->freq, (s64)1, &tmp) ||
+ check_mul_overflow(tmp, (s64)125, &tmp))
+ return -ERANGE;
+ ppb = scaled_ppm_to_ppb(tx->freq);
if (ppb > ops->max_adj || ppb < -ops->max_adj)
return -ERANGE;
err = ops->adjfine(ops, tx->freq);
--
2.43.0
^ permalink raw reply related
* [PATCH v2 net 2/2] selftests: ptp: add a regression test for the frequency adjustment overflow
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
In-Reply-To: <20260721014256.1876-1-deepshah146@gmail.com>
testptp's -f option stores the requested adjustment as an int ppb and
converts it to scaled ppm, so it cannot express the 64-bit scaled-ppm
values needed to overflow scaled_ppm_to_ppb() and bypass the max_adj
check enforced by ptp_clock_adjtime().
Add a small test that crafts struct timex.freq directly and verifies that
an overflowing frequency adjustment is rejected with -ERANGE. The test
skips when no frequency-adjustable PTP device is available.
Signed-off-by: Deep Shah <deepshah146@gmail.com>
---
tools/testing/selftests/ptp/Makefile | 2 +-
.../testing/selftests/ptp/ptp_freq_overflow.c | 99 +++++++++++++++++++
2 files changed, 100 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c
diff --git a/tools/testing/selftests/ptp/Makefile b/tools/testing/selftests/ptp/Makefile
index 8f57f88ecadd..dd7376cc9bf5 100644
--- a/tools/testing/selftests/ptp/Makefile
+++ b/tools/testing/selftests/ptp/Makefile
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
CFLAGS += $(KHDR_INCLUDES)
-TEST_GEN_PROGS := testptp
+TEST_GEN_PROGS := testptp ptp_freq_overflow
LDLIBS += -lrt
TEST_PROGS = phc.sh
diff --git a/tools/testing/selftests/ptp/ptp_freq_overflow.c b/tools/testing/selftests/ptp/ptp_freq_overflow.c
new file mode 100644
index 000000000000..417c0516622d
--- /dev/null
+++ b/tools/testing/selftests/ptp/ptp_freq_overflow.c
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Regression test for the scaled_ppm_to_ppb() integer overflow that allowed
+ * a crafted clock_adjtime(ADJ_FREQUENCY) to bypass the PTP max_adj check.
+ *
+ * testptp's -f option stores the adjustment as an int ppb and cannot express
+ * the 64-bit scaled-ppm values needed to overflow the conversion, so this
+ * test crafts struct timex.freq directly.
+ */
+#define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/timex.h>
+#include <time.h>
+#include <unistd.h>
+#include <linux/ptp_clock.h>
+#include "../kselftest.h"
+
+#define FD_TO_CLOCKID(fd) ((clockid_t)((((unsigned int)~(fd)) << 3) | 3))
+
+/* clock_adjtime is not available in GLIBC < 2.14 */
+#if !__GLIBC_PREREQ(2, 14)
+#include <sys/syscall.h>
+static int clock_adjtime(clockid_t id, struct timex *tx)
+{
+ return syscall(__NR_clock_adjtime, id, tx);
+}
+#endif
+
+int main(int argc, char *argv[])
+{
+ const char *device = argc > 1 ? argv[1] : "/dev/ptp0";
+ struct ptp_clock_caps caps;
+ struct timex restore = { 0 };
+ struct timex tx = { 0 };
+ clockid_t clkid;
+ int fd, ret;
+
+ ksft_print_header();
+ ksft_set_plan(1);
+
+ if (sizeof(tx.freq) < 8)
+ ksft_exit_skip("the overflow only affects 64-bit kernels\n");
+
+ fd = open(device, O_RDWR);
+ if (fd < 0)
+ ksft_exit_skip("cannot open %s: %s\n", device, strerror(errno));
+
+ clkid = FD_TO_CLOCKID(fd);
+
+ if (ioctl(fd, PTP_CLOCK_GETCAPS, &caps))
+ ksft_exit_skip("PTP_CLOCK_GETCAPS on %s: %s\n", device, strerror(errno));
+ if (!caps.max_adj)
+ ksft_exit_skip("%s does not support frequency adjustment\n", device);
+
+ /*
+ * Remember the current frequency. A vulnerable kernel accepts the
+ * bogus value below and programs it into the hardware, so restore the
+ * original afterwards instead of leaving the clock corrupted.
+ */
+ if (clock_adjtime(clkid, &restore))
+ ksft_exit_skip("clock_adjtime(get) on %s: %s\n", device, strerror(errno));
+ restore.modes = ADJ_FREQUENCY;
+
+ /*
+ * (1 + 147573952589676412) * 125 == 2^64 + 9, which overflows s64 in
+ * scaled_ppm_to_ppb() and wraps the result to a ppb of 0. A kernel
+ * that does not detect the overflow lets this absurd frequency past
+ * the max_adj check; a fixed kernel rejects it with -ERANGE.
+ */
+ tx.modes = ADJ_FREQUENCY;
+#if __SIZEOF_LONG__ >= 8
+ tx.freq = 147573952589676412L;
+#endif
+
+ ret = clock_adjtime(clkid, &tx);
+ if (ret < 0 && errno == EBUSY) {
+ /*
+ * A free-running physical clock (virtual clocks active) rejects
+ * frequency adjustment with -EBUSY before the overflow is even
+ * evaluated, so the test cannot run here.
+ */
+ ksft_test_result_skip("%s: frequency adjustment returned EBUSY, skipping\n",
+ device);
+ } else {
+ ksft_test_result(ret < 0 && errno == ERANGE,
+ "overflowing frequency adjustment is rejected (ret=%d errno=%d)\n",
+ ret, ret < 0 ? errno : 0);
+ }
+
+ /* put the frequency back the way we found it */
+ clock_adjtime(clkid, &restore);
+
+ close(fd);
+ ksft_finished();
+}
--
2.43.0
^ permalink raw reply related
* [PATCH net] tun: prevent underflow in rx headroom calculation
From: Asim Viladi Oglu Manizada @ 2026-07-21 1:43 UTC (permalink / raw)
To: netdev
Cc: Willem de Bruijn, Jason Wang, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
tun_get_user() calculates good_linear with SKB_MAX_HEAD(align). The align
value comes from ndo_set_rx_headroom() and can be larger than the linear
space available in a one-page skb head.
OVS can reach this case by carrying headroom from a netkit/VXLAN port to a
TUN port. SKB_MAX_HEAD() then underflows, leaving good_linear negative.
Assigning that value to the size_t linear variable in tun_get_user()
converts it to a large positive value. The wrapped value is passed to
tun_alloc_skb(), where prepad + linear and len - linear wrap. skb->data can
then end up past the allocated head, and later packet processing can access
memory outside the skb.
Clamp good_linear to zero when SKB_MAX_HEAD() returns a negative value.
This lets tun_alloc_skb() allocate the requested headroom and place the
packet data linearly or in fragments without wrapping.
Fixes: eaea34b23c46 ("net/tun: implement ndo_set_rx_headroom")
Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
---
drivers/net/tun.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ffbe6f13fb1..d3be0f2d5df 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1780,6 +1780,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
}
good_linear = SKB_MAX_HEAD(align);
+ good_linear = max(good_linear, 0);
if (msg_control) {
struct iov_iter i = *from;
--
2.39.5
^ permalink raw reply related
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox