* Re: [PATCH] net: pcs: xpcs-plat: fix runtime PM initialization
From: Jakub Kicinski @ 2026-07-21 0:24 UTC (permalink / raw)
To: Coia Prant
Cc: netdev, Andrew Lunn, Heiner Kallweit, Russell King,
David S . Miller, Eric Dumazet, Paolo Abeni, Serge Semin,
linux-kernel, stable
In-Reply-To: <20260704214808.1566710-1-coiaprant@gmail.com>
On Sun, 5 Jul 2026 05:48:08 +0800 Coia Prant wrote:
> The driver calls `pm_runtime_set_active()` before runtime PM is enabled,
> and before the clock is prepared and enabled.
>
> This causes the clock to be unprepared/disabled later in the suspend
> callback even though it was never prepared/enabled, resulting in warnings:
>
> clk_csr already disabled
> clk_csr already unprepared
>
> Fix this by setting the initial runtime PM status to SUSPENDED instead
> of ACTIVE.
>
> The clock will be properly enabled when the device is first resumed
> via runtime PM (e.g., during MDIO access).
Seems a bit odd that this hasn't been discovered until now.
Could you add more details about your platform and maybe
a hypothesis why we haven't noticed?
^ permalink raw reply
* Re: [PATCH net] vxlan: vnifilter: enforce exact length of GROUP/GROUP6 attributes
From: Jakub Kicinski @ 2026-07-21 0:25 UTC (permalink / raw)
To: Xiang Mei
Cc: Andrew Lunn, David S . Miller, Eric Dumazet, Paolo Abeni,
Roopa Prabhu, netdev, linux-kernel, Petr Machata, Andy Roulin,
David Yang, Kees Cook, Weiming Shi
In-Reply-To: <20260704222254.914567-1-xmei5@asu.edu>
On Sat, 4 Jul 2026 15:22:54 -0700 Xiang Mei wrote:
> The VXLAN VNI filter entry policy declares the GROUP/GROUP6 address
> attributes as NLA_BINARY with only a maximum length, so validate_nla()
> accepts a payload shorter than the address. The GROUP consumer reads it
> with nla_get_in_addr(), an unconditional 4-byte load, so a short
> attribute over-reads up to 3 bytes of uninitialised slab data, which are
> stored into remote_ip and echoed back via RTM_GETTUNNEL, disclosing
> kernel memory.
>
> Switch both entries to NLA_POLICY_EXACT_LEN() so the validator rejects
> any GROUP/GROUP6 that is not exactly 4 / 16 bytes; a valid address is
> always sent at full width.
The netdev patch queue has overflown, if the patch is still needed
you'll have to repost, sorry.
^ permalink raw reply
* Re: [PATCH net v4 0/3] net/smc: bound wire-controlled CDC cursors against the local buffers
From: Jakub Kicinski @ 2026-07-21 0:28 UTC (permalink / raw)
To: Bryam Vargas via B4 Relay
Cc: hexlabsecurity, Dust Li, David S. Miller, Sidraya Jayagond,
Eric Dumazet, D. Wythe, Simon Horman, Wenjia Zhang, Paolo Abeni,
Stefan Raspl, Wen Gu, linux-kernel, netdev, Mahanta Jambigi,
Tony Lu, Ursula Braun, linux-s390, linux-rdma
In-Reply-To: <20260705-b4-disp-28a1bbca-v4-0-be089b98acc6@proton.me>
On Sun, 05 Jul 2026 02:54:04 -0500 Bryam Vargas via B4 Relay wrote:
> A peer's CDC producer/consumer cursors are copied from the wire and used,
> without an upper bound against the local buffers, as (a) a raw index into the
> RMB on the urgent path, (b) the receive length in smc_rx_recvmsg(), and (c) the
> send length in smc_tx_sendmsg() on the SMC-D DMB-merge path. A malicious or
> buggy peer can forge a cursor so each runs past the relevant buffer: an
> out-of-bounds read of adjacent kernel memory (disclosed to the peer) on the
> receive/urgent side, and, on the send side, an out-of-bounds write whose
> length the peer controls and whose overflowing bytes are the local sender's
> own outbound data.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next v5 2/3] selftests/net: ncdevmem: add -b option to set rx-buf-size on bind
From: Bobby Eshleman @ 2026-07-21 0:28 UTC (permalink / raw)
To: Mina Almasry
Cc: Donald Hunter, Jakub Kicinski, David S. Miller, Eric Dumazet,
Paolo Abeni, Simon Horman, Andrew Lunn, Gerd Hoffmann,
Vivek Kasireddy, Sumit Semwal, Christian König, Shuah Khan,
netdev, linux-kernel, dri-devel, linux-media, linaro-mm-sig,
linux-kselftest, sdf, razor, daniel, matttbe, skhawaja, dw,
Joe Damato, Bobby Eshleman
In-Reply-To: <CAHS8izMz_S8K80EXn3oFXiDNkGuPUMzjecaJjAvaZVky-7O40Q@mail.gmail.com>
On Mon, Jul 20, 2026 at 02:15:42PM -0700, Mina Almasry wrote:
> On Wed, Jul 8, 2026 at 3:55 PM Bobby Eshleman <bobbyeshleman@gmail.com> wrote:
> >
> > From: Bobby Eshleman <bobbyeshleman@meta.com>
> >
> > Add -b <bytes> to request a non-default niov size via
> > NETDEV_A_DMABUF_RX_BUF_SIZE. When the value exceeds PAGE_SIZE,
> > udmabuf_alloc() switches to an MFD_HUGETLB-backed memfd so each 2 MB
> > hugepage produces one naturally-aligned sg entry.
> >
> > Signed-off-by: Bobby Eshleman <bobbyeshleman@meta.com>
> > Acked-by: Stanislav Fomichev <sdf@fomichev.me>
>
> Reviewed-by: Mina Almasry <almasrymina@google.com>
>
>
> > ---
> > tools/testing/selftests/drivers/net/hw/ncdevmem.c | 36 +++++++++++++++++++++--
> > 1 file changed, 33 insertions(+), 3 deletions(-)
> >
> > diff --git a/tools/testing/selftests/drivers/net/hw/ncdevmem.c b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > index d96e8a3b5a65..a16e55af51ee 100644
> > --- a/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > +++ b/tools/testing/selftests/drivers/net/hw/ncdevmem.c
> > @@ -40,6 +40,7 @@
> >
> > #include <linux/uio.h>
> > #include <stdarg.h>
> > +#include <stdint.h>
> > #include <stdio.h>
> > #include <stdlib.h>
> > #include <unistd.h>
> > @@ -61,6 +62,7 @@
> > #include <sys/time.h>
> >
> > #include <linux/memfd.h>
> > +#include <sys/param.h>
> > #include <linux/dma-buf.h>
> > #include <linux/errqueue.h>
> > #include <linux/udmabuf.h>
> > @@ -79,6 +81,7 @@
> > #define PAGE_SHIFT 12
> > #define TEST_PREFIX "ncdevmem"
> > #define NUM_PAGES 16000
> > +#define MB(x) ((x) << 20)
> >
> > #ifndef MSG_SOCK_DEVMEM
> > #define MSG_SOCK_DEVMEM 0x2000000
> > @@ -100,6 +103,7 @@ static unsigned int dmabuf_id;
> > static uint32_t tx_dmabuf_id;
> > static int waittime_ms = 500;
> > static bool fail_on_linear;
> > +static uint32_t rx_buf_size;
> >
> > /* System state loaded by current_config_load() */
> > #define MAX_FLOWS 8
> > @@ -142,6 +146,7 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
> > {
> > struct udmabuf_create create;
> > struct memory_buffer *ctx;
> > + unsigned int memfd_flags;
> > int ret;
> >
> > ctx = malloc(sizeof(*ctx));
> > @@ -156,9 +161,14 @@ static struct memory_buffer *udmabuf_alloc(size_t size)
> > goto err_free_ctx;
> > }
> >
> > - ctx->memfd = memfd_create("udmabuf-test", MFD_ALLOW_SEALING);
> > + memfd_flags = MFD_ALLOW_SEALING;
> > + if (rx_buf_size > getpagesize())
> > + memfd_flags |= MFD_HUGETLB | MFD_HUGE_2MB;
> > +
>
> The fact that you are using HUGETLM and 2MB mappings here made me
> realize there is a pathological edge case in the code where the netmem
> size you're requesting is greater than the mapping size, so you
> actually get no netmems. So like if you ask for a 64KB netmem size but
> actually you did a normal udambuf mapping and all the maps (sg len
> entries) are 4K or something. IDK if the code already handles this
> well with an error or what not. Worth checking.
If I follow you correctly, in the case of sg len == 4K, and requested
size of 64K, it will fail the !IS_ALIGNED(len=4k, niov_size=64K) check
and return -EINVAL.
>
> --
> Thanks,
> Mina
Thanks for the review Mina!
Best,
Bobby
^ permalink raw reply
* Re: [PATCH net-next 0/2] net: sfp: quirk support for XGS-PON ONT sticks with unclean EEPROMs
From: Jakub Kicinski @ 2026-07-21 0:31 UTC (permalink / raw)
To: Martino Dell'Ambrogio
Cc: netdev, Russell King, Andrew Lunn, Heiner Kallweit,
David S . Miller, Eric Dumazet, Paolo Abeni, linux-kernel
In-Reply-To: <20260705185440.136496-1-tillo@tillo.ch>
On Sun, 5 Jul 2026 20:54:37 +0200 Martino Dell'Ambrogio wrote:
> Some clone XGS-PON ONT sticks ship EEPROMs where the vendor PN field is
> filled with non-printable garbage past the legitimate string instead of
> the SFF-8472 mandated space padding. sfp_strlen() then can't trim the
> field, the exact-length check in sfp_match() rejects the quirk entry
> before the string comparison runs, and the quirk silently never applies
> — so the kernel honors the module's spurious TX_FAULT and eventually
> disables it.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net] selftests: netfilter: conntrack_resize.sh: fix skip exit code
From: Jakub Kicinski @ 2026-07-21 0:33 UTC (permalink / raw)
To: Florian Westphal; +Cc: Dharmik Parmar, netdev
In-Reply-To: <aktQ5kLLtdG3pn3W@strlen.de>
On Mon, 6 Jul 2026 08:53:55 +0200 Florian Westphal wrote:
> Dharmik Parmar <dharmikparmar2004@yahoo.com> wrote:
> > When conntrack sysctls are unavailable, the test prints SKIP but exits
> > with $KSFT_SKIP. lib.sh defines ksft_skip instead, so the kselftest
> > runner did not see a proper skip.
>
> Acked-by: Florian Westphal <fw@strlen.de>
This is tagged for net but FWIW & AFAIU we haven't applied it.
^ permalink raw reply
* Re: [PATCH net] net: stmmac: raise TX completion interrupt at the end of an xmit burst
From: Jakub Kicinski @ 2026-07-21 0:35 UTC (permalink / raw)
To: Johan Alvarado
Cc: andrew+netdev, davem, edumazet, pabeni, mcoquelin.stm32,
alexandre.torgue, Jose.Abreu, pavel, netdev, linux-stm32,
linux-arm-kernel, linux-kernel
In-Reply-To: <0100019f35ea26e0-42ad009c-01ab-4a8f-b126-fa65fbacae5c-000000@email.amazonses.com>
On Mon, 6 Jul 2026 05:32:45 +0000 Johan Alvarado wrote:
> The TX mitigation logic only sets the Interrupt on Completion bit once
> every tx_coal_frames descriptors (STMMAC_TX_FRAMES = 25), with the
> tx_coal_timer hrtimer (STMMAC_COAL_TX_TIMER = 5000 us) as the only
> fallback. TX skbs are freed exclusively from the TX completion path,
> so any flow that keeps fewer than 25 frames in flight has all of its
> skbs held for up to 5 ms after transmission.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next] net: Convert %pK back to %p
From: Jakub Kicinski @ 2026-07-21 0:39 UTC (permalink / raw)
To: Sebastian Andrzej Siewior
Cc: linux-atm-general, linux-can, linux-sctp, netdev, David S. Miller,
Eric Dumazet, Herbert Xu, Kuniyuki Iwashima, Marc Kleine-Budde,
Marcelo Ricardo Leitner, Neal Cardwell, Oliver Hartkopp,
Paolo Abeni, Remi Denis-Courmont, Simon Horman, Steffen Klassert,
Willem de Bruijn, Xin Long, Petr Mladek, Thomas Weißschuh,
Kees Cook
In-Reply-To: <20260706073824.xixrLxoD@linutronix.de>
On Mon, 6 Jul 2026 09:38:24 +0200 Sebastian Andrzej Siewior wrote:
> This is a revert of commit 71338aa7d050c ("net: convert %p usage to
> %pK") which is from 2011. Back then the default behaviour for %p was to
> print the pointer. The %pK modifier was introduced to be able to control
> the behaviour of specific pointer output without changing the behaviour
> of %p for everyone. It was dedicated to avoid leaking pointers via
> /proc.
> There was also the idea to remove the check from formatting the string
> and move to the open callback (of the /proc file) with some helpers but
> this did not happen.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net-next] net: stmmac: Simplify ioctl handling
From: Andrew Lunn @ 2026-07-21 0:39 UTC (permalink / raw)
To: Vadim Fedorenko
Cc: Maxime Chevallier, Andrew Lunn, Jakub Kicinski, davem,
Eric Dumazet, Paolo Abeni, Simon Horman, Maxime Coquelin,
Alexandre Torgue, Russell King, thomas.petazzoni,
Alexis Lothoré, netdev, linux-kernel, linux-arm-kernel,
linux-stm32
In-Reply-To: <d4f606b9-d793-47c1-8c91-9c9da0e68b4a@linux.dev>
> looks like it won't work now. we have to create helpers in phy to fix it.
> I can work on it, but I don't have such HW combination to test. Do you have
> some HW to test this combination?
I don't. You should ask Richard Cochran. He added this code.
Andrew
^ permalink raw reply
* Re: [PATCH net] net: stmmac: intel: don't reconfigure SerDes on unchanged mode
From: Jakub Kicinski @ 2026-07-21 0:40 UTC (permalink / raw)
To: Markus Breitenberger
Cc: netdev, Andrew Lunn, David S. Miller, Eric Dumazet, Paolo Abeni,
Choong Yong Liang, stable, Markus Breitenberger
In-Reply-To: <20260706061954.94842-1-bre@breiti.cc>
On Mon, 6 Jul 2026 08:19:54 +0200 Markus Breitenberger wrote:
> intel_mac_finish() is registered as the phylink mac_finish() callback
> for the Elkhart Lake SGMII ports. phylink calls mac_finish() at the end
> of every major link reconfiguration, including the initial one during
> probe, before any interface mode has actually changed.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH] net: mana: cap HWC init max message size to HW_CHANNEL_MAX_REQUEST_SIZE
From: Michael Bommarito @ 2026-07-21 0:40 UTC (permalink / raw)
To: Erni Sri Satya Vennela
Cc: Haiyang Zhang, Dexuan Cui, Long Li, K . Y . Srinivasan, Wei Liu,
Andrew Lunn, Jakub Kicinski, Paolo Abeni, netdev, linux-hyperv,
linux-kernel, stable
In-Reply-To: <al6ABAMHeE76yldL@linuxonhyperv3.guj3yctzbm1etfxqx2vob5hsef.xx.internal.cloudapp.net>
On Mon, Jul 20, 2026 at 4:07 PM Erni Sri Satya Vennela
<ernis@linux.microsoft.com> wrote:
> I don't think the described data flow actually
> exists in the current tree, so the security framing looks inaccurate.
> Please check the comment below.
Agreed, I got mixed up on that. Sorry for the noise
Thanks,
Mike
^ permalink raw reply
* Re: [PATCH net-next v5 0/2] net: lan743x: add RMII support for PCI11x1x
From: Jakub Kicinski @ 2026-07-21 0:41 UTC (permalink / raw)
To: Thangaraj Samynathan
Cc: netdev, andrew+netdev, davem, edumazet, pabeni, horms,
bryan.whitehead, UNGLinuxDriver, linux-kernel
In-Reply-To: <20260706093150.9033-1-thangaraj.s@microchip.com>
On Mon, 6 Jul 2026 15:01:48 +0530 Thangaraj Samynathan wrote:
> This series adds RMII interface support for the Microchip PCI11x1x
> Ethernet controller.
The netdev patch queue has overflown.
If these patches are still relevant you'll have to repost them.
^ permalink raw reply
* Re: [PATCH net] net: phy: marvell: fix return code
From: Jakub Kicinski @ 2026-07-21 0:52 UTC (permalink / raw)
To: Michael Walle
Cc: Andrew Lunn, Heiner Kallweit, Russell King, David S . Miller,
Eric Dumazet, Paolo Abeni, Russell King, netdev, linux-kernel
In-Reply-To: <20260706120637.1947685-1-mwalle@kernel.org>
On Mon, 6 Jul 2026 14:06:27 +0200 Michael Walle wrote:
> Return the correct error code, not the value written to the register.
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net] selftests/net: Fix tun IPv6 test addresses to avoid 6to4 range
From: Jakub Kicinski @ 2026-07-21 0:59 UTC (permalink / raw)
To: Ricardo B. Marlière
Cc: David S. Miller, Eric Dumazet, Paolo Abeni, Simon Horman,
Shuah Khan, Xu Du, netdev, linux-kselftest, linux-kernel
In-Reply-To: <20260706-b4-net_tun_addr-v1-1-3d3cb2473560@suse.com>
On Mon, 06 Jul 2026 13:24:04 -0300 Ricardo B. Marlière wrote:
> The IPv6 addresses used for the tun_vnet_udptnl fixture currently fall in
> the 2002::/16 prefix, which is reserved for the 6to4 transition mechanism
> (RFC 3056).
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net] net: hsr: fix memory leak on slave unregistration by removing synced VLANs
From: Jakub Kicinski @ 2026-07-21 1:12 UTC (permalink / raw)
To: Fernando Fernandez Mancera
Cc: Eric Dumazet, David S . Miller, Paolo Abeni, Simon Horman,
Andrew Lunn, netdev, eric.dumazet, syzbot+456957213f32970c0762
In-Reply-To: <178406192459.16306.5204629050926533917.b4-review@b4>
On Tue, 14 Jul 2026 22:45:24 +0200 Fernando Fernandez Mancera wrote:
> > When an HSR master device is brought UP, it auto-adds VLAN 0 via
> > vlan_vid0_add(), which propagates VID 0 to its slave devices.
> >
> > If a slave device is later unregistered while HSR is active (e.g., during
> > netns cleanup or interface destruction), hsr_del_port() is called to
> > detach the slave port from the HSR master. However, hsr_del_port() currently
> > does not delete the VLAN IDs that were synced to the slave device by HSR.
> >
> > As a result, the slave device retains a refcount on VID 0 (and any other
> > synced VLANs). When the slave device is destroyed, its vlan_info /
> > vlan_vid_info structure remains allocated, leading to a memory leak.
> >
> > Fix this by calling vlan_vids_del_by_dev(port->dev, master->dev) in
> > hsr_del_port() before unlinking the slave device, matching the cleanup
> > behavior in bonding and team drivers.
> >
> > Fixes: 1a8a63a5305e ("net: hsr: Add VLAN CTAG filter support")
> > Reported-by: syzbot+456957213f32970c0762@syzkaller.appspotmail.com
> > Closes: https://lore.kernel.org/netdev/6a4cb6ca.57639fcc.86d58.000b.GAE@google.com/T/#u
> > Signed-off-by: Eric Dumazet <edumazet@google.com>
>
> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de>
Just to confirm - is the sashiko review a false positive?
https://sashiko.dev/#/patchset/20260707082327.3238690-1-edumazet%40google.com
^ permalink raw reply
* Re: [PATCH net] bonding: fix devconf_all NULL dereference when IPv6 is disabled
From: Jakub Kicinski @ 2026-07-21 1:18 UTC (permalink / raw)
To: zhangzl2013
Cc: Jay Vosburgh, Andrew Lunn, David S . Miller, Eric Dumazet,
Paolo Abeni, Hangbin Liu, netdev, linux-kernel, Qianheng Peng,
Zhaolong Zhang
In-Reply-To: <20260707010622.487333-1-zhangzl2013@126.com>
On Tue, 7 Jul 2026 09:06:22 +0800 zhangzl2013@126.com wrote:
> When booting with the 'ipv6.disable=1' parameter, the devconf_all is
> never initialized because inet6_init() exits before addrconf_init() is
> called which initializes it. bond_send_validate(), however, will still
> call bond_ns_send_all() even ipv6 is indeed disabled. It will lead to
> NULL derefence of net->ipv6.devconf_all in ip6_pol_route().
Applied, thanks.
^ permalink raw reply
* Re: [PATCH net v3] net/packet: avoid fanout hook re-registration after unregister
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: David Lee
Cc: willemdebruijn.kernel, davem, edumazet, kuba, pabeni, horms,
dominik.czarnota, netdev, linux-kernel, willemb
In-Reply-To: <20260707104440.833129-1-david.lee@trailofbits.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 10:44:37 +0000 you wrote:
> packet_set_ring() temporarily detaches a socket from packet delivery while
> reconfiguring its ring. It records the previous running state, clears
> po->num, unregisters the protocol hook when needed, drops po->bind_lock,
> and later restores po->num and re-registers the hook from the saved
> was_running value.
>
> That unlocked window can race with NETDEV_UNREGISTER. The notifier can
> observe the socket as not running, skip __unregister_prot_hook(), and
> invalidate the per-socket binding by setting po->ifindex to -1 and clearing
> po->prot_hook.dev. A one-member fanout group can still retain its shared
> fanout hook device pointer. When packet_set_ring() resumes, re-registering
> solely from the stale was_running state can re-add the fanout hook after
> the device has been unregistered.
>
> [...]
Here is the summary with links:
- [net,v3] net/packet: avoid fanout hook re-registration after unregister
https://git.kernel.org/netdev/net/c/50aff80475ab
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH net] netlink: specs: rt-link: convert bridge port flag attributes to u8
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: Danielle Ratson
Cc: netdev, donald.hunter, kuba, davem, edumazet, pabeni, horms,
razor, petrm, nikolay, idosch, bridge, linux-kernel
In-Reply-To: <a57cdfcfc4a6dcb92106c25b4dde5059fde2bd44.1783236731.git.danieller@nvidia.com>
Hello:
This patch was applied to netdev/net.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 11:03:04 +0300 you wrote:
> A number of IFLA_BRPORT_* attributes are documented in the rt-link spec
> as having the "flag" type, i.e. a payload-less NLA_FLAG attribute whose
> meaning is presence-only. This does not match the kernel, which emits
> these attributes with nla_put_u8() and validates them as NLA_U8 in
> br_port_policy[]. The values are not mere presence flags but carry a u8
> payload (0/1).
>
> [...]
Here is the summary with links:
- [net] netlink: specs: rt-link: convert bridge port flag attributes to u8
https://git.kernel.org/netdev/net/c/f6e3b21608e9
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* Re: [PATCH v2 net] bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()
From: patchwork-bot+netdevbpf @ 2026-07-21 1:30 UTC (permalink / raw)
To: Abdun Nihaal
Cc: skalluru, manishc, andrew+netdev, davem, edumazet, kuba, pabeni,
netdev, linux-kernel, horms, maciej.fijalkowski, stable,
sashiko-bot
In-Reply-To: <20260707054618.932108-1-nihaal@cse.iitm.ac.in>
Hello:
This patch was applied to netdev/net-next.git (main)
by Jakub Kicinski <kuba@kernel.org>:
On Tue, 7 Jul 2026 11:16:16 +0530 you wrote:
> In one of the error path in bnx2x_alloc_mem_bp(), bnx2x_free_mem_bp()
> may be called with bp->fp uninitialized. And so, there could be a null
> pointer dereference in bnx2x_free_mem_bp(). Fix that by initializing the
> fp_array_size after the bp->fp pointer is correctly initialized.
>
> Fixes: c3146eb676e7 ("bnx2x: Correct memory preparation and release")
> Cc: stable@vger.kernel.org
> Reported-by: Sashiko AI Review <sashiko-bot@kernel.org>
> Reviewed-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
> Signed-off-by: Abdun Nihaal <nihaal@cse.iitm.ac.in>
>
> [...]
Here is the summary with links:
- [v2,net] bnx2x: fix null pointer dereference in bnx2x_free_mem_bp()
https://git.kernel.org/netdev/net-next/c/e354f7d60f14
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html
^ permalink raw reply
* [PATCH v2 net 0/2] ptp: fix scaled_ppm_to_ppb() overflow bypassing the max_adj check
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting
tx->freq to ppb and comparing it against ops->max_adj. On 64-bit systems
that conversion can overflow s64 and wrap the result back into range, so
a crafted tx->freq bypasses the check and reaches ->adjfine() unclamped.
Patch 1 rejects the overflow in ptp_clock_adjtime().
Patch 2 adds a regression test that crafts struct timex.freq directly
(testptp's int-ppb path cannot express the value) and confirms it is
rejected with -ERANGE.
Changes in v2:
- patch 1: unchanged, added Reviewed-by from Vadim Fedorenko.
- patch 2 (all from Simon Horman's review):
- cast fd to unsigned before the shift in FD_TO_CLOCKID (UBSan)
- only set the 64-bit test value on 64-bit builds (32-bit -Woverflow)
- save and restore the clock frequency
- skip instead of fail on -EBUSY (free-running clock)
Link to v1:
https://lore.kernel.org/netdev/20260712040922.6403-1-deepshah146@gmail.com/
Deep Shah (2):
ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
selftests: ptp: add a regression test for the frequency adjustment
overflow
drivers/ptp/ptp_clock.c | 14 ++-
tools/testing/selftests/ptp/Makefile | 2 +-
.../testing/selftests/ptp/ptp_freq_overflow.c | 99 +++++++++++++++++++
3 files changed, 113 insertions(+), 2 deletions(-)
create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c
base-commit: 1c975de3343cdef506f2eecc833cc1f14b0401c4
--
2.43.0
^ permalink raw reply
* [PATCH v2 net 1/2] ptp: reject frequency adjustments that overflow scaled_ppm_to_ppb()
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
In-Reply-To: <20260721014256.1876-1-deepshah146@gmail.com>
ptp_clock_adjtime() validates an ADJ_FREQUENCY request by converting the
requested scaled ppm to ppb and comparing it against ops->max_adj:
long ppb = scaled_ppm_to_ppb(tx->freq);
if (ppb > ops->max_adj || ppb < -ops->max_adj)
return -ERANGE;
scaled_ppm_to_ppb() computes (1 + ppm) * 125 >> 13 in s64. For a
sufficiently large tx->freq the multiplication overflows s64 and wraps,
so the resulting ppb can fall back within [-max_adj, max_adj] and pass
the check. The unclamped tx->freq is then handed to ->adjfine(), where
drivers scale it again (e.g. scaled_ppm * 762939453125 in ptp_idt82p33)
and program a bogus frequency word.
For example tx->freq = 147573952589676412 makes (1 + ppm) * 125 equal
2^64 + 9, which wraps to ppb == 0 and is accepted.
The caller already has write access to the PHC, so this hardens the
max_adj sanity check rather than crossing a privilege boundary, and
well-behaved user space (e.g. ptp4l) never requests such values. It is
a follow-up to commit 475b92f93216 ("ptp: improve max_adj check against
unreasonable values"), which handled the analogous s32 narrowing but not
this multiplication overflow.
Detect the overflow with check_*_overflow() and reject the request in
ptp_clock_adjtime() instead of acting on the wrapped value.
Fixes: d39a743511cd ("ptp: validate the requested frequency adjustment.")
Signed-off-by: Deep Shah <deepshah146@gmail.com>
Reviewed-by: Vadim Fedorenko <vadim.fedorenko@linux.dev>
---
drivers/ptp/ptp_clock.c | 14 +++++++++++++-
1 file changed, 13 insertions(+), 1 deletion(-)
diff --git a/drivers/ptp/ptp_clock.c b/drivers/ptp/ptp_clock.c
index d6f54ccaf93b..4111342d64f0 100644
--- a/drivers/ptp/ptp_clock.c
+++ b/drivers/ptp/ptp_clock.c
@@ -9,6 +9,7 @@
#include <linux/init.h>
#include <linux/kernel.h>
#include <linux/module.h>
+#include <linux/overflow.h>
#include <linux/posix-clock.h>
#include <linux/pps_kernel.h>
#include <linux/property.h>
@@ -159,7 +160,18 @@ static int ptp_clock_adjtime(struct posix_clock *pc, struct __kernel_timex *tx)
delta = ktime_to_ns(kt);
err = ops->adjtime(ops, delta);
} else if (tx->modes & ADJ_FREQUENCY) {
- long ppb = scaled_ppm_to_ppb(tx->freq);
+ long ppb;
+ s64 tmp;
+
+ /*
+ * scaled_ppm_to_ppb() multiplies (1 + freq) by 125 in s64;
+ * reject a ->freq large enough to overflow that, which would
+ * otherwise wrap the result back into the max_adj range.
+ */
+ if (check_add_overflow((s64)tx->freq, (s64)1, &tmp) ||
+ check_mul_overflow(tmp, (s64)125, &tmp))
+ return -ERANGE;
+ ppb = scaled_ppm_to_ppb(tx->freq);
if (ppb > ops->max_adj || ppb < -ops->max_adj)
return -ERANGE;
err = ops->adjfine(ops, tx->freq);
--
2.43.0
^ permalink raw reply related
* [PATCH v2 net 2/2] selftests: ptp: add a regression test for the frequency adjustment overflow
From: Deep Shah @ 2026-07-21 1:42 UTC (permalink / raw)
To: netdev, Richard Cochran, David S . Miller, Jakub Kicinski,
Paolo Abeni, Eric Dumazet, Andrew Lunn
Cc: linux-kernel, linux-kselftest, Shuah Khan, Vadim Fedorenko,
Simon Horman, Deep Shah
In-Reply-To: <20260721014256.1876-1-deepshah146@gmail.com>
testptp's -f option stores the requested adjustment as an int ppb and
converts it to scaled ppm, so it cannot express the 64-bit scaled-ppm
values needed to overflow scaled_ppm_to_ppb() and bypass the max_adj
check enforced by ptp_clock_adjtime().
Add a small test that crafts struct timex.freq directly and verifies that
an overflowing frequency adjustment is rejected with -ERANGE. The test
skips when no frequency-adjustable PTP device is available.
Signed-off-by: Deep Shah <deepshah146@gmail.com>
---
tools/testing/selftests/ptp/Makefile | 2 +-
.../testing/selftests/ptp/ptp_freq_overflow.c | 99 +++++++++++++++++++
2 files changed, 100 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/ptp/ptp_freq_overflow.c
diff --git a/tools/testing/selftests/ptp/Makefile b/tools/testing/selftests/ptp/Makefile
index 8f57f88ecadd..dd7376cc9bf5 100644
--- a/tools/testing/selftests/ptp/Makefile
+++ b/tools/testing/selftests/ptp/Makefile
@@ -1,6 +1,6 @@
# SPDX-License-Identifier: GPL-2.0
CFLAGS += $(KHDR_INCLUDES)
-TEST_GEN_PROGS := testptp
+TEST_GEN_PROGS := testptp ptp_freq_overflow
LDLIBS += -lrt
TEST_PROGS = phc.sh
diff --git a/tools/testing/selftests/ptp/ptp_freq_overflow.c b/tools/testing/selftests/ptp/ptp_freq_overflow.c
new file mode 100644
index 000000000000..417c0516622d
--- /dev/null
+++ b/tools/testing/selftests/ptp/ptp_freq_overflow.c
@@ -0,0 +1,99 @@
+// SPDX-License-Identifier: GPL-2.0
+/*
+ * Regression test for the scaled_ppm_to_ppb() integer overflow that allowed
+ * a crafted clock_adjtime(ADJ_FREQUENCY) to bypass the PTP max_adj check.
+ *
+ * testptp's -f option stores the adjustment as an int ppb and cannot express
+ * the 64-bit scaled-ppm values needed to overflow the conversion, so this
+ * test crafts struct timex.freq directly.
+ */
+#define _GNU_SOURCE
+#define __SANE_USERSPACE_TYPES__
+#include <errno.h>
+#include <fcntl.h>
+#include <string.h>
+#include <sys/ioctl.h>
+#include <sys/timex.h>
+#include <time.h>
+#include <unistd.h>
+#include <linux/ptp_clock.h>
+#include "../kselftest.h"
+
+#define FD_TO_CLOCKID(fd) ((clockid_t)((((unsigned int)~(fd)) << 3) | 3))
+
+/* clock_adjtime is not available in GLIBC < 2.14 */
+#if !__GLIBC_PREREQ(2, 14)
+#include <sys/syscall.h>
+static int clock_adjtime(clockid_t id, struct timex *tx)
+{
+ return syscall(__NR_clock_adjtime, id, tx);
+}
+#endif
+
+int main(int argc, char *argv[])
+{
+ const char *device = argc > 1 ? argv[1] : "/dev/ptp0";
+ struct ptp_clock_caps caps;
+ struct timex restore = { 0 };
+ struct timex tx = { 0 };
+ clockid_t clkid;
+ int fd, ret;
+
+ ksft_print_header();
+ ksft_set_plan(1);
+
+ if (sizeof(tx.freq) < 8)
+ ksft_exit_skip("the overflow only affects 64-bit kernels\n");
+
+ fd = open(device, O_RDWR);
+ if (fd < 0)
+ ksft_exit_skip("cannot open %s: %s\n", device, strerror(errno));
+
+ clkid = FD_TO_CLOCKID(fd);
+
+ if (ioctl(fd, PTP_CLOCK_GETCAPS, &caps))
+ ksft_exit_skip("PTP_CLOCK_GETCAPS on %s: %s\n", device, strerror(errno));
+ if (!caps.max_adj)
+ ksft_exit_skip("%s does not support frequency adjustment\n", device);
+
+ /*
+ * Remember the current frequency. A vulnerable kernel accepts the
+ * bogus value below and programs it into the hardware, so restore the
+ * original afterwards instead of leaving the clock corrupted.
+ */
+ if (clock_adjtime(clkid, &restore))
+ ksft_exit_skip("clock_adjtime(get) on %s: %s\n", device, strerror(errno));
+ restore.modes = ADJ_FREQUENCY;
+
+ /*
+ * (1 + 147573952589676412) * 125 == 2^64 + 9, which overflows s64 in
+ * scaled_ppm_to_ppb() and wraps the result to a ppb of 0. A kernel
+ * that does not detect the overflow lets this absurd frequency past
+ * the max_adj check; a fixed kernel rejects it with -ERANGE.
+ */
+ tx.modes = ADJ_FREQUENCY;
+#if __SIZEOF_LONG__ >= 8
+ tx.freq = 147573952589676412L;
+#endif
+
+ ret = clock_adjtime(clkid, &tx);
+ if (ret < 0 && errno == EBUSY) {
+ /*
+ * A free-running physical clock (virtual clocks active) rejects
+ * frequency adjustment with -EBUSY before the overflow is even
+ * evaluated, so the test cannot run here.
+ */
+ ksft_test_result_skip("%s: frequency adjustment returned EBUSY, skipping\n",
+ device);
+ } else {
+ ksft_test_result(ret < 0 && errno == ERANGE,
+ "overflowing frequency adjustment is rejected (ret=%d errno=%d)\n",
+ ret, ret < 0 ? errno : 0);
+ }
+
+ /* put the frequency back the way we found it */
+ clock_adjtime(clkid, &restore);
+
+ close(fd);
+ ksft_finished();
+}
--
2.43.0
^ permalink raw reply related
* [PATCH net] tun: prevent underflow in rx headroom calculation
From: Asim Viladi Oglu Manizada @ 2026-07-21 1:43 UTC (permalink / raw)
To: netdev
Cc: Willem de Bruijn, Jason Wang, Andrew Lunn, David S . Miller,
Eric Dumazet, Jakub Kicinski, Paolo Abeni
tun_get_user() calculates good_linear with SKB_MAX_HEAD(align). The align
value comes from ndo_set_rx_headroom() and can be larger than the linear
space available in a one-page skb head.
OVS can reach this case by carrying headroom from a netkit/VXLAN port to a
TUN port. SKB_MAX_HEAD() then underflows, leaving good_linear negative.
Assigning that value to the size_t linear variable in tun_get_user()
converts it to a large positive value. The wrapped value is passed to
tun_alloc_skb(), where prepad + linear and len - linear wrap. skb->data can
then end up past the allocated head, and later packet processing can access
memory outside the skb.
Clamp good_linear to zero when SKB_MAX_HEAD() returns a negative value.
This lets tun_alloc_skb() allocate the requested headroom and place the
packet data linearly or in fragments without wrapping.
Fixes: eaea34b23c46 ("net/tun: implement ndo_set_rx_headroom")
Cc: stable@vger.kernel.org
Assisted-by: avom-custom-harness:gpt-5.5-qwen3.6-mod-mix
Signed-off-by: Asim Viladi Oglu Manizada <manizada@pm.me>
---
drivers/net/tun.c | 1 +
1 file changed, 1 insertion(+)
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index ffbe6f13fb1..d3be0f2d5df 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -1780,6 +1780,7 @@ static ssize_t tun_get_user(struct tun_struct *tun, struct tun_file *tfile,
}
good_linear = SKB_MAX_HEAD(align);
+ good_linear = max(good_linear, 0);
if (msg_control) {
struct iov_iter i = *from;
--
2.39.5
^ permalink raw reply related
* Re: [PATCH net 2/2] selftests: ptp: add a regression test for the frequency adjustment overflow
From: Deep Shah @ 2026-07-21 1:47 UTC (permalink / raw)
To: Simon Horman
Cc: netdev, linux-kernel, linux-kselftest, Richard Cochran,
Jakub Kicinski, Paolo Abeni, Vadim Fedorenko
In-Reply-To: <20260720112842.106914-1-horms@kernel.org>
Thanks Simon. v2 addresses all four points:
https://lore.kernel.org/netdev/20260721014256.1876-1-deepshah146@gmail.com/
^ permalink raw reply
* Re: [PATCH] net: pcs: xpcs-plat: fix runtime PM initialization
From: Coia Prant @ 2026-07-21 1:53 UTC (permalink / raw)
To: Jakub Kicinski
Cc: netdev, Andrew Lunn, Heiner Kallweit, Russell King,
David S . Miller, Eric Dumazet, Paolo Abeni, Serge Semin,
linux-kernel, stable
In-Reply-To: <20260720172433.77b83dc7@kernel.org>
On July 21, 2026 8:24:33 AM GMT+08:00, Jakub Kicinski <kuba@kernel.org> wrote:
>On Sun, 5 Jul 2026 05:48:08 +0800 Coia Prant wrote:
>> The driver calls `pm_runtime_set_active()` before runtime PM is enabled,
>> and before the clock is prepared and enabled.
>>
>> This causes the clock to be unprepared/disabled later in the suspend
>> callback even though it was never prepared/enabled, resulting in warnings:
>>
>> clk_csr already disabled
>> clk_csr already unprepared
>>
>> Fix this by setting the initial runtime PM status to SUSPENDED instead
>> of ACTIVE.
>>
>> The clock will be properly enabled when the device is first resumed
>> via runtime PM (e.g., during MDIO access).
>
>Seems a bit odd that this hasn't been discovered until now.
>Could you add more details about your platform and maybe
>a hypothesis why we haven't noticed?
Hi,
I came across what looks like a runtime PM initialization issue while
using pcs-xpcs-plat.c as a reference for the Rockchip XPCS glue driver
(drivers/net/pcs/pcs-xpcs-rk.c).
The current code in pcs-xpcs-plat.c does:
pm_runtime_set_active(dev);
ret = devm_pm_runtime_enable(dev);
This sets the initial PM state to ACTIVE before runtime PM is fully
enabled, and before the clock is prepared and enabled.
If the device is later suspended (e.g., during unbind), the suspend
callback may try to disable a clock that was never enabled, leading to:
clk_csr already disabled
clk_csr already unprepared
On Rockchip platforms, the CSR clock (PCLK_XPCS) is required for register
access, and this pattern seems problematic when a clock is actually
provided.
I have a few questions:
1. Is there a reason this hasn't been noticed before?
As far as I can tell, there is currently no mainline device tree
user that enables this driver on a platform with a real clock
dependency. Out-of-tree users might be using it without any clock
at all, or ACPI users might behave differently.
2. Should we select PM in Kconfig and drop __maybe_unused from the
PM callbacks? Since this driver relies on runtime PM for clock
management, it seems odd to allow !PM builds.
3. Should we add a .remove callback to force suspend the device on
unbind? Otherwise the clock might remain enabled if the driver is
removed while active.
I'm happy to send a follow-up patch addressing these points if you
agree with the direction. Let me know what you think.
Thanks,
Coia
^ permalink raw reply
page: next (older) | prev (newer) | latest
- recent:[subjects (threaded)|topics (new)|topics (active)]
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox