From: Sasha Levin <sashal@kernel.org>
To: stable@vger.kernel.org
Cc: Jeremy Kerr <jk@codeconstruct.com.au>,
Paolo Abeni <pabeni@redhat.com>, Sasha Levin <sashal@kernel.org>
Subject: [PATCH 6.6.y 1/4] net: mctp: avoid confusion over local/peer dest/source addresses
Date: Tue, 29 Sep 2026 10:03:01 -0400 [thread overview]
Message-ID: <20260929140304.3526894-1-sashal@kernel.org> (raw)
In-Reply-To: <2026092919-dawdler-dodge-debe@gregkh>
From: Jeremy Kerr <jk@codeconstruct.com.au>
[ Upstream commit ee076b73e576b0a052d5686d873346b285ae50ea ]
We have a double-swap of local and peer addresses in
mctp_alloc_local_tag; the arguments in both call sites are swapped, but
there is also a swap in the implementation of alloc_local_tag. This is
opaque because we're using source/dest address references, which don't
match the local/peer semantics.
Avoid this confusion by naming the arguments as 'local' and 'peer', and
remove the double swap. The calling order now matches mctp_key_alloc.
Signed-off-by: Jeremy Kerr <jk@codeconstruct.com.au>
Signed-off-by: Paolo Abeni <pabeni@redhat.com>
Stable-dep-of: 26cc0e69cce0 ("mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()")
Signed-off-by: Sasha Levin <sashal@kernel.org>
---
include/net/mctp.h | 4 ++--
net/mctp/af_mctp.c | 2 +-
net/mctp/route.c | 16 ++++++++--------
3 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/include/net/mctp.h b/include/net/mctp.h
index 6dbed4ca22205..d7e331ce099ad 100644
--- a/include/net/mctp.h
+++ b/include/net/mctp.h
@@ -90,7 +90,7 @@ struct mctp_sock {
};
/* Key for matching incoming packets to sockets or reassembly contexts.
- * Packets are matched on (src,dest,tag).
+ * Packets are matched on (peer EID, local EID, tag).
*
* Lifetime / locking requirements:
*
@@ -258,7 +258,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
void mctp_key_unref(struct mctp_sk_key *key);
struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
- mctp_eid_t daddr, mctp_eid_t saddr,
+ mctp_eid_t local, mctp_eid_t peer,
bool manual, u8 *tagp);
/* routing <--> device interface */
diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c
index 805f7376cebe3..d6e0350b1c949 100644
--- a/net/mctp/af_mctp.c
+++ b/net/mctp/af_mctp.c
@@ -366,7 +366,7 @@ static int mctp_ioctl_alloctag(struct mctp_sock *msk, unsigned long arg)
if (ctl.flags)
return -EINVAL;
- key = mctp_alloc_local_tag(msk, ctl.peer_addr, MCTP_ADDR_ANY,
+ key = mctp_alloc_local_tag(msk, MCTP_ADDR_ANY, ctl.peer_addr,
true, &tag);
if (IS_ERR(key))
return PTR_ERR(key);
diff --git a/net/mctp/route.c b/net/mctp/route.c
index 6d6e19c049396..3e21bc0a88688 100644
--- a/net/mctp/route.c
+++ b/net/mctp/route.c
@@ -619,11 +619,11 @@ static void mctp_reserve_tag(struct net *net, struct mctp_sk_key *key,
refcount_inc(&key->refs);
}
-/* Allocate a locally-owned tag value for (saddr, daddr), and reserve
+/* Allocate a locally-owned tag value for (local, peer), and reserve
* it for the socket msk
*/
struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
- mctp_eid_t daddr, mctp_eid_t saddr,
+ mctp_eid_t local, mctp_eid_t peer,
bool manual, u8 *tagp)
{
struct net *net = sock_net(&msk->sk);
@@ -633,11 +633,11 @@ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
u8 tagbits;
/* for NULL destination EIDs, we may get a response from any peer */
- if (daddr == MCTP_ADDR_NULL)
- daddr = MCTP_ADDR_ANY;
+ if (peer == MCTP_ADDR_NULL)
+ peer = MCTP_ADDR_ANY;
/* be optimistic, alloc now */
- key = mctp_key_alloc(msk, saddr, daddr, 0, GFP_KERNEL);
+ key = mctp_key_alloc(msk, local, peer, 0, GFP_KERNEL);
if (!key)
return ERR_PTR(-ENOMEM);
@@ -658,8 +658,8 @@ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk,
if (tmp->tag & MCTP_HDR_FLAG_TO)
continue;
- if (!(mctp_address_matches(tmp->peer_addr, daddr) &&
- mctp_address_matches(tmp->local_addr, saddr)))
+ if (!(mctp_address_matches(tmp->peer_addr, peer) &&
+ mctp_address_matches(tmp->local_addr, local)))
continue;
spin_lock(&tmp->lock);
@@ -951,7 +951,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt,
key = mctp_lookup_prealloc_tag(msk, daddr,
req_tag, &tag);
else
- key = mctp_alloc_local_tag(msk, daddr, saddr,
+ key = mctp_alloc_local_tag(msk, saddr, daddr,
false, &tag);
if (IS_ERR(key)) {
--
2.53.0
next prev parent reply other threads:[~2026-09-29 14:03 UTC|newest]
Thread overview: 5+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-09-29 6:49 FAILED: patch "[PATCH] mctp: route: iterate socket tag list in" failed to apply to 6.6-stable tree gregkh
2026-09-29 14:03 ` Sasha Levin [this message]
2026-09-29 14:03 ` [PATCH 6.6.y 2/4] net: mctp: Add some detail on the key allocation implementation Sasha Levin
2026-09-29 14:03 ` [PATCH 6.6.y 3/4] net: mctp: separate key correlation across nets Sasha Levin
2026-09-29 14:03 ` [PATCH 6.6.y 4/4] mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag() Sasha Levin
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20260929140304.3526894-1-sashal@kernel.org \
--to=sashal@kernel.org \
--cc=jk@codeconstruct.com.au \
--cc=pabeni@redhat.com \
--cc=stable@vger.kernel.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox