From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 81F0531B828 for ; Tue, 29 Sep 2026 14:03:06 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790690587; cv=none; b=l5gle4tV3abaDftikNa9Ec7SW/QxDGfHJfYDzWLOerZBBtFv+hKePPkn2QALQj8J3zRUvzFeTjsrIN7m+gFilYekL+QEHA6QklK4BpzBmpxdrlZiPH+ZVsV7ZCqSxlPygbSgV/E+d9mH2zXbxrlXtOV3cucMFTNTmz/gqDO2pfo= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1790690587; c=relaxed/simple; bh=h7zsXoQL2hN8RXJKrwNvSLiqqMzpoDcMTcDvfpe1HVg=; h=From:To:Cc:Subject:Date:Message-ID:In-Reply-To:References: MIME-Version; b=DYYf71LstfF4ji8Cv+aAtN4qkLynryYpmpv91EiGh0lj7A635JBzuKkde4cgVDCu31wmoLPLo+U1M+xiDkOjjFMPWW6Sp96S21O7a9bMTFIEx5n1nFIQ3J0EEjrXNZ+K+98TAhiWfOz7sOtZAyt1hR9FxQAWkWPqfntQiRixia8= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b=TWnXnVgc; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (2048-bit key) header.d=kernel.org header.i=@kernel.org header.b="TWnXnVgc" Received: by smtp.kernel.org (Postfix) with ESMTPSA id CBC5A1F000FF; Tue, 29 Sep 2026 14:03:05 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=kernel.org; s=k20260515; t=1790690586; bh=grgROgOMJGs8LOGlkz1VjP+E7Z5yJHpmFtWiTdNhEXg=; h=From:To:Cc:Subject:Date:In-Reply-To:References; b=TWnXnVgc1APtM9tbbtN6AWw5wTpHpKQA/E8b4q5w5jZn3s9NYgpnV56eYG3zZ9IbY 5oqqwwDdzfe2HggbmHL23R+3giI+GLQS/7YFcWcOtwexrn1RauRVi4lmlJRHAtmRUV H8ieGXW4WXozbDuN9t3eDsnFCrM5oFQ6YWUAZvLUYb1YaKcGDzb97aWLebErjkn17b bydjAANxd6Vjlf2EzOwQCPj1pQfobDV3norREtEmG3MNUq3XZRmpFnKyBKvpAEOAjw 3lvEnIWpuTRr6VV+xoTa5ruFvBdKtYLGMj7YR1XF/lvGwS6WnNEIlkp6WK/JQHl9bh jE4pLuWdobvtQ== From: Sasha Levin To: stable@vger.kernel.org Cc: Jeremy Kerr , Paolo Abeni , Sasha Levin Subject: [PATCH 6.6.y 1/4] net: mctp: avoid confusion over local/peer dest/source addresses Date: Tue, 29 Sep 2026 10:03:01 -0400 Message-ID: <20260929140304.3526894-1-sashal@kernel.org> X-Mailer: git-send-email 2.53.0 In-Reply-To: <2026092919-dawdler-dodge-debe@gregkh> References: <2026092919-dawdler-dodge-debe@gregkh> Precedence: bulk X-Mailing-List: stable@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Content-Transfer-Encoding: 8bit From: Jeremy Kerr [ Upstream commit ee076b73e576b0a052d5686d873346b285ae50ea ] We have a double-swap of local and peer addresses in mctp_alloc_local_tag; the arguments in both call sites are swapped, but there is also a swap in the implementation of alloc_local_tag. This is opaque because we're using source/dest address references, which don't match the local/peer semantics. Avoid this confusion by naming the arguments as 'local' and 'peer', and remove the double swap. The calling order now matches mctp_key_alloc. Signed-off-by: Jeremy Kerr Signed-off-by: Paolo Abeni Stable-dep-of: 26cc0e69cce0 ("mctp: route: iterate socket tag list in mctp_lookup_prealloc_tag()") Signed-off-by: Sasha Levin --- include/net/mctp.h | 4 ++-- net/mctp/af_mctp.c | 2 +- net/mctp/route.c | 16 ++++++++-------- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/include/net/mctp.h b/include/net/mctp.h index 6dbed4ca22205..d7e331ce099ad 100644 --- a/include/net/mctp.h +++ b/include/net/mctp.h @@ -90,7 +90,7 @@ struct mctp_sock { }; /* Key for matching incoming packets to sockets or reassembly contexts. - * Packets are matched on (src,dest,tag). + * Packets are matched on (peer EID, local EID, tag). * * Lifetime / locking requirements: * @@ -258,7 +258,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, void mctp_key_unref(struct mctp_sk_key *key); struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk, - mctp_eid_t daddr, mctp_eid_t saddr, + mctp_eid_t local, mctp_eid_t peer, bool manual, u8 *tagp); /* routing <--> device interface */ diff --git a/net/mctp/af_mctp.c b/net/mctp/af_mctp.c index 805f7376cebe3..d6e0350b1c949 100644 --- a/net/mctp/af_mctp.c +++ b/net/mctp/af_mctp.c @@ -366,7 +366,7 @@ static int mctp_ioctl_alloctag(struct mctp_sock *msk, unsigned long arg) if (ctl.flags) return -EINVAL; - key = mctp_alloc_local_tag(msk, ctl.peer_addr, MCTP_ADDR_ANY, + key = mctp_alloc_local_tag(msk, MCTP_ADDR_ANY, ctl.peer_addr, true, &tag); if (IS_ERR(key)) return PTR_ERR(key); diff --git a/net/mctp/route.c b/net/mctp/route.c index 6d6e19c049396..3e21bc0a88688 100644 --- a/net/mctp/route.c +++ b/net/mctp/route.c @@ -619,11 +619,11 @@ static void mctp_reserve_tag(struct net *net, struct mctp_sk_key *key, refcount_inc(&key->refs); } -/* Allocate a locally-owned tag value for (saddr, daddr), and reserve +/* Allocate a locally-owned tag value for (local, peer), and reserve * it for the socket msk */ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk, - mctp_eid_t daddr, mctp_eid_t saddr, + mctp_eid_t local, mctp_eid_t peer, bool manual, u8 *tagp) { struct net *net = sock_net(&msk->sk); @@ -633,11 +633,11 @@ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk, u8 tagbits; /* for NULL destination EIDs, we may get a response from any peer */ - if (daddr == MCTP_ADDR_NULL) - daddr = MCTP_ADDR_ANY; + if (peer == MCTP_ADDR_NULL) + peer = MCTP_ADDR_ANY; /* be optimistic, alloc now */ - key = mctp_key_alloc(msk, saddr, daddr, 0, GFP_KERNEL); + key = mctp_key_alloc(msk, local, peer, 0, GFP_KERNEL); if (!key) return ERR_PTR(-ENOMEM); @@ -658,8 +658,8 @@ struct mctp_sk_key *mctp_alloc_local_tag(struct mctp_sock *msk, if (tmp->tag & MCTP_HDR_FLAG_TO) continue; - if (!(mctp_address_matches(tmp->peer_addr, daddr) && - mctp_address_matches(tmp->local_addr, saddr))) + if (!(mctp_address_matches(tmp->peer_addr, peer) && + mctp_address_matches(tmp->local_addr, local))) continue; spin_lock(&tmp->lock); @@ -951,7 +951,7 @@ int mctp_local_output(struct sock *sk, struct mctp_route *rt, key = mctp_lookup_prealloc_tag(msk, daddr, req_tag, &tag); else - key = mctp_alloc_local_tag(msk, daddr, saddr, + key = mctp_alloc_local_tag(msk, saddr, daddr, false, &tag); if (IS_ERR(key)) { -- 2.53.0