kernel/git/next/linux-next.git/drivers/net/netdevsim, branch master

netdevsim: psp: drop tx key ops

2026-09-07T23:38:37+00:00

netdevsim has no SADB. The usage of psp_assoc_drv_data() was always obsolete given psp_validate_xmit(), so we can remove nsim_assoc_add() and nsim_assoc_del(). netdevsim::assoc_cnt can also be removed. PSP core can track the balance of tx_key_add vs tx_key_del calls in a future change. Delete psp_assoc_drv_data() because there are no more callers left in the tree. mlx5 accesses pas->drv_data directly. Signed-off-by: Daniel Zahka Link: https://patch.msgid.link/20260903-psp-prep-v1-4-d47e9c4c375d@gmail.com Signed-off-by: Jakub Kicinski

netdevsim: take bus device refcount before registering device

2026-09-03T23:59:23+00:00

nsim_bus_dev_release() drops nsim_bus_devs when a device is freed, but the matching increment was done in new_device_store() after nsim_bus_dev_new() returned. When device_register() failed inside nsim_bus_dev_new(), put_device() invoked the release callback and decremented without an increment, driving the refcount to zero; a later creation then incremented from zero (refcount_t: addition on 0). Increment nsim_bus_devs in nsim_bus_dev_new() before device_register(), and drop the bus reference in nsim_bus_exit() only after every device has been removed, so the completion cannot be signaled early. Cc: stable+noautosel@kernel.org # netdevsim is a test harness, it's never loaded on production systems Reported-by: syzbot+989ff6506f5c6d1ff56b@syzkaller.appspot.com Closes: https://syzkaller.appspot.com/bug?extid=989ff6506f5c6d1ff56b Signed-off-by: Adriano Cordova Link: https://patch.msgid.link/20260902025704.34606-1-adrianox@gmail.com Signed-off-by: Jakub Kicinski

netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port

2026-09-03T01:34:58+00:00

A netdevsim VF port cannot process incoming data. It never runs nsim_queue_init(), so ns->rq is NULL, and nsim_vf_netdev_ops has no ->ndo_open, so its NAPI is never set up either. nsim_setup() offers NETIF_F_LOOPBACK to both PF and VF ports. Turning it on for a VF makes nsim_start_xmit() take ns itself as peer_ns and dereference peer_ns->rq[], which panics. A VF cannot deliver packets at all: it can't be linked as a peer either, since netdev_is_nsim() only matches the PF netdev_ops, so ns->peer is always NULL and every skb ends up dropped. Give VF ports a dedicated xmit that just drops the traffic, so VFs no longer depend on PF-only state in nsim_start_xmit(). Reproduce in qemu: modprobe netdevsim echo "90 1" > /sys/bus/netdevsim/new_device echo 2 > /sys/bus/netdevsim/devices/netdevsim90/sriov_numvfs devlink dev eswitch set netdevsim/netdevsim90 mode switchdev ethtool -K eth2 loopback on # eth2 is the vfnum 0 port ip link set eth2 up Panic: KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007] CPU: 0 UID: 0 PID: 141 Comm: kworker/0:3 Not tainted 7.2.0+ #338 PREEMPT Workqueue: mld mld_ifc_work RIP: 0010:nsim_start_xmit (drivers/net/netdevsim/netdev.c:159) dev_hard_start_xmit ( net/core/dev.c:3953) sch_direct_xmit (net/sched/sch_generic.c:372) __dev_queue_xmit (net/core/dev.c:4262 net/core/dev.c:4884) neigh_resolve_output (net/core/neighbour.c:1616) ip6_finish_output2 (net/ipv6/ip6_output.c:138) ip6_finish_output (net/ipv6/ip6_output.c:221) ip6_output (net/ipv6/ip6_output.c:248) ...... Cc: stable+noautosel@kernel.org # netdevsim is a test harness, it's never loaded on production systems Signed-off-by: Jiayuan Chen Link: https://patch.msgid.link/20260901061851.61734-1-jiayuan.chen@linux.dev Signed-off-by: Jakub Kicinski

netdevsim: update queue NAPI association on queue reset

2026-08-20T19:35:57+00:00

In netdevsim, receive queues (struct nsim_rq) embed their own struct napi_struct. When queue reset is performed (e.g. via queue_reset debugfs), nsim_queue_start() swaps in a newly allocated struct nsim_rq, and nsim_queue_mem_free() later deletes and frees the old one. However, nsim_queue_start() failed to update the queue-to-NAPI mapping via netif_queue_set_napi(). As a result, dev->_rx[idx].napi continued to point to the old NAPI struct. After the old queue was freed, a subsequent queue dump via Netlink (NETDEV_CMD_QUEUE_GET) triggered a KASAN slab-use-after-free read in nla_put_napi_id() when accessing rxq->napi->napi_id. Fix this by calling netif_queue_set_napi() in nsim_queue_start() to associate the new NAPI with the RX queue, and clear the association with netif_queue_set_napi(..., NULL) in nsim_del_napi() during teardown. Fixes: 5bc8e8dbef27 ("netdevsim: add queue management API support") Reported-by: syzbot+483a6efbc4882c1201ee@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6a82c3d4.f7a79266.2f965f.0024.GAE@google.com/T/#u Signed-off-by: Eric Dumazet Reviewed-by: Vadim Fedorenko Link: https://patch.msgid.link/20260817082511.2300402-1-edumazet@google.com Signed-off-by: Jakub Kicinski

netdevsim: drop the ability to change max_vfs via debugfs

2026-08-14T00:38:05+00:00

This debugfs file isn't used by kernel's selftests, so drop it. Reported-by: syzbot+3147c5de186107ffc7a1@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=3147c5de186107ffc7a1 Suggested-by: Jakub Kicinski Signed-off-by: Slawomir Stepien Link: https://patch.msgid.link/20260810085717.570382-1-sst@poczta.fm Signed-off-by: Jakub Kicinski

net: Use helpers to get/set UDP len tree-wide

2026-07-22T11:47:02+00:00

Since BIG TCP for UDP tunnels will start using len=0 in the UDP header as an indicator of a GSO packet bigger than 65535 bytes, this commit introduces the following getter and setters to use tree-wide, in order to explicitly mark places where len=0 may be expected, and handle them properly: 1. udp_set_len() sets uh->len to its real value if it's not bigger than 65535, and to 0 otherwise: to be used in GSO context with aggregated packets. 2. udp_set_len_short() is to be used when the length is known to fit 16 bits. It WARNs when the caller tries to assign a bigger value if CONFIG_DEBUG_NET=y. 3. udp_get_len_short() returns len in host byte order: to be used on the RX side to deal with non-aggregated packets, or to access the raw value of the len field. 4. udp_get_len() decodes uh->len set by udp_set_len(). It checks whether the packet is GSO to guard from malformed packets. At the moment udp_set_len() is not used, a following commit will start using it after enabling len>65535 for GSO. Raw uh->len (in network byte order) is still accessed in a few places for checksum calculation purposes, and to decode len=0 in udpv6_rcv for jumbograms. udp_rcv and udpv6_rcv will be addressed by the commit that starts using udp_set_len() to set UDP len=0 for BIG TCP packets in UDP tunnels. Signed-off-by: Alice Mikityanska Reviewed-by: Willem de Bruijn Acked-by: Jason A. Donenfeld Link: https://patch.msgid.link/20260710134242.216538-2-alice.kernel@fastmail.im Reviewed-by: Nikolay Aleksandrov Signed-off-by: Paolo Abeni

netdevsim: remove ethtool debugfs files before freeing netdev

2026-06-30T01:47:23+00:00

The ethtool debugfs files point directly into struct netdevsim, which is allocated as net_device private data. Their containing port directory is removed only after nsim_destroy() calls free_netdev(). An open simple-attribute file can consequently dereference the freed private data before the directory is removed. KASAN observed this in debugfs_u32_get() during network namespace teardown. Track and remove the ethtool subtree before free_netdev() on both the normal and registration-failure paths. debugfs removal drains active file users before returning. Fixes: ff1f7c17fb20 ("netdevsim: add pause frame stats") Reported-by: syzbot+6c25f4750230faf70be9@syzkaller.appspotmail.com Closes: https://syzkaller.appspot.com/bug?extid=6c25f4750230faf70be9 Cc: # netdevsim is a test harness, it's never loaded on production systems Signed-off-by: Yousef Alhouseen Link: https://patch.msgid.link/20260628002804.24214-1-alhouseenyousef@gmail.com Signed-off-by: Jakub Kicinski

netdevsim: tc: allow to test nf_tables offload control plane code

2026-06-13T17:29:39+00:00

The actual 'offload' is phony, all commands are ignored: this is only useful to test control plane code. Tag the existing callback to permit error injection to test rollback/abort code in nf_tables. This is also for fuzzers - the fault injection framework allows probabilistic error insertion. Signed-off-by: Florian Westphal Link: https://patch.msgid.link/20260612092209.11966-2-fw@strlen.de Signed-off-by: Jakub Kicinski

net: change ndo_set_rx_mode_async return type to int

2026-06-10T01:15:29+00:00

Change the return type of ndo_set_rx_mode_async from void to int to allow drivers to report failures back to the core stack. This is a prerequisite for adding retry logic in the core when drivers fail to program RX filters (e.g. bnxt VF when PF is unavailable). All existing implementations return 0 for now, maintaining current behavior. Signed-off-by: Stanislav Fomichev Link: https://patch.msgid.link/20260608154014.227538-2-sdf@fomichev.me Signed-off-by: Jakub Kicinski

net: ethtool: optionally skip rtnl_lock on Netlink path for SET ops

2026-06-09T17:13:05+00:00

Make ethtool not take rtnl_lock for SET commands when operation is performed on an ops-locked driver. cfg/cfg_pending are now ops-locked, since only ethtool modifies them. Some SET driver callbacks will still need rtnl_lock, most notably those which may end up calling netdev_update_features() or the qdisc layer (via netif_set_real_num_tx_queues()). Let drivers selectively opt back into the rtnl_lock with a new bitfield in ops. We need two helpers since Netlink and ioctl cmds have different values. Keep the helpers side by side in common.h to make sure they get updated together, even tho they will only get called from ioctl.c and netlink.c. SET commands which don't use ethnl_default_set_doit() are converted by subsequent commits. Reviewed-by: Eric Dumazet Acked-by: Stanislav Fomichev Reviewed-by: Jacob Keller Link: https://patch.msgid.link/20260605002912.3456868-6-kuba@kernel.org Signed-off-by: Jakub Kicinski