summaryrefslogtreecommitdiff
path: root/net/bridge
AgeCommit message (Collapse)Author
3 daysMerge tag 'net-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net Pull networking fixes from Jakub Kicinski: "Current release - new code bugs: - mctp: usblib: fix assertion breaking esoteric builds Previous releases - regressions: - Revert advertising the TCP MSS from the configured MTU - netlink: check sk_rcvbuf before charging the dump skb - eth: - ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl - mlx4: always create the eth and ib auxiliary devices - tg3: invert restart quirk logic to restrict SNP power-down bypass - bnxt: recycle agg buffers when Rx head buffer allocation fails Previous releases - always broken: - net: fix frag_list leak in skb_segment_list() error path - sctp: reject forged cookie peer_addr with unknown address family - vxlan: keep reserved_bits across changelink - net: limit priority VLAN untag depth - inet: frags: prevent acceptance of partially authenticated reassembly - gro: do not GRO GSO packets with inconsistent payload - tcp: avoid double destroy in tcp_abort() of an unaccepted child" * tag 'net-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits) tun: drop batched packets while the device is down selftests: net: netlink-dumps: start a dump with a notification queued netlink: check sk_rcvbuf before charging the dump skb net/sched: act_ife: do not consume the inner header on egress openvswitch: use eth_type_trans_careful() in internal_dev_recv() net: use eth_type_trans_careful() in __dev_forward_skb2() loopback: use eth_type_trans_careful() net: add eth_type_trans_careful() tcp: initialize mapped children before route lookup tcp: fix reordering addition overflow in MTU probing tcp: avoid double destroy in tcp_abort() of an unaccepted child net: bgmac: fix TX DMA unmapping and slot cleanup gro: do not GRO GSO packets with inconsistent payload net/packet: check TX_RING fragments before memory accounting eth: bnxt: hand XDP frags over to the copybreak skb eth: bnxt: free XDP frags when xdp_do_redirect() fails eth: bnxt: don't leak buffers when XDP agg buffer allocation fails eth: bnxt: resize Rx head buffers when rx-copybreak changes eth: bnxt: recycle agg buffers when Rx head buffer allocation fails netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts ...
4 daysnet: bridge: netlink: do not clear the vlan info dump errorLinkui Xiao
br_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over the result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed() instead of only running the second helper when the first one succeeded. When the vlan information no longer fits in the skb but the port has no vlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan list and returns 0 without touching the skb. The -EMSGSIZE is lost, br_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated, and the dump carries on to the next interface instead of stopping, so userspace silently sees an incomplete vlan list. Only fill the tunnel information when the vlan information was filled successfully. This was flagged as a pre-existing issue in the Sashiko review of the net-next series, which noted that the VLAN fill result is overwritten before it is tested (see the Link tag below). Not triggered or tested. Fixes: efa5356b0d97 ("bridge: per vlan dst_metadata netlink support") Link: https://lore.kernel.org/bridge/ed1de95e-e112-4076-93f0-6f7668e657ad@blackwall.org/T/#u#5 Signed-off-by: Linkui Xiao <xiaolinkui@kylinos.cn> Reviewed-by: Eric Dumazet <edumazet@kernel.org> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20261027085200.1501599-1-xiaolinkui@126.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
9 daysMerge tag 'modules-7.4-rc1' of ↵Linus Torvalds
git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux Pull module updates from Petr Pavlu: - Ignore local labels and mapping symbols during module load These symbols were already ignored during kallsyms address-to-symbol lookups. Filter them out earlier during module loading to reduce lookup overhead and prevent them from appearing in /proc/kallsyms. - Fix potentially incorrect access of SetOnce<T> when setting Rust module parameters. - Fix a potential read of an uninitialized count when printing taint information for unloaded modules. - Allocate the kmod argument array using kmalloc_array() in preparation for conversion to type-aware allocators. - Clean up includes in linux/kmod.h Add explicit includes of linux/umh.h to files that use usermode helpers. Then clean up the #include list in linux/kmod.h, notably removing the compatibility linux/umh.h include. - Remove the error-injection.h include from linux/module.h Add explicit includes of linux/error-injection.h to files that use the ALLOW_ERROR_INJECTION() macro and currently rely on it being provided indirectly via linux/module.h. Then remove the unnecessary linux/error-injection.h include from linux/module.h. - Replace __MODULE_STRING() with __stringify() in various drivers in preparation for removing the former macro. * tag 'modules-7.4-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/modules/linux: drivers: Replace __MODULE_STRING() with __stringify() module: Fix uninitialized count read of unloaded taint tracking record rust: module_param: Fix potentially incorrect access of `SetOnce<T>` module: Remove the error-injection.h include from linux/module.h drm/xe: Include error-injection.h for ALLOW_ERROR_INJECTION() drm/i915: Include error-injection.h for ALLOW_ERROR_INJECTION() syscalls: Include error-injection.h for ALLOW_ERROR_INJECTION() net: Include error-injection.h for ALLOW_ERROR_INJECTION() block: Include error-injection.h for ALLOW_ERROR_INJECTION() module: Bring includes in linux/kmod.h up to date time/jiffies: Include linux/sysctl.h for proc_int_u2k_conv_uop(), ... umh, treewide: Explicitly include linux/umh.h where needed modules/kmod: Allocate argv with kmalloc_array() module/kallsyms: Ignore local labels and mapping symbols during module load module/kallsyms: Refactor current symbol filtering into is_core_symbol() module/kallsyms: Rename is_mapping_symbol() to is_ignored_kernel_symbol()
11 daysMerge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netPaolo Abeni
Merge in late fixes in preparation for the net-next PR. Conflicts: net/netfilter/nf_conntrack_netlink.c cd37ab22a74e0 ("netfilter: nf_conntrack_netlink: fix inverted IPv6 tuple filter") 1ae2d094b0200 ("netfilter: ctnetlink: fix inverted IPv6 address match in dump filter") Adjacent changes: drivers/net/ethernet/marvell/octeontx2/af/rvu_nix.c 8830e65ed46de ("net: use assign_bit() where applicable") 07bd391eb957 ("octeontx2-af: Fix CQ enable state tracking after AQ writes") net/core/sock.c 31c5ea8a3296 ("ipv6: Remove IPV6_ADDRFORM.") 31b564f70d88 ("net: use the full socket in sk_mc_loop()") net/mptcp/protocol.h 0cb6910130a3 ("mptcp: remove thmac from subflow ctx") 7538fa33bb2f ("mptcp: fix subflow bitfield misuse") Signed-off-by: Paolo Abeni <pabeni@redhat.com>
12 daysMerge tag 'nf-next-26-10-18' of ↵Jakub Kicinski
git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next Pablo Neira Ayuso says: ==================== Netfilter updates for net-next The following patchset contains Netfilter/IPVS updates for net-next: 1) Disable br_netfilter in userns and schedule it for removal in 2027, from Florian Westphal. 2) Update selftest nft_queue.sh to make it more stable on debug kernels, from Jakub Kicinski. 3) Fix a overflow in IPVS sync messages which can only happen in very old 2.6 kernels, from Julian Anastasov. 4) Finer grain packet drop in nfnetlink_queue when dependency objects are going away, from Antonio Ojea. 5) Add a selftest for the nfnetlink_queue packet drop case, also from Antonio Ojea. 6) Flush conntrack gc worker when existing netns to address a unlikely UaF, from Florian Westphal. 7) Switch nf_tables chain types to use rcu, otherwise module removal can trigger UaF, also from Florian. 8) Remove redundant parsing in nft_exthdr for the tcp options case, from Fernando F. Mancera. 9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp options, from Fernando F. Mancera. 10) Fix conntrack_vrf.sh selftest return value in zone subtest, from Florian Westphal. 11) Restrict raw table in nft_compat to specific family, hook and priority, from Florian Westphal. Prepare the flowtable to support for IPv4 over IPv6 tunneling and vice-versa, this includes 4 patches from Lorenzo Bianconi. 12) Explicitly set inner protocol when popping header, this is not needed for the existing IPIP and IP6IP6 case because skb->protocol remains the same. 13) Simplify tuple tunnel information fill up when parsing outer tunnel IP headers. 14) Add a new encap_proto which determines the outer tunnel protocol family. 15) Prepare flowtable forwarding path to deal with mixed IPv4-IPv6 tunnels. * tag 'nf-next-26-10-18' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next: netfilter: flowtable: unify tunnel push for IPv4 and IPv6 netfilter: flowtable: add encap_proto to flow_offload_tunnel netfilter: flowtable: populate tunnel tuple regardless of inner protocol netfilter: flowtable: set inner protocol when popping tunnel header netfilter: nft_compat: restrict raw table targets/matches selftests: netfilter: fix return value in zone subtest netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init netfilter: nf_tables: switch chain_types array to rcu netfilter: conntrack: fix unlikely UaF in gc worker selftests: netfilter: nft_queue: check the scope of the hook drop flush netfilter: nf_queue: limit the hook drop flush to the unregistered hook point ipvs: fix buffer overflow when sending sync messages selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply netfilter: disable br_netfilter in user namespaces ==================== Link: https://patch.msgid.link/20261018005638.1776148-1-pablo@netfilter.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
12 daysbridge: mcast: Delete empty MDB entry when port group creation failsIdo Schimmel
When a port group cannot be created for a new group, the MDB entry that was created for it is left with no ports and is not joined by the host. Its timer is never armed, so the entry is never deleted, but it is counted towards mcast_hash_max. When this maximum is reached, the bridge disables multicast snooping. Since commit b57e8d870d52 ("net: bridge: Maintain number of MDB entries in net_bridge_mcast_port"), port group creation also fails when the port reached its mcast_max_groups limit. A host behind such a port can therefore disable snooping by sending reports for new groups, which is what the limit is meant to prevent. The RTM_NEWMDB path has the same problem. Fix by deleting the entry after a failure if it is unused. Delete it immediately rather than arming its timer, so that it stops counting towards the maximum right away. Fixes: b57e8d870d52 ("net: bridge: Maintain number of MDB entries in net_bridge_mcast_port") Reported-by: Yunlong Ma <yunlong_ma@buaa.edu.cn> Closes: https://lore.kernel.org/netdev/2f5b61e2.1e71a.1a11fcb3809.Coremail.yunlong_ma@buaa.edu.cn/ Acked-by: Nikolay Aleksandrov <nikolay@nvidia.com> Signed-off-by: Ido Schimmel <idosch@nvidia.com> Tested-by: Gabriel Goller <g.goller@proxmox.com> Reviewed-by: Gabriel Goller <g.goller@proxmox.com> Link: https://patch.msgid.link/20261016101407.2030133-2-idosch@nvidia.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-11netfilter: disable br_netfilter in user namespacesFlorian Westphal
br_netfilter has way too many bugs, schedule for removal and disable the feature in user namespaces. In particular, we get more and more gadgets to have bridge ports escape rcu_read_lock() protection, then underlying device gets reconfigured (macvlan or something else), then reinject into network stack causes crash because net_device is assumed to still have bridge rx data associated with it. br_netfilter is an ancient kludge that emulates ip stack from within the bridge and then calls into ipv4/ipv6 netfilter hooks to have bridged frames processed via iptables/ip6tables by setting the 'call-iptables' sysctls to 1. It is NOT related to ebtables or nftables 'bridge' family at all. Note that in addition to call-iptables, sysctls, the bridge also exposes call-iptables per bridge device via netlink and sysfs ('BROPT_NF_CALL_IPTABLES') toggles. Those are still available, the brnet structure is scoped to br_netfilter; exposing it bridge-wide is a big no-no. This relies on brnf_device_event() no longer registering the base br_netfilter hooks, so while BROPT_NF_CALL_IPTABLES can be set, it has no effect because the hooks that evaluate this feature bit are never registered. brnf_init_net can no longer depend on CONFIG_SYSCTL, else such builds never disable support in user namespaces. Cc: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Florian Westphal <fw@strlen.de> Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
2026-10-08Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc7). Conflicts: include/net/strparser.h 0984ebc631792 ("strparser: make sure __strp_recv isn't running before tearing down the parser") 02fd0a2111374 ("net: strparser: removed the aborted bit and aborts counter") https://lore.kernel.org/asYfmLsfy-SCxXjr@sirena.co.uk Adjacent changes: Documentation/networking/strparser.rst 5f193cdabf25 ("docs: networking: strparser: remove general mode") 0984ebc63179 ("strparser: make sure __strp_recv isn't running before tearing down the parser") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-08ipv4: validate checksum_start before completing checksumMichael S. Tsirkin
If a packet with bad checksum metadata gets into the ipv4 stack, skb_checksum_help can corrupt the network header and cause a bunch of mischief. This was discovered and reported by Paulos, and has been reporoduced by others independently since. We really shouldn't allow such packets in, but as a defence in depth measure, let's also check before we complete the checksum. A more complete validation at input is forthcoming, but needs more work. Cc: stable@vger.kernel.org Fixes: f43798c27684 ("tun: Allow GSO using virtio_net_hdr") Fixes: bfd5f4a3d605 ("packet: Add GSO/csum offload support.") Reported-by: Paulos Yibelo <habte.yibelo@gmail.com> Closes: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/ Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Reviewed-by: Willem de Bruijn <willemb@google.com> Link: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-07ipv4: Use ipv4_neigh_lookup() and friends.Kuniyuki Iwashima
It is error-prone to require callers to fetch netns and neigh_table and pass it with dev to neigh_lookup(), etc. Let's replace neigh_lookup() and friends with IPv4 helpers. Note that __neigh_lookup(create=false) is replaced with ipv4_neigh_lookup() and __neigh_lookup(create=true) and __neigh_lookup_errno() are split into ipv4_neigh_lookup() and ipv4_neigh_create(). Fixes: 2430df635a59 ("ipv4: Replace &arp_tbl with arp_table(net).") Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261003212336.1304988-8-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-07ipv6: Use ipv6_neigh_lookup() and friends.Kuniyuki Iwashima
syzbot reported the splat below in neigh_mark_dead() [0] where tbl->lock was not held while neigh_ifdown() should have acquired one. This only happens when a neigh_table accidentally has a neighbour from a different netns. In ip6_finish_output2(), the net argument is the caller's and does not always match dev_net(dev) fetched from dst. (e.g. xfrm) It is error-prone to require callers to fetch netns and neigh_table and pass it with dev to neigh_lookup(), etc. Let's replace neigh_lookup() and friends with IPv6 helpers. Note that __neigh_lookup() is split into ipv6_neigh_lookup() and ipv6_neigh_create(). [0]: debug_locks && !(lock_is_held(&(&n->tbl->lock)->dep_map) != 0) WARNING: net/core/neighbour.c:154 at neigh_mark_dead+0x2fb/0x340 net/core/neighbour.c:154, CPU#0: syz.0.857/9765 Modules linked in: CPU: 0 UID: 0 PID: 9765 Comm: syz.0.857 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026 RIP: 0010:neigh_mark_dead+0x2fb/0x340 net/core/neighbour.c:154 Code: e8 03 42 80 3c 28 00 74 08 48 89 df e8 ee 9a 80 f8 4c 89 33 5b 41 5c 41 5d 41 5e 41 5f 5d c3 cc cc cc cc cc e8 86 95 10 f8 90 <0f> 0b 90 e9 8f fd ff ff 48 c7 c1 80 9a 7a 90 80 e1 07 80 c1 03 38 RSP: 0018:ffffc90003726600 EFLAGS: 00010287 RAX: ffffffff89b7467a RBX: ffff888022e86000 RCX: 0000000000080000 RDX: ffffc900047fa000 RSI: 0000000000003e08 RDI: 0000000000003e09 RBP: 0000000000000000 R08: 0000000000000003 R09: 0000000000000004 R10: dffffc0000000000 R11: fffff520006e4cb8 R12: ffff888022e8613c R13: dffffc0000000000 R14: ffff888022e86020 R15: ffff888022e86000 FS: 00007f9c30f046c0(0000) GS:ffff888124cc6000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000000000000000 CR3: 0000000076c56000 CR4: 00000000003526f0 Call Trace: <TASK> neigh_flush_one+0x27c/0x5a0 net/core/neighbour.c:388 neigh_flush_dev net/core/neighbour.c:432 [inline] __neigh_ifdown+0x1fb/0xc70 net/core/neighbour.c:465 neigh_ifdown+0x1f/0x30 net/core/neighbour.c:487 rt6_disable_ip+0x751/0x7e0 net/ipv6/route.c:5058 addrconf_ifdown+0x155/0x1ad0 net/ipv6/addrconf.c:3892 addrconf_notify+0x1bc/0x1050 net/ipv6/addrconf.c:-1 notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85 call_netdevice_notifiers_mtu net/core/dev.c:2350 [inline] netif_set_mtu_ext+0x5ac/0x830 net/core/dev.c:9963 do_setlink+0xa81/0x47a0 net/core/rtnetlink.c:3247 rtnl_setlink+0x578/0x820 net/core/rtnetlink.c:3623 rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7159 netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572 netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline] netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361 netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916 sock_sendmsg_nosec+0x13a/0x180 net/socket.c:800 __sock_sendmsg net/socket.c:815 [inline] sock_write_iter+0x2de/0x3e0 net/socket.c:1266 do_iter_readv_writev+0x612/0x8c0 fs/read_write.c:-1 vfs_writev+0x343/0x990 fs/read_write.c:1058 do_writev+0x154/0x2e0 fs/read_write.c:1104 do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline] do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f9c2ff9e159 Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 RSP: 002b:00007f9c30f04028 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 RAX: ffffffffffffffda RBX: 00007f9c30225fa0 RCX: 00007f9c2ff9e159 RDX: 0000000000000001 RSI: 00002000000003c0 RDI: 0000000000000004 RBP: 00007f9c3003506b R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 R13: 00007f9c30226038 R14: 00007f9c30225fa0 R15: 00007ffed3c74808 </TASK> Fixes: df5f4f372de5 ("ipv6: Replace &nd_tbl with nd_table(net).") Reported-by: syzbot+5a8857f0b4a0a7b12c62@syzkaller.appspotmail.com Closes: https://lore.kernel.org/netdev/6abd69a9.80e1c6cc.22483f.0005.GAE@google.com/ Signed-off-by: Kuniyuki Iwashima <kuniyu@google.com> Reviewed-by: Fernando Fernandez Mancera <fmancera@suse.de> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261003212336.1304988-7-kuniyu@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: fdb: use the entry key in __fdb_updateNikolay Aleksandrov
The address and VLAN ID passed to __fdb_update() match the key of the entry just found, so we can just use it. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-7-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: fdb: factor out configured entry destination updatesNikolay Aleksandrov
Share the destination update logic used by user configured and ext learned entries. Report a modification only when the port changes. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-6-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: vlan: inline pvid pointer updatesNikolay Aleksandrov
After caching the pvid VLAN entry directly, the add and delete helpers only check and update the pointer. So inline them both and clear pvid directly in __vlan_flush before walking the VLAN entries. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-5-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: vlan: share VLAN validation in br_should_learnNikolay Aleksandrov
Both the pvid and tagged paths now resolve a VLAN entry. Select the entry first and share the state check and output assignment. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-4-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: fdb: update the comment for br_fdb_cleanup_by_dstNikolay Aleksandrov
Update the comment for br_fdb_cleanup_by_dst to better reflect what it is doing after the recent changes. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-06net: bridge: rename dst to fwd in br_flood_vlanNikolay Aleksandrov
Rename dst to fwd to be consistent and avoid confusion (dst is used for fdbs). Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20261005143937.877466-2-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-05net: bridge: avoid recursive multicast port cleanupZixuan Chai
br_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL port groups by calling br_multicast_del_pg(). For S,G entries, that deletion calls back into br_multicast_sg_del_exclude_ports(), so a large number of STAR_EXCL ports consumes one kernel stack frame per port and can hit the stack guard page. Keep the complete port-group deletion path for cleanup, but suppress the S,G exclude-port cleanup while that helper is already walking the same entry. Normal deletion callers retain the existing behavior. Fixes: 8266a0491e92 ("net: bridge: mcast: handle port group filter modes") Cc: stable@vger.kernel.org Reported-by: Vega <vega@nebusec.ai> Assisted-by: LLM Signed-off-by: Zixuan Chai <petalzu987@gmail.com> Signed-off-by: Ren Wei <weir@nebusec.ai> Signed-off-by: David S. Miller <davem@davemloft.net>
2026-10-02net: bridge: fdb: avoid VLAN lookups in unicast forwardingNikolay Aleksandrov
Pass the complete fdb destination to br_forward(). The tagged value is decoded once into br_fwd_dst on entry so all subsequent forwarding checks use the decoded port and VLAN. A cached port-VLAN is then used to avoid two VLAN hash lookups in the standard unicast forwarding path. A backup-port redirect also uses a raw destination because the cached VLAN belongs to the original port. [1] 64 byte vlan packets, 4k randomized fdb hits with 4k fdbs, 5 million packets passed 5 times for every case VIDs Ports Mpps Gbps CPU1 cycles/input before after gain before after before after reduction 64 8/2 2.375486 2.635811 11.0% 1.216 1.350 1724.6 1553.7 9.9% 64 8/4 2.376731 2.636459 10.9% 1.217 1.350 1714.8 1554.7 9.3% 64 8/8 2.376621 2.635783 10.9% 1.217 1.350 1722.6 1553.2 9.8% 64 32/2 2.375876 2.637897 11.0% 1.216 1.351 1726.7 1552.3 10.1% 64 32/16 2.376442 2.636426 10.9% 1.217 1.350 1721.3 1554.2 9.7% 64 32/32 2.376763 2.636268 10.9% 1.217 1.350 1726.8 1553.5 10.0% 64 64/2 2.375678 2.638707 11.1% 1.216 1.351 1725.0 1552.1 10.0% 64 64/32 2.376681 2.637359 11.0% 1.217 1.350 1725.1 1555.9 9.8% 64 64/64 2.376787 2.638396 11.0% 1.217 1.351 1722.8 1550.9 10.0% 1024 8/2 2.263768 2.498881 10.4% 1.159 1.279 1808.5 1637.1 9.5% 1024 8/4 2.264519 2.499075 10.4% 1.159 1.280 1807.6 1638.8 9.3% 1024 8/8 2.263551 2.499231 10.4% 1.159 1.280 1812.0 1640.2 9.5% 1024 32/2 2.263841 2.499120 10.4% 1.159 1.280 1806.8 1639.6 9.3% 1024 32/16 2.263990 2.499562 10.4% 1.159 1.280 1806.1 1639.2 9.2% 1024 32/32 2.263719 2.498905 10.4% 1.159 1.279 1807.7 1639.3 9.3% 1024 64/2 2.263635 2.501889 10.5% 1.159 1.281 1809.4 1635.6 9.6% 1024 64/32 2.264467 2.500359 10.4% 1.159 1.280 1806.5 1633.0 9.6% 1024 64/64 2.240494 2.470246 10.3% 1.147 1.265 1810.0 1637.1 9.6% Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-13-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: fdb: cache VLAN destinations in configured entriesNikolay Aleksandrov
Use the known port-VLAN destination for user-configured fdb entries and resolve switchdev vids with an fdb helper. VLAN 0, bridge entries and unconfigured switchdev vids retain raw port destinations. Keep the vid alongside the destination because it remains part of the fdb key. Use conditional replacement for same port destination upgrades so they don't overwrite a concurrent packet-learned roam. Port changing updates remain direct and report a forwarding change. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-12-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: fdb: cache port VLANs in learned entriesNikolay Aleksandrov
Store the resolved port-VLAN as the destination of dynamically learned FDB entries. Roaming updates the destination directly, while an existing raw port destination is conditionally upgraded without generating a spurious notification. Conditional replacements prevent both this upgrade and a VLAN deletion fallback from overwriting a concurrent roam. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-11-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: fdb: factor out existing entry updatesNikolay Aleksandrov
Move the existing fdb entry update path out of br_fdb_update() into __fdb_update(). This reduces nesting in br_fdb_update() and keeps the lookup and creation flow separate from updates to an entry that was found. No functional changes intended. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-10-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: vlan: quiesce readers before freeing port VLANsNikolay Aleksandrov
Later fdb entries will cache port-VLAN pointers so unpublish a VLAN, wait for a grace period (existing readers) and then purge or rewrite fdb references before releasing it. Cached destinations can continue forwarding until they are cleaned, that is acceptable so add a comment to document it. During port teardown unpublish the complete VLAN group first, clean the port fdbs and then release the VLANs. This lets all VLANs share one grace period. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-9-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: vlan: split unpublishing from deletionNikolay Aleksandrov
Split removal of a VLAN from its lookup and flood structures from object destruction. Pass the VLAN group explicitly to __vlan_del() and call both operations consecutively for now. This prepares deletion paths to quiesce readers after making an entry unreachable and before freeing it. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-8-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: fdb: consolidate port-VLAN cleanupNikolay Aleksandrov
Deleting a port-VLAN currently takes the hash_lock twice and performs two fdb ops. The first removes its automatically generated local entry and the second deletes dynamic entries associated with the port and vid. Rename br_fdb_delete_by_port() to br_fdb_cleanup_by_dst() and pass a bridge dst so it can distinguish a port-VLAN from a raw port. This allows both operations to be done during the same locked fdb walk. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-7-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: fdb: pass VLAN entries to learning updatesNikolay Aleksandrov
Pass the resolved VLAN entry through fdb learning paths and derive the vid inside br_fdb_update(). The fdb destination remains a port for now, this is a preparation for caching the VLAN. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-6-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: vlan: return VLAN entries from ingress helpersNikolay Aleksandrov
Have the ingress helpers return the resolved vlan entry directly and let callers derive the vid from it. This keeps the vlan available for later fdb operations without carrying parallel vlan pointer and vid. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-5-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: add VLAN support to bridge destinationsNikolay Aleksandrov
Use bit 0 to distinguish port-VLAN pointers from bridge port pointers in struct net_bridge_dst. Add helpers for constructing and decoding VLAN destinations. No caller creates one yet, so behavior remains unchanged. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-4-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: use net_bridge_dst for fdb destinationsNikolay Aleksandrov
Store fdb destinations in struct net_bridge_dst and access them through the destination helpers. This doesn't change their representation or behavior, fdb destinations still contain only bridge port pointers. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-02net: bridge: introduce a bridge destination typeNikolay Aleksandrov
Add an opaque destination type and helpers for representing bridge port destinations. Using a separate structure makes raw pointer assignments and comparisons fail at build time while marking its value member __private makes sparse warn about accesses that bypass the helpers. Reviewed-by: Ido Schimmel <idosch@nvidia.com> Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260930071411.2786201-2-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-10-01net: drop unused LLC-related includesJakub Kicinski
The bridge and the openvswitch code include <net/llc.h>, <net/llc_pdu.h> and <linux/llc.h> without using anything out of them. parse_ethertype() is the one exception: it wants LLC_SAP_SNAP, which comes from the uAPI header <linux/llc.h> pulls in, so flow.c keeps that one. The LLC core has leftovers of its own - slab, string, interrupt and net_namespace - which it has not used in a long time. None of this is new, the type 2 removal has just shrunk the LLC headers enough to make it easy to see. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Acked-by: Aaron Conole <aconole@redhat.com> Link: https://patch.msgid.link/20260928190800.2521749-4-kuba@kernel.org Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-10-01llc: strip the leftovers of the llc2 removalJakub Kicinski
Nothing in tree registers the type 1 / type 2 packet handlers or the station handler any more, and nothing looks at the socket hashes hanging off struct llc_sap. The two SAPs opened in tree - SNAP, and STP for the bridge's BPDUs and GARP's PDUs - receive through the per-SAP rcv_func(), so llc_rcv() boils down to a SAP lookup and a call. llc_sap_list becomes static and five exports go away with all this; the llc2 module out of tree has been reworked to open its own SAPs. Frames with a NULL DSAP used to be handed to the station handler before the SAP lookup. They take the normal path now, meaning they get dropped unless something registers SAP 0. struct llc_sap is down to 48 bytes on 64-bit from over a kilobyte, which also moves its GFP_ATOMIC allocation from kmalloc-2k to kmalloc-64. The two 64-entry socket hashes are the bulk of it, and the address it carried is now just the SAP number - nothing has read the MAC half since the socket layer left. llc_pdu.h keeps only what its remaining users need, plus LLC_PDU_RSP to document the one argument which can take it. That takes out the type 2 (I and S format, FRMR) definitions, the XID and TEST builders with their constants - the kernel neither sends nor answers either any more - the SAP address defines, the field accessors, and the prototypes of the llc_pdu.c helpers which went out of tree with the rest of LLC2. With the I and S formats gone llc_pdu_header_init() has one PDU type left, so drop the argument. Signed-off-by: Jakub Kicinski <kuba@kernel.org> Link: https://patch.msgid.link/20260928190800.2521749-3-kuba@kernel.org Reviewed-by: Nikolay Aleksandrov <razor@blackwall.org> Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-24Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc5). Conflicts: drivers/net/mdio/mdio-realtek-rtl9300.c 89a8a1eef2d44 ("net: mdio: realtek-rtl9300: fix RTL931x C22 extended page selection") cc3cb8db1eef9 ("net: mdio: realtek-rtl9300: Add page tracking") https://lore.kernel.org/arUZOqy73bE2pp0w@sirena.org.uk net/8021q/vlan_dev.c cd5dd68267c4 ("vlan: ensure sufficient headroom in vlan_dev_hard_header()") ca6ff8dd70eb ("vlan: annotate data-races in vlan_dev_priv fields") Adjacent changes: net/ipv6/ip6_gre.c dd47bcf279f1 ("ip6_gre: Call ip6erspan_tunnel_unlink_md() in ip6erspan_changelink().") cce829e2aa1d ("ip6_gre: Protect ip6gre_net.tunnels[][] with mutex.") drivers/net/ethernet/meta/fbnic/fbnic_txrx.c b5d9e9d4d0c1 ("eth: fbnic: use the Rx queue napi pointer to find the napi vector") c0aca269ec07 ("eth: fbnic: Make Rx completion coalescing configurable") drivers/net/ethernet/stmicro/stmmac/stmmac_selftests.c d68acbf93531 ("net: stmmac: selftests: Support running selftests on DSA conduits") 85ca3292d7a3 ("net: stmmac: Remove ARP offload code") drivers/net/ethernet/wangxun/libwx/wx_hw.c 3173cba11701 ("net: libwx: fix races in Tx timestamp handling") 7042c8c193e5 ("net: libwx: rename wx_pf_flags to wx_flags") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-24bridge: check llc_mac_hdr_init() return value in br_send_bpdu()Eric Dumazet
If llc_mac_hdr_init() fails (for instance if the port device type does not support LLC or dev_hard_header() fails), br_send_bpdu() should drop the skb instead of resetting the mac header to the LLC payload and transmitting a malformed frame. Fixes: 1da177e4c3f4 ("Linux-2.6.12-rc2") Closes: https://lore.kernel.org/netdev/179022851638.2160803.1808206741379444999@kernel.org/ Cc: Nikolay Aleksandrov <razor@blackwall.org> Cc: Ido Schimmel <idosch@nvidia.com> Cc: bridge@lists.linux.dev Signed-off-by: Eric Dumazet <edumazet@google.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260924082951.1599377-3-edumazet@google.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-23net: bridge: mdb: restart port group walk after deletionFourie Zhang
br_mdb_flush_pgs() keeps a pointer-to-pointer cursor while walking mp->ports. br_multicast_del_pg() can re-enter the same MDB entry through br_multicast_sg_del_exclude_ports() and unlink other port groups. If the cursor points into one of those groups, the next iteration dereferences a stale cursor and can leave mp->ports pointing at freed memory. A following RTM_GETMDB exposes the dangling pointer: BUG: KASAN: slab-use-after-free in br_mdb_dump Read of size 8 br_mdb_dump rtnl_mdb_dump rtnl_dumpit netlink_dump Reset the cursor to mp->ports after every deletion. The deletion removes at least the selected group, so the restarted walk always makes progress. Fixes: a6acb535afb2 ("bridge: mdb: Add MDB bulk deletion support") Cc: stable@vger.kernel.org Signed-off-by: Fourie Zhang <fouriezhang@tencent.com> Acked-by: Nikolay Aleksandrov <razor@blackwall.org> Link: https://patch.msgid.link/20260920110852.60293-1-fouriezhang@tencent.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-22umh, treewide: Explicitly include linux/umh.h where neededPetr Pavlu
The usermode helper declarations were previously provided by linux/kmod.h but commit c1f3fa2a4fde ("kmod: split off umh headers into its own file") moved them to linux/umh.h in 2017. Add explicit includes of linux/umh.h to files that use usermode helpers and remove linux/kmod.h where it is no longer needed. Acked-by: Alex Elder <elder@riscstar.com> # for greybus Signed-off-by: Petr Pavlu <petr.pavlu@suse.com>
2026-09-21net: bridge: avoid VLAN lookups for flood neighbour suppressionNikolay Aleksandrov
We can remove more unnecessary VLAN lookups if we pass the port-VLAN entry to the neighbour suppression helpers so they can use it directly instead of resolving it again. Use a vid wrapper for callers which don't have the port-VLAN entry. This removes up to two additional VLAN hash lookups per flooded egress port for packets marked as proxy replied. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-10-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: avoid egress VLAN lookups when floodingNikolay Aleksandrov
VLAN flooding already provides the exact port-VLAN entry associated with each destination port. Use that entry directly for the egress state check and VLAN handling instead of resolving it again from the packet VLAN ID. Keep the existing lookup path for forwarding destinations which do not provide a port-VLAN entry. This removes two VLAN hash lookups for every flooded egress port. Use __always_inline for should_deliver as it provides a measurable 3% additional gain, should_deliver wasn't inlined even though it had the inline specifier, the bridge module size increases by 173 bytes. The series were tested in a two CPU VM with packet generation and bridge forwarding on separate pinned CPUs. The results are medians of seven runs with 300000 64b tagged broadcast packets. Mpps br_flood TSC cycles/input VIDs Ports before after gain before after reduction 1 8/2 1.209298 1.636580 35.3% 1444 845 41.5% 1 8/4 0.843175 0.986541 17.0% 3036 2527 16.8% 1 8/8 0.508857 0.559844 10.0% 5999 5465 8.9% 1 32/2 0.893896 1.586532 77.5% 3013 841 72.1% 1 32/16 0.250567 0.282339 12.7% 13670 11137 18.5% 1 32/32 0.135351 0.148461 9.7% 25429 22320 12.2% 1 64/2 0.555010 1.603776 189.0% 5001 837 83.3% 1 64/32 0.123831 0.149639 20.8% 27674 22602 18.3% 1 64/64 0.069122 0.076047 10.0% 51508 45138 12.4% 64 8/2 1.044185 1.500468 43.7% 1528 851 44.3% 64 8/4 0.802680 0.977700 21.8% 3178 2546 19.9% 64 8/8 0.479748 0.555419 15.8% 6283 5635 10.3% 64 32/2 0.861074 1.561266 81.3% 3063 849 72.3% 64 32/16 0.234011 0.280027 19.7% 14332 11165 22.1% 64 32/32 0.126145 0.148085 17.4% 27225 22613 16.9% 64 64/2 0.530587 1.496179 182.0% 4377 826 81.1% 64 64/32 0.121105 0.147943 22.2% 29286 22541 23.0% 64 64/64 0.063626 0.077051 21.1% 56147 45520 18.9% 1024 8/2 1.008693 1.358408 34.7% 1538 879 42.8% 1024 8/4 0.785636 0.943545 20.1% 3280 2704 17.6% 1024 8/8 0.448194 0.521765 16.4% 6678 6011 10.0% 1024 32/2 0.840864 1.417311 68.6% 2756 859 68.8% 1024 32/16 0.195786 0.247129 26.2% 16269 12639 22.3% 1024 32/32 0.097978 0.122742 25.3% 35249 29273 17.0% 1024 64/2 0.536947 1.400985 160.9% 4421 849 80.8% 1024 64/32 0.093962 0.123383 31.3% 37425 29197 22.0% 1024 64/64 0.045147 0.057867 28.2% 72626 59198 18.5% Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-9-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: introduce a forwarding destination structureNikolay Aleksandrov
Introduce struct br_fwd_dst to keep an egress port together with its corresponding VLAN while passing it through the forwarding helpers. This allows paths which already resolved the port VLAN to preserve that information for later egress processing. maybe_deliver() now returns the clone error directly and we pass it separately to br_flood_finish() avoiding the error-pointer encoding and decoding which overloaded the previous port pointer. No functional changes intended. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-8-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: vlan: use an RCU array for large flood setsNikolay Aleksandrov
Walking the master VLAN's port-VLAN list avoids considering ports outside the VLAN but its pointer chasing becomes more expensive than array when many ports participate. Add an rcu array of port-VLAN pointers for larger flood sets. Rebuild and publish the array under RTNL when VLAN membership changes. Continue using the list for small flood sets and as a fallback if the array allocation fails. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-7-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: consider only port-VLAN members when floodingNikolay Aleksandrov
Use the port-VLAN list that is in every master VLAN and consider only participating port-VLANs when flooding packets. This is the first optimization that greatly improves performance for sparse port VLANs e.g. 2 out of 32 ports participating in a single VLAN: before the bridge would consider all 32 ports and forward the packet only through the 2, now it will only consider the participating 2 ports. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-6-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: vlan: introduce a list of port-VLANs in the master VLANNikolay Aleksandrov
Keep a list of all port-VLANs that have been created within their master VLAN. The list is rcu-safe and will be used for optimizing the flood path. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-5-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: vlan: cache the pvid vlan entry directlyNikolay Aleksandrov
VLAN groups cache the pvid and its state separately requiring state updates to keep both copies synchronized. Lockless readers can also observe the pvid and state from different updates. Cache an rcu protected pointer to the pvid vlan entry instead. This makes the vlan entry the single source of truth and lets the ingress path reuse it without another lookup. It also makes the vlan entry always available at the ingress path for subsequent forwarding-path optimizations. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-4-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: factor out port floodingNikolay Aleksandrov
Factor out port flooding code into its own helper, it will be used by later changes to flood to specific port VLANs. No functional changes intended. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-3-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: bridge: factor out common flood completion handlingNikolay Aleksandrov
Factor out the common flood completion handling shared by br_flood and br_multicast_flood into a new helper - br_flood_finish. No functional changes intended. Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260918152950.1938259-2-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-21net: protocol: use assign_bit() where applicablePeng Fan
Convert open-coded if/else with set_bit/clear_bit and their non-atomic __set_bit/__clear_bit variants to the assign_bit/__assign_bit API. Where a bit is toggled based on its own value, use change_bit() instead. Done with Coccinelle semantic patch: // set_bit -> clear_bit => assign_bit @@ expression cond, bit, addr; @@ -if (cond) - set_bit(bit, addr); -else - clear_bit(bit, addr); +assign_bit(bit, addr, cond); // clear_bit -> set_bit => assign_bit @@ expression cond, bit, addr; @@ -if (cond) - clear_bit(bit, addr); -else - set_bit(bit, addr); +assign_bit(bit, addr, !cond); // __set_bit -> __clear_bit => __assign_bit @@ expression cond, bit, addr; @@ -if (cond) - __set_bit(bit, addr); -else - __clear_bit(bit, addr); +__assign_bit(bit, addr, cond); // __clear_bit -> __set_bit => __assign_bit @@ expression cond, bit, addr; @@ -if (cond) - __clear_bit(bit, addr); -else - __set_bit(bit, addr); +__assign_bit(bit, addr, !cond); Signed-off-by: Peng Fan <peng.fan@nxp.com> Reviewed-by: Simon Horman <horms@kernel.org> Link: https://patch.msgid.link/20260920022745.3145847-1-peng.fan@oss.nxp.com Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-17Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc4). Conflicts: net/core/neighbour.c 979aabdad8dd0 ("neighbour: Skip default parms when resumed in neightbl_dump_info().") 7b430fcfc972f ("neighbour: Don't render blackhole_netdev via RTM_GETNEIGHTBL.") fae1c59810b86 ("neighbour: Remove unnecessary net_eq().") https://lore.kernel.org/20260911173056.44ec06e0@kernel.org https://lore.kernel.org/aqfbJi7nAX4IbmnR@sirena.co.uk Adjacent changes: net/netlink/af_netlink.c ceac0de741bf ("netlink: do not free nlk->groups while lockless readers can use it") 7c0ec6288b49 ("net: Replace %pK output with 0") net/bridge/br_vlan.c 2842ce397dd0 ("net: bridge: vlan: fix bugs caused by switchdev deletion errors") 5bec8f861114 ("net: bridge: vlan: annotate lockless use of num_vlans") 2b1f8fd3118c ("net: bridge: vlan: annotate lockless vlan flags use") net/bridge/br_mst.c 18a6fe05fb6e ("net: bridge: mst: move switchdev call outside rcu") 120207a08fc0 ("net: bridge: vlan: annotate lockless use of msti") drivers/net/ethernet/stmicro/stmmac/hwif.h 90e4b849dfa6 ("net: stmmac: propagate FPE preemption-class mapping errors") 85ca3292d7a3 ("net: stmmac: Remove ARP offload code") Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-15net: bridge: vlan: fix bugs caused by switchdev deletion errorsNikolay Aleksandrov
Allowing switchdev to prevent vlan deletion and error out in __vlan_del could cause multiple different issues - inconsistent state, memory leaks when flushing, NULL pointer dereference on bridge error when flushing. It doesn't make sense to allow it to stop __vlan_del, so log the error and continue with software vlan deletion. This is also consistent with 8021q behaviour. Suggested-by: Ido Schimmel <idosch@nvidia.com> Fixes: bf361ad38165 ("net: bridge: check __vlan_vid_del for error") Fixes: 5454f5c28eca ("net: bridge: vlan: check for errors from __vlan_del in __vlan_flush") Fixes: 2594e9064a57 ("bridge: vlan: add per-vlan struct and move to rhashtables") Fixes: 9c86ce2c1ae3 ("net: bridge: Notify about bridge VLANs") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260914105258.3436918-1-razor@blackwall.org Signed-off-by: Jakub Kicinski <kuba@kernel.org>
2026-09-15net: bridge: mst: move switchdev call outside rcuNikolay Aleksandrov
This is a follow-up of one of sashiko's pre-existing bug reports. br_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs while holding rcu_read_lock() which invokes the blocking switchdev notifier chain and may sleep. Nonzero MSTI changes come from netlink with rtnl held. Move the switchdev call before entering the rcu section and assert that rtnl is held. The call cannot be deferred because netlink needs its error and extack. Also DSA reads the old bridge MST state during the callback and checks it. A deferred callback will be late and will see the updated state. Fixes: 3a7c1661ae13 ("net: bridge: mst: fix vlan use-after-free") Signed-off-by: Nikolay Aleksandrov <razor@blackwall.org> Reviewed-by: Ido Schimmel <idosch@nvidia.com> Link: https://patch.msgid.link/20260911105021.1385934-1-razor@blackwall.org Signed-off-by: Paolo Abeni <pabeni@redhat.com>
2026-09-10Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/netJakub Kicinski
Cross-merge networking fixes after downstream PR (net-7.3-rc3). Conflicts: drivers/net/dsa/mt7530.c 3c18e3c9a54e ("net: dsa: mt7530: populate lpi_interfaces to fix EEE support") 10d9d8328e8a ("net: dsa: mt7530: replace mt7530_read with regmap_read") Adjacent changes: drivers/net/bonding/bond_alb.c 1746ef2e2df2 ("bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()") 4cef95f72bbd ("bonding: fix u32 overflow in compute_gap()") Signed-off-by: Jakub Kicinski <kuba@kernel.org>