1. 25 Apr, 2024 23 commits
  2. 24 Apr, 2024 17 commits
    • Bartosz Golaszewski's avatar
      Bluetooth: qca: set power_ctrl_enabled on NULL returned by gpiod_get_optional() · 3d05fc82
      Bartosz Golaszewski authored
      Any return value from gpiod_get_optional() other than a pointer to a
      GPIO descriptor or a NULL-pointer is an error and the driver should
      abort probing. That being said: commit 56d074d2 ("Bluetooth: hci_qca:
      don't use IS_ERR_OR_NULL() with gpiod_get_optional()") no longer sets
      power_ctrl_enabled on NULL-pointer returned by
      devm_gpiod_get_optional(). Restore this behavior but bail-out on errors.
      While at it: also bail-out on error returned when trying to get the
      "swctrl" GPIO.
      Reported-by: default avatarWren Turkal <wt@penguintechs.org>
      Reported-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
      Closes: https://lore.kernel.org/linux-bluetooth/1713449192-25926-2-git-send-email-quic_zijuhu@quicinc.com/
      Fixes: 56d074d2 ("Bluetooth: hci_qca: don't use IS_ERR_OR_NULL() with gpiod_get_optional()")
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Signed-off-by: default avatarBartosz Golaszewski <bartosz.golaszewski@linaro.org>
      Tested-by: default avatarWren Turkal" <wt@penguintechs.org>
      Reported-by: default avatarWren Turkal <wt@penguintechs.org>
      Reported-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
      Reviewed-by: Krzysztof Kozlowski<krzysztof.kozlowski@linaro.org>
      Reviewed-by: default avatarKrzysztof Kozlowski <krzysztof.kozlowski@linaro.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      3d05fc82
    • Chun-Yi Lee's avatar
      Bluetooth: hci_sync: Using hci_cmd_sync_submit when removing Adv Monitor · 88cd6e6b
      Chun-Yi Lee authored
      Since the d883a466 be introduced in v6.4, bluetooth daemon
      got the following failed message of MGMT_OP_REMOVE_ADV_MONITOR
      command when controller is power-off:
      
      bluetoothd[20976]:
      src/adapter.c:reset_adv_monitors_complete() Failed to reset Adv
      Monitors: Failed>
      
      Normally this situation is happened when the bluetoothd deamon
      be started manually after system booting. Which means that
      bluetoothd received MGMT_EV_INDEX_ADDED event after kernel
      runs hci_power_off().
      
      Base on doc/mgmt-api.txt, the MGMT_OP_REMOVE_ADV_MONITOR command
      can be used when the controller is not powered. This patch changes
      the code in remove_adv_monitor() to use hci_cmd_sync_submit()
      instead of hci_cmd_sync_queue().
      
      Fixes: d883a466 ("Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running")
      Cc: Luiz Augusto von Dentz <luiz.von.dentz@intel.com>
      Cc: Manish Mandlik <mmandlik@google.com>
      Cc: Archie Pusaka <apusaka@chromium.org>
      Cc: Miao-chen Chou <mcchou@chromium.org>
      Signed-off-by: default avatarChun-Yi Lee <jlee@suse.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      88cd6e6b
    • Johan Hovold's avatar
      Bluetooth: qca: fix NULL-deref on non-serdev setup · 7ddb9de6
      Johan Hovold authored
      Qualcomm ROME controllers can be registered from the Bluetooth line
      discipline and in this case the HCI UART serdev pointer is NULL.
      
      Add the missing sanity check to prevent a NULL-pointer dereference when
      setup() is called for a non-serdev controller.
      
      Fixes: e9b3e5b8 ("Bluetooth: hci_qca: only assign wakeup with serial port support")
      Cc: stable@vger.kernel.org      # 6.2
      Cc: Zhengping Jiang <jiangzp@google.com>
      Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      7ddb9de6
    • Johan Hovold's avatar
      Bluetooth: qca: fix NULL-deref on non-serdev suspend · 73e87c0a
      Johan Hovold authored
      Qualcomm ROME controllers can be registered from the Bluetooth line
      discipline and in this case the HCI UART serdev pointer is NULL.
      
      Add the missing sanity check to prevent a NULL-pointer dereference when
      wakeup() is called for a non-serdev controller during suspend.
      
      Just return true for now to restore the original behaviour and address
      the crash with pre-6.2 kernels, which do not have commit e9b3e5b8
      ("Bluetooth: hci_qca: only assign wakeup with serial port support") that
      causes the crash to happen already at setup() time.
      
      Fixes: c1a74160 ("Bluetooth: hci_qca: Add device_may_wakeup support")
      Cc: stable@vger.kernel.org      # 5.13
      Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      73e87c0a
    • Sean Wang's avatar
      Bluetooth: btusb: mediatek: Fix double free of skb in coredump · 18bdb386
      Sean Wang authored
      hci_devcd_append() would free the skb on error so the caller don't
      have to free it again otherwise it would cause the double free of skb.
      
      Fixes: 0b701513 ("Bluetooth: btusb: mediatek: add MediaTek devcoredump support")
      Reported-by : Dan Carpenter <dan.carpenter@linaro.org>
      Signed-off-by: default avatarSean Wang <sean.wang@mediatek.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      18bdb386
    • Luiz Augusto von Dentz's avatar
      Bluetooth: MGMT: Fix failing to MGMT_OP_ADD_UUID/MGMT_OP_REMOVE_UUID · 6eb5fcc4
      Luiz Augusto von Dentz authored
      These commands don't require the adapter to be up and running so don't
      use hci_cmd_sync_queue which would check that flag, instead use
      hci_cmd_sync_submit which would ensure mgmt_class_complete is set
      properly regardless if any command was actually run or not.
      
      Link: https://github.com/bluez/bluez/issues/809
      Fixes: d883a466 ("Bluetooth: hci_sync: Only allow hci_cmd_sync_queue if running")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      6eb5fcc4
    • Johan Hovold's avatar
      Bluetooth: qca: fix invalid device address check · 32868e12
      Johan Hovold authored
      Qualcomm Bluetooth controllers may not have been provisioned with a
      valid device address and instead end up using the default address
      00:00:00:00:5a:ad.
      
      This was previously believed to be due to lack of persistent storage for
      the address but it may also be due to integrators opting to not use the
      on-chip OTP memory and instead store the address elsewhere (e.g. in
      storage managed by secure world firmware).
      
      According to Qualcomm, at least WCN6750, WCN6855 and WCN7850 have
      on-chip OTP storage for the address.
      
      As the device type alone cannot be used to determine when the address is
      valid, instead read back the address during setup() and only set the
      HCI_QUIRK_USE_BDADDR_PROPERTY flag when needed.
      
      This specifically makes sure that controllers that have been provisioned
      with an address do not start as unconfigured.
      Reported-by: default avatarJanaki Ramaiah Thota <quic_janathot@quicinc.com>
      Link: https://lore.kernel.org/r/124a7d54-5a18-4be7-9a76-a12017f6cce5@quicinc.com/
      Fixes: 5971752d ("Bluetooth: hci_qca: Set HCI_QUIRK_USE_BDADDR_PROPERTY for wcn3990")
      Fixes: e668eb1e ("Bluetooth: hci_core: Don't stop BT if the BD address missing in dts")
      Fixes: 6945795b ("Bluetooth: fix use-bdaddr-property quirk")
      Cc: stable@vger.kernel.org	# 6.5
      Cc: Matthias Kaehlcke <mka@chromium.org>
      Signed-off-by: default avatarJohan Hovold <johan+linaro@kernel.org>
      Reported-by: default avatarJanaki Ramaiah Thota <quic_janathot@quicinc.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      32868e12
    • Luiz Augusto von Dentz's avatar
      Bluetooth: hci_event: Fix sending HCI_OP_READ_ENC_KEY_SIZE · a9a830a6
      Luiz Augusto von Dentz authored
      The code shall always check if HCI_QUIRK_BROKEN_READ_ENC_KEY_SIZE has
      been set before attempting to use HCI_OP_READ_ENC_KEY_SIZE.
      
      Fixes: c569242c ("Bluetooth: hci_event: set the conn encrypted before conn establishes")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      a9a830a6
    • Zijun Hu's avatar
      Bluetooth: btusb: Fix triggering coredump implementation for QCA · b23d98d4
      Zijun Hu authored
      btusb_coredump_qca() uses __hci_cmd_sync() to send a vendor-specific
      command to trigger firmware coredump, but the command does not
      have any event as its sync response, so it is not suitable to use
      __hci_cmd_sync(), fixed by using __hci_cmd_send().
      
      Fixes: 20981ce2 ("Bluetooth: btusb: Add WCN6855 devcoredump support")
      Signed-off-by: default avatarZijun Hu <quic_zijuhu@quicinc.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      b23d98d4
    • WangYuli's avatar
      Bluetooth: btusb: Add Realtek RTL8852BE support ID 0x0bda:0x4853 · d1a5a7ee
      WangYuli authored
      Add the support ID(0x0bda, 0x4853) to usb_device_id table for
      Realtek RTL8852BE.
      
      Without this change the device utilizes an obsolete version of
      the firmware that is encoded in it rather than the updated Realtek
      firmware and config files from the firmware directory. The latter
      files implement many new features.
      
      The device table is as follows:
      
      T: Bus=03 Lev=01 Prnt=01 Port=09 Cnt=03 Dev#= 4 Spd=12 MxCh= 0
      D: Ver= 1.00 Cls=e0(wlcon) Sub=01 Prot=01 MxPS=64 #Cfgs= 1
      P: Vendor=0bda ProdID=4853 Rev= 0.00
      S: Manufacturer=Realtek
      S: Product=Bluetooth Radio
      S: SerialNumber=00e04c000001
      C:* #Ifs= 2 Cfg#= 1 Atr=e0 MxPwr=500mA
      I:* If#= 0 Alt= 0 #EPs= 3 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=81(I) Atr=03(Int.) MxPS= 16 Ivl=1ms
      E: Ad=02(O) Atr=02(Bulk) MxPS= 64 Ivl=0ms
      E: Ad=82(I) Atr=02(Bulk) MxPS= 64 Ivl=0ms
      I:* If#= 1 Alt= 0 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 0 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 0 Ivl=1ms
      I: If#= 1 Alt= 1 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 9 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 9 Ivl=1ms
      I: If#= 1 Alt= 2 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 17 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 17 Ivl=1ms
      I: If#= 1 Alt= 3 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 25 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 25 Ivl=1ms
      I: If#= 1 Alt= 4 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 33 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 33 Ivl=1ms
      I: If#= 1 Alt= 5 #EPs= 2 Cls=e0(wlcon) Sub=01 Prot=01 Driver=btusb
      E: Ad=03(O) Atr=01(Isoc) MxPS= 49 Ivl=1ms
      E: Ad=83(I) Atr=01(Isoc) MxPS= 49 Ivl=1ms
      
      Cc: stable@vger.kernel.org
      Signed-off-by: default avatarLarry Finger <Larry.Finger@lwfinger.net>
      Signed-off-by: default avatarWangYuli <wangyuli@uniontech.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      d1a5a7ee
    • Luiz Augusto von Dentz's avatar
      Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync · 2e7ed5f5
      Luiz Augusto von Dentz authored
      The extended advertising reports do report the PHYs so this store then
      in hci_conn so it can be later used in hci_le_ext_create_conn_sync to
      narrow the PHYs to be scanned since the controller will also perform a
      scan having a smaller set of PHYs shall reduce the time it takes to
      find and connect peers.
      
      Fixes: 288c9022 ("Bluetooth: Enable all supported LE PHY by default")
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      2e7ed5f5
    • Nathan Chancellor's avatar
      Bluetooth: Fix type of len in {l2cap,sco}_sock_getsockopt_old() · 9bf4e919
      Nathan Chancellor authored
      After an innocuous optimization change in LLVM main (19.0.0), x86_64
      allmodconfig (which enables CONFIG_KCSAN / -fsanitize=thread) fails to
      build due to the checks in check_copy_size():
      
        In file included from net/bluetooth/sco.c:27:
        In file included from include/linux/module.h:13:
        In file included from include/linux/stat.h:19:
        In file included from include/linux/time.h:60:
        In file included from include/linux/time32.h:13:
        In file included from include/linux/timex.h:67:
        In file included from arch/x86/include/asm/timex.h:6:
        In file included from arch/x86/include/asm/tsc.h:10:
        In file included from arch/x86/include/asm/msr.h:15:
        In file included from include/linux/percpu.h:7:
        In file included from include/linux/smp.h:118:
        include/linux/thread_info.h:244:4: error: call to '__bad_copy_from'
        declared with 'error' attribute: copy source size is too small
          244 |                         __bad_copy_from();
              |                         ^
      
      The same exact error occurs in l2cap_sock.c. The copy_to_user()
      statements that are failing come from l2cap_sock_getsockopt_old() and
      sco_sock_getsockopt_old(). This does not occur with GCC with or without
      KCSAN or Clang without KCSAN enabled.
      
      len is defined as an 'int' because it is assigned from
      '__user int *optlen'. However, it is clamped against the result of
      sizeof(), which has a type of 'size_t' ('unsigned long' for 64-bit
      platforms). This is done with min_t() because min() requires compatible
      types, which results in both len and the result of sizeof() being casted
      to 'unsigned int', meaning len changes signs and the result of sizeof()
      is truncated. From there, len is passed to copy_to_user(), which has a
      third parameter type of 'unsigned long', so it is widened and changes
      signs again. This excessive casting in combination with the KCSAN
      instrumentation causes LLVM to fail to eliminate the __bad_copy_from()
      call, failing the build.
      
      The official recommendation from LLVM developers is to consistently use
      long types for all size variables to avoid the unnecessary casting in
      the first place. Change the type of len to size_t in both
      l2cap_sock_getsockopt_old() and sco_sock_getsockopt_old(). This clears
      up the error while allowing min_t() to be replaced with min(), resulting
      in simpler code with no casts and fewer implicit conversions. While len
      is a different type than optlen now, it should result in no functional
      change because the result of sizeof() will clamp all values of optlen in
      the same manner as before.
      
      Cc: stable@vger.kernel.org
      Closes: https://github.com/ClangBuiltLinux/linux/issues/2007
      Link: https://github.com/llvm/llvm-project/issues/85647Signed-off-by: default avatarNathan Chancellor <nathan@kernel.org>
      Reviewed-by: default avatarJustin Stitt <justinstitt@google.com>
      Signed-off-by: default avatarLuiz Augusto von Dentz <luiz.von.dentz@intel.com>
      9bf4e919
    • Daniel Golle's avatar
      net: phy: mediatek-ge-soc: follow netdev LED trigger semantics · 5b5f724b
      Daniel Golle authored
      Only blink if the link is up on a LED which is programmed to also
      indicate link-status.
      
      Otherwise, if both LEDs are in use to indicate different speeds, the
      resulting blinking being inverted on LEDs which aren't switched on at
      a specific speed is quite counter-intuitive.
      
      Also make sure that state left behind by reset or the bootloader is
      recognized correctly including the half-duplex and full-duplex bits as
      well as the (unsupported by Linux netdev trigger semantics) link-down
      bit.
      
      Fixes: c66937b0 ("net: phy: mediatek-ge-soc: support PHY LEDs")
      Signed-off-by: default avatarDaniel Golle <daniel@makrotopia.org>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      5b5f724b
    • Hyunwoo Kim's avatar
      net: gtp: Fix Use-After-Free in gtp_dellink · f2a90410
      Hyunwoo Kim authored
      Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal
      of gtp_dellink, is not part of the RCU read critical section, it
      is possible that the RCU grace period will pass during the traversal and
      the key will be free.
      
      To prevent this, it should be changed to hlist_for_each_entry_safe.
      
      Fixes: 94dc550a ("gtp: fix an use-after-free in ipv4_pdp_find()")
      Signed-off-by: default avatarHyunwoo Kim <v4bel@theori.io>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Signed-off-by: default avatarDavid S. Miller <davem@davemloft.net>
      f2a90410
    • Hyunwoo Kim's avatar
      tcp: Fix Use-After-Free in tcp_ao_connect_init · 80e679b3
      Hyunwoo Kim authored
      Since call_rcu, which is called in the hlist_for_each_entry_rcu traversal
      of tcp_ao_connect_init, is not part of the RCU read critical section, it
      is possible that the RCU grace period will pass during the traversal and
      the key will be free.
      
      To prevent this, it should be changed to hlist_for_each_entry_safe.
      
      Fixes: 7c2ffaf2 ("net/tcp: Calculate TCP-AO traffic keys")
      Signed-off-by: default avatarHyunwoo Kim <v4bel@theori.io>
      Reviewed-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarDmitry Safonov <0x7f454c46@gmail.com>
      Link: https://lore.kernel.org/r/ZiYu9NJ/ClR8uSkH@v4bel-B760M-AORUS-ELITE-AXSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      80e679b3
    • Eric Dumazet's avatar
      net: usb: ax88179_178a: stop lying about skb->truesize · 4ce62d5b
      Eric Dumazet authored
      Some usb drivers try to set small skb->truesize and break
      core networking stacks.
      
      In this patch, I removed one of the skb->truesize overide.
      
      I also replaced one skb_clone() by an allocation of a fresh
      and small skb, to get minimally sized skbs, like we did
      in commit 1e2c6117 ("net: cdc_ncm: reduce skb truesize
      in rx path")
      
      Fixes: f8ebb3ac ("net: usb: ax88179_178a: Fix packet receiving")
      Reported-by: default avatarshironeko <shironeko@tesaguri.club>
      Closes: https://lore.kernel.org/netdev/c110f41a0d2776b525930f213ca9715c@tesaguri.club/Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Cc: Jose Alonso <joalonsof@gmail.com>
      Reviewed-by: default avatarSimon Horman <horms@kernel.org>
      Link: https://lore.kernel.org/r/20240421193828.1966195-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      4ce62d5b
    • Eric Dumazet's avatar
      ipv4: check for NULL idev in ip_route_use_hint() · 58a4c9b1
      Eric Dumazet authored
      syzbot was able to trigger a NULL deref in fib_validate_source()
      in an old tree [1].
      
      It appears the bug exists in latest trees.
      
      All calls to __in_dev_get_rcu() must be checked for a NULL result.
      
      [1]
      general protection fault, probably for non-canonical address 0xdffffc0000000000: 0000 [#1] SMP KASAN
      KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]
      CPU: 2 PID: 3257 Comm: syz-executor.3 Not tainted 5.10.0-syzkaller #0
      Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014
       RIP: 0010:fib_validate_source+0xbf/0x15a0 net/ipv4/fib_frontend.c:425
      Code: 18 f2 f2 f2 f2 42 c7 44 20 23 f3 f3 f3 f3 48 89 44 24 78 42 c6 44 20 27 f3 e8 5d 88 48 fc 4c 89 e8 48 c1 e8 03 48 89 44 24 18 <42> 80 3c 20 00 74 08 4c 89 ef e8 d2 15 98 fc 48 89 5c 24 10 41 bf
      RSP: 0018:ffffc900015fee40 EFLAGS: 00010246
      RAX: 0000000000000000 RBX: ffff88800f7a4000 RCX: ffff88800f4f90c0
      RDX: 0000000000000000 RSI: 0000000004001eac RDI: ffff8880160c64c0
      RBP: ffffc900015ff060 R08: 0000000000000000 R09: ffff88800f7a4000
      R10: 0000000000000002 R11: ffff88800f4f90c0 R12: dffffc0000000000
      R13: 0000000000000000 R14: 0000000000000000 R15: ffff88800f7a4000
      FS:  00007f938acfe6c0(0000) GS:ffff888058c00000(0000) knlGS:0000000000000000
      CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
      CR2: 00007f938acddd58 CR3: 000000001248e000 CR4: 0000000000352ef0
      DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000
      DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400
      Call Trace:
        ip_route_use_hint+0x410/0x9b0 net/ipv4/route.c:2231
        ip_rcv_finish_core+0x2c4/0x1a30 net/ipv4/ip_input.c:327
        ip_list_rcv_finish net/ipv4/ip_input.c:612 [inline]
        ip_sublist_rcv+0x3ed/0xe50 net/ipv4/ip_input.c:638
        ip_list_rcv+0x422/0x470 net/ipv4/ip_input.c:673
        __netif_receive_skb_list_ptype net/core/dev.c:5572 [inline]
        __netif_receive_skb_list_core+0x6b1/0x890 net/core/dev.c:5620
        __netif_receive_skb_list net/core/dev.c:5672 [inline]
        netif_receive_skb_list_internal+0x9f9/0xdc0 net/core/dev.c:5764
        netif_receive_skb_list+0x55/0x3e0 net/core/dev.c:5816
        xdp_recv_frames net/bpf/test_run.c:257 [inline]
        xdp_test_run_batch net/bpf/test_run.c:335 [inline]
        bpf_test_run_xdp_live+0x1818/0x1d00 net/bpf/test_run.c:363
        bpf_prog_test_run_xdp+0x81f/0x1170 net/bpf/test_run.c:1376
        bpf_prog_test_run+0x349/0x3c0 kernel/bpf/syscall.c:3736
        __sys_bpf+0x45c/0x710 kernel/bpf/syscall.c:5115
        __do_sys_bpf kernel/bpf/syscall.c:5201 [inline]
        __se_sys_bpf kernel/bpf/syscall.c:5199 [inline]
        __x64_sys_bpf+0x7c/0x90 kernel/bpf/syscall.c:5199
      
      Fixes: 02b24941 ("ipv4: use dst hint for ipv4 list receive")
      Reported-by: default avatarsyzbot <syzkaller@googlegroups.com>
      Signed-off-by: default avatarEric Dumazet <edumazet@google.com>
      Acked-by: default avatarPaolo Abeni <pabeni@redhat.com>
      Link: https://lore.kernel.org/r/20240421184326.1704930-1-edumazet@google.comSigned-off-by: default avatarJakub Kicinski <kuba@kernel.org>
      58a4c9b1