Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2218425/?format=api
{ "id": 2218425, "url": "http://patchwork.ozlabs.org/api/patches/2218425/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260401074509.1897527-4-dwmw2@infradead.org/", "project": { "id": 26, "url": "http://patchwork.ozlabs.org/api/projects/26/?format=api", "name": "Netfilter Development", "link_name": "netfilter-devel", "list_id": "netfilter-devel.vger.kernel.org", "list_email": "netfilter-devel@vger.kernel.org", "web_url": null, "scm_url": null, "webscm_url": null, "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260401074509.1897527-4-dwmw2@infradead.org>", "list_archive_url": null, "date": "2026-04-01T07:44:17", "name": "[3/6] net: Guard Legacy IP entry points with CONFIG_LEGACY_IP", "commit_ref": null, "pull_url": null, "state": "awaiting-upstream", "archived": false, "hash": "a2a4ef8dce5bfaab3073951953cf2193bda525c6", "submitter": { "id": 26, "url": "http://patchwork.ozlabs.org/api/people/26/?format=api", "name": "David Woodhouse", "email": "dwmw2@infradead.org" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/netfilter-devel/patch/20260401074509.1897527-4-dwmw2@infradead.org/mbox/", "series": [ { "id": 498288, "url": "http://patchwork.ozlabs.org/api/series/498288/?format=api", "web_url": "http://patchwork.ozlabs.org/project/netfilter-devel/list/?series=498288", "date": "2026-04-01T07:44:20", "name": "Deprecate Legacy IP", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/498288/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2218425/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2218425/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "\n <netfilter-devel+bounces-11538-incoming=patchwork.ozlabs.org@vger.kernel.org>", "X-Original-To": [ "incoming@patchwork.ozlabs.org", "netfilter-devel@vger.kernel.org" ], "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n secure) header.d=infradead.org header.i=@infradead.org header.a=rsa-sha256\n header.s=desiato.20200630 header.b=XmZ0vjW/;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=vger.kernel.org\n (client-ip=2600:3c09:e001:a7::12fc:5321; helo=sto.lore.kernel.org;\n envelope-from=netfilter-devel+bounces-11538-incoming=patchwork.ozlabs.org@vger.kernel.org;\n receiver=patchwork.ozlabs.org)", "smtp.subspace.kernel.org;\n\tdkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org\n header.b=\"XmZ0vjW/\"", "smtp.subspace.kernel.org;\n arc=none smtp.client-ip=90.155.92.199", "smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=infradead.org", "smtp.subspace.kernel.org;\n spf=none smtp.mailfrom=desiato.srs.infradead.org" ], "Received": [ "from sto.lore.kernel.org (sto.lore.kernel.org\n [IPv6:2600:3c09:e001:a7::12fc:5321])\n\t(using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits)\n\t key-exchange x25519)\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fly2h5Wthz1yCp\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 01 Apr 2026 18:55:24 +1100 (AEDT)", "from smtp.subspace.kernel.org (conduit.subspace.kernel.org\n [100.90.174.1])\n\tby sto.lore.kernel.org (Postfix) with ESMTP id AD82630A669F\n\tfor <incoming@patchwork.ozlabs.org>; Wed, 1 Apr 2026 07:47:52 +0000 (UTC)", "from localhost.localdomain (localhost.localdomain [127.0.0.1])\n\tby smtp.subspace.kernel.org (Postfix) with ESMTP id 82F0738AC99;\n\tWed, 1 Apr 2026 07:45:53 +0000 (UTC)", "from desiato.infradead.org (desiato.infradead.org [90.155.92.199])\n\t(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby smtp.subspace.kernel.org (Postfix) with ESMTPS id 7955639936F;\n\tWed, 1 Apr 2026 07:45:48 +0000 (UTC)", "from [2001:8b0:10b:1::425] (helo=i7.infradead.org)\n\tby desiato.infradead.org with esmtpsa (Exim 4.98.2 #2 (Red Hat Linux))\n\tid 1w7qGN-0000000HLQQ-0Bmv;\n\tWed, 01 Apr 2026 07:45:19 +0000", "from dwoodhou by i7.infradead.org with local (Exim 4.98.2 #2 (Red\n Hat Linux))\n\tid 1w7qGM-00000007xeB-26NS;\n\tWed, 01 Apr 2026 08:45:18 +0100" ], "ARC-Seal": "i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116;\n\tt=1775029551; cv=none;\n b=QStxo3oX22odQeZUxJUqej3TKP6nKvsheTL722f3WlV5u3PPMatXiqt7qNmdzSdVFIkWPPfy6we2vHsrFwzWqO+616JAFCCjOmvgN6/jTH+vKIBbdvDOd3Q02C3Pap5jM5FEie5Lm1R00RekRW9yu1bxeuao7CZhIjctJnQlWZ4=", "ARC-Message-Signature": "i=1; a=rsa-sha256; d=subspace.kernel.org;\n\ts=arc-20240116; t=1775029551; c=relaxed/simple;\n\tbh=+tR2lkGhY7EMKxIv9XlfDa5D+Kafii4siVw1srfeq1Y=;\n\th=From:To:Subject:Date:Message-ID:In-Reply-To:References:\n\t MIME-Version;\n b=X0JuGKPmSa1LGWrvJIkwGnVqqDsyermBI/0eNFSBgUIOeI/VWso4r2I8pTyny0QzwTRcKp0t8PH2JRxt4PfV8nrElkIAi47/bM+0abWaTRxyv+a7VcwucG69hlnW39hBIm0FfIjbQ+qJKe16bVMiplAVsZsVfPcMPCbo+JLvSUM=", "ARC-Authentication-Results": "i=1; smtp.subspace.kernel.org;\n dmarc=pass (p=none dis=none) header.from=infradead.org;\n spf=none smtp.mailfrom=desiato.srs.infradead.org;\n dkim=pass (2048-bit key) header.d=infradead.org header.i=@infradead.org\n header.b=XmZ0vjW/; arc=none smtp.client-ip=90.155.92.199", "DKIM-Signature": "v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed;\n\td=infradead.org; s=desiato.20200630; h=Sender:Content-Transfer-Encoding:\n\tMIME-Version:References:In-Reply-To:Message-ID:Date:Subject:To:From:Reply-To:\n\tCc:Content-Type:Content-ID:Content-Description;\n\tbh=rUPZcZvnz7m4wObN0nRKDSPdiuPMBaSG6sDNy+wfNnY=; b=XmZ0vjW/LAOkBb5O+5LmfCk5YI\n\tn8C7/YEH/1OL7qrT9tmUxRH1AvhkSP1DC33BAFZa/XLf4jRDI2N3NZqjWHOn+7sUESjIM1aasCgA4\n\tJBIzZF6GADalqzb484AmGNw/yymN7DMeWwDe63XCJwHL4+6jeB8/s2BCmtK9Y9DjhZl2LXE2exenv\n\t5UNcjFFLrHczGy9tgX4x9RLKNa0chk+2fuONLjXfVSiQoITjn3ij5WJNeyhuBO28yKyWy0KYFAtDd\n\t34i6caZsumKmuoFkoLuH0sqvSRVFs3CPszxsTh9RD6P2LkTvTFD/fIbqcapt5G6lIiaqPKWm+nVz3\n\tHfXKpo5Q==;", "From": "David Woodhouse <dwmw2@infradead.org>", "To": "Saeed Mahameed <saeedm@nvidia.com>,\n\tLeon Romanovsky <leon@kernel.org>,\n\tTariq Toukan <tariqt@nvidia.com>,\n\tMark Bloch <mbloch@nvidia.com>,\n\tAndrew Lunn <andrew+netdev@lunn.ch>,\n\t\"David S. Miller\" <davem@davemloft.net>,\n\tEric Dumazet <edumazet@google.com>,\n\tJakub Kicinski <kuba@kernel.org>,\n\tPaolo Abeni <pabeni@redhat.com>,\n\tSimon Horman <horms@kernel.org>,\n\tNikolay Aleksandrov <razor@blackwall.org>,\n\tIdo Schimmel <idosch@nvidia.com>,\n\tMartin KaFai Lau <martin.lau@linux.dev>,\n\tDaniel Borkmann <daniel@iogearbox.net>,\n\tJohn Fastabend <john.fastabend@gmail.com>,\n\tStanislav Fomichev <sdf@fomichev.me>,\n\tAlexei Starovoitov <ast@kernel.org>,\n\tAndrii Nakryiko <andrii@kernel.org>,\n\tEduard Zingerman <eddyz87@gmail.com>,\n\tSong Liu <song@kernel.org>,\n\tYonghong Song <yonghong.song@linux.dev>,\n\tKP Singh <kpsingh@kernel.org>,\n\tHao Luo <haoluo@google.com>,\n\tJiri Olsa <jolsa@kernel.org>,\n\tKuniyuki Iwashima <kuniyu@google.com>,\n\tWillem de Bruijn <willemb@google.com>,\n\tDavid Ahern <dsahern@kernel.org>,\n\tNeal Cardwell <ncardwell@google.com>,\n\tJohannes Berg <johannes@sipsolutions.net>,\n\tPablo Neira Ayuso <pablo@netfilter.org>,\n\tFlorian Westphal <fw@strlen.de>,\n\tPhil Sutter <phil@nwl.cc>,\n\tGuillaume Nault <gnault@redhat.com>,\n\tDavid Woodhouse <dwmw@amazon.co.uk>,\n\tKees Cook <kees@kernel.org>,\n\tAlexei Lazar <alazar@nvidia.com>,\n\tGal Pressman <gal@nvidia.com>,\n\tPaul Moore <paul@paul-moore.com>,\n\tnetdev@vger.kernel.org,\n\tlinux-rdma@vger.kernel.org,\n\tlinux-kernel@vger.kernel.org,\n\toss-drivers@corigine.com,\n\tbridge@lists.linux.dev,\n\tbpf@vger.kernel.org,\n\tlinux-wireless@vger.kernel.org,\n\tnetfilter-devel@vger.kernel.org,\n\tcoreteam@netfilter.org,\n\ttorvalds@linux-foundation.org,\n\tjon.maddog.hall@gmail.com", "Subject": "[PATCH 3/6] net: Guard Legacy IP entry points with CONFIG_LEGACY_IP", "Date": "Wed, 1 Apr 2026 08:44:17 +0100", "Message-ID": "<20260401074509.1897527-4-dwmw2@infradead.org>", "X-Mailer": "git-send-email 2.51.0", "In-Reply-To": "<20260401074509.1897527-1-dwmw2@infradead.org>", "References": "<20260401074509.1897527-1-dwmw2@infradead.org>", "Precedence": "bulk", "X-Mailing-List": "netfilter-devel@vger.kernel.org", "List-Id": "<netfilter-devel.vger.kernel.org>", "List-Subscribe": "<mailto:netfilter-devel+subscribe@vger.kernel.org>", "List-Unsubscribe": "<mailto:netfilter-devel+unsubscribe@vger.kernel.org>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "Sender": "David Woodhouse <dwmw2@infradead.org>", "X-SRS-Rewrite": "SMTP reverse-path rewritten from <dwmw2@infradead.org> by\n desiato.infradead.org. See http://www.infradead.org/rpr.html" }, "content": "From: David Woodhouse <dwmw@amazon.co.uk>\n\nWrap the IPv4-specific registrations in inet_init() with\nCONFIG_LEGACY_IP guards. When LEGACY_IP is disabled, the kernel\nwill not:\n - Register the AF_INET socket family\n - Register the ETH_P_IP packet handler (ip_rcv)\n - Initialize ARP, ICMP, IGMP, or IPv4 routing\n - Register IPv4 protocol handlers (TCP/UDP/ICMP over IPv4)\n - Initialize IPv4 multicast routing, proc entries, or fragmentation\n\nThe shared INET infrastructure (tcp_prot, udp_prot, tcp_init, etc.)\nremains initialized for use by IPv6.\n\nAlso update INDIRECT_CALL_INET to not use ip_rcv/ip_list_rcv as\ndirect call targets when LEGACY_IP is disabled, avoiding a link-time\nreference to functions that will eventually be compiled out.\n\nSigned-off-by: David Woodhouse <dwmw@amazon.co.uk>\n---\n include/linux/indirect_call_wrapper.h | 4 +++-\n net/ipv4/af_inet.c | 20 +++++++++++++-----\n net/ipv4/devinet.c | 2 ++\n net/ipv4/route.c | 1 -\n net/ipv4/tcp_ipv4.c | 30 ++++++++++++++-------------\n 5 files changed, 36 insertions(+), 21 deletions(-)", "diff": "diff --git a/include/linux/indirect_call_wrapper.h b/include/linux/indirect_call_wrapper.h\nindex dc272b514a01..25a3873da462 100644\n--- a/include/linux/indirect_call_wrapper.h\n+++ b/include/linux/indirect_call_wrapper.h\n@@ -57,9 +57,11 @@\n * builtin, this macro simplify dealing with indirect calls with only ipv4/ipv6\n * alternatives\n */\n-#if IS_BUILTIN(CONFIG_IPV6)\n+#if IS_BUILTIN(CONFIG_IPV6) && IS_ENABLED(CONFIG_LEGACY_IP)\n #define INDIRECT_CALL_INET(f, f2, f1, ...) \\\n \tINDIRECT_CALL_2(f, f2, f1, __VA_ARGS__)\n+#elif IS_BUILTIN(CONFIG_IPV6)\n+#define INDIRECT_CALL_INET(f, f2, f1, ...) INDIRECT_CALL_1(f, f2, __VA_ARGS__)\n #elif IS_ENABLED(CONFIG_INET)\n #define INDIRECT_CALL_INET(f, f2, f1, ...) INDIRECT_CALL_1(f, f1, __VA_ARGS__)\n #else\ndiff --git a/net/ipv4/af_inet.c b/net/ipv4/af_inet.c\nindex c7731e300a44..dc358faa1647 100644\n--- a/net/ipv4/af_inet.c\n+++ b/net/ipv4/af_inet.c\n@@ -1922,7 +1922,15 @@ static int __init inet_init(void)\n \t/*\n \t *\tTell SOCKET that we are alive...\n \t */\n+\t/* Initialize the socket-side protocol switch tables. */\n+\tfor (r = &inetsw[0]; r < &inetsw[SOCK_MAX]; ++r)\n+\t\tINIT_LIST_HEAD(r);\n+\n+#ifdef CONFIG_XFRM\n+\txfrm_init();\n+#endif\n \n+#ifdef CONFIG_LEGACY_IP\n \t(void)sock_register(&inet_family_ops);\n \n #ifdef CONFIG_SYSCTL\n@@ -1957,10 +1965,6 @@ static int __init inet_init(void)\n \t\tpr_crit(\"%s: Cannot add IGMP protocol\\n\", __func__);\n #endif\n \n-\t/* Register the socket-side information for inet_create. */\n-\tfor (r = &inetsw[0]; r < &inetsw[SOCK_MAX]; ++r)\n-\t\tINIT_LIST_HEAD(r);\n-\n \tfor (q = inetsw_array; q < &inetsw_array[INETSW_ARRAY_LEN]; ++q)\n \t\tinet_register_protosw(q);\n \n@@ -1975,6 +1979,7 @@ static int __init inet_init(void)\n \t */\n \n \tip_init();\n+#endif /* CONFIG_LEGACY_IP */\n \n \t/* Initialise per-cpu ipv4 mibs */\n \tif (init_ipv4_mibs())\n@@ -1987,7 +1992,8 @@ static int __init inet_init(void)\n \tudp_init();\n \n \t/* Add UDP-Lite (RFC 3828) */\n-\tudplite4_register();\n+\tif (IS_ENABLED(CONFIG_LEGACY_IP))\n+\t\tudplite4_register();\n \n \traw_init();\n \n@@ -1997,6 +2003,7 @@ static int __init inet_init(void)\n \t *\tSet the ICMP layer up\n \t */\n \n+#ifdef CONFIG_LEGACY_IP\n \tif (icmp_init() < 0)\n \t\tpanic(\"Failed to create the ICMP control socket.\\n\");\n \n@@ -2007,10 +2014,12 @@ static int __init inet_init(void)\n \tif (ip_mr_init())\n \t\tpr_crit(\"%s: Cannot init ipv4 mroute\\n\", __func__);\n #endif\n+#endif /* CONFIG_LEGACY_IP */\n \n \tif (init_inet_pernet_ops())\n \t\tpr_crit(\"%s: Cannot init ipv4 inet pernet ops\\n\", __func__);\n \n+#ifdef CONFIG_LEGACY_IP\n \tipv4_proc_init();\n \n \tipfrag_init();\n@@ -2018,6 +2027,7 @@ static int __init inet_init(void)\n \tdev_add_pack(&ip_packet_type);\n \n \tip_tunnel_core_init();\n+#endif /* CONFIG_LEGACY_IP */\n \n \trc = 0;\n out:\ndiff --git a/net/ipv4/devinet.c b/net/ipv4/devinet.c\nindex 537bb6c315d2..9b9db10e5db2 100644\n--- a/net/ipv4/devinet.c\n+++ b/net/ipv4/devinet.c\n@@ -348,7 +348,9 @@ static int __init inet_blackhole_dev_init(void)\n \n \treturn PTR_ERR_OR_ZERO(in_dev);\n }\n+#ifdef CONFIG_LEGACY_IP\n late_initcall(inet_blackhole_dev_init);\n+#endif\n \n int inet_addr_onlink(struct in_device *in_dev, __be32 a, __be32 b)\n {\ndiff --git a/net/ipv4/route.c b/net/ipv4/route.c\nindex 463236e0dc2d..125614f552c7 100644\n--- a/net/ipv4/route.c\n+++ b/net/ipv4/route.c\n@@ -3773,7 +3773,6 @@ int __init ip_rt_init(void)\n \tif (ip_rt_proc_init())\n \t\tpr_err(\"Unable to create route proc files\\n\");\n #ifdef CONFIG_XFRM\n-\txfrm_init();\n \txfrm4_init();\n #endif\n \trtnl_register_many(ip_rt_rtnl_msg_handlers);\ndiff --git a/net/ipv4/tcp_ipv4.c b/net/ipv4/tcp_ipv4.c\nindex c7b2463c2e25..7660bd45aac7 100644\n--- a/net/ipv4/tcp_ipv4.c\n+++ b/net/ipv4/tcp_ipv4.c\n@@ -3717,25 +3717,27 @@ static void __init bpf_iter_register(void)\n \n void __init tcp_v4_init(void)\n {\n-\tint cpu, res;\n+\tif (IS_ENABLED(CONFIG_LEGACY_IP)) {\n+\t\tint cpu, res;\n \n-\tfor_each_possible_cpu(cpu) {\n-\t\tstruct sock *sk;\n+\t\tfor_each_possible_cpu(cpu) {\n+\t\t\tstruct sock *sk;\n \n-\t\tres = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,\n-\t\t\t\t\t IPPROTO_TCP, &init_net);\n-\t\tif (res)\n-\t\t\tpanic(\"Failed to create the TCP control socket.\\n\");\n-\t\tsock_set_flag(sk, SOCK_USE_WRITE_QUEUE);\n+\t\t\tres = inet_ctl_sock_create(&sk, PF_INET, SOCK_RAW,\n+\t\t\t\t\t\t IPPROTO_TCP, &init_net);\n+\t\t\tif (res)\n+\t\t\t\tpanic(\"Failed to create the TCP control socket.\\n\");\n+\t\t\tsock_set_flag(sk, SOCK_USE_WRITE_QUEUE);\n \n-\t\t/* Please enforce IP_DF and IPID==0 for RST and\n-\t\t * ACK sent in SYN-RECV and TIME-WAIT state.\n-\t\t */\n-\t\tinet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;\n+\t\t\t/* Please enforce IP_DF and IPID==0 for RST and\n+\t\t\t * ACK sent in SYN-RECV and TIME-WAIT state.\n+\t\t\t */\n+\t\t\tinet_sk(sk)->pmtudisc = IP_PMTUDISC_DO;\n \n-\t\tsk->sk_clockid = CLOCK_MONOTONIC;\n+\t\t\tsk->sk_clockid = CLOCK_MONOTONIC;\n \n-\t\tper_cpu(ipv4_tcp_sk.sock, cpu) = sk;\n+\t\t\tper_cpu(ipv4_tcp_sk.sock, cpu) = sk;\n+\t\t}\n \t}\n \tif (register_pernet_subsys(&tcp_sk_ops))\n \t\tpanic(\"Failed to create the TCP control socket.\\n\");\n", "prefixes": [ "3/6" ] }