)]}' { "log": [ { "commit": "af32da41b0327b9c6a37856ba82b6760d6c8d10e", "tree": "1908c1d636394d7ab56ed3e469eb41e9cd357fd6", "parents": [ "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "37f12441f557468a56c1e27790413aa78c82afa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Fri Oct 09 06:40:28 2026 +0200" }, "message": "Merge tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from wireless, wireguard, CAN and Bluetooth.\n We have one known regression to wrap up in VLAN handling.\n\n Current release - regressions:\n\n - Bluetooth: RFCOMM: fix deadlock on rfcomm_mutex\n\n Previous releases - regressions:\n\n - can: fix regression in handling RPS after migrating metadata to skb_ext\n\n - eth:\n - iavf: fix regressions in reconfig impacting bonding\n - mana: fix packet forwarding performance regression\n - stmmac: remove buggy VLAN acceleration support\n\n Previous releases - always broken:\n\n - a few high prio fixes for tun, and af_packet\n\n - amt: fix a UaF on tunnel teardown\n\n - eth:\n - bnxt: fix PCIe AER recovery and FLR handling issues\n - macb: don\u0027t modify Tx skbs before taking ownership\n - axienet: don\u0027t leak Tx skbs on interface stop\n\n - wifi:\n - nxpwifi: number of LLM-ish fixes\n - assorted mt76 fixes\"\n\n* tag \u0027net-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (128 commits)\n net: macb: copy shared skbs before appending the FCS\n net: macb: check TX ring before modifying skb\n vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n wireguard: noise: reject response consumption after intermediate initiation\n wireguard: queueing: preserve tstamp_type when encapsulating packet\n net: openvswitch: validate transport header presence in set_ipv6_addr\n net/smc: protect clcsock lifetime in smc_getname\n ipv6: do not warn on route notification size race\n ipv4: do not warn on route notification size race\n ipv4: validate checksum_start before completing checksum\n ptp: ocp: fix PCIe delay estimation calculation\n xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n xen/netfront: drop RX packets with a short Ethernet header\n net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n net: sparx5: free the matchall entry on destroy\n selftests: mlxsw: Test port range occupancy on template create\n mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n net: dsa: microchip: fix KSZ8765 fiber detection\n net/mlx5e: Order ICOSQ cc update after CQ doorbell\n ...\n" }, { "commit": "37f12441f557468a56c1e27790413aa78c82afa2", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3", "9151d6c42799105e109c8b54dbaad91ce0e17c47" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:54 2026 -0700" }, "message": "Merge branch \u0027net-macb-fix-software-fcs-handling-of-shared-and-requeued-skbs\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: macb: fix software FCS handling of shared and requeued skbs\n\nWhile testing the genet MTU series I used a Raspberry Pi CM5 (RP1 GEM)\nas pktgen source for the CM4. With clone_skb the CM5 rebooted after a\nfew seconds. Further investigation showed that macb_pad_and_fcs()\nappends the FCS in place, so the shared skb grows with every transmit\nuntil BQL completes more than was queued and dql_completed() hits its\nBUG_ON.\n\nThe same code also modifies the skb before the TX ring check, so a\nNETDEV_TX_BUSY retry gets an skb that was already replaced or grown.\n\nPatch 1 checks the ring first, patch 2 copies shared skbs.\n\nTested on Raspberry CM5 with pktgen at 60/20000 bytes, clone_skb 0/\n1000, burst 1/32.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-0-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9151d6c42799105e109c8b54dbaad91ce0e17c47", "tree": "3e1ee798184e51c7cc2dfa3632a3504b70d3a969", "parents": [ "6b48ed85ae0ca37c7403ef5d512be75975844f2f" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: copy shared skbs before appending the FCS\n\nmacb_pad_and_fcs() appends the FCS in place when the skb has tailroom.\nA shared skb, as pktgen sends in clone_skb mode, grows by one FCS per\ntransmit. BQL then completes more bytes than were queued and\ndql_completed() hits its BUG_ON.\n\nOn a Raspberry Pi CM5 (RP1 GEM) pktgen with clone_skb 1000 burst 32 at\n60 bytes kills the box within seconds.\n\nCopy shared skbs before appending the FCS. Clearing IFF_TX_SKB_SHARING\nwould also fix it but makes pktgen refuse clone_skb on macb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-2-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6b48ed85ae0ca37c7403ef5d512be75975844f2f", "tree": "009f5227692a79a54dc6d9f5da534e11059f1f99", "parents": [ "7c24a4e87e219072e5e106f6791146cbf3b056b3" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 06 07:41:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:48:50 2026 -0700" }, "message": "net: macb: check TX ring before modifying skb\n\nmacb_pad_and_fcs() replaces or extends the skb before the ring space\ncheck. On NETDEV_TX_BUSY the stack requeues an skb that is already freed\nor grown.\n\nCheck the ring first, using the padded length for the descriptor count.\nNonlinear skbs always take the copy path so the count can assume a\nlinear skb.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261006-nb-macb-shared-skb-net-v1-1-a80641479041@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c24a4e87e219072e5e106f6791146cbf3b056b3", "tree": "c2a0498021ae56990a1be3cd207ba25477c780b7", "parents": [ "fe4167bf53b61405f97614f644f6a63a5d6ad034" ], "author": { "name": "Ilia Gavrilov", "email": "Ilia.Gavrilov@infotecs.ru", "time": "Thu Oct 08 14:41:17 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:46:13 2026 -0700" }, "message": "vsock: Fix memory leak in vmci_transport_recv_dgram_cb()\n\nDuring the closure of a datagram socket, the vmci_transport_recv_dgram_cb()\nfunction may be called, which will add the packets\nto the socket\u0027s backlog; then, after the receive queue is cleared,\nthe __release_sock() function will move the packet back from the socket\u0027s\nbacklog to the receive queue, which will lead to a memory leak.\n\nsock_close\n __sock_release\n __vsock_release\n // take ownership by user-space\n lock_sock_nested\n sock_set_flag(sk, SOCK_DEAD)\n vmci_transport_release\n vmci_dispatch_dgs\n vmci_datagram_invoke_guest_handler\n vmci_transport_recv_dgram_cb\n sk_receive_skb\n if (!sock_owned_by_user(sk))\n [...]\n (!) else if sk_add_backlog()\n [...]\n (!) skb_queue_purge(\u0026sk-\u003esk_receive_queue)\n\n release_sock\n __release_sock\n // move all packets from the backlog\n // to the receive queue\n (!) sk_backlog_rcv\n vsock_queue_rcv_skb\n [...]\n __sock_queue_rcv_skb\n if (!sock_flag(sk, SOCK_DEAD))\n // Since the socket is \"dead\", the function will not\n // be called\n sk-\u003esk_data_ready(sk)\n sock_release_ownership(sk);\n sock_put\n\nAdd a receive queue cleanup in the socket destructor to fix this.\n\nsyzkaller report:\n\nunreferenced object 0xffff8880117bfb80 (size 240):\n comm \"irq/56-vmw_vmci\", pid 205, jiffies 4295064448 (age 73.992s)\n hex dump (first 32 bytes):\n 78 dc 26 1e 80 88 ff ff 78 dc 26 1e 80 88 ff ff x.\u0026.....x.\u0026.....\n 00 00 00 00 00 00 00 00 c0 da 26 1e 80 88 ff ff ..........\u0026.....\n backtrace:\n [\u003cffffffff82be8d97\u003e] __alloc_skb+0x287/0x330 net/core/skbuff.c:505\n [\u003cffffffffa114bcbd\u003e] vmci_transport_recv_dgram_cb+0xbd/0x210 [vmw_vsock_vmci_transport]\n [\u003cffffffffa05072c6\u003e] vmci_datagram_invoke_guest_handler+0x366/0x450 [vmw_vmci]\n [\u003cffffffffa050ad75\u003e] vmci_dispatch_dgs+0x235/0x490 [vmw_vmci]\n [\u003cffffffffa050b025\u003e] vmci_interrupt+0x55/0x290 [vmw_vmci]\n [\u003cffffffff8137ad2b\u003e] irq_thread_fn+0x8b/0x1a0 kernel/irq/manage.c:1205\n [\u003cffffffff8137c7ae\u003e] irq_thread+0x28e/0x530 kernel/irq/manage.c:1314\n [\u003cffffffff81253dd6\u003e] kthread+0x2e6/0x3a0 kernel/kthread.c:376\n [\u003cffffffff81004392\u003e] ret_from_fork+0x22/0x30 arch/x86/entry/entry_64.S:295\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.\n\nFixes: d021c344051a (\"VSOCK: Introduce VM Sockets\")\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Ilia Gavrilov \u003cIlia.Gavrilov@infotecs.ru\u003e\nLink: https://patch.msgid.link/20261008144046.90853-1-Ilia.Gavrilov@infotecs.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe4167bf53b61405f97614f644f6a63a5d6ad034", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "d0305f8d90029556260c6824b61c493c424eba9e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:39 2026 -0700" }, "message": "Merge branch \u0027wireguard-fixes-for-7-3-rc7\u0027\n\nJason A. Donenfeld says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nWireGuard fixes for 7.3-rc7\n\nThis series contains two important WireGuard fixes\n\n1) Stop zeroing out skb-\u003etstamp_type when encapsulating packets, so that\n fq behaves correctly, from Ramses de Norre.\n\n2) Make sure handshake state isn\u0027t swapped out while locks are\n released, reported by Jérémy Jean.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261008130124.724119-1-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d0305f8d90029556260c6824b61c493c424eba9e", "tree": "3652ea0cc192daa10c08397192b1a0b8ba57670f", "parents": [ "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897" ], "author": { "name": "Jason A. Donenfeld", "email": "Jason@zx2c4.com", "time": "Thu Oct 08 14:59:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: noise: reject response consumption after intermediate initiation\n\nTwo threads begin processing the identical response message, received\ntwice. The first thread, A, runs. While it\u0027s running, the second one,\nB, gets partway through, and during that slow calculation, or even while\nblocking on down_write(), A completes and then also a handshake\ninitiation that\u0027s already been queued up runs in thread C, which itself\ntakes that same down_write(). The handshake initiation creation\nsucceeds, and sets the state back to waiting-for-response, and calls\nup_write(), at which point thread B resumes, because either its finished\nits calculations or was finally allowed to acquire down_write(). Thread\nB then copies the state back to the peer, and begins a new session,\nusing that state, which is the same session as the one made in thread A.\n\nThread A\t\t\tThread B\t\t\tThread C\n\ndown_read()\n sA \u003d handshake-\u003estate\n memcpy(cA, handshake-\u003ecrypto)\nup_read()\nif (sA !\u003d 1)\n goto fail\nslow_crypto(cA)\n\t\t\t\tdown_read()\n\t\t\t\t sB \u003d handshake-\u003estate\n\t\t\t\t memcpy(cB, handshake-\u003ecrypto)\n\t\t\t\tup_read()\n\t\t\t\tif (sB !\u003d 1)\n\t\t\t\t goto fail\n\t\t\t\tslow_crypto(cB)\ndown_write()\n if (sA !\u003d handshake-\u003estate)\n goto fail\n memcpy(handshake-\u003ecrypto, cA)\n handshake-\u003estate \u003d 2\nup_write()\ndown_write()\n if (handshake-\u003estate !\u003d 2)\n goto fail\n derive_session(handshake-\u003ecrypto)\nup_write()\n\t\t\t\t\t\t\t\tdown_write()\n\t\t\t\t\t\t\t\t slow_crypto(handshake-\u003ecrypto)\n\t\t\t\t\t\t\t\t handshake-\u003estate \u003d 1\n\t\t\t\t\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (sB !\u003d handshake-\u003estate)\n\t\t\t\t goto fail\n\t\t\t\t memcpy(handshake-\u003ecrypto, cB)\n\t\t\t\t handshake-\u003estate \u003d 2\n\t\t\t\tup_write()\n\t\t\t\tdown_write()\n\t\t\t\t if (handshake-\u003estate !\u003d 2)\n\t\t\t\t goto fail\n\t\t\t\t derive_session(handshake-\u003ecrypto)\n\t\t\t\tup_write()\n\nThis seems basically impossible to hit in a meaningful way in practice,\nbut ensure that it absolutely cannot happen by comparing the ephemeral\nprivate key that\u0027s on the stack with the latest one that the peer\u0027s\nhandshake state has.\n\nCc: stable@vger.kernel.org\nFixes: e7096c131e51 (\"net: WireGuard secure network tunnel\")\nReported-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-4-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65ab9de4bdd4c05d8277cfc20ae0b9f5aff60897", "tree": "9d95e48bcea0bdea94c5a0f6a64f51eae07abd4b", "parents": [ "3c6a4b11330fe424557538a98fca9f0a4c5bf313" ], "author": { "name": "Ramses de Norre", "email": "ramses@well-founded.dev", "time": "Thu Oct 08 14:59:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:43:38 2026 -0700" }, "message": "wireguard: queueing: preserve tstamp_type when encapsulating packet\n\nSending traffic through a wireguard tunnel on a host using the fq\nqdisc fills the log with:\n\n fq: likely mono tstamp with tstamp_type 0\n\nAn skb carries a timestamp in skb-\u003etstamp and, separately, a\nskb-\u003etstamp_type field recording which clock that timestamp came from.\nThe two have to agree.\n\nWhen wireguard encapsulates a packet it calls wg_reset_packet(), which\nclears the fields that must not leak from the inner packet into the\ntunnel packet. It does so in two steps:\n\n skb_scrub_packet(skb, true);\n memset(\u0026skb-\u003eheaders, 0, sizeof(skb-\u003eheaders));\n\nskb_scrub_packet() deliberately keeps skb-\u003etstamp when it holds a\nmonotonic timestamp: that value is the time the packet is scheduled to\nbe sent, and the qdisc still needs it. The memset then zeroes\nskb-\u003etstamp_type, because that field sits inside the headers group\nwhile skb-\u003etstamp does not. The packet therefore leaves wireguard\ncarrying a monotonic timestamp labelled as a realtime one.\n\nNothing noticed until commit c4f796c4f16b (\"net_sched: sch_fq: convert\nskb-\u003etstamp if not monotonic\"): fq used to assume every timestamp was\nmonotonic. It now consults tstamp_type, spots the mismatch, warns, and\nfalls back to treating the value as monotonic. Pacing still ends up\ncorrect, so the log spam is the actual problem.\n\nSave tstamp_type before the memset and restore it when encapsulating,\nnext to the hash fields that are already carried over this way. When\ndecapsulating it stays zeroed, which is right: an incoming packet\u0027s\ntimestamp is a realtime receive timestamp.\n\nFixes: d98d58a00261 (\"net: Set skb-\u003emono_delivery_time and clear it after sch_handle_ingress()\")\nSigned-off-by: Ramses de Norre \u003cramses@well-founded.dev\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Jason A. Donenfeld \u003cJason@zx2c4.com\u003e\nLink: https://patch.msgid.link/20261008130124.724119-3-Jason@zx2c4.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c6a4b11330fe424557538a98fca9f0a4c5bf313", "tree": "204be600ed191b6c040ac994154190bc882a4798", "parents": [ "64a6b36b0e1855288080bc5f89769f27d6dc03c8" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Thu Oct 08 12:41:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:38 2026 -0700" }, "message": "net: openvswitch: validate transport header presence in set_ipv6_addr\n\nWhen executing IPv6 address rewrite actions on IPv6 fragments,\nset_ipv6_addr() calls update_ipv6_checksum(). If parse_ipv6hdr()\nprocesses a non-first IPv6 fragment, it sets key-\u003eip.proto to\nNEXTHDR_FRAGMENT and returns early without calling\nskb_set_transport_header().\n\nupdate_ipv6_checksum() unconditionally evaluates skb_transport_offset()\non entry before checking l4_proto. Because skb-\u003etransport_header is\nuninitialized, this triggers a warning under CONFIG_DEBUG_NET\u003dy although\nit is completely harmless.\n\nFix this by returning early in update_ipv6_checksum() if l4_proto is\nNEXTHDR_FRAGMENT. This avoids reading the uninitialized transport offset\nfor fragments while preserving the debug warning for any other protocol\nwhere the transport header is unexpectedly missing.\n\nSee the syzbot trace:\n\n!skb_transport_header_was_set(skb)\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_header include/linux/skbuff.h:3075 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at skb_transport_offset include/linux/skbuff.h:3250 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at update_ipv6_checksum net/openvswitch/actions.c:361 [inline], CPU#1: syz-executor463/5635\nWARNING: ./include/linux/skbuff.h:3075 at set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399, CPU#1: syz-executor463/5635\n[...]\nRIP: 0010:skb_transport_header include/linux/skbuff.h:3075 [inline]\nRIP: 0010:skb_transport_offset include/linux/skbuff.h:3250 [inline]\nRIP: 0010:update_ipv6_checksum net/openvswitch/actions.c:361 [inline]\nRIP: 0010:set_ipv6_addr+0x462/0x660 net/openvswitch/actions.c:399\n[...]\nCall Trace:\n \u003cTASK\u003e\n set_ipv6 net/openvswitch/actions.c:531 [inline]\n do_execute_actions+0x557e/0x8600 net/openvswitch/actions.c:1366\n ovs_execute_actions+0xde/0x520 net/openvswitch/actions.c:1592\n ovs_packet_cmd_execute+0xb4f/0xf10 net/openvswitch/datapath.c:705\n genl_family_rcv_msg_doit+0x233/0x340 net/netlink/genetlink.c:1114\n genl_rcv_msg+0x614/0x7a0 net/netlink/genetlink.c:1209\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n genl_rcv+0x28/0x40 net/netlink/genetlink.c:1218\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800\n\nReported-by: syzbot+4cc63fcfb3845e149969@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d4cc63fcfb3845e149969\nFixes: 3fdbd1ce11e5 (\"openvswitch: add ipv6 \u0027set\u0027 action\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20261008104135.4722-1-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "64a6b36b0e1855288080bc5f89769f27d6dc03c8", "tree": "23b3e56944f4ebff357aa5e1d7f6b9306d601553", "parents": [ "d5788029c34fa7f27ab23f88a4f878e8913042a9" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Thu Oct 08 16:44:44 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:33:12 2026 -0700" }, "message": "net/smc: protect clcsock lifetime in smc_getname\n\nsmc_getname() dereferences smc-\u003eclcsock without holding\nclcsock_release_lock. Link-group termination can release the CLC socket\nthrough smc_close_active_abort() while the SMC socket is still open,\nfor example after shutdown(SHUT_WR).\n\nA getsockname() caller can load smc-\u003eclcsock, then the termination worker\ncan clear the pointer and call sock_release() before the caller accesses\nclcsock-\u003eops or invokes getname(). This causes a use-after-free; if the\nworker clears the pointer before the load, it causes a NULL dereference.\nThe syscall\u0027s file reference keeps the SMC socket alive but does not\nprevent asynchronous release of its CLC socket.\n\nKASAN reported the following with test-only timing instrumentation:\n\n BUG: KASAN: slab-use-after-free in smc_getname+0x19e/0x1b0\n Read of size 8 at addr ffff888109abb4e0 by task poc/103\n Call Trace:\n smc_getname+0x19e/0x1b0\n do_getsockname+0xe5/0x170\n __sys_getsockname+0x8c/0x100\n\n Allocated by task 95:\n sock_alloc_inode+0x1e/0x280\n sock_alloc+0x3d/0x240\n __sock_create+0x7e/0x430\n smc_create+0x121/0x240\n\n Freed by task 0:\n kmem_cache_free+0xcc/0x340\n rcu_core+0x50a/0x1850\n\n Last potentially related work creation:\n evict+0x446/0x6c0\n smc_clcsock_release+0xa8/0xd0\n smc_close_active_abort+0x26a/0x3a0\n __smc_lgr_terminate.part.0+0x137/0x2e0\n\nHold clcsock_release_lock across the pointer check and the getname()\ncallback to serialize with smc_clcsock_release(). Return -EBADF if the\nCLC socket has already been released, preserving the existing peer\nstate check and the callback\u0027s return value otherwise.\n\nFixes: b03faa1fafc8 (\"net/smc: postpone release of clcsock\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nReviewed-by: Dust Li \u003cdust.li@linux.alibaba.com\u003e\nLink: https://patch.msgid.link/20261008084444.787449-1-nicoyip.dev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5788029c34fa7f27ab23f88a4f878e8913042a9", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "6785011f8b16abf40b1e9d8b2e332232b3e68822", "c97426ec649d99596d8969e1a052c16b14b7b485" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:39 2026 -0700" }, "message": "Merge branch \u0027ipv4-ipv6-do-not-warn-on-route-notification-size-races\u0027\n\nDaehyeon Ko says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4/ipv6: do not warn on route notification size races\n\nA nexthop group can grow between route notification sizing and filling.\nBoth IPv4 and IPv6 can then legitimately return -EMSGSIZE, so remove the\nstale warnings while preserving their existing error paths.\n\nPatch 1 is unchanged from v1. Patch 2 adds the IPv6 counterpart requested\nby Ido. No new build or runtime test was run; both changes only delete the\nstale comment and WARN_ON().\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c97426ec649d99596d8969e1a052c16b14b7b485", "tree": "63c8f114e845faceccaec8ee8450a6f0b1773faf", "parents": [ "e02a5b6588161673ef75a4bc5cdfb62bd493374d" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Thu Oct 08 14:29:23 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:36 2026 -0700" }, "message": "ipv6: do not warn on route notification size race\n\nfib6_info_hw_flags_set() sizes the skb with rt6_nlmsg_size() and later\nfills it with rt6_fill_node(). With nexthop compatibility mode enabled,\na concurrent replacement can grow the group between these independent\nsnapshots. rt6_fill_node() can then legitimately return -EMSGSIZE, so\nthe warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.\n\nFixes: 907eea486888 (\"net: ipv6: Emit notification when fib hardware flags are changed\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261007114003.GA1011260@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/4012604727e5ba80b69ccd4d08796511397ddaef.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e02a5b6588161673ef75a4bc5cdfb62bd493374d", "tree": "f5f8e3b24a1605932cbef9b43f4a0eb30fdb6030", "parents": [ "6785011f8b16abf40b1e9d8b2e332232b3e68822" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Thu Oct 08 14:29:22 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:32:36 2026 -0700" }, "message": "ipv4: do not warn on route notification size race\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib hardware\nflags are changed\") added asynchronous route notifications for hardware\nflag changes.\n\nfib_alias_hw_flags_set() sizes the skb with fib_nlmsg_size() and later\nfills it with fib_dump_info() while holding only RCU. With nexthop\ncompatibility mode enabled, a concurrent replacement can grow the group\nbetween these independent snapshots. fib_dump_info() can then\nlegitimately return -EMSGSIZE, so the warning does not prove a sizing bug.\n\nRemove the warning. The existing error path still frees the skb and\nreports the error to listeners.\n\nFixes: 680aea08e78c (\"net: ipv4: Emit notification when fib hardware flags are changed\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261004082043.GB92032@shredder/\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/b7e203fc5867651cb67ef84aa03e082f0f76008e.1791423190.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6785011f8b16abf40b1e9d8b2e332232b3e68822", "tree": "777d8a04fab8b680e27e8bf8c4fb5d5c17227ca2", "parents": [ "f8c8bd159a9bf626dd4921b7746ff481fce8c758" ], "author": { "name": "Michael S. Tsirkin", "email": "mst@redhat.com", "time": "Wed Oct 07 18:42:49 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:03:47 2026 -0700" }, "message": "ipv4: validate checksum_start before completing checksum\n\nIf a packet with bad checksum metadata gets into the ipv4 stack,\nskb_checksum_help can corrupt the network header and cause a bunch of\nmischief.\n\nThis was discovered and reported by Paulos, and has been reporoduced\nby others independently since.\n\nWe really shouldn\u0027t allow such packets in, but as a defence\nin depth measure, let\u0027s also check before we complete the checksum.\n\nA more complete validation at input is forthcoming, but needs more work.\n\nCc: stable@vger.kernel.org\nFixes: f43798c27684 (\"tun: Allow GSO using virtio_net_hdr\")\nFixes: bfd5f4a3d605 (\"packet: Add GSO/csum offload support.\")\nReported-by: Paulos Yibelo \u003chabte.yibelo@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260922030310.8684-2-habte.yibelo@gmail.com/\nSigned-off-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/0a012b4923e189c4c593ef4f471e5ff0edbe9030.1791412497.git.mst@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f8c8bd159a9bf626dd4921b7746ff481fce8c758", "tree": "2b97f1992807f5413ad59c280aa11e4bf4915391", "parents": [ "93ccaf1c26e2133396173b76a071e59024daa622" ], "author": { "name": "Vadim Fedorenko", "email": "vadim.fedorenko@linux.dev", "time": "Wed Oct 07 20:33:59 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:01:02 2026 -0700" }, "message": "ptp: ocp: fix PCIe delay estimation calculation\n\nThe commit in fixes introduced a high cap for delayas U64_MAX value\nwhile ktime_t is actually s64. This is wrong cap as it becomes negative\nvalue and any comparison to a real delay will fail to update delay\nvalue. Use KTIME_MAX constant as correct max cap for PCIe delay.\n\nThe issue was hit in production (a negative value is observed):\n\n # cat /sys/class/timecard/ocp0/ts_window_adjust\n -3\n\nFixes: aa05fe67bcd64 (\"ptp: ocp: Improve PCIe delay estimation\")\nSigned-off-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261007203359.417270-1-vadim.fedorenko@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "93ccaf1c26e2133396173b76a071e59024daa622", "tree": "4e49a3d06692a62bcfd603de3a584be2b521ac6a", "parents": [ "513e23857a3a64fa73a1deb36a385eecd4ad7690" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:57:32 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 11:00:01 2026 -0700" }, "message": "xen/netfront: don\u0027t leak the skb when xennet_fill_frags() fails\n\nWhen a response chain has more slots than fit in the skb\u0027s frags,\nxennet_fill_frags() returns an error and xennet_poll() jumps to its\nerror path. That path moves what\u0027s left on tmpq to errq to be freed,\nbut the skb being filled was already dequeued from tmpq, so it\u0027s never\nfreed. Each chain that overflows leaks the skb and the pages attached\nto it as frags, and the backend decides how many slots it sends.\n\nPut the skb back on tmpq before taking the error path, like the\nxennet_set_skb_gso() failure just above it does.\n\nFixes: ad4f15dc2c70 (\"xen/netfront: don\u0027t bug in case of too many frags\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Juergen Gross \u003cjgross@suse.com\u003e\nLink: https://patch.msgid.link/20261007-b4-xen-netfront-fill-frags-leak-v1-1-a8a01ff9cd52@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "513e23857a3a64fa73a1deb36a385eecd4ad7690", "tree": "0d0789ca9e6c5b4ef999c134bdb122e6c3dda182", "parents": [ "089e58805c452e52179482b1025a8e309a57f801" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Wed Oct 07 13:57:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:59:20 2026 -0700" }, "message": "net/packet: call packet_parse_headers after virtio_net_hdr_to_skb\n\nSOCK_RAW packet sockets incorrectly drop VLAN-tagged GSO packets\nwithout VIRTIO_NET_HDR_F_NEEDS_CSUM.\n\npacket_parse_headers() sets skb-\u003eprotocol to VLAN but advances\nskb-\u003enetwork_header past the VLAN tags. virtio_net_hdr_to_skb()\nthen flow dissects these packets, which parses the network header as a\nVLAN tag, and fails.\n\nCall packet_parse_headers() after virtio_net_hdr_to_skb() instead.\n\nThis matches tun_get_user() and tap_get_user() and thus simplifies\noverall complexity.\n\nCommit 01fdecc0480d (\"net: packet: fix wrong transport_header when\nsending VLAN-tagged frame\") fixed the same issue for the transport\nheader probe in packet_parse_headers(). That probe is now skipped if\nvirtio_net_hdr_to_skb() already set the transport header, avoiding a\nredundant dissection.\n\nImplementation details:\n- Do not set skb-\u003eprotocol to the RX wildcard ETH_P_ALL. SOCK_RAW then\n derives it from the link layer header, as before. SOCK_DGRAM now\n leaves it 0, or derives it from gso_type for GSO with NEEDS_CSUM.\n- Keep virtio_net_hdr_set_proto() last, so that the link layer protocol\n takes priority over gso_type.\n\nReported-by: Junnan Zhang \u003czhangjn_dev@163.com\u003e\nCloses: https://lore.kernel.org/netdev/20260821085722.24036-1-zhangjn_dev@163.com/\nFixes: dfed913e8b55 (\"net/af_packet: add VLAN support for AF_PACKET SOCK_RAW GSO\")\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261007175816.3138556-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "089e58805c452e52179482b1025a8e309a57f801", "tree": "f6cf606daeb9b15d84270c04ac3ec22fa3dbc0ff", "parents": [ "ab9414ed70bd783e902a85c350620dee269bcb2b" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:55:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:58:31 2026 -0700" }, "message": "xen/netfront: drop RX packets with a short Ethernet header\n\nhandle_incoming_queue() pulls pull_to bytes into the head before\ncalling eth_type_trans(). pull_to is the length of the first RX slot,\ncapped at RX_COPY_THRESHOLD, and that length comes from the backend.\nNothing checks it against ETH_HLEN.\n\nIf the first slot is shorter than ETH_HLEN and more slots follow, the\nhead ends up shorter than an Ethernet header while skb-\u003elen is longer,\nand eth_type_trans() BUG()s in __skb_pull(). If the whole packet is\nshorter than ETH_HLEN, eth_type_trans() reads the header past the end\nof the data instead.\n\nPull at least ETH_HLEN, and drop the packet if that fails, which also\ndrops packets too short to hold an Ethernet header. This also checks\nthe return value of the pull, which was ignored.\n\nFixes: 0d160211965b (\"xen: add virtual network device driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nLink: https://patch.msgid.link/20261007-b4-xen-netfront-short-head-v1-1-12d7113a7e4e@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab9414ed70bd783e902a85c350620dee269bcb2b", "tree": "af7cabc8b5b64cb4b88c52dc191be184822f64e0", "parents": [ "2b82e16d6084cbc651e3c902198f1945408ee1a5" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Wed Oct 07 17:29:34 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:57:41 2026 -0700" }, "message": "net: skbuff: don\u0027t leave stale bytes in skb_copy_and_csum_bits()\n\nWhen skb_copy_and_csum_bits() reaches unreadable frags it returns 0\nafter copying only the linear part, and the rest of the caller\u0027s buffer\nis left as it was. The callers copy into a buffer that is about to go\nout on the wire: an ICMP error quoting the offending packet, or a\ndriver\u0027s TX bounce buffer in skb_copy_and_csum_dev(). Neither buffer\nis zeroed beforehand, so whatever was in memory there gets sent.\n\nZero the part of the buffer we didn\u0027t fill. The checksum usually\nwon\u0027t match the data any more, so the receiver will usually drop the\npacket, but either way it no longer carries anything it shouldn\u0027t.\nOnly zero for a positive @len, a negative one from a broken caller must\nnot turn into a huge memset().\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nCc: stable@vger.kernel.org\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20261007-b4-skb-copy-csum-stale-bytes-v1-1-adbbde033fb3@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b82e16d6084cbc651e3c902198f1945408ee1a5", "tree": "0b6ccf6751194935d32a27c89f8c67389e1bcf5d", "parents": [ "ff6f5157e034f81c2d6482259fc656cd0fe5a8ff" ], "author": { "name": "Daniel Machon", "email": "daniel.machon@microchip.com", "time": "Wed Oct 07 17:03:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:55:23 2026 -0700" }, "message": "net: sparx5: free the matchall entry on destroy\n\nsparx5_tc_matchall_replace() allocates a struct sparx5_mall_entry for\nevery offloaded matchall filter and adds it to sparx5-\u003emall_entries.\nsparx5_tc_matchall_destroy() removes the entry from the list, but never\nfrees it, so the entry of every deleted mirror and goto matchall filter\nis leaked.\n\nFree the entry after unlinking it.\n\nThe leak was discovered by an AI code review agent, and reproduced with\nkmemleak on a lan969x EV board (EV23X71A) by repeatedly adding and\ndeleting matchall mirror and goto filters. With the fix, kmemleak no\nlonger reports the leak.\n\nCc: stable@vger.kernel.org\nFixes: 1ede4acf045c (\"net: sparx5: add bookkeeping code for matchall rules\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261007-sparx5-matchall-kfree-net-v1-1-c8918685b337@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff6f5157e034f81c2d6482259fc656cd0fe5a8ff", "tree": "829db06971b3900b274aa125a0883e57b911effe", "parents": [ "fc13ba44da197a186f2f4d77c5b7d73d0f99f053", "71198b59df56a9a0115115091cc1aad2a4e3c74d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:26 2026 -0700" }, "message": "Merge branch \u0027mlxsw-fix-port-range-register-leak\u0027\n\nPetr Machata says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlxsw: Fix port range register leak\n\nWhen the mlxsw driver parses a port range template rule, it acquires the\nactual port range registers. The parsing is only done to determine the\nelement usage, so the registers can be deallocated right away, but this is\nnever done, and the registers are leaked. Plug this leak and add a selftest\nthat would have caught it.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "71198b59df56a9a0115115091cc1aad2a4e3c74d", "tree": "829db06971b3900b274aa125a0883e57b911effe", "parents": [ "7ea07afb230f1342ab0f9365edd0aae137f425d3" ], "author": { "name": "Petr Machata", "email": "petrm@nvidia.com", "time": "Tue Oct 06 16:21:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:24 2026 -0700" }, "message": "selftests: mlxsw: Test port range occupancy on template create\n\nAdd a test that creates a tc chain template matching on both source and\ndestination port ranges and verifies via devlink-resource occupancy that\nthis does not leak port range registers, neither while the template\nexists nor after it is deleted.\n\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/e7b37b80adb7ac8b0ef20a22d7654a6656c1c545.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7ea07afb230f1342ab0f9365edd0aae137f425d3", "tree": "db69eb17befeba65b705f492a2741fdb7f628120", "parents": [ "fc13ba44da197a186f2f4d77c5b7d73d0f99f053" ], "author": { "name": "Petr Machata", "email": "petrm@nvidia.com", "time": "Tue Oct 06 16:21:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:49:24 2026 -0700" }, "message": "mlxsw: spectrum_flower: Fix port range register leak in tmplt_create()\n\nmlxsw_sp_flower_tmplt_create() parses a flow_cls_offload template\ninto a stack-local struct mlxsw_sp_acl_rule_info purely to compute\nrulei.values.elusage. Parsing can acquire port range registers via\nmlxsw_sp_flower_parse_ports_range(), but since this rulei never goes\nthrough mlxsw_sp_acl_rulei_destroy(), those registers were never\nreleased, including through chain template deletion.\n\nFactor out of mlxsw_sp_acl_rulei_destroy() the code to actually\nrelease the necessary resources and call from\nmlxsw_sp_flower_tmplt_create() to plug the leak.\n\nThe issue was found during a review of Wentao Liang\u0027s patch referenced\nbelow.\n\nFixes: fe22f7410527 (\"mlxsw: spectrum_flower: Add ability to match on port ranges\")\nReported-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nCloses: https://lore.kernel.org/netdev/20260917113236.2149095-1-vulab@iscas.ac.cn/\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/95339cf970ce78e1a74aa86ffcc104ecf7c7762c.1791294384.git.petrm@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fc13ba44da197a186f2f4d77c5b7d73d0f99f053", "tree": "34babcea535b1596fa74dfa8a282074450f4b0fb", "parents": [ "b056ca4d3742d0769f91137bb1ce3215428398f7" ], "author": { "name": "Sebastien Royen", "email": "sebastien.royen@armadeus.com", "time": "Wed Oct 07 10:05:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:48:00 2026 -0700" }, "message": "net: dsa: microchip: fix KSZ8765 fiber detection\n\nThe KSZ8765 is similar to the KSZ8795 but has two fiber ports.\n\nKSZ8_PORT_STATUS_0 is used to detect fiber mode. It is currently\ndefined as 0x08, which is the Global Control 6 MIB Control register\nand has bit 7 defined as Flush Counter.\n\nSet KSZ8_PORT_STATUS_0 to 0x18, which is the Port 1 Status 0 register\nwhere bit 7 is the Fiber Mode bit.\n\nThis issue was discovered when upgrading an embedded device from kernel\n5.10 to 6.16. The device was using a KSZ8765 device tree configuration\nand the corresponding hardware, but during boot the kernel incorrectly\ndetected it as a KSZ8795. The relevant boot messages were:\n\n ksz-switch spi0.0: found switch: KSZ8795, rev 0\n ksz-switch spi0.0: Device tree specifies chip KSZ8765 but found KSZ8795, please fix it!\n\nCc: stable@vger.kernel.org\nFixes: 91a98917a883 (\"net: dsa: microchip: move switch chip_id detection to ksz_common\")\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Sebastien Royen \u003csebastien.royen@armadeus.com\u003e\nLink: https://patch.msgid.link/20261007080557.15719-1-sebastien.royen@armadeus.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b056ca4d3742d0769f91137bb1ce3215428398f7", "tree": "9c0c42b1bbfa6218f34ee241a308774b4b4f1893", "parents": [ "726be6a0e81ac603b34a5953623bb39c86cf495a" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Tue Oct 06 13:58:20 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:44:21 2026 -0700" }, "message": "net/mlx5e: Order ICOSQ cc update after CQ doorbell\n\nmlx5e_poll_ico_cq() requires sq-\u003ecc to be updated only after\nmlx5_cqwq_update_db_record(), otherwise a CQ overrun may occur.\n\nThe current implementation updates sq-\u003ecc before the CQ doorbell\nrecord, violating this ordering requirement.\n\nUpdate the CQ doorbell record first and use dma_wmb() before updating\nsq-\u003ecc. This ensures that the CQ space is released to the device\nbefore the corresponding ICOSQ consumer index is updated by software.\n\nFixes: fd9b4be8002c (\"net/mlx5e: RX, Support multiple outstanding UMR posts\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261006105820.257208-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "726be6a0e81ac603b34a5953623bb39c86cf495a", "tree": "58fb22832e85b7cb5810bd85aed5f9a6039c5a96", "parents": [ "259c4a519100e9182f264f8009ee212b32774277", "c017800af5c71ebb2e6209eebf5c60c19850ffe7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:16 2026 -0700" }, "message": "Merge branch \u0027veth-fix-peer-netdev_xdp_act_ndo_xmit-after-gro-is-toggled-while-down\u0027\n\nTianyi Gao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nveth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down\n\nToggling GRO on a veth device while it is down leaves its peer\u0027s\nNETDEV_XDP_ACT_NDO_XMIT flag stale once the device comes up. XDP\nredirects into the peer are then rejected with -EOPNOTSUPP, or, if GRO\nwas turned off, accepted and then dropped with -ENXIO. Patch 1 refreshes\nthe peer\u0027s flags in veth_open().\n\nPatch 2 extends veth.sh to check the peer\u0027s flag after GRO is toggled\nwhile the device is down, in both directions.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261006173241.65945-1-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c017800af5c71ebb2e6209eebf5c60c19850ffe7", "tree": "58fb22832e85b7cb5810bd85aed5f9a6039c5a96", "parents": [ "3f090039995f609a8e236f37980dee5712dded61" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Tue Oct 06 18:32:37 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:14 2026 -0700" }, "message": "selftests: net: veth: test peer ndo-xmit after GRO toggle while down\n\nTest that toggling GRO on a veth device while it is down updates the\npeer\u0027s ndo-xmit XDP feature once the device comes up, for both GRO on\nand GRO off.\n\nxdp-features is only visible through netlink, so read it with the ynl\nCLI, as double_udp_encap.sh does. Skip the checks if the CLI is not\nfound, as in an installed kselftest tree.\n\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nLink: https://patch.msgid.link/20261006173241.65945-3-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3f090039995f609a8e236f37980dee5712dded61", "tree": "019fc6b48dcedd012a5a021d57a1eae059f3394a", "parents": [ "259c4a519100e9182f264f8009ee212b32774277" ], "author": { "name": "Tianyi Gao", "email": "tianyi@cloudflare.com", "time": "Tue Oct 06 18:32:36 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:43:13 2026 -0700" }, "message": "veth: fix peer NETDEV_XDP_ACT_NDO_XMIT after GRO is toggled while down\n\nA veth device advertises NETDEV_XDP_ACT_NDO_XMIT only if its peer has an\nXDP program attached or GRO enabled, that is, only if the peer will have\nNAPI to receive the frames.\n\nveth_set_features() updates the peer\u0027s flag when GRO is toggled, but\nreturns early if the device is down, and veth_open() only refreshes the\nflags of the device being opened. Toggling GRO while the device is down\ntherefore leaves the peer\u0027s flag stale after the device comes up.\n\nIf GRO was enabled while down, the device comes up with NAPI but the\npeer does not advertise NDO_XMIT, and devmap rejects redirects to the\npeer with -EOPNOTSUPP. If GRO was disabled while down, the device comes\nup without NAPI but the peer still advertises NDO_XMIT, so redirects are\naccepted and then dropped in veth_xdp_xmit() with -ENXIO.\n\nCommit 7a6102aa6df0 (\"veth: Update XDP feature set when bringing up\ndevice\") made veth_open() refresh the device\u0027s own flags. Refresh the\npeer\u0027s flags there too. The peer\u0027s flag depends on this device\u0027s XDP\nprogram and GRO setting, not on whether the peer is up, so it is\ncorrect to set it even if the peer is down.\n\nFixes: 8267fc71abb2 (\"veth: take into account peer device for NETDEV_XDP_ACT_NDO_XMIT xdp_features flag\")\nSigned-off-by: Tianyi Gao \u003ctianyi@cloudflare.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261006173241.65945-2-tianyi@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "259c4a519100e9182f264f8009ee212b32774277", "tree": "b956a3611e9e908bc9f76445f9841da7ee451491", "parents": [ "6d25ffca055a77787c21a36b66c253f76239411b" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Fri Oct 02 21:36:47 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 08 10:42:03 2026 -0700" }, "message": "net: mana: reserve RX buffer headroom to fix forwarding performance\n\nCommit 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers\ninstead of full pages to improve memory efficiency.\") started handing\nout RX buffers with zero headroom so that two buffers fit into one page\nat the default MTU.\n\nThe MANA TX path, however, stores the per scatter-gather entry DMA\nmappings in `struct mana_skb_head` at skb-\u003ehead, and mana_start_xmit()\ntherefore calls skb_cow_head(skb, MANA_HEADROOM). The port advertises\nthis requirement as ndev-\u003eneeded_headroom \u003d MANA_HEADROOM.\n\nAs a result every packet that is received and then forwarded out of a\nMANA port fails the skb_cow() in ip_forward() and gets reallocated and\ncopied by pskb_expand_head(). This is invisible to a plain RX or TX\nworkload, but it puts a full skb reallocation plus memcpy on the hot\npath of every single forwarded packet, which is exactly what a\nrouter/NVA workload does.\n\nRestore the headroom. Note that reserving MANA_HEADROOM (232) is not\nenough: ip_forward() asks for LL_RESERVED_SPACE(dev), which rounds\nhard_header_len + needed_headroom up to HH_DATA_MOD and is 256 bytes on\nethernet. Use LL_RESERVED_SPACE() directly so the value keeps tracking\nboth constants. Also, since LL_RESERVED_SPACE() tracks MANA_HEADROOM,\nit grows with MAX_SKB_FRAGS and for MAX_SKB_FRAGS \u003e\u003d 19 it is greater\nthan 256, so we have to account for that by using the headroom the RX\nqueue actually uses (instead of assuming XDP_PACKET_HEADROOM) and\nturning MANA_XDP_MTU_MAX into MANA_XDP_MTU_MAX(ndev) (note that at the\ndefault CONFIG_MAX_SKB_FRAGS\u003d17 they are equivalent).\n\nAt the default MTU on a 4K page this means a buffer no longer fits twice\ninto a page (SKB_DATA_ALIGN(1500 + MANA_RXBUF_PAD + 256) \u003d 2112), so the\nfrag-vs-single decision is now made by computing the real buffer size\ninstead of comparing the MTU against PAGE_SIZE / 2. The page_pool\nfragment path is still used wherever at least two buffers genuinely fit,\ne.g. on 16K and 64K page sizes.\n\nMeasured on an Azure VM with a MANA NIC acting as a forwarding NVA (UDP,\n1400 byte payload, 4 streams, 8 Gbps offered, only the forwarding\nnode\u0027s kernel differs), 8 runs each, median:\n\n forwarded pps throughput\n before 272,830 3.06 Gbps\n after 390,560 4.37 Gbps (+43%)\n\nperf on the forwarding node, same workload:\n\n memset_orig __pi_memcpy pskb_expand_head\n before 10.07% 3.96% present\n after 0.94% 0.64% gone\n\nCc: stable@vger.kernel.org\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261003013647.2051416-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c377d19d4a5116d9bec5203aa3c6c11523e7898", "tree": "aaf86020951b9694b463c98d164c3fa8757e8b38", "parents": [ "47324d3a5b3abd781295044d01d92d09f184e872", "3e78d7b063230d39ffc42e80ee665b6c32a6adeb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 17:37:49 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 17:37:49 2026 +0200" }, "message": "Merge tag \u0027ext4_for_linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4\n\nPull ext4 fixes from Ted Ts\u0027o:\n \"Mark the ext4 data\u003djournal feature as being deprecated and will be\n removed in 2028.\n\n Also designate the primary branch that Sashiko and other tools use to\n find the primary development branch in the ext4 tree\"\n\n* tag \u0027ext4_for_linus-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tytso/ext4:\n ext4: mark data\u003djournal as deprecated and will be removed in January 2028.\n MAINTAINERS: name the ext4 dev branch\n" }, { "commit": "3e78d7b063230d39ffc42e80ee665b6c32a6adeb", "tree": "d39b5cad1df500d5fe99c6eba2e87534d3f10324", "parents": [ "4b1d04693e5ef388d8c6110bc93ee0d0681f9711" ], "author": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Sep 24 10:58:12 2026 -0400" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Oct 08 11:21:30 2026 -0400" }, "message": "ext4: mark data\u003djournal as deprecated and will be removed in January 2028.\n\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "4b1d04693e5ef388d8c6110bc93ee0d0681f9711", "tree": "355d11ba4ab560ebf76a0c73419a1ffceaefeb2d", "parents": [ "93f51579e7df248780214094418f205253383cc5" ], "author": { "name": "Matthias Goergens", "email": "matthias.goergens@gmail.com", "time": "Wed Sep 23 18:17:49 2026 +0800" }, "committer": { "name": "Theodore Ts\u0027o", "email": "tytso@mit.edu", "time": "Thu Oct 08 11:21:30 2026 -0400" }, "message": "MAINTAINERS: name the ext4 dev branch\n\nThe ext4 T: entry names the repository without a branch, so tools that\ndefault to the repository\u0027s HEAD select master, which still points at a\nmerge from October 2020 (96485e446260). Development happens on dev,\nwhich is also the branch linux-next merges. Name it.\n\nThe Sashiko review bot, for one, falls back to HEAD this way and has\nbeen reviewing ext4 patches against that tree. Its review of an EA\ninode refcount fix reported a Critical double decrement and an\nundefined function after applying the patch to that stale baseline;\nneither holds on dev.\n\nLink: https://lore.kernel.org/all/20260916072420.316321F000FF@smtp.kernel.org/\nSigned-off-by: Matthias Goergens \u003cmatthias.goergens@gmail.com\u003e\nAcked-by: Jan Kara \u003cjack@suse.cz\u003e\nLink: https://patch.msgid.link/20260923101749.3505886-1-matthias.goergens@gmail.com\nSigned-off-by: Theodore Ts\u0027o \u003ctytso@mit.edu\u003e\n" }, { "commit": "47324d3a5b3abd781295044d01d92d09f184e872", "tree": "4c9fa5b31d3b63ede60685727a04290b9e30dd1f", "parents": [ "156c9ca041377f9ffa5967c7debc5fd0f667d395", "0d6c5794fd633427f0d4ad8b51d94061295649da" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:35:07 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:35:07 2026 +0200" }, "message": "Merge tag \u0027pwrseq-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull power sequencing fixes from Bartosz Golaszewski:\n\n - add missing PCI device IDs for Thinkpad T14s gen6 which should have\n been part of commit a39ac4651e3b (\"power: sequencing: pcie-m2: Match\n WCN6855 and WCN7851 UART BT variants by subdevice ID\") in\n pwrseq-pcie-m2\n\n - fix memory leak in pwrseq-pcie-m2 (leaking the array returned by\n of_regulator_bulk_get_all())\n\n* tag \u0027pwrseq-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n power: sequencing: pcie-m2: Fix leaking array from of_regulator_bulk_get_all()\n power: sequencing: pcie-m2: Add Lenovo ThinkPad T14s gen6 WCN7850 subsystem PCI ids\n" }, { "commit": "156c9ca041377f9ffa5967c7debc5fd0f667d395", "tree": "3ab1f74ab3a8d4bec253a241843afe0d9d62c572", "parents": [ "b732c98215831db36eff1cbbcd0df2f98b765f4e", "7efa1a1953cd6b20b23a3524d5b4b81789c6ef25" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:33:05 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 13:33:05 2026 +0200" }, "message": "Merge tag \u0027gpio-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux\n\nPull gpio fixes from Bartosz Golaszewski:\n\n - fix runtime PM leak in error path in gpio-xilinx\n\n - fix race when arming the IRQ poll worker in gpio-mpsse\n\n - fix devres cleanup path on probe error in gpio-exar\n\n* tag \u0027gpio-fixes-for-v7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/brgl/linux:\n gpio: mpsse: fix race when arming the IRQ poll worker\n gpio: exar: initialize the ID before registering its cleanup\n gpio: xilinx: fix runtime PM leak on request error path\n" }, { "commit": "b732c98215831db36eff1cbbcd0df2f98b765f4e", "tree": "e9a30d3dd21a271a8e29acd0d4f0b6e5c10d0397", "parents": [ "0c2669a9f4a1d607e7591ae50ccf3c432a0aff08", "80ce29104123be4d61b5912dae543c70af0fcb75" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 12:35:20 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 12:35:20 2026 +0200" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-10-07-21-48\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - Update .mailmap entries for Andy Yan and John Garry\n\n - Fix read-only MAP_SHARED /dev/zero mappings so they retain\n shared-file semantics instead of being treated as anonymous memory,\n also avoiding a CONFIG_DEBUG_VM assertion\n\n - Fix 32-bit build warnings in the hugetlb-mmap selftest caused by\n using the wrong printf format for size_t values\n\n - Fix a boot-time crash when early function tracing causes CPA to free\n kernel page tables before the workqueues used for deferred freeing\n are available\n\n - Fix two MREMAP_DONTUNMAP locked_vm accounting leaks: one caused by\n an mlock-on-fault VMA self-merging, and one caused by partially\n remapping a locked VMA\n\n* tag \u0027mm-hotfixes-stable-2026-10-07-21-48\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mailmap: update entry for Andy Yan\n drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly\n selftests/mm: cleanup -Wformat issues in hugetlb-mmap\n mm: don\u0027t schedule deferred kernel page table freeing while booting\n mailmap: update addresses for John Garry\n mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP\n mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge\n" }, { "commit": "0c2669a9f4a1d607e7591ae50ccf3c432a0aff08", "tree": "5fbe07899ae22662b7f05d4af23c32595180a3a0", "parents": [ "8fc6e594884a65ec99c78ad05e7fae110ad714d9", "1fc2d80928b706147e371602dabd0ba927dfe4a3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:44:07 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:44:07 2026 +0200" }, "message": "Merge tag \u0027soc-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc\n\nPull SoC fixes from Arnd Bergmann:\n\n - Four distinct issues in TEE firmware, all fairly minor\n\n - Five devicetree mistakes on NXP i.MX8, lx2160a and Qualcomm\n based machines, one of these may cause file system corruption\n from an incorrect SD card supply voltage\n\n - Five fixes for clk drivers on new Qualcomm platforms,\n addressing issues with incorrect enable states\n\n* tag \u0027soc-fixes-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc:\n MAINTAINERS: update my email address\n tee: optee: ffa: support shared memory offsets on large-page kernels\n optee: register TEE devices only once fully initialized\n tee: shm: reject zero-sized allocations in tee_dyn_shm_alloc_helper()\n arm64: dts: imx8mp-var-dart-sonata: Fix Sonata SD I/O supply\n arm64: dts: lx2160a: fix the iic5 spi3 pinmux offset and value\n arm64: dts: lx2160a: fix IIC1 pinmux submask rejected by pinctrl-single\n arm64: dts: lx2160a: fix incorrect pinmux\n clk: qcom: gpucc-kaanapali: Mark the GPU CX GDSC as votable\n clk: qcom: gpucc-glymur: Mark the GPU CX GDSC as votable\n clk: qcom: gcc-kaanapali: Fix always-enabling PCIE_RSCC clocks\n clk: qcom: gcc-hawi: Fix always-enabling PCIE_RSCC clocks\n clk: qcom: gcc-eliza: Fix always-enabling PCIE_RSCC clocks\n arm64: dts: qcom: x1-denali: Fix microphone distortion\n tee: qcomtee: fix kernel-doc warnings\n" }, { "commit": "8fc6e594884a65ec99c78ad05e7fae110ad714d9", "tree": "92949a925fa4fbb5ed0f43c9ff0a248f0a94a689", "parents": [ "4cc6bbaeb3afe9166380eccd8d166d2dd75c0278", "cfb3293c4573289f11f913611f530ea6b1926d67" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:36:57 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:36:57 2026 +0200" }, "message": "Merge tag \u0027usb-mtu3.2026.10.06a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu\n\nPull tracing fix from Paul McKenney:\n \"Fix a double-dereference splat in TP_printk in usb mtu3. This was a\n pre-existing bug that can corrupt tracing output, but which was\n exposed this cycle by additional checking that was added to the\n tracing subsystem.\n\n This splat is reporting a double-dereference that can result in\n garbage traces being dumped due to the possibility of the TP_printk()\n being executed without the benefit of main memory being present.\n\n The fix is to move the extra dereference from TP_printk() time to\n TP_fast_assign() time\"\n\n* tag \u0027usb-mtu3.2026.10.06a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/paulmck/linux-rcu:\n usb: mtu3: Fix double dereference in TP_printk\n" }, { "commit": "4cc6bbaeb3afe9166380eccd8d166d2dd75c0278", "tree": "8826673106a0aea9dcc25ef351aa72b64c13a072", "parents": [ "7b63ef2d55f24519e7e9e5f4d15dbea03f126e40", "26f90559a77cac4b8fdfa3491732b7c7e08210ac" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:30:50 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 08 06:30:50 2026 +0200" }, "message": "Merge tag \u0027urgent.2026.10.01a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux\n\nPull RCU fix from Paul McKenney:\n \"Fix spurious WARN_ON() for rcu_segcblist_n_cbs() in\n cleanup_srcu_struct()\n\n This issue was introduced by 78a38cbf6f20 (\"srcu: Queue\n sdp-\u003ework when the delay timer is successfully deleted\")\n during this merge window.\n\n Enough people are hitting this that I am sending it now\n rather than waiting for the next merge window. Especially\n given that it is a simple one-liner\"\n\n* tag \u0027urgent.2026.10.01a\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rcu/linux:\n srcu: Fix WARN_ON() for rcu_segcblist_n_cbs() in cleanup_srcu_struct()\n" }, { "commit": "6d25ffca055a77787c21a36b66c253f76239411b", "tree": "c00da6c861729f69f6265eb7f99d0ab59573303f", "parents": [ "c57b2e60d4bf29707c51b39ed3bacbcce2f3ba2e" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Tue Oct 06 12:51:08 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:17:52 2026 -0700" }, "message": "cipso: adjust cached option offsets when removing CIPSO\n\ncipso_v4_skbuff_delattr() removes the CIPSO bytes but does not adjust\ncached offsets for options that follow them.\n\nFor example, with a valid 10-byte CIPSO option followed by a seven-byte\nRR option, parsing records rr at offset 30. Removing CIPSO moves RR to\noffset 20, while the cached offset remains 30. Consumers such as\nip_forward_options() and __ip_options_echo() then access the wrong bytes;\nthe latter may interpret packet data as the option length and copy it into\nfixed-size option storage.\n\nMirror cipso_v4_delopt() and subtract cipso_len from the srr, rr, ts and\nrouter_alert offsets when they follow CIPSO. cipso_len is the distance\nthe first memmove() shifts those options. The later header move and\nnetwork-header reset relocate the bytes and their offset base together.\n\nFixes: 89aa3619d141 (\"cipso: make cipso_v4_skbuff_delattr() fully remove the CIPSO options\")\nCc: stable@vger.kernel.org\nReviewed-by: Ondrej Mosnáček \u003comosnacek@gmail.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nAcked-by: Paul Moore \u003cpaul@paul-moore.com\u003e\nLink: https://patch.msgid.link/20261006035108.3101440-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c57b2e60d4bf29707c51b39ed3bacbcce2f3ba2e", "tree": "45a326abe9435960c33833e666b85332b5138787", "parents": [ "1d6500523b8d5112afe0118173ebc8c1ca23784e" ], "author": { "name": "Haishuang Yan", "email": "yanhaishuang@cmss.chinamobile.com", "time": "Fri Oct 02 23:30:39 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:15:08 2026 -0700" }, "message": "bareudp: set the inner protocol to the protocol of the packet\n\nbareudp_xmit_skb() sets the inner protocol of the skb to the configured\nethertype, and bareudp6_xmit_skb() does not set it at all. The inner\nprotocol is used by skb_udp_tunnel_segment() to segment the inner packet\nwhen GSO has to be done in software, for instance when the lower device\ndoes not offload the checksum.\n\nWith multiproto, an IPv4 device also carries IPv6, so the IPv6 header\nis parsed as an IPv4 one. With IPv6 underlay, the inner protocol is\nwhatever the skb had before. In both cases segmentation fails and the\npackets are dropped. With veth tx checksum offload disabled, iperf3 TCP\nover bareudp gets about 10 Mbit/s with thousands of retransmits instead\nof about 700 Mbit/s for IPv6 over IPv4 and for both families over IPv6,\nwhile IPv4 over IPv4 works.\n\nAt this point skb-\u003eprotocol is the protocol of the inner packet, which\nbareudp_xmit() has already checked against the configuration, so use it\non both paths.\n\nFixes: 571912c69f0e (\"net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.\")\nFixes: 4b5f67232d95 (\"net: Special handling for IP \u0026 MPLS.\")\nSigned-off-by: Haishuang Yan \u003cyanhaishuang@cmss.chinamobile.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261002153039.462663-1-yanhaishuang@cmss.chinamobile.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d6500523b8d5112afe0118173ebc8c1ca23784e", "tree": "80bb7a68882473ee671e4db59605c57ef565e1b4", "parents": [ "f202578efc738b883cfa04889eb97328914265a7" ], "author": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Thu Oct 01 15:24:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 19:00:32 2026 -0700" }, "message": "e1000e: add system to disable K1 list\n\nJavier reports seeing packet loss issues related to the re-enablement\nof K1; disabling it makes the issues go away. Add the reported system\nto have K1 disabled by default.\n\nReproduction steps (from the Link):\nPlug the cable and ping the default gateway on the LAN. No suspend/resume\ninvolved, machine freshly booted and on AC power. Nothing e1000e-related in\ndmesg apart from the link up/down messages; no \"Hardware Unit Hang\".\n\nDefault (K1 enabled):\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 18 received, 40% packet loss, time 29734ms\n rtt min/avg/max/mdev \u003d 0.211/0.315/0.384/0.046 ms\n\nThe lost packets are spread over the run (seq 6, 8, 9, 11, 13, 14, 16, 19,\n20, 24, 25, 30), not a single burst. DHCP on this link also takes 1-2\nminutes to get a lease, consistent with incoming packets being dropped.\n\nWith K1 disabled at runtime:\n\n # ethtool --set-priv-flags enp0s31f6 disable-k1 on\n $ ethtool --show-priv-flags enp0s31f6\n Private flags for enp0s31f6:\n s0ix-enabled: on\n disable-k1 : on\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 30 received, 0% packet loss, time 29713ms\n rtt min/avg/max/mdev \u003d 0.169/0.251/0.468/0.054 ms\n\n $ ping -c 30 192.168.10.1\n --- 192.168.10.1 ping statistics ---\n 30 packets transmitted, 30 received, 0% packet loss, time 29677ms\n rtt min/avg/max/mdev \u003d 0.101/0.222/0.360/0.064 ms\n\nI have only compile tested this, but Javier has tested that disabling K1\non his system (Lenovo ThinkPad P14s Gen 5 (Intel), I219-LM [8086:550a])\nresolves his issues.\n\nCc: stable@vger.kernel.org\nFixes: 578294b8b60d (\"e1000e: Reconfigure PLL clock gate timeout and re-enable K1 on Meteor Lake\")\nReported-by: Javier Herrera \u003cjavier.herrera@afronta.com\u003e\nLink: https://lore.kernel.org/intel-wired-lan/CAKRuCQLWEcci9hPgNUmvq44Bd2H30T5_vP\u003dexMjsknXMN5Yh9A@mail.gmail.com/\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20261001222443.3500206-7-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f202578efc738b883cfa04889eb97328914265a7", "tree": "7592c5928610fd78eee15e095de89a1c2c0a6a41", "parents": [ "a51d233ccd4889aadb71dace863525cc2b00271e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 07 06:56:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:57:04 2026 -0700" }, "message": "flow_dissector: avoid u16 truncation of hlen in bpf_flow_dissect()\n\nbpf_flow_dissect() sanitizes the offsets returned by the BPF program\nwith clamp_t(u16, ..., hlen).\n\nIf hlen is bigger than 65535, the upper bound is truncated before\nthe comparison. For instance, with hlen \u003d\u003d 65536, both nhoff and\nthoff are forced to zero, even if the program returned sane values.\n\nThis is the same class of bug as the one fixed in commit 99bda1ecbd56\n(\"flow_dissector: avoid u16 truncation of skb-\u003elen when computing\nthoff\"). That fix does not cover the BPF path, because\n__skb_flow_dissect() returns early when a BPF flow dissector\nhandles the packet.\n\nstruct bpf_flow_keys stores nhoff and thoff as u16, so cap hlen\nto U16_MAX before clamping.\n\nFound by sashiko while reviewing the commit above.\n\nFixes: d58e468b1112 (\"flow_dissector: implements flow dissector BPF hook\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261007045616.445596-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a51d233ccd4889aadb71dace863525cc2b00271e", "tree": "a3ccc2624764af44cb554a17afecbb4621ae3c91", "parents": [ "7fadfc8dc63fe77b3a2dd1e023915f6fad7efdac" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 07 07:17:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:53:31 2026 -0700" }, "message": "bnxt_en: fix DMA mapping length for padded small packets\n\nStefan Fleischmann reported Intel IOMMU DMA Read faults on BCM57412\nNetXtreme-E NICs when transmitting packets on VLAN/macvlan interfaces:\n\n DMAR: [DMA Read NO_PASID] Request device [18:00.0] fault addr 0xfc499000\n [fault reason 0x06] PTE Read access is not set\n bnxt_en 0000:18:00.0 eno1np0: Abandoning msg {0xb4 0x41a} len: 0 due to firmware status: 0x2000001\n ...\n NETDEV WATCHDOG: eno1np0 (bnxt_en): transmit queue 0 timed out\n\nThe fault address (0xfc499000) is on an exact 4KB page boundary,\npointing to a DMA read buffer overrun.\n\nIn bnxt_start_xmit(), packets smaller than BNXT_MIN_PKT_SIZE (52 bytes),\nsuch as 42-byte untagged ARP frames, are padded:\n\n if (length \u003c BNXT_MIN_PKT_SIZE) {\n pad \u003d BNXT_MIN_PKT_SIZE - length;\n if (skb_pad(skb, pad))\n goto tx_kick_pending;\n length \u003d BNXT_MIN_PKT_SIZE;\n }\n\n mapping \u003d dma_map_single(\u0026pdev-\u003edev, skb-\u003edata, len, DMA_TO_DEVICE);\n ...\n dma_unmap_len_set(tx_buf, len, len);\n\nHowever, \u0027len\u0027 was initialized earlier to skb_headlen(skb) (e.g. 42 bytes)\nand is left unadjusted after padding. Consequently, dma_map_single() and\ndma_unmap_len_set() map and track only 42 bytes.\n\nLater, the hardware TX buffer descriptor is programmed with the padded length:\n\n txbd-\u003etx_bd_len_flags_type \u003d\n cpu_to_le32(((len + pad) \u003c\u003c TX_BD_LEN_SHIFT) | flags |\n TX_BD_FLAGS_PACKET_END);\n\nThe NIC DMA engine is thus instructed to read 52 bytes from a region where\nonly 42 bytes were DMA-mapped. If skb-\u003edata ends near the boundary of a 4KB\npage (within \u0027pad\u0027 bytes of the next page), the hardware DMA read overruns\ninto the unmapped adjacent page, triggering an IOMMU fault.\n\nThis issue was exposed after commit 447cbe95ebb9 (\"vlan: fix skb_under_panic\nand races when toggling HW VLAN offload\") because reserving extra VLAN\nheadroom rounded LL_RESERVED_SPACE from 48 up to 64 bytes, shifting skb-\u003edata\noffsets and potentially causing small frames to land right against page\nboundaries.\n\nFix this by using skb_put_padto(skb, BNXT_MIN_PKT_SIZE) in\nbnxt_start_xmit(), before skb_shinfo(skb)-\u003enr_frags is sampled,\nbecause padding might linearize the skb.\nThis ensures skb-\u003elen and skb_headlen(skb) reflect the padded size so\nthat dma_map_single() maps the full buffer and the descriptor length is\nconsistent. This also removes the temporary \u0027pad\u0027 variable and masking logic.\n\nThe padding is done after the SW USO branch, otherwise\nbnxt_sw_udp_gso_xmit() would account the padding as UDP payload\nand send it in extra segments.\n\nNote that SW USO segments are still not padded: with IPv4, a segment\ncarrying less than 10 bytes of UDP payload (small gso_size, or a short\nlast segment) is sent as a frame shorter than BNXT_MIN_PKT_SIZE.\nThis is a separate issue, left for a followup patch.\n\nFixes: c0c050c58d84 (\"bnxt_en: New Broadcom ethernet driver.\")\nCc: stable@vger.kernel.org\nReported-by: Stefan Fleischmann \u003csfle@kth.se\u003e\nCloses: https://lore.kernel.org/netdev/20261004122616.56714cbd@nargothrond/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261007051747.455273-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7fadfc8dc63fe77b3a2dd1e023915f6fad7efdac", "tree": "a7d7e8ed2c3699b737f16fe74672e9971dd65311", "parents": [ "9b6c20f788472d2042717a3c2f1bc60b2b77083e", "2e52da27096d9dbc487f303bbc10d44ad837a8c4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:04 2026 -0700" }, "message": "Merge branch \u0027bnxt_en-pcie-flr-aer-fixes\u0027\n\nMichael Chan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbnxt_en: PCIe FLR/AER fixes\n\nThis patchset is split from the earlier 9-patch series to limit the\nfixes to the PCIe FLR/AER issues only (patches 7 to 9). The other\nfixes (patches 1 to 6) will be sent to net-next separately.\n\nThe 1st patch is unchanged since v1. It refactors a bnxt_clear_bars()\nhelper needed by patch 2 and 3. Patch 2 fixes an issue during driver\ninit. in the kdump kernel on a Dell system with a smart PCIe switch\nupstream from the NIC. Patch 3 fixes an issue in the AER code path for\nnon-fatal errors found by a partner.\n\nThese patches have been regression tested on Broadcom 5750X and 5760X\nNICs running 237.x.x.x production FW.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261005204246.3822563-1-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2e52da27096d9dbc487f303bbc10d44ad837a8c4", "tree": "a7d7e8ed2c3699b737f16fe74672e9971dd65311", "parents": [ "386f887c8290f0747dd0180e98ec7a82811bc506" ], "author": { "name": "Pavan Chebbi", "email": "pavan.chebbi@broadcom.com", "time": "Mon Oct 05 13:42:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Re-write the BARs following any type of PCIe errors\n\nCurrently the driver zeroes the BARs only when fatal PCIe errors\nare reported so that pci_restore_state() restores it. However\nfirmware handles both fatal and non-fatal errors the same way when\nit sees the slot reset resulting from the PCI_ERS_RESULT_NEED_RESET\nreturn code from the driver. This means that we must re-write the\nBARs post recovery even during non-fatal errors. Otherwise we will\nsee that every MMIO access returns all-ones and the firmware appears\ndead.\n\nZero-out the BARs during PCIe error recovery regardless of type of\nPCIe error, and make the wait after the hot reset unconditional.\n\nDisable memory decode and bus mastering before rewriting the BARs so\nthe device doesn\u0027t decode a half-updated address, bailing out if\nconfig space is still inaccessible. Defer pci_enable_device() until\nafter the BAR rewrite and restore, so the device isn\u0027t re-enabled\nwhile its BARs are still being rewritten, then re-enable the device\nand re-assert bus mastering. Guard the same Command register cleanup\non the re-enable failure path against an inaccessible device.\n\nSkip re-enabling the device in bnxt_io_slot_reset() if it is already\nenabled, so enable_cnt does not go unbalanced. A concurrent\nbnxt_fw_reset_task() can also be re-enabling the same device in its\nENABLE_DEV state, so guard that call the same way.\n\nFixes: f75d9a0aa967 (\"bnxt_en: Re-write PCI BARs after PCI fatal error.\")\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nReviewed-by: Scott Branden \u003cscott.branden@broadcom.com\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-4-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "386f887c8290f0747dd0180e98ec7a82811bc506", "tree": "fd41ece9ea3cfeac7049252d9ab35c3296410705", "parents": [ "8f5d59b9cfa69beab3b52cca621bb301c5af98aa" ], "author": { "name": "Michael Chan", "email": "michael.chan@broadcom.com", "time": "Mon Oct 05 13:42:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Fix driver init in kdump kernel\n\nFix and strengthen the FLR sequence when initializing in the kdump\nkernel. If the NIC is behind a PCIe switch in synthetic (smart)\nmode, the switch may need to see that the BARs have been initialized\nbefore it will pass mem read/write TLPs to the NIC.\n\nOn a Dell system with a PEX89144 PCIe switch, echo c \u003e /proc/sysrq-trigger\nwill trigger fatal AER without this patch:\n\nbnxt_en 0000:67:00.0: enabling device (0000 -\u003e 0002)\n[Hardware Error]: Hardware error from APEI Generic Hardware Error Source: 5\n[Hardware Error]: event severity: recoverable\n[Hardware Error]: Error 0, type: fatal\n[Hardware Error]: section_type: PCIe error\n[Hardware Error]: port_type: 5, upstream switch port\n...\n\nAdd a new bnxt_kdump_reset() to do the expanded FLR sequence in the\nkdump kernel. We now disable bus master and memory, save the PCI\nstate, do the FLR, clear the BARs, and restore the PCI state. The\nBARs have to be cleared to ensure that they get re-initialized and\nvisible to the PCIe switch.\n\nSince it is the kdump kernel, we make every effort to continue in\nthe best possible way even if pci_save_state() or pcie_flr() returns\nerror. After FLR, we poll for an additional 5 seconds before\naborting in case the device is not properly returning CRS. This is\nsimilar to the 5-second wait in bnxt_io_slot_reset().\n\nFixes: 8743db4a9acf (\"bnxt_en: Issue PCIe FLR in kdump kernel to cleanup pending DMAs.\")\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-3-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f5d59b9cfa69beab3b52cca621bb301c5af98aa", "tree": "68b05bc98787d2c7efbc3fd0f8085efd91bb7f6c", "parents": [ "9b6c20f788472d2042717a3c2f1bc60b2b77083e" ], "author": { "name": "Michael Chan", "email": "michael.chan@broadcom.com", "time": "Mon Oct 05 13:42:44 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 17:52:01 2026 -0700" }, "message": "bnxt_en: Add bnxt_clear_bars() helper\n\nIn bnxt_io_slot_reset(), we clear the 6 BAR registers. Add a helper\nfunction to do that. The helper will be used again in the next patch.\n\nReviewed-by: Kalesh AP \u003ckalesh-anakkur.purayil@broadcom.com\u003e\nReviewed-by: Somnath Kotur \u003csomnath.kotur@broadcom.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nSigned-off-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nSigned-off-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261005204246.3822563-2-michael.chan@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b6c20f788472d2042717a3c2f1bc60b2b77083e", "tree": "5ccfae91814f26b9cdd15ea9cc9acbeba9219908", "parents": [ "fd4e7f1137291c7446278a0189f8064f29b5a605" ], "author": { "name": "Fredrik Nyberg", "email": "fredrik.nyberg@volvocars.com", "time": "Fri Oct 02 14:28:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:43:50 2026 -0700" }, "message": "net: usb: ax88179_178a: fix rx frame length for non-last packets\n\nCommit 4ce62d5b2f7a (\"net: usb: ax88179_178a: stop lying about\nskb-\u003etruesize\") replaced skb_clone() with a copy into a new skb for\nevery packet of a bulk-in transfer except the last one. The copy skips\nthe 2-byte IP alignment pseudo header but still copies pkt_len bytes,\nand pkt_len includes that header. Each of these frames is therefore\ndelivered with two extra trailing bytes: the 0xeeee pseudo header of\nthe next slot when the frame ends on an 8-byte boundary, or slot\npadding otherwise. The last packet is still trimmed to pkt_len - 2.\n\nIPv4 and IPv6 trim the extra bytes, so most traffic is unaffected.\nAnything that relies on the frame length is not. MACsec takes the ICV\nfrom the last 16 bytes and drops every such frame as InPktsNotValid. In\nour setup that was 0.2-1.2% of received MACsec frames, depending on how\nmany frames shared a transfer, including service discovery multicast.\n\nAllocate and copy pkt_len - 2 bytes, like the last-packet path.\n\nFixes: 4ce62d5b2f7a (\"net: usb: ax88179_178a: stop lying about skb-\u003etruesize\")\nCc: stable@vger.kernel.org\nSigned-off-by: Fredrik Nyberg \u003cfredrik.nyberg@volvocars.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261002-ax88179-rx-len-v1-1-f01a2a295079@volvocars.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd4e7f1137291c7446278a0189f8064f29b5a605", "tree": "01d2e9fb61033ea843065412e4f135ec80a45b12", "parents": [ "23609bce9e1de525d1d0e73fc68c6e7971d0b49e", "9727d1c4e1c971fc42b049b645fdda6852758835" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:23:43 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 07 16:23:44 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-10-07\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nSome more fixes:\n - ath12k: revert broken panic handler\n - mt76: SAR/MLO/STA/NAPI fixes\n - nxpwifi: race fixes, validation\n - libertas: revert botched frame size fix\n - brcmfmac: fix crash on P2P removal\n - mac80211: fix WARN on downlink OFDMA frames\n\n* tag \u0027wireless-2026-10-07\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (25 commits)\n Revert \"wifi: libertas: reject short monitor TX frames\"\n wifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n wifi: mac80211: don\u0027t estimate airtime for unsupported rate widths\n Revert \"wifi: ath12k: add panic handler\"\n wifi: nxpwifi: do not delete Rx reorder entries under RCU\n wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion\n wifi: nxpwifi: handle authentication frame allocation failures\n wifi: nxpwifi: fix the authentication frame length handling\n wifi: nxpwifi: zero the channel statistics array\n wifi: nxpwifi: free the aggregation buffer when the RA list disappears\n wifi: nxpwifi: wait for the wakeup timer before the adapter is freed\n wifi: nxpwifi: delete the station entry on the uAP deauth event\n wifi: nxpwifi: protect sta_list against concurrent add and delete\n wifi: mt76: mt7996: fix uninitialized buf read in mt7996_variant_fem_init()\n wifi: mt76: mt792x: pick the SAR table layout from the table itself\n wifi: mt76: mt792x: treat 0xff ACPI SAR entries as no limit\n wifi: mt76: mt7603: initialize global station WCID\n wifi: mt76: mt7925: don\u0027t put the band auto marker in TGID\n wifi: mt76: mt7915: disable rx napi when removing device\n wifi: mt76: mt7996: fix struct mt7996_mcu_wed_rro_ba_delete_event layout\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261007205143.464714-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9727d1c4e1c971fc42b049b645fdda6852758835", "tree": "71beac7a870e91bf7e4bfc7e15dca7ce4b7f8fbf", "parents": [ "08a3f02fea636e97a7422d1512f76dacdb5b0887" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 22:42:08 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 22:48:10 2026 +0200" }, "message": "Revert \"wifi: libertas: reject short monitor TX frames\"\n\nThis reverts commit 13ff543e0b2c713aedeaadadde686686e949dc78.\n\nThe \u0027goto free\u0027 just made things worse, causing a spinlock\nto be handled incorrectly. Revert this for now.\n\nReported-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nCc: stable@vger.kernel.org\nFixes: 13ff543e0b2c (\"wifi: libertas: reject short monitor TX frames\")\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "7b63ef2d55f24519e7e9e5f4d15dbea03f126e40", "tree": "9e842d00ac35cf317b27afc0867f8eb632e4c9aa", "parents": [ "0f2732620d6ec49d3e6c06831575eaec6bc99d42", "41c8899d59898f6fa51ceebd2b6e55257191a8ee" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 15:58:48 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 15:58:48 2026 +0200" }, "message": "Merge tag \u0027for-7.3-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix command queuing and cleanup in encoded read/write ioctls\n\n - fix root and transaction association to avoid unnecessary lock\n contention and transaction start\n\n - properly handle replacing multiple xattrs in the same item\n\n - in scrub, fix root reference leak after reporting an unresolved file\n path\n\n* tag \u0027for-7.3-rc6-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix lost error return value in btrfs_listxattr()\n btrfs: fix xattr replace when multiple xattrs are packed in the same item\n btrfs: don\u0027t stash io_uring encoded data across -EAGAIN\n btrfs: unlock inode and extent in caller when io_uring read extent fails\n btrfs: free iov when btrfs_uring_read_extent() fails\n btrfs: always return -EIOCBQUEUED after btrfs_uring_read_extent_endio\n btrfs: scrub: fix local_root reference leak in scrub_print_warning_inode()\n btrfs: clear BTRFS_ROOT_IN_TRANS_SETUP on early exit from record_root_in_trans()\n" }, { "commit": "08a3f02fea636e97a7422d1512f76dacdb5b0887", "tree": "36919105e45a3f09f050a8040d19c12315fc405a", "parents": [ "c96334f67061eb45cef1e54f73e1846d57615ad1" ], "author": { "name": "Michele Dionisio", "email": "michele.dionisio@gmail.com", "time": "Thu Sep 24 14:30:27 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 12:48:14 2026 +0200" }, "message": "wifi: brcmfmac: fix P2P device removal race in brcmf_detach()\n\nWhen the driver is removed while the user space process that created\nthe P2P device (e.g. wpa_supplicant) is still exiting, the P2P device\ninterface is removed twice and the kernel crashes.\n\nThe two paths are:\n\n - wpa_supplicant, on exit, sends NL80211_CMD_DEL_INTERFACE for the P2P\n device. nl80211_del_interface() holds RTNL and the wiphy mutex and\n calls brcmf_p2p_del_vif(), which disables discovery and waits up to\n 1.5 s for BRCMF_E_IF_DEL. Then it calls brcmf_remove_interface(),\n which unregisters the wdev and frees the vif and the ifp.\n\n - brcmf_detach() sets the bus down, so BRCMF_E_IF_DEL never arrives,\n and calls brcmf_remove_interface(ifp, false) for the same ifp.\n brcmf_p2p_ifp_removed() reads ifp-\u003evif and then blocks on\n rtnl_lock(). When brcmf_p2p_del_vif() releases RTNL, it calls\n cfg80211_unregister_wdev() on the wdev that was already unregistered\n and freed.\n\nThe second list_del_rcu() of wdev-\u003elist faults on LIST_POISON2:\n\n brcmfmac: brcmf_p2p_del_vif delete P2P vif\n brcmfmac: brcmf_p2p_deinit_discovery enter\n brcmfmac: brcmf_p2p_del_vif P2P: GO_NEG_PHASE status cleared\n brcmfmac: brcmf_detach Enter\n brcmfmac: brcmf_bus_change_state 1 -\u003e 0\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx\u003d1, ifidx\u003d0\n brcmfmac: brcmf_del_if Enter, bsscfgidx\u003d1, ifidx\u003d0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n [1.5 s later, brcmf_p2p_del_vif() timed out]\n brcmfmac: brcmf_remove_interface Enter, bsscfgidx\u003d1, ifidx\u003d0\n brcmfmac: brcmf_del_if Enter, bsscfgidx\u003d1, ifidx\u003d0\n brcmfmac: brcmf_p2p_ifp_removed P2P: device interface removed\n Unable to handle kernel paging request at virtual address dead000000000122\n Internal error: Oops: 96000044 [#1] PREEMPT_RT SMP\n pc : _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n Call trace:\n _cfg80211_unregister_wdev+0x6c/0x264 [cfg80211]\n cfg80211_unregister_wdev+0x10/0x1c [cfg80211]\n brcmf_p2p_ifp_removed+0x84/0xb0 [brcmfmac]\n brcmf_remove_interface+0x1f4/0x254 [brcmfmac]\n brcmf_detach+0x88/0x180 [brcmfmac]\n brcmf_sdio_remove+0x90/0x7b0 [brcmfmac]\n brcmf_sdiod_remove+0x20/0xa0 [brcmfmac]\n brcmf_ops_sdio_remove+0xbc/0x12c [brcmfmac]\n sdio_bus_remove+0x38/0x144\n device_release_driver_internal+0x1e8/0x2c0\n device_release_driver+0x14/0x20\n brcmf_sdio_bus_remove+0x2c/0x40 [brcmfmac]\n brcmf_fwvid_unregister_vendor+0xd8/0x170 [brcmfmac]\n __exit_compat+0x18/0x418 [brcmfmac_cyw]\n __arm64_sys_delete_module+0x1ac/0x244\n\nThe log was taken with debug\u003d0x406 on an i.MX 8M Plus board with a\nCYW55513 (Sona IF513) on SDIO. The driver is the Ezurio backport of\nbrcmfmac from v6.18.22 on a 5.4-rt kernel. The code involved is the same\nin mainline.\n\nTo reproduce:\n\n 1. Start wpa_supplicant on wlan0 and let it associate. It creates the\n P2P device (iw dev shows \"type P2P-device\").\n 2. Stop wpa_supplicant and remove the driver without waiting for\n wpa_supplicant to exit:\n\n kill $(pidof wpa_supplicant)\n rmmod brcmfmac_cyw brcmfmac\n\nThe crash is reproducible on that board.\n\nFor the interface without a netdev (the P2P device), take RTNL and the\nwiphy mutex in brcmf_detach() before reading iflist, and remove it with\nlocked\u003dtrue. If brcmf_p2p_del_vif() runs first, brcmf_detach() finds the\nslot empty. If brcmf_detach() runs first, nl80211 does not find the wdev\nany more. The interfaces with a netdev are removed as before, because\nbrcmf_del_if() takes RTNL on its own for the primary interface.\n\nFixes: 9831bcb987df (\"brcmfmac: Deleting of p2p device is leaking memory.\")\nCc: stable@vger.kernel.org\nAssisted-by: claude-opus-5-5\nSigned-off-by: Michele Dionisio \u003cmichele.dionisio@gmail.com\u003e\nAcked-by: Arend van Spriel \u003carend.vanspriel@broadcom.com\u003e\nLink: https://patch.msgid.link/20260924123027.4122909-2-michele.dionisio@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "c96334f67061eb45cef1e54f73e1846d57615ad1", "tree": "b7a0688c696d937fa045e126119129ac0ee03c44", "parents": [ "420e393bc79601d764991591f38f84c4d6b6de0a", "05165f7b3b9ab6817fe216c24f90755b7c5e15f3" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 06 18:00:35 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 12:47:36 2026 +0200" }, "message": "Merge tag \u0027ath-current-20261006\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ath/ath\n\nJeff Johnson says:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nath.git update for v7.3-rc7\n\nIn ath12k, revert the panic handler that landed in v6.11 since it can\nperform a voluntary context switch within an RCU read-side critical\nsection.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "420e393bc79601d764991591f38f84c4d6b6de0a", "tree": "a00b3ecc5411ac8c73e790a65e26543a15932e2f", "parents": [ "95148fe661ffb90c8ecc94ce88c808a61801ea14", "5e99bdb94720331e2fd38c10c5b1afa1ce640835" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 06 17:40:31 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 12:47:18 2026 +0200" }, "message": "Merge tag \u0027nxpwifi-fixes-20261006-v2\u0027 of https://github.com/nxp-upstream/nxpwifi-next\n\nJeff Chen says:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnxpwifi updates for 7.3\n\nThis update contains fixes for station list synchronization,\naggregation and reorder buffer cleanup, authentication frame\nhandling, and several memory safety issues.\n\nHighlights:\n- fix concurrent sta_list add/delete races\n- clean up station entries on uAP deauthentication\n- fix Tx BA stream entry deletion logic\n- avoid deleting Rx reorder entries under RCU\n- improve aggregation buffer cleanup\n- fix authentication frame length validation\n- handle authentication frame allocation failures\n- fix wakeup timer shutdown ordering\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "95148fe661ffb90c8ecc94ce88c808a61801ea14", "tree": "f60fa526de0fe2acdd6bec1a57b55ec3ae825379", "parents": [ "f394cbd0980c95c9173f8551a5eb4c4f28d598eb", "52f6a065e0810c739a5dabd33a58047f08100f50" ], "author": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Tue Oct 06 12:46:20 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 12:47:03 2026 +0200" }, "message": "Merge tag \u0027mt76-fixes-2026-10-05\u0027 of https://github.com/nbd168/wireless\n\nFelix Fietkau says:\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmt76 fixes for 7.3\n\n- mt7925 ACPI SAR fixes\n- MLO fixes\n- sta handling fixes\n- mt7915 napi disable fix\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "f394cbd0980c95c9173f8551a5eb4c4f28d598eb", "tree": "f2eea3ecedb45aefd2467d43812eeaa364f206a6", "parents": [ "d24e8ac715de2e16a53c144005b1863660a5fbea" ], "author": { "name": "François Roux", "email": "franzelfranzel@gmail.com", "time": "Tue Oct 06 10:37:51 2026 +0200" }, "committer": { "name": "Johannes Berg", "email": "johannes.berg@intel.com", "time": "Wed Oct 07 12:46:15 2026 +0200" }, "message": "wifi: mac80211: don\u0027t estimate airtime for unsupported rate widths\n\nieee80211_fill_rate_info() copies the driver\u0027s rate_info bandwidth into\nthe rx_status as is, but ieee80211_get_rate_duration() only handles\n20/40/80/160/320 MHz. When a driver reports another width, e.g. an\nHE/EHT RU allocation, it hits WARN_ON_ONCE() and returns 0 without\nsetting *overhead. ieee80211_rate_expected_tx_airtime() then goes on\nusing the uninitialized overhead, as Dan\u0027s static checker report\npoints out.\n\nSeen on a Microsoft Surface Pro 11 (WCN7850, ath12k) while\nNetworkManager dumps station info:\n\n WARNING: net/mac80211/airtime.c:532 at ieee80211_get_rate_duration.isra.0+0xc0/0x180 [mac80211]\n ieee80211_get_rate_duration.isra.0+0xc0/0x180 [mac80211]\n sta_estimate_expected_throughput.isra.0+0x38/0x64 [mac80211]\n sta_set_sinfo+0x7fc/0x8e4 [mac80211]\n ieee80211_dump_station+0x4c/0x84 [mac80211]\n nl80211_dump_station+0x594/0x7e8 [cfg80211]\n\nOnly accept widths that ieee80211_get_rate_duration() handles in\nieee80211_fill_rate_info(). Other widths then give no estimate instead\nof a warning. Also return 0 from ieee80211_rate_expected_tx_airtime()\nwhen no duration could be computed, as ieee80211_calc_rx_airtime()\nalready does.\n\nTested on the Surface Pro 11 with next-20260929: Wi-Fi works and\n\"expected throughput\" is still reported (about 1049 Mbit/s for a\n1297 Mbit/s HE 160 MHz tx rate). The warning itself is rare (twice in\nseveral days of use), so this does not prove it is gone, only that the\nchange does not break the normal path.\n\nFixes: 094dc1619cb0 (\"wifi: mac80211: factor out part of ieee80211_calc_expected_tx_airtime\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/all/aneGlCMVnqRhlf6p@stanley.mountain/\nAssisted-by: LLM\nSigned-off-by: François Roux \u003cfranzelfranzel@gmail.com\u003e\nLink: https://patch.msgid.link/20261006083751.4015-1-franzelfranzel@gmail.com\nSigned-off-by: Johannes Berg \u003cjohannes.berg@intel.com\u003e\n" }, { "commit": "0f2732620d6ec49d3e6c06831575eaec6bc99d42", "tree": "78f660d9d7ddbea15bf425ef3d9f3fbf083e7702", "parents": [ "602042bf29f6efde39cfb5fdd9289bf4854bc0c5", "fc79aeb86a2c244c1f1894e2d8f2966fe2b60fa2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 12:19:52 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 12:19:52 2026 +0200" }, "message": "Merge tag \u0027for-7.3/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mikulas Patocka:\n \"dm-integrity:\n - validate the superblock after re-reading it\n - fix buffer overflow if tag size \u003e 64\n\n dm:\n - fix reading up to 7 bytes beyond the end of block in dm-ioctl\n - fix reading free memory if the ioctls are called concurrently\n\n dm-crypt:\n - fix a crash on invalid table line\n\n dm-snap:\n - fix a crash on invalid table line\"\n\n* tag \u0027for-7.3/dm-fixes-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm-integrity: validate the superblock on resume\n dm-snap: reject the transient exception store for snapshot-merge\n dm: fix reading free memory in do_resume\n dm ioctl: don\u0027t let data_start run past the buffer\n dm-crypt: reject the lmk IV mode with AEAD ciphers\n dm-integrity: fix buffer overflow in inline mode with large tag size\n" }, { "commit": "23609bce9e1de525d1d0e73fc68c6e7971d0b49e", "tree": "45125ab0ba80399ab2a1c60d62cdf4fbd406a4e6", "parents": [ "5857e5a196b069766a39ceb754736326a43bc6bc" ], "author": { "name": "Haishuang Yan", "email": "yanhaishuang@cmss.chinamobile.com", "time": "Wed Sep 30 20:48:18 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:47:02 2026 -0700" }, "message": "pfcp: make sure the SEID is linear before reading it\n\npfcp_encap_recv() only makes sure that the UDP header and the 4 byte\nPFCP header are in the linear area. When the S flag is set,\npfcp_session_recv() then reads the 8 byte SEID that follows, which is\nnot covered by the pskb_may_pull() check.\n\nA short PFCP packet with the S flag set, or one whose session header\nlies in a fragment, therefore makes pfcp_session_recv() read beyond the\nend of the packet data, and whatever it finds there is stored in the\ntunnel metadata that flower later classifies on.\n\nPull up to the end of the SEID before reading it, and drop packets\nthat are too short to contain it. Reload the header pointer afterwards\nsince pskb_may_pull() may reallocate the skb head.\n\nUse offsetofend() rather than sizeof(struct pfcphdr_session): the\nstructure is not packed, so its size is 16 bytes because of the\nalignment of the __be64 member, while the header on the wire is only 12\nbytes, and valid session messages would be dropped.\n\nFixes: 6dd514f48110 (\"pfcp: always set pfcp metadata\")\nSigned-off-by: Haishuang Yan \u003cyanhaishuang@cmss.chinamobile.com\u003e\nLink: https://patch.msgid.link/20260930124818.114224-3-yanhaishuang@cmss.chinamobile.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5857e5a196b069766a39ceb754736326a43bc6bc", "tree": "f0eadb6caf47821a76d7ed4329f044b254b5370f", "parents": [ "0984ebc631792acf8fff105112ee74a6b8f1efcc" ], "author": { "name": "Justin Chen", "email": "justin.chen@broadcom.com", "time": "Wed Sep 30 16:06:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:43:09 2026 -0700" }, "message": "net: bcmgenet: if UMAC was suspended in SW_RESET, restore it to SW_RESET\n\nWhen the revised suspend/resume sequence was introduced this led to an edge\ncase where the TX is left disabled in the following sequence.\n\n1. phy link is down, so UMAC is held in reset and then network interface\n is WoL enabled\n2. Enter suspend, bcmgenet_wol_power_down_cfg() enables UMAC_RX since MAC\n is in SW_RESET\n4. Enter resume, UMAC_RX is left enabled. Since we only enable UMAC_TX\n and UMAC_RX in SW_RESET. The UMAC_TX is never enabled again on link up.\n\nThe issue was hit in production and I verified the sequence keeps\nthe TX disabled in my standalone test. I tested on an internal\ndevelopment board with bcm77122, but should be reproducible\non any genet HW that supports power management.\n\nFixes: 254f3239dd07 (\"net: bcmgenet: revise suspend/resume\")\nSigned-off-by: Justin Chen \u003cjustin.chen@broadcom.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260930230634.3132729-1-justin.chen@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0984ebc631792acf8fff105112ee74a6b8f1efcc", "tree": "9bbc7c1a2e55b2aec93c5bb6e722e9b8bc97688d", "parents": [ "538b529509c7ab0d909cb65bb7264edca1788d30" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Mon Oct 05 15:50:02 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:29:12 2026 -0700" }, "message": "strparser: make sure __strp_recv isn\u0027t running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That\u0027s only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it\u0027s called from -\u003esk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp-\u003esk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It\u0027ll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8\u0027s to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].\n\nReported-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nLink: https://lore.kernel.org/all/aZLn2Faeg1FB7XOf@v4bel/\nLink: https://lore.kernel.org/all/aZgpkyTDU3aXe_V0@v4bel/\nLink: https://github.com/m0x41nos/RustyTux [1]\nFixes: e27cca96cd68 (\"xfrm: add espintcp (RFC 8229)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nLink: https://patch.msgid.link/425d9d926709b542ed5331110c19fee4aee1f28d.1791206940.git.sd@queasysnail.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "538b529509c7ab0d909cb65bb7264edca1788d30", "tree": "d73dd0ba8ad84a6f608b31b2abf1109f7cb785de", "parents": [ "c8a900ded7759ca982910d3fb4a56f11529079b4" ], "author": { "name": "Hui Peng", "email": "benquike@gmail.com", "time": "Wed Sep 30 04:46:11 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:15:13 2026 -0700" }, "message": "sctp: copy zeroed stats to user in sctp_getsockopt_pr_streamstatus() when !streamoute\n\nWhen an SCTP stream output extension structure (streamoute) has not yet\nbeen allocated, sctp_getsockopt_pr_streamstatus() sets the local stack\nvariables params.sprstat_abandoned_unsent \u003d 0 and\nparams.sprstat_abandoned_sent \u003d 0, but then immediately jumps to \u0027out:\u0027,\nbypassing copy_to_user(). As a result, when an uninitialized user buffer\nis passed to getsockopt(SCTP_PR_STREAM_STATUS), the kernel returns\nsuccess (0) without copying the zeroed stats back to user space, leaving\nuninitialized data in the user buffer.\n\nRefactor the !streamoute check into an if-else chain so that when\nstreamoute is NULL, params is zeroed and falls through to copy_to_user(),\ncopying the zeroed stats to user space and setting retval \u003d 0 once before\nreturning.\n\nTested in QEMU against Linux 7.3.0-rc3 using an uninitialized\nsctp_prstatus user struct passed to getsockopt(SCTP_PR_STREAM_STATUS) on a\nfreshly created stream: on the unfixed kernel the user struct contains\nuninitialized stack garbage; whereas with this fix applied, getsockopt()\ncopies zeroed stats into user space and returns 0.\n\nCc: stable@vger.kernel.org\nReviewed-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: Hui Peng \u003cbenquike@gmail.com\u003e\nFixes: f952be79cebd (\"sctp: introduce struct sctp_stream_out_ext\")\nLink: https://patch.msgid.link/20260930044611.204739-1-benquike@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c8a900ded7759ca982910d3fb4a56f11529079b4", "tree": "76ca50500230512dcab6808e0f23298667893b1c", "parents": [ "86b785b18f8f4a6b4a7392d1e2b29d6bb095011a", "7f85d1170575645f9f327062d78017a23b2714eb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:11:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:11:19 2026 -0700" }, "message": "Merge tag \u0027linux-can-fixes-for-7.3-20261001\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can\n\nMarc Kleine-Budde says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\npull-request: can 2026-10-01\n\nThe first patch is by zjamg and restores the skb header initialization\nlost during the v7.0 release cycle.\n\nOliver Hartkopp contributes a patch for the CAN net layer to fix the\nunique skb identifier regression under RPS, introduced in the v7.0\nrelease cycle, which causes lost packets.\n\nThe last patch is by Ji-Ze Hong and fixes a struct size mismatch in\nthe f81604 CAN driver, which results in a TX starvation.\n\n* tag \u0027linux-can-fixes-for-7.3-20261001\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mkl/linux-can:\n usb: f81604: fix struct f81604_int_data size mismatch\n can: fix unique skb identifier regression under RPS\n can: dev: init_can_skb(): restore skb header initialization\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261001151905.1556270-1-mkl@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "86b785b18f8f4a6b4a7392d1e2b29d6bb095011a", "tree": "492464e2360618bdba7e16e25c67efbcf03a8e31", "parents": [ "6fa2e7db99fb9ed67496c652fcfce5a31c6b73d0" ], "author": { "name": "Or Har-Toov", "email": "ohartoov@nvidia.com", "time": "Sun Oct 04 11:35:31 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 18:03:00 2026 -0700" }, "message": "Revert \"net/mlx5: E-Switch, preserve max tx speed on vport state modification\"\n\nThis reverts commit ad0ae7aefa7a (\"net/mlx5: E-Switch, preserve max tx\nspeed on vport state modification\").\n\nmlx5_modify_vport_admin_state() and mlx5_esw_adj_vport_modify() query\nthe vport\u0027s current max_tx_speed before modifying its state, and\nwrite that value back, to avoid resetting it to 0 as a side effect\nof an unrelated admin-state change.\n\nThat\u0027s unnecessary: max_tx_speed is optional in MODIFY_VPORT_STATE -\nFW skips writing it whenever it\u0027s 0, treating that as \"not provided\"\nrather than \"reset to zero\". Leaving it unset already preserves FW\u0027s\ncurrent value, with no query needed.\n\nFixes: ad0ae7aefa7a (\"net/mlx5: E-Switch, preserve max tx speed on vport state modification\")\nSigned-off-by: Or Har-Toov \u003cohartoov@nvidia.com\u003e\nReviewed-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20261004083531.216988-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6fa2e7db99fb9ed67496c652fcfce5a31c6b73d0", "tree": "f830accc2b192bffefa05cfb9b15eb56827bd987", "parents": [ "b72e025ac556984766392001e74b7587e145bcd0" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Thu Oct 01 12:32:01 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:59:06 2026 -0700" }, "message": "selftests: tc-testing: add cls_route no-routing-attribute change tests\n\nAdd a boundary pair for route4 change without a routing attribute:\n\n- a classid-only change of a wildcard filter (handle 0xffff8000) is a\n metadata-only update and must succeed;\n- the same change on a non-wildcard handle (0x10001) would rekey the\n filter to the wildcard bucket, leaving the handle userspace stored stale,\n and must be rejected with -EINVAL.\n\nThe change of a wildcard filter is the flow iproute2 uses by default\n(\"tc filter add ... route classid X:Y\" gives handle 0xffff8000).\n\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-0JB3.v1.20260923100921@mojatatu.com.2\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b72e025ac556984766392001e74b7587e145bcd0", "tree": "65bf5d7310a49a35f3df9eb4b3a4b7714e71d966", "parents": [ "c5c4e1701059324914873f9e8e65c57ebd96ac96" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Thu Oct 01 12:32:00 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:59:06 2026 -0700" }, "message": "net/sched: cls_route: reject change with no routing attribute\n\nroute4_change on a filter change that supplies no routing attribute\nat all (no to/from/iif) reaches route4_set_parms with fold set, so the\nhandle-mismatch check -- which only fires when creating -- is skipped.\nnhandle is built as the all-wildcard bucket (0x8000 | 0xFFFF \u003c\u003c 16) and\nthe filter is rekeyed to 0xFFFF8000, so the handle userspace already\nstored no longer addresses the filter. (The netlink reply carries the\nnew handle; what goes stale is the handle the caller holds.)\n\nThe rekey actually misclassifies the packets. The new handle\u0027s from_hash\nis the wildcard chain (route4_hash_wild), whose filters route4_classify\napplies without any id/iif comparison, and its bucket (256) is reached\nby every packet through the h \u003c 256 restart. A filter that matched only\na specific realm therefore becomes an unconditional catch-all that applies\nits classid and actions to all otherwise-unmatched traffic.\n\nReject a change that would rekey the filter this way, with the\nrouting-attributes-required error. A change that names at least one of\nto/from/iif, and an in-place replace that keeps the routing identity via\na supplied attribute, are unaffected. A change of a filter that already\nsits at the wildcard handle is a metadata-only update and remains valid,\nso only a change that actually moves the handle is rejected.\n\nThis is a follow-up to commit 41e85e54e564 (\"net/sched: cls_route: Fix\nin-place replace\"); this patch closes the no-routing-attribute variant\nthat the parent series did not address.\n\nConditions to recreate the bug:\n tc qdisc add dev lo clsact\n tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1\n tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n route classid 1:2\n tc filter show dev lo ingress # handle became 0xffff8000; iproute2\u0027s\n # stored 0x10001 no longer addresses it\n\nA change of a filter already at the wildcard handle, e.g. one created by\n\"tc filter add dev lo ingress protocol ip pref 100 route classid 1:1\"\n(iproute2 defaults the handle to 0xffff8000), stays a valid metadata-only\nupdate.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260907192133.2639067-1-victor@mojatatu.com\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-0JB3.v1.20260929143022@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c5c4e1701059324914873f9e8e65c57ebd96ac96", "tree": "a4a2b9ae8b20f96e8c56ee6c24711b379ac038a7", "parents": [ "f75b8de197e718e8bce8f5eb0cf54f592dc48d20", "e32d80293a0e1a160d5e5101daa8c82148c07510" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:38:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:38:23 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-10-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\nCore:\n\n - hci_sync: Fix command skb lifetime during scan setup\n - hci_sock: Serialize dead-device detachment\n - RFCOMM: free the skb when the DLC has no owner\n - RFCOMM: connect the session socket without rfcomm_mutex\n - RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n - SCO: serialise sco_conn lifetime against sco_recv_scodata()\n - ISO: Reject concurrent BIS listener setup\n - ISO: Serialize concurrent connect calls\n - MGMT: Fix status of pending commands flushed on power off\n\nDriver:\n\n - btintel_pcie: fix TX descriptor bounds check\n - btintel_pcie: use managed IRQ teardown\n - btintel_pcie: Add shared HW reset for clean start\n\n* tag \u0027for-net-2026-10-05\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: ISO: Serialize concurrent connect calls\n Bluetooth: ISO: Reject concurrent BIS listener setup\n Bluetooth: hci_sync: Fix command skb lifetime during scan setup\n Bluetooth: hci_sock: Serialize dead-device detachment\n Bluetooth: RFCOMM: Fix NULL tty_dev dereference in rfcomm_dev_shutdown\n Bluetooth: btintel_pcie: use managed IRQ teardown\n Bluetooth: MGMT: Fix status of pending commands flushed on power off\n Bluetooth: btintel_pcie: Add shared HW reset for clean start\n Bluetooth: RFCOMM: connect the session socket without rfcomm_mutex\n Bluetooth: btintel_pcie: fix TX descriptor bounds check\n Bluetooth: SCO: serialise sco_conn lifetime against sco_recv_scodata()\n Bluetooth: RFCOMM: free the skb when the DLC has no owner\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261005194436.3594085-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "602042bf29f6efde39cfb5fdd9289bf4854bc0c5", "tree": "9d1056524921544d2359e81c6a6697e62e8373ad", "parents": [ "0d32b3ec5f902bf40d03db08837f3eafbb6a4577", "980db94e3eeefdd8a1c46f86412c33a7f7806f51" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:24:23 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:24:23 2026 +0200" }, "message": "Merge tag \u0027wq-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fixes from Tejun Heo:\n\n - Fix a NULL dereference in the chained work check when a kworker\n queues work on a draining or destroying workqueue outside work item\n execution.\n\n* tag \u0027wq-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n workqueue: Fix NULL current_pwq deref in chained work check\n" }, { "commit": "f75b8de197e718e8bce8f5eb0cf54f592dc48d20", "tree": "53cdc4955561e6b65438ceae0647804533077dc1", "parents": [ "c5381ae1cd1481cc431c2bd79460472c6f1d3ce3", "489114c9ecae44e523361a4b3e610ee5ebd9189c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:20:56 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:20:57 2026 -0700" }, "message": "Merge branch \u0027net-team-fix-transmit-skb-ownership\u0027\n\nWeiming Shi says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: team: fix transmit skb ownership\n\nThe queue override path can pass an skb to a lower device, see that\ndev_queue_xmit() returned a drop, and then reuse the consumed skb. Fix\nthe handoff decision separately from the transmit result.\n\nAn AI-generated review of v1 forwarded by Jakub identified a separate\nbroadcast-mode leak: bc_transmit() returns without consuming the skb\nwhen no port is txable. Fix that in the second patch.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261001182326.572045-1-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "489114c9ecae44e523361a4b3e610ee5ebd9189c", "tree": "53cdc4955561e6b65438ceae0647804533077dc1", "parents": [ "b7454f1940c5e6d92e753853c476a769e452f30a" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Fri Oct 02 02:23:26 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:20:44 2026 -0700" }, "message": "net: team: free skb when broadcast has no txable port\n\nbc_transmit() sends the original skb through the last txable port.\nWhen no port is txable, it returns false without consuming the skb, but\nteam_xmit() still returns NETDEV_TX_OK. AF_PACKET sends then retain the\nskb and its socket write-memory charge.\n\nA TX-enabled, link-down port keeps the broadcast transmit op installed.\nCarrier can stay up through a second link-up, TX-disabled port or be\nforced on by userspace. Free the original skb on the no-port path while\nleaving the existing drop accounting intact.\n\nDiscovered by Sashiko during review of previous commit.\n\nCc: stable@vger.kernel.org\nFixes: 5fc889911a99 (\"team: add broadcast mode\")\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20261001182326.572045-3-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7454f1940c5e6d92e753853c476a769e452f30a", "tree": "87e0fd4f917839ddeee5efe636e2ec98cc44b39e", "parents": [ "c5381ae1cd1481cc431c2bd79460472c6f1d3ce3" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Fri Oct 02 02:23:25 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:20:39 2026 -0700" }, "message": "net: team: stop reusing skb after queue override\n\nA nonzero dev_queue_xmit() result does not return ownership of the skb.\nWhen an override port\u0027s qdisc drops it, the queue override helper used to\ntry another port or the mode transmit op with the freed skb.\n\nReturn the handoff decision separately from transmit success. Select only\nthe first override port under RCU and stop after handing it the skb,\nregardless of the lower transmit result. Keep the existing success and\ndrop accounting.\n\n BUG: KASAN: slab-use-after-free in sk_skb_reason_drop\n Write of size 4 by task poc/5040\n sk_skb_reason_drop (net/core/skbuff.c:1240)\n dev_kfree_skb_any_reason (net/core/dev.c:3470)\n ab_transmit (drivers/net/team/team_mode_activebackup.c:49)\n team_xmit (drivers/net/team/team_core.c:1849)\n __dev_direct_xmit (net/core/dev.c:4934)\n Freed by task 5040:\n __tcf_kfree_skb_list (net/sched/sch_generic.c:43)\n __dev_queue_xmit (net/core/dev.c:4831)\n team_xmit (drivers/net/team/team_core.c:1846)\n Kernel panic - not syncing: KASAN: panic_on_warn set ...\n\nCc: stable@vger.kernel.org\nFixes: 8ff5105a2b9d (\"team: add support for queue override by setting queue_id for port\")\nReported-by: \u003cco+2cf741c3005abc20@bugs.sh\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20261001182326.572045-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0d32b3ec5f902bf40d03db08837f3eafbb6a4577", "tree": "2aee0ffb92d604ebff45127a72935b282ab3f49f", "parents": [ "762122d75e50e4919ef77afc2dffdc4931c5be87", "b8eb5fd5bdb4c03758b056c70e5e1d962ca89757" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:19:02 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:19:02 2026 +0200" }, "message": "Merge tag \u0027cgroup-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - During CPU offline, the active mask drops the CPU before cpuset\n updates the effective CPUs, so a task placement in that window could\n find no active CPU in the top cpuset and dereference NULL. Restore\n the NULL check.\n\n - The cpuset v2-mode test read the subsystem\u0027s root pointer, which is\n stale during a cgroup filesystem rebind, and the hotplug handler\n evaluated it before taking the cpuset mutex. Record the mode in a\n flag and test it under the mutex.\n\n* tag \u0027cgroup-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()\n cgroup/cpuset: Handle cpu hotplug race in guarantee_active_cpus()\n cgroup/cpuset: Don\u0027t access cpuset_cgrp_subsys.root in is_in_v2_mode()\n" }, { "commit": "c5381ae1cd1481cc431c2bd79460472c6f1d3ce3", "tree": "dba65dbac0752c16c26a06e0c07e788bfe5310c6", "parents": [ "ca5012757bf027df83d51593a07656cb8c80caee" ], "author": { "name": "Haishuang Yan", "email": "yanhaishuang@cmss.chinamobile.com", "time": "Thu Oct 01 12:22:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:16:14 2026 -0700" }, "message": "devlink: fix devlink_rel reference leak when notify work is pending\n\ndevlink_rel_nested_in_notify_work_schedule() takes a reference on the\ndevlink_rel for the notify work and then queues the work, ignoring the\nreturn value of schedule_delayed_work(). If the work is already pending,\nnothing new is queued, the work runs only once and drops only one\nreference, so the extra one is leaked together with the devlink_rel and\nits index in devlink_rels.\n\nThis is easy to hit. devl_register() of a nested instance queues the\nwork, and if the instance is unregistered before the work has run,\ndevlink_rel_put() queues it again while it is still pending. The work\nalso keeps rescheduling itself for as long as the parent devlink lock\ncannot be taken, which widens the window. Registering and unregistering\na nested devlink instance 100 times while holding the parent lock leaks\nall 100 devlink_rel objects.\n\nThe reschedule path in devlink_rel_nested_in_notify_work() has the same\nproblem: if the work was queued again while it was running, the\nreference it holds is never dropped.\n\nDrop the reference in both places when the work was already pending.\nThe pending work holds its own reference, so this can not be the last\none.\n\nFixes: c137743bce02 (\"devlink: introduce object and nested devlink relationship infra\")\nSigned-off-by: Haishuang Yan \u003cyanhaishuang@cmss.chinamobile.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261001042232.222987-1-yanhaishuang@cmss.chinamobile.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ca5012757bf027df83d51593a07656cb8c80caee", "tree": "6a0c015995553da3250425444e5ddd03da29d677", "parents": [ "588003f74005bbe34cdb4a39f65312cd43cf6935" ], "author": { "name": "Quentin Freimanis", "email": "quentin@q-lab.dev", "time": "Sun Oct 04 22:28:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 17:07:30 2026 -0700" }, "message": "net: sparx5: start the TOD counters on non-PTP lan969x variants\n\nCurrently the base non-PTP-capable lan969x variants don\u0027t forward any\nEthernet frames:\n\n $ ip link set eth10 up\n\n $ ip addr add 10.0.0.54/24 dev eth10\n\n $ ping 10.0.0.1\n PING 10.0.0.1 (10.0.0.1): 56 data bytes\n\n --- 10.0.0.1 ping statistics ---\n 7 packets transmitted, 0 packets received, 100% packet loss\n\n $ cat /proc/interrupts | grep fdma\n 20: 0 GIC-0 120 Level sparx5-fdma\n\n $ ip -s link show dev eth10\n RX: bytes packets errors dropped missed mcast\n 20828 102 0 0 0 72\n TX: bytes packets errors dropped carrier collsns\n 0 0 0 0 0 0\n\nTesting showed that starting the domain 0 TOD counter gets networking\nworking again, but start all three for consistency with the PTP variants.\n\nFixes: 207966787b71 (\"net: sparx5: add feature support\")\nSuggested-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nSigned-off-by: Quentin Freimanis \u003cquentin@q-lab.dev\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261005052826.14251-1-quentin@q-lab.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "762122d75e50e4919ef77afc2dffdc4931c5be87", "tree": "c6a4e5e53e813d62b79a3bcfee8d42246234017b", "parents": [ "69f80fef3153299d9c72c53d1d71eef6354b6926", "e6ac89b8b1c12e9104df45a14a26e2dfa96ded06" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:03:46 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 07 02:03:46 2026 +0200" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - Taking a CPU offline could hang, or stall until the watchdog ejected\n the BPF scheduler, when tasks on the dying CPU were still held by the\n scheduler or sitting on a user dispatch queue. Re-enqueue them onto\n the local queue when the runqueue goes offline so that the CPU pushes\n them off like the other sched classes.\n\n - The sequence number guarding against stale dispatches was per\n runqueue, so a task re-enqueued on another CPU could get the same\n number and a dispatch meant for its earlier instance was applied to\n the new one. Use a per-task counter.\n\n - A task dispatched to another CPU\u0027s local queue got its ops.dequeue()\n only when picked to run and flagged as a core-sched pick. Call it at\n insertion like for same-CPU dispatches.\n\n* tag \u0027sched_ext-for-7.3-rc6-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Generate qseq from a per-task counter\n selftests/sched_ext: Add a test for ops.dequeue() on remote local DSQ moves\n sched_ext: Call ops.dequeue() when a task arrives on a remote local DSQ\n sched_ext: Fix CPU hotplug hang when a dying CPU\u0027s tasks sit in the BPF scheduler\n" }, { "commit": "80ce29104123be4d61b5912dae543c70af0fcb75", "tree": "8ac78a4d921895165bf2b2732df64c1b74c2549c", "parents": [ "d3ed3a40951c964d30dc7fc63d13e87a873ea300" ], "author": { "name": "Andy Yan", "email": "andyshrk@163.com", "time": "Thu Sep 24 18:50:33 2026 +0800" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:19 2026 -0700" }, "message": "mailmap: update entry for Andy Yan\n\nI will use andyshrk@163.com for future review and discussion.\n\nLink: https://lore.kernel.org/20260924105052.768760-1-andyshrk@163.com\nSigned-off-by: Andy Yan \u003candyshrk@163.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Shawn Lin \u003cshawn.lin@rock-chips.com\u003e\nCc: Alexander Sverdlin \u003calex@sverdlin.org\u003e\nCc: Chuck Lever \u003ccel@kernel.org\u003e\nCc: Jakub Kicinski \u003ckuba@kernel.org\u003e\nCc: Martin Kepplinger \u003cmartink@posteo.de\u003e\n" }, { "commit": "d3ed3a40951c964d30dc7fc63d13e87a873ea300", "tree": "e564bb90b1af41f393b427731f1f0fa97049905a", "parents": [ "28eed9906e01d01cbdfb352e799413b2e8b33b76" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Thu Sep 24 15:48:24 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:18 2026 -0700" }, "message": "drivers/char/mem: mmap readonly MAP_SHARED-/dev/zero correctly\n\nRather surprisingly, opening /dev/zero read-only then mmap()\u0027ing it\nMAP_SHARED gets you true anonymous memory (albeit in a VMA with non-NULL\nvma-\u003evm_file).\n\nThis is a by-product of MAP_PRIVATE-/dev/zero being how anonymous memory\nwas mapped in Linux\u0027s distant past.\n\nIt happens because mmap_zero_prepare() gates on VMA_SHARED_BIT and when\nmapping a read-only file MAP_SHARED, do_mmap() clears VMA_SHARED_BIT and\nVMA_MAYWRITE_BIT.\n\nThe gating is incorrect - the (poorly named) VMA_MAYSHARE_BIT flag exists\nexplicitly to tell you if something was originally mapped MAP_SHARED.\n\nSo the fix is simple - gate on this instead.\n\nThis isn\u0027t exactly a common use case, but it\u0027s unexpected behaviour which\nnow causes an assert if CONFIG_DEBUG_VM is set.\n\nWhile this bug has existed since the dawn of time for linux (or at least\nsince 2.6.12), it hasn\u0027t caused issues in the past, so while it\u0027s\nincorrect behaviour, it doesn\u0027t seem necessary to backport that far.\n\nThe mapping is now accounted at mmap time and can fail with -ENOMEM under\nstrict overcommit, and read faults allocate folios. However this is\nnormal behaviour for a read-only shmem mapping.\n\nCommit 93c0c8dc87f6 (\"mm/rmap: use anon pgoff to track MAP_PRIVATE\nfile-backed anon folios\") is the first patch at which the debug assert\nfires, so target that instead.\n\nLink: https://lore.kernel.org/20260924-fix-dev-zero-readonly-shared-v1-1-153c2111e323@kernel.org\nFixes: 93c0c8dc87f6 (\"mm/rmap: use anon pgoff to track MAP_PRIVATE file-backed anon folios\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReported-by: \u003csyzbot+c181d3198e98f8aef8b9@syzkaller.appspotmail.com\u003e\nCloses: https://lore.kernel.org/linux-mm/6ab4ae75.80e1c6cc.1e8e5f.000d.GAE@google.com/\nAcked-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Pedro Falcato \u003cpfalcato@suse.de\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Arnd Bergmann \u003carnd@arndb.de\u003e\nCc: Greg Kroah-Hartman \u003cgregkh@linuxfoundation.org\u003e\nCc: Lance Yang \u003clance.yang@linux.dev\u003e\n" }, { "commit": "28eed9906e01d01cbdfb352e799413b2e8b33b76", "tree": "11fac740fdd168f245f13c8d9e17fe488d67b62a", "parents": [ "2fb552b0bee70c24c092720028ab4620f5eb2646" ], "author": { "name": "Carlos Llamas", "email": "cmllamas@google.com", "time": "Sun Sep 27 16:24:18 2026 +0000" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:18 2026 -0700" }, "message": "selftests/mm: cleanup -Wformat issues in hugetlb-mmap\n\nCommit ae571cd6015c (\"selftests/mm: hugetlb-mmap: add setup of HugeTLB\npages\") and commit 9c5a65f374f8 (\"selftests/mm: merge map_hugetlb into\nhugepage-mmap\") added logs of \u0027hugepage_size\u0027 which has a size_t type.\nHowever, the incorrect format specifier \u0027%lu\u0027 was used which triggers\n-Wformat warnings when building for 32-bit:\n\n hugetlb-mmap.c:125:55: warning: format specifies type \u0027unsigned long\u0027\n but the argument has type \u0027size_t\u0027 (aka \u0027unsigned int\u0027) [-Wformat]\n 125 | ksft_print_msg(\"Default size hugepages (%lu kB)\\n\", hugepage_size \u003e\u003e 10);\n | ~~~ ^~~~~~~~~~~~~~~~~~~\n | %zu\n\n hugetlb-mmap.c:134:47: warning: format specifies type \u0027unsigned long\u0027\n but the argument has type \u0027size_t\u0027 (aka \u0027unsigned int\u0027) [-Wformat]\n 134 | ksft_exit_skip(\"Not enough %lu Kb pages\\n\", hugepage_size \u003e\u003e 10);\n | ~~~ ^~~~~~~~~~~~~~~~~~~\n | %zu\n\nFix this by switching to the expected \u0027%zu\u0027 format specifier.\n\nLink: https://lore.kernel.org/20260927162419.820609-1-cmllamas@google.com\nFixes: ae571cd6015c (\"selftests/mm: hugetlb-mmap: add setup of HugeTLB pages\")\nFixes: 9c5a65f374f8 (\"selftests/mm: merge map_hugetlb into hugepage-mmap\")\nSigned-off-by: Carlos Llamas \u003ccmllamas@google.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Sarthak Sharma \u003csarthak.sharma@arm.com\u003e\nReviewed-by: SJ Park \u003csj@kernel.org\u003e\nAcked-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: David Hildenbrand \u003cdavid@kernel.org\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Shuah Khan \u003cshuah@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "2fb552b0bee70c24c092720028ab4620f5eb2646", "tree": "aa60745c23eeb7ab55dec02b6b967fdbcdc66b6e", "parents": [ "29e0dd1f2ef82d0931ed1a4e6b1d8aa04650835d" ], "author": { "name": "Mikhail Gavrilov", "email": "mikhail.v.gavrilov@gmail.com", "time": "Fri Sep 25 10:06:47 2026 +0500" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:18 2026 -0700" }, "message": "mm: don\u0027t schedule deferred kernel page table freeing while booting\n\nBooting with a boot-time function tracer and a filter, for example\n\n ftrace\u003dfunction ftrace_filter\u003dpud_free_pmd_page\n\npanics on 7.3-rc4 as soon as the tracer starts:\n\n [ 23.531178] Starting tracer \u0027function\u0027\n [ 23.675800] Oops: general protection fault, probably for non-canonical address 0xdffffc0000000038: 0000 [#1] SMP KASAN NOPTI\n [ 23.819917] KASAN: null-ptr-deref in range [0x00000000000001c0-0x00000000000001c7]\n [ 23.964025] CPU: 0 UID: 0 PID: 0 Comm: swapper Not tainted 7.3.0-rc4-fe2ec83746e5-with-fixes-v2+ #195 PREEMPT(undef)\n [ 24.252248] RIP: 0010:__queue_work+0xab/0xf00\n [ 25.981629] Call Trace:\n [ 26.125727] \u003cTASK\u003e\n [ 26.413912] ? pagetable_free_kernel+0x20/0x120\n [ 26.990283] queue_work_on+0x97/0xf0\n [ 27.134382] __cpa_collapse_large_pages+0x501/0x6f0\n [ 27.566662] cpa_flush+0x394/0x620\n [ 27.998953] change_page_attr_set_clr+0x321/0x4a0\n [ 29.151729] set_memory_rox+0xa2/0xf0\n [ 29.584018] create_trampoline+0x431/0x6f0\n ...\n [ 44.343347] Kernel panic - not syncing: Attempted to kill the idle task!\n\nThe boot-time tracer is started from early_trace_init(), which runs\nbefore workqueue_init_early(). Making its trampoline read-only splits a\nlarge page, and CPA collapses it again right away. The split table has\nbeen a kernel page table since commit 9e4a3ec3411b\n(\"x86/mm/pat: Allocate split page tables as kernel page tables\"), so the\ncollapse frees it through pagetable_free_kernel(), which queues work on\nsystem_percpu_wq - still NULL at that point. That commit is correct in\nitself; it only lets CPA reach pagetable_free_kernel() before the\nworkqueue that function relies on exists.\n\nKeep putting the table on the list, but don\u0027t schedule the work while\nthe system is still booting. A core_initcall schedules it once to free\nwhatever was queued by then.\n\nLink: https://lore.kernel.org/20260925050647.86913-1-mikhail.v.gavrilov@gmail.com\nLink: https://lore.kernel.org/20260924064321.23787-1-mikhail.v.gavrilov@gmail.com\nFixes: 9e4a3ec3411b (\"x86/mm/pat: Allocate split page tables as kernel page tables\")\nSigned-off-by: Mikhail Gavrilov \u003cmikhail.v.gavrilov@gmail.com\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nSuggested-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nSuggested-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: David Hildenbrand (Arm) \u003cdavid@kernel.org\u003e\nReviewed-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nTested-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nCc: Dave Hansen \u003cdave.hansen@linux.intel.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Mike Rapoport \u003crppt@kernel.org\u003e\nCc: Suren Baghdasaryan \u003csurenb@google.com\u003e\nCc: Michal Hocko \u003cmhocko@suse.com\u003e\nCc: Vishal Moola (Oracle) \u003cvishal.moola@gmail.com\u003e\nCc: Ingo Molnar \u003cmingo@kernel.org\u003e\nCc: Lu Baolu \u003cbaolu.lu@linux.intel.com\u003e\nCc: Jason Gunthorpe \u003cjgg@ziepe.ca\u003e\nCc: Steven Rostedt \u003crostedt@goodmis.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "29e0dd1f2ef82d0931ed1a4e6b1d8aa04650835d", "tree": "1d23592eb91ffce078647af4f28396480805be05", "parents": [ "597e4b9ab48a3f841080f627722064853d3f650e" ], "author": { "name": "John Garry", "email": "john.garry@linux.dev", "time": "Wed Sep 23 08:53:24 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:17 2026 -0700" }, "message": "mailmap: update addresses for John Garry\n\nPoint any employment addresses at my personal dev address.\n\nLink: https://lore.kernel.org/20260923075324.1382927-1-john.garry@linux.dev\nSigned-off-by: John Garry \u003cjohn.garry@linux.dev\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\n" }, { "commit": "597e4b9ab48a3f841080f627722064853d3f650e", "tree": "2fd58e9ae6b27f0b6e9e1302d2e0a3f87ccba693", "parents": [ "838bb60dc21553e32df90f2f3bac5b905376e7aa" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Wed Sep 30 19:47:10 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:17 2026 -0700" }, "message": "mm/mremap: fix locked_vm leak by splitting VMA for MREMAP_DONTUNMAP\n\nThe MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap()\noperations that keep the original VMA in place.\n\nHistorically this has led to a lot of bugs where non-obvious interactions\noccur between existing mremap() operations and the original VMA.\n\nFix another of these - partial copies.\n\nThe long-standing mremap() partial VMA logic has the baked-in assumption\nthat the originating VMA is unmapped and thus moved.\n\nHowever MREMAP_DONTUNMAP defeats this by performing a partial copy\ninstead since it keeps the source VMA around.\n\nAn mremap(..., MREMAP_DONTUNMAP) operation disallows resizing of the VMA,\nbut the operation can be performed partially:\n\n |-----------------|\n | |\n | v\n \u003c------\u003e \u003c------\u003e\n .new_sz. new_sz\n |--.------.--| |------|\n | .source. | | dest |\n |--.------.--| |------|\n \u003c------------\u003e\n old_sz\n\nThe page tables in the specified range are moved, but the original VMA is\nkept intact.\n\nThis interacts poorly with mlock()\u0027d VMAs, as the VMA_LOCKED_BIT flag is\ncleared for the entire source VMA and set for the entire destination VMA.\n\nThis results in an mm-\u003elocked_vm leak as the change is therefore not\naccounted correctly.\n\nThe clear solution here is to make the portion of the source VMA which is\nmremap()\u0027d distinct from the rest of it, a.k.a. split it.\n\nTherefore resolve this issue by splitting it ahead of the rest of the\nmremap() operation if the VMA is mlock()\u0027d.\n\nThis is valid, as the source VMA will lose its VMA_LOCKED_BIT flag, so if a\npartial remap it will become distinct from the rest of the VMA.\n\nIn order to make this change re-expose split_vma() in vma.h for\nCONFIG_MMU (nommu doesn\u0027t compile mremap.c and uses a static helper\ninstead).\n\nFinally, update the sys_map_count check to account for this case.\n\nNote that the early check does not use needs_pre_split() - this is because\nthe VMA has not been looked up by this point, so be conservative and assume\nthat the VMA is mlock()\u0027d in this case for the purposes of the\nsys_map_count check.\n\nLink: https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-2-f388985a0f0a@kernel.org\nFixes: e346b3813067 (\"mm/mremap: add MREMAP_DONTUNMAP to mremap()\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nAcked-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nTested-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Brian Geffon \u003cbgeffon@google.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "838bb60dc21553e32df90f2f3bac5b905376e7aa", "tree": "d0794213776937a64a4547348db18184de5dccf1", "parents": [ "ff47652a4b66c067c765a7ad464d930b5a9367cc" ], "author": { "name": "Lorenzo Stoakes (ARM)", "email": "ljs@kernel.org", "time": "Wed Sep 30 19:47:09 2026 +0100" }, "committer": { "name": "Andrew Morton", "email": "akpm@linux-foundation.org", "time": "Tue Oct 06 16:44:17 2026 -0700" }, "message": "mm/mremap: fix locked_vm leak from MREMAP_DONTUNMAP self-merge\n\nPatch series \"mm/mremap: fix two issues with MREMAP_DONTUNMAP\", v2.\n\nThe MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap()\noperations that keep the original VMA in place.\n\nHistorically this has led to a lot of bugs where non-obvious interactions\noccur between existing mremap() operations and the original VMA.\n\nCommit 397432cab17b (\"mm/mremap: account mm-\u003elocked_vm correctly for\nMREMAP_DONTUNMAP\") fixed an accidentally introduced bug around\nmm-\u003elocked_vm accounting, but this wasn\u0027t the only issue.\n\nAnd thus history repeats itself, as it turns out that mm-\u003elocked_vm\naccounting is broken by MREMAP_DONTUNMAP yet again by two further cases,\nand has been broken ever since the feature was introduced.\n\nBoth relate to the fact that VMA_LOCKED_BIT is cleared on the source VMA\n(it has to be as all page tables are moved):\n\n1. If an unfaulted VMA_LOCKONFAULT_BIT anonymous VMA self-merges it\n clears the VMA_LOCKED_BIT flag and permanently leaks mm-\u003elocked_vm\n pages.\n\n2. If a partial mremap() is performed on a locked VMA there is a leak equal\n to the number of pages not copied.\n\n(Both for MREMAP_DONTUNMAP operations only)\n\nBoth issues can be fixed by treating the source range as distinct from the\ndestination range, which is the definition of what MREMAP_DONTUNMAP does\nso is appropriate.\n\nIn case 1, simply disallow the self-merge, keeping adjacent source and\ndestination VMAs distinct.\n\nIn case 2, split the source range ahead of time if the VMA is mlock()\u0027d,\nso accounting is always correct.\n\nBoth changes were tested locally and confirmed to fix the issues.\n\nFor the purposes of a backport, the fixes are kept distinct, a follow-up\nseries can add self-tests.\n\n\nThis patch (of 2):\n\nThe MREMAP_DONTUNMAP feature is highly unusual in that it permits mremap()\noperations that keep the original VMA in place.\n\nHistorically this has led to a lot of bugs where non-obvious interactions\noccur between existing mremap() operations and the original VMA.\n\nFix another of these - self-merge.\n\nSelf-merge occurs when a VMA is moved in front of or behind itself and the\nattributes of the VMA permit such a merge.\n\nPractically this can only happen for unfaulted anonymous VMAs due to the\npage offset equality requirement for merge:\n\n |------------|\n | |\n | v\n |...........||-----------||...........|\n | || unfaulted || |\n |...........||-----------||...........|\n ^ |\n | |\n |------------|\n\nThis becomes problematic if the VMA is configured by the user to\nmlock-on-fault, i.e. the VMA_LOCKED_BIT, VMA_LOCKONFAULT_BIT VMA flags are\nset.\n\nMREMAP_DONTUNMAP clears mlock flags for the source VMA and maintains them\nfor the destination VMA.\n\nSelf-merge makes this impossible (there is only one VMA) and incorrectly\nclears the destination VMA\u0027s mlock flags.\n\nThis causes a leak in mm-\u003elocked_vm as clearing this flag does not\ndecrement the counter and the VMA no longer has VMA_LOCKED_BIT set so it\nis not decremented on unmap.\n\nResolve this by simply disallowing a self-merge in this case - the source\nand destination VMAs are kept distinct and then are able to have distinct\nmlock() flags.\n\nUpdate dontunmap_complete() to make the now-redundant self-merge check a\nVM_WARN_ON_ONCE() instead to guard against future regressions.\n\nAlso update the VMA userland tests to reflect the change.\n\nLink: https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-0-f388985a0f0a@kernel.org\nLink: https://lore.kernel.org/20260930-fix-dontunmap-partial-self-merge-v2-1-f388985a0f0a@kernel.org\nFixes: e346b3813067 (\"mm/mremap: add MREMAP_DONTUNMAP to mremap()\")\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nSigned-off-by: Andrew Morton \u003cakpm@linux-foundation.org\u003e\nReviewed-by: Pedro Falcato \u003cpfalcato@suse.de\u003e\nAcked-by: Kiryl Shutsemau (Meta) \u003ckas@kernel.org\u003e\nReviewed-by: Jose A. Perez de Azpillaga \u003cazpijr@gmail.com\u003e\nTested-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nCc: Liam R. Howlett \u003cliam@infradead.org\u003e\nCc: Vlastimil Babka \u003cvbabka@kernel.org\u003e\nCc: Jann Horn \u003cjannh@google.com\u003e\nCc: Brian Geffon \u003cbgeffon@google.com\u003e\nCc: Minchan Kim \u003cminchan@kernel.org\u003e\nCc: \u003cstable@vger.kernel.org\u003e\n" }, { "commit": "588003f74005bbe34cdb4a39f65312cd43cf6935", "tree": "d19cdf804c8281bc4c71285f469ef4475fef6e7e", "parents": [ "a463f55c791b96cfd12df8b10ea737d45c80bb18", "d3daa33c7af92e38f2274bbd2576f58bfbaf89e6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:23:11 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:23:12 2026 -0700" }, "message": "Merge branch \u0027ipv4-handle-nexthop-group-shrink-races\u0027\n\nDaehyeon Ko says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv4: handle nexthop group shrink races\n\nfib_info_num_path() and fib_info_nhc() can observe different RCU\ngenerations of a replaceable nexthop group. An indexed consumer can\ntherefore accept an index from a larger group and receive NULL after a\nconcurrent shrink.\n\nPatch 1 is unchanged from v1. Patch 2 addresses the analogous\nfib_dump_info_fnhe() race Ido identified. Auditing the remaining\naccessor pairs found the same issue in the RCU-only hardware-flag\nnotification path, fixed by patch 3. Separate patches retain the\ncorrect Fixes tag for each concurrency boundary.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1790915964.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d3daa33c7af92e38f2274bbd2576f58bfbaf89e6", "tree": "d19cdf804c8281bc4c71285f469ef4475fef6e7e", "parents": [ "4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 02 13:51:00 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:23:09 2026 -0700" }, "message": "ipv4: stop route notification sizing when nexthop group shrinks\n\nCommit 680aea08e78c (\"net: ipv4: Emit notification when fib\nhardware flags are changed\") added an RCU-only fib_nlmsg_size() call\nfor asynchronous hardware flag notifications.\n\nfib_nlmsg_size() checks fib_info_num_path() before each iteration,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and fib_nexthop_nlmsg_size() dereferences\nit.\n\nStop sizing when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.\n\nFixes: 680aea08e78c (\"net: ipv4: Emit notification when fib hardware flags are changed\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/1054fa46165bba1b473782fa41367804aa908e86.1790915964.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f4afc07dcb2edd4f9afa36595373f8cdb9b58c2", "tree": "1b7a2bbc23d8ed307c8ed14abd11bdd5c53c3f6c", "parents": [ "6619e01855e65ef35723685a557e3eb106f4ecf5" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 02 13:50:59 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:23:09 2026 -0700" }, "message": "ipv4: stop exception dump when nexthop group shrinks\n\nCommit 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU\nprotection\") allowed IPv4 FIB dumps to run concurrently with nexthop\nreplacement.\n\nfib_dump_info_fnhe() uses fib_info_num_path() as the loop bound,\nthen fib_info_nhc() independently reloads nh-\u003enh_grp. If\nRTM_NEWNEXTHOP replaces a group with fewer paths between those loads,\nfib_info_nhc() returns NULL and the dump dereferences it through\nnhc_flags.\n\nStop the walk when the indexed path is absent. Nexthop groups are\ndense, so the current snapshot has no later path.\n\nFixes: 4ce5dc9316de (\"inet: switch inet_dump_fib() to RCU protection\")\nReported-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20261001170513.GA1657889@shredder/\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/5bb7bd97411eb9db454464bf449107395e760f26.1790915964.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6619e01855e65ef35723685a557e3eb106f4ecf5", "tree": "1381a1e1e5f1defdad097b57f75722e56cb3f7c1", "parents": [ "a463f55c791b96cfd12df8b10ea737d45c80bb18" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 02 13:50:58 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:23:09 2026 -0700" }, "message": "ipv4: stop PMTU walk when nexthop group shrinks\n\nCommit 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if\nmultipath enabled\") made __ip_rt_update_pmtu() update every path.\n\nFor nexthop objects, fib_info_num_path() and fib_info_nhc()\nindependently load nh-\u003enh_grp. RCU protects each group\u0027s lifetime but\ndoes not make the loads observe the same group. If replacement shrinks\nthe group after the loop accepts an index, fib_info_nhc() returns NULL\nand update_or_create_fnhe() dereferences it.\n\nA deterministic probe only widened the existing window between the real\noperations. On v7.2, an RTM_NEWNEXTHOP replacement published a\none-member group after the PMTU reader accepted index 1 from a two-member\ngroup, producing:\n\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n RIP: update_or_create_fnhe+0x45/0x15b0\n\nStop when the indexed path is absent. Groups are dense, so no later\nindex exists in that snapshot. The same real-writer window completed\n114,423 PMTU iterations without an oops with this check. A reproducer\nis available on request.\n\nReplacement requires CAP_NET_ADMIN in the network namespace. Where\nunprivileged user namespaces are permitted, a local user can obtain it\nin a new user and network namespace.\n\nFixes: 7d3f3b4367f3 (\"net: ipv4: Cache pmtu for all packet paths if multipath enabled\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/4fb87ed994dfc067178fc845cdd8bc9b5446b039.1790915964.git.4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a463f55c791b96cfd12df8b10ea737d45c80bb18", "tree": "de9eda438ca104116798f2cea628b1d2a5459c9e", "parents": [ "8bc60db48e8cba35488bbd6e1f94aa990afa275a" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 02 00:13:10 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:11:49 2026 -0700" }, "message": "vsock/virtio: account only unread bytes in read_skb()\n\nAfter a partial stream receive, rx_bytes tracks the unread suffix while\nbuf_used and peer credit still cover the whole packet.\nvirtio_transport_read_skb() dequeues that packet but passes pkt_len for\nboth counters, underflowing rx_bytes.\n\nOn a connected CID_LOCAL stream with an SK_SKB verdict, a 40-byte read\nfrom a 100-byte packet made SIOCINQ report -40, an empty recv return\nELOOP, and poll report the empty socket readable. After verdict detach,\nreceiving 40 bytes wrapped the counter to zero and hid those queued bytes\nuntil one more byte arrived. The fixed run kept the counter balanced\nand exposed all queued data immediately.\n\nThis was found during an LLM-assisted manual source audit of VSOCK\nreceive accounting while re-evaluating virtio_transport_read_skb() after\nCVE-2024-50169.\n\nSubtract only skb-\u003elen minus the VSOCK offset from rx_bytes. Retain the\nfull packet length for buf_used and peer credit.\n\nFixes: 45ca7e9f0730 (\"vsock/virtio: fix `rx_bytes` accounting for stream sockets\")\nCc: stable@vger.kernel.org\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/20261001151310.4101006-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8bc60db48e8cba35488bbd6e1f94aa990afa275a", "tree": "7892fd5ad22b0b1d637e444d8cc3e32a38e0286e", "parents": [ "ab699d296e066eb64f51d2a8a1d42237a3b186c8" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Fri Oct 02 12:30:58 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 16:07:29 2026 -0700" }, "message": "ip6_gre: remove obsolete ERSPAN PMTU update\n\nA tc tunnel_key action can attach a METADATA_IP_TUNNEL dst to an skb,\nand mirred can redirect it to a native ip6erspan device. The legacy PMTU\nupdate in ip6erspan_tunnel_xmit() treats that metadata dst as a route.\nSince it has no output device, dst_dev(dst)-\u003emtu dereferences NULL.\n\nOn v7.2 with KASAN, an initial UID/GID 65534 process with CapEff 0 used\nself-created user and network namespaces to trigger:\n\n KASAN: null-ptr-deref\n RIP: ip6erspan_tunnel_xmit+0x10fc/0x2cc0\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThe update is obsolete. Commit fe1a4ca0a2b7 (\"ip6_gre: process toobig\nin a better way\") changed IPv6 GRE Too Big handling to update the\nunderlay route and removed the equivalent block from __gre6_xmit().\nip6_tnl_xmit() then propagates the underlay PMTU to the overlay route.\n\nRemove the stale ERSPAN copy and its now-unused dst variable. This\neliminates the metadata-dst dereference and keeps ERSPAN aligned with\nIPv6 GRE PMTU handling.\n\nFixes: 5a963eb61b7c (\"ip6_gre: Add ERSPAN native tunnel support\")\nCc: stable@vger.kernel.org\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261002033058.358137-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab699d296e066eb64f51d2a8a1d42237a3b186c8", "tree": "2e805ac724e4a0117bd54fb547a580f31700716a", "parents": [ "d5a007b9b457c915ab1a53227e8939e4018aa97a", "ee2d4c2d7cc18a2cd504044a75ea614e720248eb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:42 2026 -0700" }, "message": "Merge branch \u0027net-always-dissect-gso-packets-in-__virtio_net_hdr_to_skb\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: always dissect GSO packets in __virtio_net_hdr_to_skb()\n\nThis series fixes a bypass of untrusted GSO flow dissection in\n__virtio_net_hdr_to_skb() when VIRTIO_NET_HDR_F_NEEDS_CSUM is not set,\nand adds a kselftest covering VLAN-tagged GSO packets without NEEDS_CSUM:\n\n- Patch 1 fixes __skb_flow_dissect(), which computes key_control-\u003ethoff\n with min_t(u16, ...). This truncates skb-\u003elen and returns a bogus small\n transport offset when skb-\u003elen modulo 65536 is smaller than the\n transport offset. Offsets that do not fit in the u16 thoff now fail the\n dissection instead of being silently truncated.\n\n- Patch 2 initializes skb-\u003edev and skb-\u003enetwork_header before calling\n virtio_net_hdr_*_to_skb() in tun_get_user(), tun_xdp_one(),\n virtnet_receive_done(), and raw_verify_header(), removes the\n \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 condition and the unvalidated\n \u0027else if (gso_type)\u0027 fallback in __virtio_net_hdr_to_skb(), and moves\n virtio_net_hdr_match_proto() after skb_flow_dissect_flow_keys_basic()\n so it validates the dissected L3 protocol (keys.basic.n_proto) rather\n than the outer L2 protocol.\n\n- Patch 3 adds kselftests in tools/testing/selftests/net/tun.c verifying\n that VLAN-tagged (802.1Q) TCPv4 GSO packets without NEEDS_CSUM (both\n flags \u003d 0 and flags \u003d VIRTIO_NET_HDR_F_DATA_VALID) are accepted on a\n TAP device, that mismatched GSO types and truncated TCP headers without\n NEEDS_CSUM are rejected with -EINVAL, and that a 65540-byte frame is\n accepted.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261001191140.2818991-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee2d4c2d7cc18a2cd504044a75ea614e720248eb", "tree": "2e805ac724e4a0117bd54fb547a580f31700716a", "parents": [ "44378d02c5aaae24b60a75fbbb539b4aa4db503d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM\n\nAdd selftests in tun.c verifying that a VLAN-tagged (802.1Q) TCPv4 GSO\npacket without VIRTIO_NET_HDR_F_NEEDS_CSUM (both flags \u003d 0 and\nflags \u003d VIRTIO_NET_HDR_F_DATA_VALID) is accepted when written to a TAP\ndevice (/dev/net/tun with IFF_TAP | IFF_NO_PI | IFF_VNET_HDR).\n\nAlso verify that the following are rejected with -EINVAL:\n- a mismatched GSO type (VIRTIO_NET_HDR_GSO_TCPV6 on a VLAN-tagged IPv4\n packet).\n- a frame whose TCP header is truncated after 10 bytes. Pulling only\n sizeof(struct iphdr) + sizeof(struct tcphdr) bytes would accept it,\n so this requires the transport offset found by flow dissection.\n\nFinally, verify that a 65540-byte frame is accepted. Its skb-\u003elen is\nabove U16_MAX while it is flow-dissected, before eth_type_trans() pulls\nthe Ethernet header.\n\nBased on a reproducer by Michael S. Tsirkin \u003cmst@redhat.com\u003e.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-4-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "44378d02c5aaae24b60a75fbbb539b4aa4db503d", "tree": "d50f551898c442a6427a463bb828305f6308aa10", "parents": [ "99bda1ecbd56905f8bd934b9cdccd3bd251192b1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "net: always dissect GSO packets in __virtio_net_hdr_to_skb()\n\nCommit 9e8db5913264 (\"net: avoid false positives in untrusted gso\nvalidation\") added a \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 check before flow-dissecting\nGSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in\n__virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(),\ntun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called\nvirtio_net_hdr_*_to_skb() before initializing skb-\u003enetwork_header and\nskb-\u003edev.\n\nBecause __alloc_skb() and __build_skb_around() zero-initialize\nskb-\u003enetwork_header to 0 (unlike mac_header and transport_header which\nare initialized to ~0U), those four callers always had\nskb-\u003enetwork_header \u003d\u003d 0 and bypassed flow dissection in\n__virtio_net_hdr_to_skb(). More generally, skb-\u003enetwork_header is an\noffset from skb-\u003ehead (where 0 is also a valid offset whenever\nskb_headroom(skb) is 0), not a boolean flag.\n\nWhenever the \u0027if (gso_type \u0026\u0026 skb-\u003enetwork_header)\u0027 branch was skipped,\nthe fallback \u0027else if (gso_type)\u0027 only pulled nh_min_len + thlen (40 bytes\nfor TCPv4) without dissecting the packet, without validating ip_proto or\nn_proto, and without setting skb-\u003etransport_header.\n\nIf the packet has a malformed network header, it is not rejected and a\nsubsequent skb_probe_transport_header() also fails, leaving\nskb-\u003etransport_header at ~0U (0xffff). Similarly, if an IPv4 packet\ncarries IP options (ihl \u003e 5) or an IPv6 packet carries extension headers,\npulling only nh_min_len + thlen can leave the TCP header outside\nskb-\u003ehead. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen()\nreads out-of-bounds:\n\n BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen\n Read of size 2 by task poc/133\n skb_gso_transport_seglen (net/core/gso.c:155)\n skb_gso_validate_mac_len (net/core/gso.c:270)\n tbf_enqueue (net/sched/sch_tbf.c:260)\n dev_qdisc_enqueue (net/core/dev.c:4227)\n __dev_queue_xmit (net/core/dev.c:4884)\n\nIn addition, checking virtio_net_hdr_match_proto() only inside\n\u0027if (!skb-\u003eprotocol)\u0027 before flow dissection both skipped validation when\nskb-\u003eprotocol was pre-set by the caller and rejected VLAN-tagged frames\nwhose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.\n\nFix this by:\n1. Initializing skb-\u003edev and skb-\u003enetwork_header (plus skb-\u003eprotocol for\n IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),\n tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In\n tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the\n IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets\n mac_header.\n2. Removing \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 and the unvalidated\n \u0027else if (gso_type)\u0027 fallback in __virtio_net_hdr_to_skb() so all GSO\n packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have\n their transport header pulled into linear data, and have\n skb-\u003etransport_header set.\n3. Moving the virtio_net_hdr_match_proto() check to after\n skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto\n against hdr_gso_type.\n\nFixes: 9e8db5913264 (\"net: avoid false positives in untrusted gso validation\")\nFixes: d5be7f632bad (\"net: validate untrusted gso packets without csum offload\")\nFixes: 924a9bc362a5 (\"net: check if protocol extracted by virtio_net_hdr_set_proto is correct\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260927163117.746432-2-bestswngs@gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-3-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99bda1ecbd56905f8bd934b9cdccd3bd251192b1", "tree": "ac24c24ba02914076a1b150c14ed92d96b4f70e1", "parents": [ "d5a007b9b457c915ab1a53227e8939e4018aa97a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:38 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "flow_dissector: avoid u16 truncation of skb-\u003elen when computing thoff\n\n__skb_flow_dissect() computes key_control-\u003ethoff using:\n\n key_control-\u003ethoff \u003d min_t(u16, nhoff, skb ? skb-\u003elen : hlen);\n\nmin_t(u16, ...) casts both arguments to u16 before comparing them.\nWhenever skb-\u003elen (or hlen) modulo 65536 is smaller than nhoff, the\ntruncated length wins and thoff is set to a bogus small value, even\nwhen the dissection succeeded. For example, an IPv4/TCP frame with\nskb-\u003elen \u003d\u003d 65540 and nhoff \u003d\u003d 34 gets thoff \u003d\u003d 4, so callers such as\nskb_probe_transport_header() point the transport header inside the\nEthernet header.\n\nSuch skbs are not exotic:\n- At the time of commit d0c081b49137 (\"flow_dissector: properly cap\n thoff field\"), AF_PACKET with PACKET_VNET_HDR could already build GSO\n skbs larger than 64KB (MTU checks are skipped for GSO, and\n alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0\n pages on top of the linear part).\n- BIG TCP now makes skbs larger than 64KB common.\n- The following patch makes tun_get_user() dissect IFF_TAP frames\n before eth_type_trans() pulls the Ethernet header, so a GSO frame\n carrying a 65522..65535 byte L3 packet will be dissected with\n skb-\u003elen in [65536, 65549].\n\nCompare as u32 instead. If the resulting offset cannot be represented\nin the u16 key_control-\u003ethoff, cap it to U16_MAX and report the\ndissection as failed rather than silently returning a wrong transport\noffset. thoff is still set on failure, as some callers (such as\neth_get_headlen()) use it regardless of the return value.\n\nFixes: d0c081b49137 (\"flow_dissector: properly cap thoff field\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-2-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b8eb5fd5bdb4c03758b056c70e5e1d962ca89757", "tree": "abe8cbb62fa109a01525581d4033fbabfc7c60e1", "parents": [ "23b1ab15ca91f2cffaf149d9bb0fafeb700c7db2" ], "author": { "name": "Waiman Long", "email": "longman@redhat.com", "time": "Mon Oct 05 06:43:10 2026 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Oct 06 06:36:51 2026 -1000" }, "message": "cgroup/cpuset: Call is_in_v2_mode() after acquiring cpuset_mutex in cpuset_handle_hotplug()\n\nIt is reported by sashiko that calling is_in_v2_mode() outside of\ncpuset_mutex critical section in cpuset_handle_hotplug() can introduce\na TOCTOU race where cgroup hierarchy may have changed from v1 to v2 or\nvice versa after is_in_v2_mode() is called leading to erroneously skip\nthe allocation of tmpmasks or incorrectly modify cpus_allowed masks,\nresulting in cpuset state corruption. Fix that by calling is_in_v2_mode()\nafter acquiring the cpuset_mutex.\n\nFixes: b8d1b8ee93df (\"cpuset: Allow v2 behavior in v1 cgroup\")\nSigned-off-by: Waiman Long \u003clongman@redhat.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "69f80fef3153299d9c72c53d1d71eef6354b6926", "tree": "617ff447861f864741afb01900aa34d651328719", "parents": [ "22430ae5d90ab288b0ee2ad99ae941f4a666b694", "bc8ce2cea5f77c4bd1a5184705e300e83546c0c4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 06 16:10:57 2026 +0200" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Oct 06 16:10:57 2026 +0200" }, "message": "Merge tag \u0027ata-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Set CHECK CONDITION for failed ATAPI commands.\n\n Since commit 2e1d2e65e773 (\"ata: libata-scsi: terminate deferred\n commands on time out\") failed ATAPI commands incorrectly stopped\n having CHECK CONDITION set for commands that had a SCSI midlayer\n byte set by scsi_check_sense(). SG_IO users therefore saw failed\n ATAPI commands as successful (Hengyu)\n\n* tag \u0027ata-7.3-rc7\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: libata-scsi: do not lose CHECK CONDITION for failed ATAPI commands\n" }, { "commit": "05165f7b3b9ab6817fe216c24f90755b7c5e15f3", "tree": "f015a5d505fb32f0264a34a39dee903466ec3d90", "parents": [ "d24e8ac715de2e16a53c144005b1863660a5fbea" ], "author": { "name": "Yingying Tang", "email": "yingying.tang@oss.qualcomm.com", "time": "Thu Jun 11 20:23:32 2026 -0700" }, "committer": { "name": "Jeff Johnson", "email": "jeff.johnson@oss.qualcomm.com", "time": "Tue Oct 06 06:42:17 2026 -0700" }, "message": "Revert \"wifi: ath12k: add panic handler\"\n\nath12k_core_panic_handler() is invoked via atomic_notifier_call_chain(),\nwhich runs inside an RCU read-side critical section. The current code calls\nath12k_pci_sw_reset() synchronously from this context, which eventually\nreaches mhi_device_get_sync() and schedule_timeout(), triggering a voluntary\ncontext switch within RCU.\n\nCall trace:\nrcu_note_context_switch+0x4c4/0x508 (P)\n__schedule+0xbc/0x1204\nschedule+0x34/0x110\nschedule_timeout+0x84/0x11c\n__mhi_device_get_sync+0x164/0x228 [mhi]\nmhi_device_get_sync+0x1c/0x3c [mhi]\nath12k_wifi7_pci_bus_wake_up+0x20/0x2c [ath12k_wifi7]\nath12k_pci_read32+0x58/0x350 [ath12k]\nath12k_pci_clear_dbg_registers+0x28/0xb8 [ath12k]\nath12k_pci_panic_handler+0x20/0x44 [ath12k] ath12k_core_panic_handler+0x28/0x3c [ath12k]\nnotifier_call_chain+0x78/0x1c0\natomic_notifier_call_chain+0x3c/0x5c\n\nRevert change \"wifi: ath12k: add panic handler\" to avoid this issue.\n\nTested-on: WCN7850 hw2.0 PCI WLAN.HMT.1.1.c7-00108-QCAHMTSWPL_V1.0_V2.0_SILICONZ_UPSTREAM-3\n\nSigned-off-by: Yingying Tang \u003cyingying.tang@oss.qualcomm.com\u003e\nTested-by: Joonhoe Kim \u003c26rote@gmail.com\u003e\nReviewed-by: Rameshkumar Sundaram \u003crameshkumar.sundaram@oss.qualcomm.com\u003e\nFixes: 809055628bce (\"wifi: ath12k: add panic handler\")\nLink: https://patch.msgid.link/20260612032332.2278338-1-yingying.tang@oss.qualcomm.com\nSigned-off-by: Jeff Johnson \u003cjeff.johnson@oss.qualcomm.com\u003e\n" }, { "commit": "5e99bdb94720331e2fd38c10c5b1afa1ce640835", "tree": "f6d0ac4ac699d9a40cf53d4176c063656adb713f", "parents": [ "32d1a000e99612e010335760363936d85591fd69" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Wed Aug 26 00:17:10 2026 +0100" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: do not delete Rx reorder entries under RCU\n\nThe RCU guard is declared in the body of the per-TID loop, so it is still\nheld across the teardown pass. nxpwifi_del_rx_reorder_entry() flushes the\nRx workqueue and deletes the reorder timer synchronously, both of which\nsleep, so a station deauthenticating from the AP splats under\nCONFIG_DEBUG_ATOMIC_SLEEP.\n\nScope the guard to the collection walk. The teardown does not need RCU: it\nserialises on priv-\u003erx_reorder_tbl_lock[] and frees with kfree_rcu().\n\nFixes: 73b01e57ed3e (\"wifi: nxp: add nxpwifi driver for IW61x\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" }, { "commit": "32d1a000e99612e010335760363936d85591fd69", "tree": "fcaab94ce70ecc6dc235a590585b97416cd6ebcd", "parents": [ "7fa5fb9976c4532007a666624dc241021f74c8a9" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Wed Aug 26 00:17:09 2026 +0100" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: fix inverted check in Tx BA stream entry deletion\n\nnxpwifi_is_tx_ba_stream_ptr_valid() returns true when the entry is still\nlinked, and every caller passes an entry that is on the list, so the early\nreturn always fires and nothing is ever unlinked or freed. Entries leak on\nevery teardown and, since nxpwifi_space_avail_for_new_ba_stream() counts\nthem, Tx aggregation stops being negotiated once the stale count reaches\nthe maximum.\n\nChanging the original dead \u0026\u0026 test to || to silence a NULL dereference\nreport inverted the validity test along with it.\n\nFixes: 00c786a7581e (\"wifi: nxpwifi: fix multiple static analysis errors and warnings\")\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" }, { "commit": "7fa5fb9976c4532007a666624dc241021f74c8a9", "tree": "c6a62156769397d0fec47c5507493ed957932f89", "parents": [ "7769bb2457fcfa8216aeae84f32cb7084cab5637" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Thu Aug 20 16:16:34 2026 +0800" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: handle authentication frame allocation failures\n\nnxpwifi_cfg80211_authenticate() allocates the buffer it builds the\nmanagement frame in and never checks the result:\n\n\tmgmt \u003d kzalloc(frame_len, GFP_KERNEL);\n\n\tskb \u003d dev_alloc_skb(...);\n\tif (!skb) {\n\t\t...\n\t\treturn -ENOMEM;\n\t}\n\t...\n\tmemcpy(mgmt-\u003eda, req-\u003ebss-\u003ebssid, ETH_ALEN);\n\nOn allocation failure the memcpy() a dozen lines later dereferences NULL.\nThe same sequence leaks mgmt when dev_alloc_skb() fails: that path\nreturns without freeing it, while the success path drops it after\nnxpwifi_form_mgmt_frame().\n\nBail out when the allocation fails, and free it before returning on the\nskb error path.\n\nFixes: 73b01e57ed3e (\"wifi: nxp: add nxpwifi driver for IW61x\")\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" }, { "commit": "7769bb2457fcfa8216aeae84f32cb7084cab5637", "tree": "053287109c7bebb5efb5afc2d8e495d5ca375aab", "parents": [ "050f03bb0effd773c877cfba3b651c6d380b1c15" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Thu Aug 20 16:16:33 2026 +0800" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: fix the authentication frame length handling\n\nnxpwifi_cfg80211_authenticate() builds a 3-address management frame in a\ntemporary buffer and hands it to nxpwifi_form_mgmt_frame(), which copies\nit into the skb and splices in address4. The frame length is tracked in\na single u16 that conflates the two lengths, and it gets both wrong.\n\nTruncation. req-\u003eie_len and req-\u003eauth_data_len are both size_t. The IE\npolicy caps req-\u003eie_len at IEEE80211_MAX_DATA_LEN, but\nNL80211_ATTR_AUTH_DATA only has a four-byte minimum length policy. Since\nnla_len is a u16, a single authentication data attribute can carry up to\n65531 bytes, enough for the combined frame length to exceed U16_MAX\nbefore it is assigned to pkt_len. With auth_data_len \u003d\u003d 65510 and no IEs\nthe length wraps to 6, kzalloc(6) succeeds, and the memcpy() below then\nwrites 65506 user-provided bytes past a 6-byte heap object.\n\nGeometry. NXPWIFI_MGMT_HEADER_LEN is 30, which is the 24-byte 3-address\nheader plus the address4 that the firmware expects. The temporary buffer\nonly holds a struct ieee80211_hdr_3addr, so six of the bytes accounted\nfor are never used, and passing that length to nxpwifi_form_mgmt_frame()\nmakes it append ETH_ALEN on top of a length that already included it.\nThe skb is sized without those six bytes, so the last skb_put_data()\noverruns the tailroom by exactly ETH_ALEN. It usually goes unnoticed\nbecause SKB_DATA_ALIGN() rounding leaves slack. The driver\u0027s other\ncaller of the helper, nxpwifi_cfg80211_mgmt_tx(), adds ETH_ALEN to the\nskb size before allocating and passes the 3-address length, which is what\nthis path should do too.\n\nKeep the two lengths apart. frame_len is the 3-address frame the driver\nbuilds: it sizes the temporary buffer and is what the helper is told.\npkt_len is what the firmware sees, frame_len plus address4: it sizes the\nskb and goes into tx_info. Computing frame_len in size_t and rejecting\nanything that cannot be represented once ETH_ALEN is added removes the\nwrap.\n\nThe value handed to the firmware is unchanged, so this is not a\nbehavioural change for frames that were already valid. A tighter 802.11\nbound may make sense, but that depends on the firmware\u0027s frame format and\nis a separate decision.\n\nFixes: 73b01e57ed3e (\"wifi: nxp: add nxpwifi driver for IW61x\")\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" }, { "commit": "050f03bb0effd773c877cfba3b651c6d380b1c15", "tree": "b1538a07acb461b879901bc71a894e5767d12f37", "parents": [ "d68d6d8d8bbb5596909479dc6cac58132d8f0dbf" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Thu Aug 13 16:23:15 2026 +0800" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: zero the channel statistics array\n\nadapter-\u003echan_stats comes from vmalloc(), which does not clear the\nmemory, and nxpwifi_cfg80211_dump_survey() reads it as soon as user\nspace asks for survey data. For the entries no scan has filled in, a\nnon-zero cca_scan_dur passes the validity check and stale bytes are\nreported to user space as noise, time and time_busy.\n\nUse kcalloc() instead. The array holds two entries per supported\nchannel, small enough not to need vmalloc(), and the two callers change\nto kfree() accordingly.\n\nmwifiex fixed the same issue in commit 0e20450829ca (\"wifi: mwifiex:\nInitialize the chan_stats array to zero\").\n\nFixes: 73b01e57ed3e (\"wifi: nxp: add nxpwifi driver for IW61x\")\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nReviewed-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" }, { "commit": "d68d6d8d8bbb5596909479dc6cac58132d8f0dbf", "tree": "1856b369c427c9e3beed94e2ace6f0cac938d7ce", "parents": [ "5c9260d7c6990875fc788ebb86ea2bf08b492704" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Thu Aug 13 16:23:14 2026 +0800" }, "committer": { "name": "Jeff Chen", "email": "jeff.chen_1@nxp.com", "time": "Tue Oct 06 21:13:54 2026 +0800" }, "message": "wifi: nxpwifi: free the aggregation buffer when the RA list disappears\n\nnxpwifi_11n_aggregate_pkt() drops ra_list_spinlock while it copies each\nsubframe, so it rechecks the RA list after taking the lock again. The\ncheck inside the aggregation loop returns without releasing the\nskb_aggr it has been filling, leaking one tx_buf_size buffer along with\nthe subframes already aggregated into it.\n\nRelease skb_aggr there, the way the same check on the -EBUSY path\nalready does.\n\nmwifiex fixed the same issue in commit 990a73dec3fd (\"wifi: mwifiex: Fix\nmemory leak in mwifiex_11n_aggregate_pkt()\").\n\nFixes: 73b01e57ed3e (\"wifi: nxp: add nxpwifi driver for IW61x\")\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nReviewed-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\nSigned-off-by: Jeff Chen \u003cjeff.chen_1@nxp.com\u003e\n" } ], "next": "5c9260d7c6990875fc788ebb86ea2bf08b492704" }