)]}' { "log": [ { "commit": "ab699d296e066eb64f51d2a8a1d42237a3b186c8", "tree": "2e805ac724e4a0117bd54fb547a580f31700716a", "parents": [ "d5a007b9b457c915ab1a53227e8939e4018aa97a", "ee2d4c2d7cc18a2cd504044a75ea614e720248eb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:42 2026 -0700" }, "message": "Merge branch \u0027net-always-dissect-gso-packets-in-__virtio_net_hdr_to_skb\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: always dissect GSO packets in __virtio_net_hdr_to_skb()\n\nThis series fixes a bypass of untrusted GSO flow dissection in\n__virtio_net_hdr_to_skb() when VIRTIO_NET_HDR_F_NEEDS_CSUM is not set,\nand adds a kselftest covering VLAN-tagged GSO packets without NEEDS_CSUM:\n\n- Patch 1 fixes __skb_flow_dissect(), which computes key_control-\u003ethoff\n with min_t(u16, ...). This truncates skb-\u003elen and returns a bogus small\n transport offset when skb-\u003elen modulo 65536 is smaller than the\n transport offset. Offsets that do not fit in the u16 thoff now fail the\n dissection instead of being silently truncated.\n\n- Patch 2 initializes skb-\u003edev and skb-\u003enetwork_header before calling\n virtio_net_hdr_*_to_skb() in tun_get_user(), tun_xdp_one(),\n virtnet_receive_done(), and raw_verify_header(), removes the\n \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 condition and the unvalidated\n \u0027else if (gso_type)\u0027 fallback in __virtio_net_hdr_to_skb(), and moves\n virtio_net_hdr_match_proto() after skb_flow_dissect_flow_keys_basic()\n so it validates the dissected L3 protocol (keys.basic.n_proto) rather\n than the outer L2 protocol.\n\n- Patch 3 adds kselftests in tools/testing/selftests/net/tun.c verifying\n that VLAN-tagged (802.1Q) TCPv4 GSO packets without NEEDS_CSUM (both\n flags \u003d 0 and flags \u003d VIRTIO_NET_HDR_F_DATA_VALID) are accepted on a\n TAP device, that mismatched GSO types and truncated TCP headers without\n NEEDS_CSUM are rejected with -EINVAL, and that a 65540-byte frame is\n accepted.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261001191140.2818991-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee2d4c2d7cc18a2cd504044a75ea614e720248eb", "tree": "2e805ac724e4a0117bd54fb547a580f31700716a", "parents": [ "44378d02c5aaae24b60a75fbbb539b4aa4db503d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "selftests: net: tun: add test for VLAN-tagged GSO without NEEDS_CSUM\n\nAdd selftests in tun.c verifying that a VLAN-tagged (802.1Q) TCPv4 GSO\npacket without VIRTIO_NET_HDR_F_NEEDS_CSUM (both flags \u003d 0 and\nflags \u003d VIRTIO_NET_HDR_F_DATA_VALID) is accepted when written to a TAP\ndevice (/dev/net/tun with IFF_TAP | IFF_NO_PI | IFF_VNET_HDR).\n\nAlso verify that the following are rejected with -EINVAL:\n- a mismatched GSO type (VIRTIO_NET_HDR_GSO_TCPV6 on a VLAN-tagged IPv4\n packet).\n- a frame whose TCP header is truncated after 10 bytes. Pulling only\n sizeof(struct iphdr) + sizeof(struct tcphdr) bytes would accept it,\n so this requires the transport offset found by flow dissection.\n\nFinally, verify that a 65540-byte frame is accepted. Its skb-\u003elen is\nabove U16_MAX while it is flow-dissected, before eth_type_trans() pulls\nthe Ethernet header.\n\nBased on a reproducer by Michael S. Tsirkin \u003cmst@redhat.com\u003e.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-4-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "44378d02c5aaae24b60a75fbbb539b4aa4db503d", "tree": "d50f551898c442a6427a463bb828305f6308aa10", "parents": [ "99bda1ecbd56905f8bd934b9cdccd3bd251192b1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "net: always dissect GSO packets in __virtio_net_hdr_to_skb()\n\nCommit 9e8db5913264 (\"net: avoid false positives in untrusted gso\nvalidation\") added a \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 check before flow-dissecting\nGSO packets without VIRTIO_NET_HDR_F_NEEDS_CSUM in\n__virtio_net_hdr_to_skb(), because some callers (such as tun_get_user(),\ntun_xdp_one(), virtnet_receive_done(), and raw_verify_header()) called\nvirtio_net_hdr_*_to_skb() before initializing skb-\u003enetwork_header and\nskb-\u003edev.\n\nBecause __alloc_skb() and __build_skb_around() zero-initialize\nskb-\u003enetwork_header to 0 (unlike mac_header and transport_header which\nare initialized to ~0U), those four callers always had\nskb-\u003enetwork_header \u003d\u003d 0 and bypassed flow dissection in\n__virtio_net_hdr_to_skb(). More generally, skb-\u003enetwork_header is an\noffset from skb-\u003ehead (where 0 is also a valid offset whenever\nskb_headroom(skb) is 0), not a boolean flag.\n\nWhenever the \u0027if (gso_type \u0026\u0026 skb-\u003enetwork_header)\u0027 branch was skipped,\nthe fallback \u0027else if (gso_type)\u0027 only pulled nh_min_len + thlen (40 bytes\nfor TCPv4) without dissecting the packet, without validating ip_proto or\nn_proto, and without setting skb-\u003etransport_header.\n\nIf the packet has a malformed network header, it is not rejected and a\nsubsequent skb_probe_transport_header() also fails, leaving\nskb-\u003etransport_header at ~0U (0xffff). Similarly, if an IPv4 packet\ncarries IP options (ihl \u003e 5) or an IPv6 packet carries extension headers,\npulling only nh_min_len + thlen can leave the TCP header outside\nskb-\u003ehead. In both cases, tcp_hdrlen(skb) in skb_gso_transport_seglen()\nreads out-of-bounds:\n\n BUG: KASAN: slab-out-of-bounds in skb_gso_transport_seglen\n Read of size 2 by task poc/133\n skb_gso_transport_seglen (net/core/gso.c:155)\n skb_gso_validate_mac_len (net/core/gso.c:270)\n tbf_enqueue (net/sched/sch_tbf.c:260)\n dev_qdisc_enqueue (net/core/dev.c:4227)\n __dev_queue_xmit (net/core/dev.c:4884)\n\nIn addition, checking virtio_net_hdr_match_proto() only inside\n\u0027if (!skb-\u003eprotocol)\u0027 before flow dissection both skipped validation when\nskb-\u003eprotocol was pre-set by the caller and rejected VLAN-tagged frames\nwhose outer L2 protocol is ETH_P_8021Q or ETH_P_8021AD.\n\nFix this by:\n1. Initializing skb-\u003edev and skb-\u003enetwork_header (plus skb-\u003eprotocol for\n IFF_TUN) before virtio_net_hdr_*_to_skb() in tun_get_user(),\n tun_xdp_one(), virtnet_receive_done(), and raw_verify_header(). In\n tun_get_user(), drop the redundant skb_reset_mac_header(skb) in the\n IFF_TUN case since __virtio_net_hdr_to_skb() unconditionally resets\n mac_header.\n2. Removing \u0027\u0026\u0026 skb-\u003enetwork_header\u0027 and the unvalidated\n \u0027else if (gso_type)\u0027 fallback in __virtio_net_hdr_to_skb() so all GSO\n packets without VIRTIO_NET_HDR_F_NEEDS_CSUM are flow-dissected, have\n their transport header pulled into linear data, and have\n skb-\u003etransport_header set.\n3. Moving the virtio_net_hdr_match_proto() check to after\n skb_flow_dissect_flow_keys_basic(), validating keys.basic.n_proto\n against hdr_gso_type.\n\nFixes: 9e8db5913264 (\"net: avoid false positives in untrusted gso validation\")\nFixes: d5be7f632bad (\"net: validate untrusted gso packets without csum offload\")\nFixes: 924a9bc362a5 (\"net: check if protocol extracted by virtio_net_hdr_set_proto is correct\")\nReported-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260927163117.746432-2-bestswngs@gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nCc: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-3-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99bda1ecbd56905f8bd934b9cdccd3bd251192b1", "tree": "ac24c24ba02914076a1b150c14ed92d96b4f70e1", "parents": [ "d5a007b9b457c915ab1a53227e8939e4018aa97a" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 19:11:38 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 06 15:35:40 2026 -0700" }, "message": "flow_dissector: avoid u16 truncation of skb-\u003elen when computing thoff\n\n__skb_flow_dissect() computes key_control-\u003ethoff using:\n\n key_control-\u003ethoff \u003d min_t(u16, nhoff, skb ? skb-\u003elen : hlen);\n\nmin_t(u16, ...) casts both arguments to u16 before comparing them.\nWhenever skb-\u003elen (or hlen) modulo 65536 is smaller than nhoff, the\ntruncated length wins and thoff is set to a bogus small value, even\nwhen the dissection succeeded. For example, an IPv4/TCP frame with\nskb-\u003elen \u003d\u003d 65540 and nhoff \u003d\u003d 34 gets thoff \u003d\u003d 4, so callers such as\nskb_probe_transport_header() point the transport header inside the\nEthernet header.\n\nSuch skbs are not exotic:\n- At the time of commit d0c081b49137 (\"flow_dissector: properly cap\n thoff field\"), AF_PACKET with PACKET_VNET_HDR could already build GSO\n skbs larger than 64KB (MTU checks are skipped for GSO, and\n alloc_skb_with_frags() accepted up to MAX_SKB_FRAGS (17) order-0\n pages on top of the linear part).\n- BIG TCP now makes skbs larger than 64KB common.\n- The following patch makes tun_get_user() dissect IFF_TAP frames\n before eth_type_trans() pulls the Ethernet header, so a GSO frame\n carrying a 65522..65535 byte L3 packet will be dissected with\n skb-\u003elen in [65536, 65549].\n\nCompare as u32 instead. If the resulting offset cannot be represented\nin the u16 key_control-\u003ethoff, cap it to U16_MAX and report the\ndissection as failed rather than silently returning a wrong transport\noffset. thoff is still set on failure, as some callers (such as\neth_get_headlen()) use it regardless of the return value.\n\nFixes: d0c081b49137 (\"flow_dissector: properly cap thoff field\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261001191140.2818991-2-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5a007b9b457c915ab1a53227e8939e4018aa97a", "tree": "7910c5b317a8ddf063304caad26bab161a1139b0", "parents": [ "7e170da2edec9fb0717543571cc14b0aabee2b46" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 18:19:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 18:19:42 2026 -0700" }, "message": "Revert \"net: stmmac: propagate PTP addend and system time programming errors\"\n\nThis reverts commit 232d49dd4b40a666283de9e722899f088ed581b2.\n\nAnirudh reports a regression from this change.\n\nIt is not appropriate for net this late in the release cycle\nin the first place, so let\u0027s revert and revisit in net-next.\n\nReported-by: Anirudh Srinivasan \u003casrinivasan@oss.tenstorrent.com\u003e\nLink: https://lore.kernel.org/CAEev2e8+fr1tJnSErD+2TtLDw5fGJbQOMcM5eefMnLyFUR+m7w@mail.gmail.com\nFixes: 232d49dd4b40 (\"net: stmmac: propagate PTP addend and system time programming errors\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7e170da2edec9fb0717543571cc14b0aabee2b46", "tree": "7ec786abccb48beb444a9a3598e3711e1b6dc6ec", "parents": [ "73abd7db0c3f93d8968ce67b4d431a51200dc80f" ], "author": { "name": "Leto Liu (刘涛)", "email": "Leto.Liu@airoha.com", "time": "Wed Sep 30 08:58:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 17:45:01 2026 -0700" }, "message": "net: airoha: Add retry mechanism to airoha_qdma_set_trtcm_param()\n\nCPU accesses QDMA via the bus. When multiple modules are using the bus\nsimultaneously, CPU access to QDMA may encounter bus timeouts and fails,\nresulting in QDMA configuration failures and potentially causing packet\ntransmission issues. In order to mitigate the issue, introduce a retry\nmechanism to airoha_qdma_set_trtcm_param routine in order to ensure the\nconfiguration is correctly applied to the hardware.\n\nIt\u0027s enough to try a second time for the TRTCM config to be actually\napplied to make sure we are not in the middle of bucket handling as it does\noperate on fixed time slot internally.\n\nFixes: ef1ca9271313b (\"net: airoha: Add sched HTB offload support\")\nSigned-off-by: Leto Liu (刘涛) \u003cLeto.Liu@airoha.com\u003e\n[ improve commit description, drop memory block, apply better loop logic]\nSigned-off-by: Christian Marangi \u003cansuelsmth@gmail.com\u003e\nLink: https://patch.msgid.link/20260930065855.46171-1-ansuelsmth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "73abd7db0c3f93d8968ce67b4d431a51200dc80f", "tree": "6c2bcf3bb3fe2cb4ff16bbe4e2224e96ea97dfd3", "parents": [ "d4bfe16cbd1d05a8584b8604de28cb323cce1801", "0cb6939a4dfefa822007b7a71986e06bc4f61f54" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:58:14 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 17:00:07 2026 -0700" }, "message": "Merge branch \u0027gve-various-xdp-fixes\u0027\n\nJoshua Washington says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngve: various XDP fixes\n\nThis patch series consists of a number of small XDP-related fixes.\n\nThese changes are split off from\nhttps://lore.kernel.org/20260922194533.631387-1-joshwash@google.com\nin an effort to prevent blocking relatively simple fixes on more complex\nfixes that will need more feedback to merge.\n\nA summary of the changes:\n1) fix an issue where XSK buffers that have not been processed are\n leaked when disabling XSK pools\n2) fix an XSK buffer leak when an RX error descriptor comes back from\n the hardware\n3) fix a deadlock introduced by attempting to acquire the netdev lock\n after it has already been acquired\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260930214735.3288780-1-joshwash@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0cb6939a4dfefa822007b7a71986e06bc4f61f54", "tree": "6c2bcf3bb3fe2cb4ff16bbe4e2224e96ea97dfd3", "parents": [ "9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Wed Sep 30 14:47:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:59:56 2026 -0700" }, "message": "gve: fix napi_disable deadlock when attempting to disable XSK pools\n\nWhen disabling XSK pools, GVE calls the unlocked versions of\nnapi_disable and napi_enable. However, the netdev lock has already been\nacquired before ndo_bpf is called because GVE supports queue management\nops. Calling the unlocked versions of napi_disable/enable results in a\ndeadlock when attempting to disable XSK pools, as the thread attempts to\nre-acquire a lock it already holds.\n\nUpdate the NAPI calls to use the locked versions.\n\nThis issue was found in production.\n\nFixes: 606048cbd834 (\"net: designate XSK pool pointers in queues as \"ops protected\"\")\nCc: stable@vger.kernel.org\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nLink: https://patch.msgid.link/20260930214735.3288780-4-joshwash@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9fed6a8ab8a5bacba2c709cb19d2dd6d2fa9112e", "tree": "a0d8895f85f7e7583ec4e213991940bffd05ceb1", "parents": [ "73670ddb91a4d22e1deb3efd962242de1ec48e90" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Wed Sep 30 14:47:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:59:36 2026 -0700" }, "message": "gve: fix XSK buffer leak on error descriptor\n\nWhen the error bit is set in the RX completion descriptor, the buf_state\nand its attached buffer should be freed. In the case of AF_XDP ZC, the\nXSK buffer was not freed, leading to a leak.\n\nThis issue was caught by LLM.\n\nFixes: c1fffc5d66a7 (\"gve: implement DQO RX datapath and control path for AF_XDP zero-copy\")\nCc: stable@vger.kernel.org\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nReviewed-by: Tim Hostetler \u003cthostet@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nLink: https://patch.msgid.link/20260930214735.3288780-3-joshwash@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "73670ddb91a4d22e1deb3efd962242de1ec48e90", "tree": "83ea28e61024d1d66945a83ad457e1d83ec0106e", "parents": [ "d4bfe16cbd1d05a8584b8604de28cb323cce1801" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Wed Sep 30 14:47:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:59:18 2026 -0700" }, "message": "gve: fix XSK buffer leak when rings are stopped\n\nGVE does not free XSK buffers when resetting ring state as a part of\nstopping queues. This causes all XSK buffers which are posted to the\nNIC to be leaked.\n\nFree XSK buffers attached to an allocated buf_state when stopping rings.\n\nThis issue was hit in production.\n\nFixes: c1fffc5d66a7 (\"gve: implement DQO RX datapath and control path for AF_XDP zero-copy\")\nCc: stable@vger.kernel.org\nReviewed-by: Tim Hostetler \u003cthostet@google.com\u003e\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nLink: https://patch.msgid.link/20260930214735.3288780-2-joshwash@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d4bfe16cbd1d05a8584b8604de28cb323cce1801", "tree": "0f4e5e8aeeb24b239d599a9787c11932ff70aa59", "parents": [ "e3f33b0a1d89d738e2b913dab519226eaf76e15b", "da17990421d79f1bfb4142f9d767fd33daecc3d8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "message": "Merge branch \u0027net-stmmac-fix-double-vlan-802-1ad-tag-handling\u0027\n\nOvidiu Panait says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: Fix double VLAN 802.1ad tag handling\n\nCurrently, hardware VLAN stripping is broken for 802.1ad tags. vlan_rx_hw()\nhardcodes ETH_P_8021Q when putting the hardware tag into the skb, rather\nthan using the actual protocol from the packet. Because of this, packets\nthat contain an 802.1ad outer tag are incorrectly passed up the stack as\nhaving an 802.1Q tag.\n\nThis issue was observed on the Renesas RZ/V2H platform (which has a dwmac4\nIP), when testing QinQ ping:\n\n # DUT\n ip link add link end0 name end0.100 type vlan proto 802.1ad id 100\n ip link add link end0.100 name end0.100.200 type vlan proto 802.1q id 200\n ip addr add 172.16.3.2/24 dev end0.100.200\n ip link set end0 up\n ip link set end0.100 up\n ip link set end0.100.200 up\n\n # Peer\n ip link add link eth0 name eth0.100 type vlan proto 802.1ad id 100\n ip link add link eth0.100 name eth0.100.200 type vlan proto 802.1q id 200\n ip addr add 172.16.3.1/24 dev eth0.100.200\n ip link set eth0 up\n ip link set eth0.100 up\n ip link set eth0.100.200 up\n ping 172.16.3.2\n -- FAIL --\n\nNote that this series only fixes the issue on dwmac4. dwxgmac2 has the same\nissue but I do not have access to hw to test on.\n\nSince dwmac4 does not expose the tag type in the RDES3 descriptor, it\ncannot support hardware S-Tag stripping correctly. This series\ndisables S-tag stripping for it, so the 802.1ad tags are left in\nplace and are handled by the software VLAN path.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260928203441.34876-1-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "da17990421d79f1bfb4142f9d767fd33daecc3d8", "tree": "0f4e5e8aeeb24b239d599a9787c11932ff70aa59", "parents": [ "c63ce7b9c7e7b68267899e4a0fc14b35d2c1dfcc" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Mon Sep 28 20:34:41 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "message": "net: stmmac: Disable S-Tag processing on dwmac4\n\nCurrently, hardware VLAN stripping is broken for 802.1ad tags. vlan_rx_hw()\nhardcodes ETH_P_8021Q when putting the hardware tag into the skb, rather\nthan using the actual protocol from the packet. Because of this, packets\nthat contain a 802.1ad outer tag are incorrectly passed up the stack as\nhaving an 802.1Q tag. This causes QinQ ping between two hosts to fail.\n\nvlan_rx_hw() is shared by dwxgmac2 and dwmac4: on dwxgmac2 the tag type\nis available in the RDES3 write-back descriptor (the ET_LT field), so the\nouter tag type can be determined based on that info. However, dwmac4\ndoesn\u0027t seem to provide the tag type. The Length/Type field in RDES3 only\nindicates whether the packet is single or double-tagged, not which tag\ntype was stripped.\n\nSince dwmac4 cannot report the stripped tag type, it cannot support\nhardware S-Tag stripping correctly. Therefore, restrict the\nNETIF_F_HW_VLAN_STAG_RX and NETIF_F_HW_VLAN_STAG_FILTER advertisement\nto dwxgmac2 only.\n\nWith this, 802.1ad tags are left in place and handled by the software\nVLAN path.\n\nFixes: 750011e239a5 (\"net: stmmac: Add support for HW-accelerated VLAN stripping\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260928203441.34876-6-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c63ce7b9c7e7b68267899e4a0fc14b35d2c1dfcc", "tree": "5a4e909282397d855be2ffa46394fc515aa7179d", "parents": [ "354b07bc1dcaa94b40a5904159c1a53b33d7cf59" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Mon Sep 28 20:34:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "message": "net: stmmac: Do not advertise S-VLAN stripping when it is disabled\n\nC-VLAN and S-VLAN tag stripping are both controlled by the EVLS bit,\nso disabling rx-vlan-offload also disables S-VLAN tag stripping.\nHowever, rx-vlan-stag-hw-parse keeps being advertised as enabled:\n\nroot@rzv2h-evk:~# ethtool -K end1 rx-vlan-offload off\nroot@rzv2h-evk:~# ethtool -k end1 | grep -i vlan\nrx-vlan-offload: off\ntx-vlan-offload: off [fixed]\nrx-vlan-filter: on [fixed]\nvlan-challenged: off [fixed]\ntx-vlan-stag-hw-insert: off [fixed]\nrx-vlan-stag-hw-parse: on [fixed]\nrx-vlan-stag-filter: on [fixed]\n\nFix this inconsistency by making NETIF_F_HW_VLAN_STAG_RX follow\nNETIF_F_HW_VLAN_CTAG_RX.\n\nFixes: 750011e239a5 (\"net: stmmac: Add support for HW-accelerated VLAN stripping\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260928203441.34876-5-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "354b07bc1dcaa94b40a5904159c1a53b33d7cf59", "tree": "8f3910e14da91fc1a5b7eea4fd40630e93fbc8d2", "parents": [ "69aa9e76677c97ba992df03a3c74d839470e7363" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Mon Sep 28 20:34:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "message": "net: stmmac: Rename double VLAN references to svlan\n\nThe ESVL and DOVLTC bits control S-VLAN tag processing and have\nnothing to do with the double VLAN feature, which only provides a way\nto process an additional inner VLAN tag. However, the driver code\nthat handles them always refers to \"double VLAN\", which is unrelated\nand makes the implementation confusing. The driver does not use any\nof the inner VLAN tag features, and the networking core does not\nsupport offloads for the inner tag anyway.\n\nTo reduce the confusion regarding S-Tag vs double VLAN handling,\nrename double -\u003e svlan.\n\nNo functional change intended.\n\nSuggested-by: Joseph Steel \u003crecv.jo@gmail.com\u003e\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260928203441.34876-4-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "69aa9e76677c97ba992df03a3c74d839470e7363", "tree": "69c949b8fca5ef486dd18e4ca3b5b9581ac7fa00", "parents": [ "11705541e7d421706a54f7f6ead8a3316c91c2bc" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Mon Sep 28 20:34:38 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:45 2026 -0700" }, "message": "net: stmmac: Stop toggling the EDVLP bit\n\nCurrently, the double VLAN EDVLP bit is toggled whenever an 802.1ad VLAN\nis registered. This bit enables processing of the inner VLAN tag, which\nis completely unrelated to S-Tag VLAN handling.\n\nMove EDVLP handling into vlan_set_hw_mode() instead, and keep it always\nenabled, so that COE can work for packets with an inner VLAN header.\nAdd a dedicated callback for dwxlgmac2, as it doesn\u0027t implement the\nset_hw_vlan_mode callback, like the other cores.\n\nSuggested-by: Joseph Steel \u003crecv.jo@gmail.com\u003e\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20260928203441.34876-3-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "11705541e7d421706a54f7f6ead8a3316c91c2bc", "tree": "727dae4e1c7dcd99ccbd857f5a8e0e90dcc6c863", "parents": [ "e3f33b0a1d89d738e2b913dab519226eaf76e15b" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Mon Sep 28 20:34:37 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:36:41 2026 -0700" }, "message": "net: stmmac: Remove VLAN perfect matching dead code\n\nstmmac_vlan_update() falls back to \"perfect matching\" when the VLAN hash\nfilter is unavailable (!priv-\u003edma_cap.vlhash). This fallback has been\nunreachable in normal operation since its introduction in\ncommit c7ab0b8088d7 (\"net: stmmac: Fallback to VLAN Perfect filtering if\nHASH is not available\") because the NETIF_F_HW_VLAN_{CTAG,STAG}_FILTER\nfeatures are advertised only when priv-\u003edma_cap.vlhash is true.\n\nThe fallback is also duplicating the code in vlan_add_hw_rx_fltr(), which\nis always available since stmmac_get_num_vlan() returns at least 1.\n\nTherefore, remove it.\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260928203441.34876-2-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3f33b0a1d89d738e2b913dab519226eaf76e15b", "tree": "c64d1c9991ed87c6b241c09004e276d5f2cf3ae9", "parents": [ "fe4114221364899ab33c3f9574da6b108d3fa79e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Thu Oct 01 22:12:53 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 16:21:57 2026 -0700" }, "message": "ipv4: free inet_opt and ireq_opt after an RCU grace period\n\ntcp_v4_syn_recv_sock() transfers ownership of ireq-\u003eireq_opt to the\nchild socket (newinet-\u003einet_opt) without copying it.\n\nAnother cpu can concurrently process a retransmitted SYN for the same\nrequest socket, and send a SYNACK from tcp_check_req().\ntcp_v4_send_synack() and inet_csk_route_req() read ireq-\u003eireq_opt\nunder rcu_read_lock() only, and ip_build_and_send_pkt() and\nip_options_build() then read opt-\u003eoptlen twice.\n\nNote that the SYNACK timer itself is not an issue: it holds a\nreference on its request socket, and inet_csk_reqsk_queue_drop()\ncalls timer_delete_sync() before the child can be freed.\n\nSince commit 079096f103fa (\"tcp/dccp: install syn_recv requests\ninto ehash table\"), request sockets are processed without holding\nthe listener lock, so nothing prevents the child socket from being\nfreed while the SYNACK is still being built. TCP child sockets do\nnot have SOCK_RCU_FREE, and inet_sock_destruct() frees inet_opt\nwith a plain kfree(), leading to a use-after-free in\nip_options_build().\n\nA similar issue exists with request socket migration\n(net.ipv4.tcp_migrate_req\u003d1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE\nprogram). reqsk_timer_handler() clones the request socket with\ninet_reqsk_clone(), so that the old request socket and its clone\nshare the same ireq_opt, then reqsk_migrate_reset() clears the\npointer in the old one. Another cpu holding a reference on the old\nrequest socket can still be using these options (sending a SYNACK,\nor creating a child in tcp_v4_syn_recv_sock()) when the clone is\nfreed, and tcp_v4_reqsk_destructor() also uses a plain kfree().\n\nReaders already use RCU, and other paths replacing inet_opt\n(do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use\nkfree_rcu(). Use kfree_rcu() in inet_sock_destruct() and\ntcp_v4_reqsk_destructor() as well.\n\nIPv6 is not affected by the first issue, because tcp_v6_syn_recv_sock()\nduplicates the options. tcp_v6_reqsk_destructor() has the same\nmigration issue with ipv6_opt, which is only set by CALIPSO. This\nwill be addressed in a separate patch.\n\nFixes: 079096f103fa (\"tcp/dccp: install syn_recv requests into ehash table\")\nFixes: c905dee62232 (\"tcp: Migrate TCP_NEW_SYN_RECV requests at retransmitting SYN+ACKs.\")\nReported-by: Xinyang Ge \u003cxinyang@anthropic.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261001221253.2964024-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe4114221364899ab33c3f9574da6b108d3fa79e", "tree": "c32c472d8da7e36052d02ba01393f2bccf3cf067", "parents": [ "af7886fcfb6633472c24c5f782fbbbf32f4b55cc" ], "author": { "name": "Or Har-Toov", "email": "ohartoov@nvidia.com", "time": "Wed Sep 30 20:04:06 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 15:56:58 2026 -0700" }, "message": "net/mlx5: Lag, split aggregate speed into oper and max helpers\n\nmlx5_lag_sum_devices_speed computes the LAG aggregate by summing oper\nspeeds across all ports. This has two bugs.\n\nFirst, it relies on the assumption that a port whose carrier is down\nwill report an oper speed of zero and therefore not contribute to the\nsum. This assumption does not always hold: when the link partner\ndisconnects the port transitions to DOWN state but firmware may still\nreport a non-zero oper speed, causing the aggregate to include a port\nthat is not actively carrying traffic.\n\nSecond, in active-backup mode only one port transmits at a time, so\nthe aggregate should reflect a single port speed rather than the sum\nof all ports.\n\nFix this by splitting mlx5_lag_sum_devices_speed into two helpers.\nmlx5_lag_get_devices_oper_speed reflects the speed currently available:\nit queries the vport state of each port and skips any port that is not\nUP, rather than relying on oper speed being zero.\nmlx5_lag_get_devices_max_speed is state-independent and returns the\nmaximum achievable speed used as a fallback when speed is 0; for\nactive-backup it takes the maximum single-port speed instead of the sum.\n\nThe bugs were discovered during integration and reproduced on a\nback-to-back ConnectX-8 setup.\n\nThe first bug (stale oper speed when link goes down) was observed: after\nthe link partner disconnected, the aggregate TX speed reported to vports\nremained full speed because firmware still returned the last oper speed,\ncausing vports to be rate-limited to the old aggregate speed.\n\nThe second bug (active-backup summing all port speeds instead of the\nactive port\u0027s speed) was also triggered: in active-backup mode the\ncomputed aggregate was double the expected value since both port speeds\nwere summed even though only one port was active.\n\nFixes: 28ea6036dad2 (\"net/mlx5: Handle port and vport speed change events in MPESW\")\nSigned-off-by: Or Har-Toov \u003cohartoov@nvidia.com\u003e\nReviewed-by: Shay Drori \u003cshayd@nvidia.com\u003e\nReviewed-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260930170406.148548-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "af7886fcfb6633472c24c5f782fbbbf32f4b55cc", "tree": "2aaeb74df84f9755671e04a364a648b7dd716ffc", "parents": [ "d333c8bca6dc3c5e978f6698d39dd799f3b0dc8d", "0a01e1df137fd7e51f045a5e97d40f42fb58ae0c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 15:44:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 15:44:46 2026 -0700" }, "message": "Merge branch \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix i40e/ice/iavf VF bonding after netdev lock changes\n\nJose Ignacio Tornos Martinez says:\n\nThis series fixes VF bonding failures introduced by commit ad7c7b2172c3\n(\"net: hold netdev instance lock during sysfs operations\").\n\nWhen adding VFs to a bond immediately after setting trust mode, MAC\naddress changes fail with -EAGAIN, preventing bonding setup. This\naffects both i40e (700-series) and ice (800-series) Intel NICs.\n\nThe core issue is lock contention: iavf_set_mac() is now called with the\nnetdev lock held and waits for MAC change completion while holding it.\nHowever, both the watchdog task that sends the request and the adminq_task\nthat processes PF responses also need this lock, creating a deadlock where\nneither can run, causing timeouts.\n\nAdditionally, setting VF trust triggers an unnecessary ~10 second VF reset\nin i40e driver that delays bonding setup, even though filter\nsynchronization happens naturally during normal VF operation. For ice\ndriver, the delay is not so big, but in the same way the operation is not\nnecessary.\n\nThis series:\n1. Eliminates unnecessary VF reset when setting trust in i40e (reset only\n if revoking trust and VF has advanced features configured).\n2. Fixes lock contention by polling admin queue synchronously\n3. Eliminates unnecessary VF reset when setting trust in ice, (reset only\n if revoking trust and VF has advanced features configured).\n\nThe key fix (patch 2/3) implements a synchronous MAC change operation\nsimilar to the approach used for ndo_change_mtu deadlock fix:\nhttps://lore.kernel.org/20260211191855.1532226-1-poros@redhat.com\nInstead of scheduling work and waiting, it:\n\n- Sends the virtchnl message directly (not via watchdog)\n- Polls the admin queue hardware directly for responses\n- Processes all messages inline (including non-MAC messages)\n- Returns when complete or times out\n\nThis allows the operation to complete synchronously while holding\nnetdev_lock, without relying on watchdog or adminq_task.\n\nThe function can sleep for up to 2.5 seconds polling hardware, but this\nis acceptable since netdev_lock is per-device and only serializes\noperations on the same interface.\n\nTesting shows VF bonding now works reliably in ~5 seconds vs 15+ seconds\nbefore (i40e), without timeouts or errors (i40e and ice).\n\nTested on Intel 700-series (i40e) and 800-series (ice) dual-port NICs\nwith iavf driver.\n\nThanks to Jan Tluka \u003cjtluka@redhat.com\u003e and Yuying Ma \u003cyuma@redhat.com\u003e for\nreporting the issues.\n\n* \u002740GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n ice: skip unnecessary VF reset when setting trust\n iavf: send MAC change request synchronously\n i40e: skip unnecessary VF reset when setting trust\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260928224454.483072-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d333c8bca6dc3c5e978f6698d39dd799f3b0dc8d", "tree": "6c4826f668987ef57826e2998edfd8bfd6d00a08", "parents": [ "aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 18:25:59 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Oct 05 15:01:19 2026 -0700" }, "message": "net: make dev_xdp_sb_prog_count() see programs attached through a link\n\nethtool refuses to enable tcp-data-split on a device running\na single-buffer XDP program (which can\u0027t deal with the payload\nlanding in a separate buffer). dev_xdp_sb_prog_count() only looks\nat xdp_state[].prog though, ignoring bpf_link integration.\nGet the prog pointer from dev_xdp_prog(), which will consult both.\n\nbpf_xdp_link_update() needs a bit of a touch-up, too, since\nethtool calls dev_xdp_sb_prog_count() with just the instance\nlock (for ops-locked devices) - we now have to make sure the\nlink updates happen under that lock.\n\nSpotted by AI while reviewing the XDP propagation series,\nverified and tested on netdevsim with a C test along these lines:\n\n link \u003d bpf_program__attach_xdp(prog, ifindex);\n system(\"ethtool -G eth0 tcp-data-split on\")\n\nFixes: 197258f0ef68 (\"net: ethtool: add hds_config member in ethtool_netdev_state\")\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261001012559.297751-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aaaaf87ea99b8766c9a8aa0e71aa42e6bc8a5320", "tree": "e45dc9ab5b4637dc63d7ae04478dfe27671554af", "parents": [ "5158353121bae4f552cb677ce8c5c3ef52f93a0d" ], "author": { "name": "Denis V. Lunev", "email": "den@openvz.org", "time": "Tue Sep 29 09:25:19 2026 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 05 03:51:13 2026 +0100" }, "message": "openvswitch: fix soft lockup in the netlink flow dump\n\nA production compute node carrying a few thousand datapath flows hit a\nsoft lockup inside a single netlink flow dump and panicked.\n\novs_flow_cmd_dump() calls ovs_flow_stats_get() for every flow it\nemits, and that releases stats-\u003elock with spin_unlock_bh() once per\nCPU that has touched the flow. Every release is a local_bh_enable(),\nand each one runs the pending softirq backlog in the dumping thread\u0027s\nown context.\n\nThe skb bounds the flows one callback emits, but not the softirq work\nit absorbs. On a CPU that carries the box\u0027s packet load the backlog\nrefills as fast as it drains, so the dumping thread becomes that CPU\u0027s\nsoftirq engine. It never sleeps and it has no reschedule point, so\nunder voluntary preemption nothing can take the CPU away from it:\nneither the ksoftirqd the kernel woke to take the work over, nor the\nstopper thread the softlockup detector dispatches to refresh its\ntimestamp.\n\nHold BH off across the whole callback instead, the way\nctnetlink_dump_table() does, so the nested spin_unlock_bh() stop\ndraining softirqs. The loop already runs under rcu_read_lock() and\ncannot sleep. What it gives up is preemption under CONFIG_PREEMPT,\nsince a BH-off region is not preemptible outside PREEMPT_RT. The\nregion stays short: the skb caps the flows one callback emits, and\nempty buckets cost no skb space but are each visited once per dump, as\nthe cursor only moves forward. The table grows on insert and shrinks\nonly on flush, so the walk is bounded by the largest flow count the\ndatapath has held. The softirq backlog the callback used to absorb has\nno bound at all.\n\nFixes: 63e7959c4b9b (\"openvswitch: Per NUMA node flow stats.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Denis V. Lunev \u003cden@openvz.org\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "5158353121bae4f552cb677ce8c5c3ef52f93a0d", "tree": "4dde29f6e87532f7eca2cf26ad0d635b1aa63b80", "parents": [ "6dc989ea46b96ce170840174b4a38c4a387fb005" ], "author": { "name": "Zixuan Chai", "email": "petalzu987@gmail.com", "time": "Sun Sep 27 01:04:39 2026 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Mon Oct 05 03:29:53 2026 +0100" }, "message": "net: bridge: avoid recursive multicast port cleanup\n\nbr_multicast_sg_del_exclude_ports() removes automatically added STAR_EXCL\nport groups by calling br_multicast_del_pg(). For S,G entries, that\ndeletion calls back into br_multicast_sg_del_exclude_ports(), so a large\nnumber of STAR_EXCL ports consumes one kernel stack frame per port and can\nhit the stack guard page.\n\nKeep the complete port-group deletion path for cleanup, but suppress the\nS,G exclude-port cleanup while that helper is already walking the same\nentry. Normal deletion callers retain the existing behavior.\n\nFixes: 8266a0491e92 (\"net: bridge: mcast: handle port group filter modes\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: LLM\nSigned-off-by: Zixuan Chai \u003cpetalzu987@gmail.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "6dc989ea46b96ce170840174b4a38c4a387fb005", "tree": "7d83c48dea2077d88057ce725c39af0f75e7dfe5", "parents": [ "8b1f0af1fd5fd113432233ed8a3862ee7c30a84f", "58858b8f14803a7eeac297b3ce20f3b21bf2ff66" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:38:09 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:41:12 2026 -0700" }, "message": "Merge branch \u0027intel-wired-lan-driver-updates-2026-09-28-idpf-ice-iavf\u0027\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-09-28 (ice) [part]\n\nFor ice:\nXuanqiang Luo resolves a use-after-free issue by changing order of\noperations so index is used before being freed.\n\nBryan Fraschetti restores ordered MMIO writes for ice Tx doorbells\nby replacing writel_relaxed() call with writel().\n\nTristan Madani fixes representor use-after-free by releasing\nmetadata_dst through dst_release() to ensure it is not freed until\nall references are dropped.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260928230429.495442-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "58858b8f14803a7eeac297b3ce20f3b21bf2ff66", "tree": "7d83c48dea2077d88057ce725c39af0f75e7dfe5", "parents": [ "7a579dec8423bba7bec96fcfcb2e30838b0858ee" ], "author": { "name": "Tristan Madani", "email": "tristan@talencesecurity.com", "time": "Mon Sep 28 16:04:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:41:12 2026 -0700" }, "message": "ice: fix metadata_dst refcount handling on representor teardown\n\nice_eswitch_release_repr() uses metadata_dst_free() to release the\nrepresentor\u0027s metadata_dst. metadata_dst_free() directly frees the\nunderlying memory without checking the dst_entry refcount.\n\nWhen ice_eswitch_port_start_xmit() processes a packet, it takes a\nreference via dst_hold() and attaches the metadata_dst to the skb.\nIf the representor is torn down while packets are still queued on\nthe lower device (e.g. in a qdisc), the metadata_dst is freed while\nreferences are still held.\n\nUse dst_release() instead, which correctly decrements the refcount\nand only frees the object when all references are dropped. The dst\nsubsystem already handles metadata_dst cleanup in dst_destroy() when\nDST_METADATA is set.\n\nOther drivers sharing this pattern (nfp, airoha, bnxt) already use\ndst_release() for their metadata_dst lifecycle.\n\nFixes: f5396b8a663f7 (\"ice: switchdev slow path\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260928230429.495442-5-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7a579dec8423bba7bec96fcfcb2e30838b0858ee", "tree": "eede5a70e62537e73faf5ecaebd29ac3bc921c7e", "parents": [ "1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff" ], "author": { "name": "Bryan Fraschetti", "email": "bryan.fraschetti@canonical.com", "time": "Mon Sep 28 16:04:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:41:05 2026 -0700" }, "message": "ice: Restore Ordered MMIO Writes for Tx Doorbells\n\nThe DQL accounting state which tracks the number of bytes queued for the\nNIC to transmit, namely dql-\u003enum_queued, is updated by the ICE driver\nwhen it invokes __netdev_tx_sent_queue(). Subsequently the driver\nupdates the hardware queue tail allowing the NIC to begin processing the\nwork queue. The queue accounting update should be ordered before the NIC\nbegins transmitting descriptors.\n\nThe transmit path currently updates the hardware doorbell using\nwritel_relaxed(), which (on arm64) does not provide the same ordering\nguarantees between writes to normal memory and writes to MMIO registers\nthat writel() does. This introduces a potential race where the NIC\nbegins transmitting descriptors before the dql-\u003enum_queued update is\nglobally visible. If the NIC finishes before the update is observed by\ndql_completed(), it detects an invalid state where more bytes have been\ncompleted than have been queued. When this happens the following BUG_ON\nis triggered.\n\n BUG_ON(count \u003e num_queued - dql-\u003enum_completed);\n\nThis has been observed and manifests as the following crash (note that\nthe trace has been trimmed) in an environment with sustained network\nload that uses an Intel Corporation Ethernet Controller E810-XXV for SFP\n(rev 02) on an arm64 machine. Replacing writel_relaxed() with writel()\nin a test kernel eliminated the crash in the user\u0027s workload, which\npreviously reproduced the issue reliably.\n\n kernel BUG at lib/dynamic_queue_limits.c:99\n\nInternal error: Oops - BUG: 00000000f2000800 [#1] SMP\npc : dql_completed+0x268/0x2a0\nlr : ice_clean_tx_irq+0x1d4/0x620 [ice]\nCall trace:\ndql_completed+0x268/0x2a0 (P)\nice_napi_poll+0x94/0x520 [ice]\n__napi_poll+0x48/0x3f0\nnet_rx_action+0x194/0x420\n\nThis restores the behaviour prior to commit ccde82e90946 (\"ice: add E830\nEarliest TxTime First Offload support\"), which changed the notification\nmechanism from writel() to writel_relaxed().\n\nLink: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/2161572\nFixes: ccde82e90946 (\"ice: add E830 Earliest TxTime First Offload support\")\nSigned-off-by: Bryan Fraschetti \u003cbryan.fraschetti@canonical.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260928230429.495442-4-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1402fc67d2f4e2e1fc7bf8ee0825b8ad994557ff", "tree": "a69533ce4a72d67864f60836068515e76e3f7240", "parents": [ "8b1f0af1fd5fd113432233ed8a3862ee7c30a84f" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Mon Sep 28 16:04:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:38:08 2026 -0700" }, "message": "ice: fix use-after-free in dynamic port cleanup\n\nice_dealloc_dynamic_port() uses dyn_port-\u003evsi-\u003eidx to erase the dynamic\nport from pf-\u003edyn_ports. However, it frees the VSI before reading the\nindex for the erase, resulting in a use-after-free.\n\nFollow the reverse of the allocation order in ice_alloc_dynamic_port()\nby erasing the xarray entry before freeing the VSI.\n\nFixes: eda69d654c7e (\"ice: add basic devlink subfunctions support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Marcin Szycik \u003cmarcin.szycik@linux.intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Patryk Holda \u003cpatryk.holda@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260928230429.495442-3-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8b1f0af1fd5fd113432233ed8a3862ee7c30a84f", "tree": "2e3d5a9d516738f0d08e415f830e15592ba1f56c", "parents": [ "bcf2573a68a808a5b54cadafa72b6672e662c2bf" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Wed Sep 30 19:25:24 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 13:05:20 2026 -0700" }, "message": "tcp: reject net_iov in zerocopy receive mapping hints\n\nAfter copying a readable prefix, receive_fallback_to_copy() asks\ntcp_zerocopy_set_hint_for_skb() where page mapping can resume. If the\nnext skb is unreadable, find_next_mappable_frag() passes its net_iov\nfragment to can_map_frag().\n\nskb_frag_page() returns NULL for a net_iov, but can_map_frag()\ndereferences it in PageCompound(). A v7.2 KASAN run on a connected TCP\nsocket with 64 readable bytes followed by a 4096-byte NET_IOV_DMABUF\nfragment reported:\n\n BUG: KASAN: null-ptr-deref in can_map_frag\n tcp_zerocopy_receive -\u003e can_map_frag\n Kernel panic - not syncing: KASAN: panic_on_warn set\n\nThe diagnostic inserted the net_iov directly because the test host has\nno devmem-capable NIC. Hardware end-to-end reachability remains untested\nand requires CONFIG_NET_DEVMEM plus a supported DMA-buf-bound RX queue.\n\nReject all net_iov fragments before skb_frag_page(). This covers both\nDMABUF and IOURING net_iov types while leaving page-backed checks\nunchanged. With the guard, the same queue copied the readable prefix,\nreturned a 4096-byte skip hint, and completed without a fault.\n\nFixes: 9f6b619edf2e (\"net: support non paged skb frags\")\nCc: stable@vger.kernel.org\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20260930102524.1659847-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bcf2573a68a808a5b54cadafa72b6672e662c2bf", "tree": "a2d691ce324d0063bab4cab466e13c777413690e", "parents": [ "184b5ddf82d45d6f75cc83719a2e453392512bd2" ], "author": { "name": "Suraj Gupta", "email": "suraj.gupta2@amd.com", "time": "Tue Sep 29 00:12:07 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 12:58:38 2026 -0700" }, "message": "net: xilinx: axienet: Free outstanding DMA buffers on dmaengine stop\n\nIn the dmaengine path the driver pre-submits RX buffers and holds\nin-flight TX buffers whose SKBs are DMA-mapped by the driver and freed\nonly in the completion callbacks. On ndo_stop() dmaengine_terminate_sync()\naborts these descriptors without running their callbacks, and the driver\nthen frees only the ring shells, leaking every SKB still owned by the\nengine and its DMA mapping on each ifdown. With 128 RX buffers pre-posted\nper channel, the mapping leak can eventually exhaust a limited IOMMU\naperture.\n\nClear the slot\u0027s skb in the TX and RX callbacks so a non-NULL skb marks a\nslot that still owns a live, DMA-mapped buffer, and on stop unmap and free\nevery such buffer.\n\naxienet_dma_rx_cb() runs from the DMA tasklet and re-arms the RX ring on\neach completion, so it can race axienet_stop(): a completion may submit a\nfresh buffer after dmaengine_terminate_sync() has returned, leaving the\nchannel armed with a buffer the teardown then frees while the engine may\nstill write into it (dma_release_channel() does not stop it either). Add a\nlock that axienet_dma_rx_cb() holds across the @stopping check and the\nresubmit, and axienet_stop() holds to set @stopping before terminating.\nOnce @stopping is set no callback can arm a new buffer, and any armed just\nbefore is aborted by the terminate, so teardown only frees buffers the\nengine no longer owns.\n\nFixes: 6a91b846af85 (\"net: axienet: Introduce dmaengine support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Suraj Gupta \u003csuraj.gupta2@amd.com\u003e\nLink: https://patch.msgid.link/20260928184207.2361931-1-suraj.gupta2@amd.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "184b5ddf82d45d6f75cc83719a2e453392512bd2", "tree": "249a1858356e5bd39cc0cb6e7135d6694b0c4e16", "parents": [ "71a77ab76e74131a101f4d2d2afb0dcbf81b4e3c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 18:26:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Oct 02 12:39:21 2026 -0700" }, "message": "bonding: fix the program leak when XDP is replaced\n\nWe need to release the reference on the old BPF prog, whether\nwe are going to no-prog, or replacing the prog with another.\n\nSpotted by AI while running tests for the propagation series\n(leaked programs were accumulating). Selftest will come in\nthe net-next series to avoid conflicts.\n\nFixes: 9e2ee5c7e7c3 (\"net, bonding: Add XDP support to the bonding driver\")\nFixes: 6d5f1ef83868 (\"bonding: Fix negative jump label count on nested bonding\")\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261001012639.298690-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "71a77ab76e74131a101f4d2d2afb0dcbf81b4e3c", "tree": "072014eee36453dc5fa925f948e12c4db644b0c7", "parents": [ "232d49dd4b40a666283de9e722899f088ed581b2" ], "author": { "name": "Frank Li", "email": "Frank.Li@nxp.com", "time": "Tue Sep 29 15:06:36 2026 -0400" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 11:38:31 2026 +0100" }, "message": "net: allwinner: remove dmaengine_desc_free()\n\ndmaengine_desc_free() is designed for DMA_CTRL_REUSE. If DMA_CTRL_REUSE\nis not set, dmaengine_desc_free() will return -EPERM.\n\n\tif (!dmaengine_desc_test_reuse(desc))\n\t\treturn -EPERM;\n\nSo calling dmaengine_desc_free() does nothing.\ndmaengine_terminate_(a)sync() will free all already allocated descriptors.\n\nSigned-off-by: Frank Li \u003cFrank.Li@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "232d49dd4b40a666283de9e722899f088ed581b2", "tree": "00936f41d086fed436547ea2546978b54320d85e", "parents": [ "4c9dc0faca98084922caeb689579d338cf3e1c29" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Tue Sep 29 15:10:11 2026 +0200" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 10:31:09 2026 +0100" }, "message": "net: stmmac: propagate PTP addend and system time programming errors\n\nstmmac_update_subsecond_increment() ignores the error returned by\nstmmac_config_addend(), and stmmac_init_tstamp_counter() discards the\naddend and system time programming errors, always returning success. A\nfailure to program the addend (PTP_TCR_TSADDREG) or to initialize the\nsystem time counter (PTP_TCR_TSINIT) is therefore silently swallowed,\nleaving the hardware timestamp counter in a non-running or partially\nconfigured state while the driver keeps operating as if timestamping\nwere up. This matters for TAPRIO/EST offloading, which derives the gate\nbase time from the hardware timestamp counter.\n\nThe same hooks are also called from the PHC callbacks: settime64 and\nadjfine drop the error and report success to clock_settime() and\nclock_adjtime(), so a dead PTP reference clock goes unnoticed by\nptp4l/phc2sys.\n\nReturn error codes from stmmac_update_subsecond_increment(),\nstmmac_init_tstamp_counter(), stmmac_dl_ts_coarse_set() and the\nsettime64/adjfine callbacks instead of silently returning success. On\nfailure, roll back the partially applied configuration so the hardware\nand the driver bookkeeping stay consistent, and report the reason\nthrough the devlink extack. Also guard against a zero sub-second\nincrement, which would otherwise divide by zero when computing the\naddend.\n\nReset the persistent timestamping state (hwts_tx_en, hwts_rx_en,\ntstamp_config, systime_flags and tsfupdt_coarse) when (re)initializing\ntimestamping, so a failed init does not leave TX/RX timestamping\nenabled on a counter that never started.\n\nFixes: cc4c9001ce31 (\"net: stmmac: Switch stmmac_hwtimestamp to generic HW Interface Helpers\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "4c9dc0faca98084922caeb689579d338cf3e1c29", "tree": "caf002d04023a8e4277dc42890afa7816ea3c1d1", "parents": [ "3acdd44385bc7e2e57605e073691ce69cc5a960d" ], "author": { "name": "Sang-Hoon Choi", "email": "csh0052@gmail.com", "time": "Wed Sep 30 02:37:34 2026 +0900" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 09:58:07 2026 +0100" }, "message": "cxgb4/ch_ktls: disable softirqs around tid_list erases\n\nchcr_ktls_cpl_act_open_rpl() inserts into tid_list from the receive path\nusing xa_insert_bh(). The array is shared by the adapter\u0027s connections\nand initialized with XA_FLAGS_LOCK_BH. However, chcr_ktls_dev_del() and\nthe chcr_ktls_dev_add() error path use xa_erase(), which takes the XArray\nlock without disabling softirqs.\n\nWhen cleanup runs with softirqs enabled, a receive softirq for another\nconnection on the same CPU can interrupt the erase and spin on the lock\nheld by the interrupted task. Use xa_erase_bh() at both sites to match\nthe insertion path.\n\nFixes: 65e302a9bd57 (\"cxgb4/ch_ktls: Clear resources when pf4 device is removed\")\nReported-by: Changyul Lee \u003clcy8047@gmail.com\u003e\nAssisted-by: LLM\nSigned-off-by: Sang-Hoon Choi \u003ccsh0052@gmail.com\u003e\nReviewed-by: Ayush Sawal \u003cayush.sawal@chelsio.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3acdd44385bc7e2e57605e073691ce69cc5a960d", "tree": "4e1c6cfb9701db5780c30f0cfa57805d92de9d76", "parents": [ "f7b3ef049a1fee3f64e48a174530ab1c46bf1de9" ], "author": { "name": "Yuqi Xu", "email": "xuyuqiabc@gmail.com", "time": "Mon Sep 28 16:24:38 2026 +0800" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 08:20:15 2026 +0100" }, "message": "tipc: destroy topsrv workqueues before closing connections\n\ntipc_topsrv_stop() closed subscriber connections while the topology\nserver\u0027s send and receive workqueues were still running. Socket\ncallbacks and subscription events could then queue more work, and\nin-flight send/recv work could drop the last connection reference\nduring the conn_idr walk.\n\nThat race produced several teardown failures: refcount_t addition on\n0 from conn_get() on a connection whose release was blocked on\nidr_lock, a subsequent use-after-free in tipc_conn_close(),\nqueue_work() on an already destroyed workqueue from the listener\ndata-ready callback, and an RCU stall in tipc_topsrv_exit_net()\nwhile the walk spun under idr_lock.\n\nClear srv-\u003elistener under idr_lock so it acts as a shutdown flag,\nskip queue_work() once it is NULL, destroy the workqueues to flush\nin-flight work, and only then close the remaining connections.\nRefuse tipc_conn_lookup() after that flag is cleared, and drop\nidr_lock when the teardown walk finds no connection, so an\nin-flight subscription event cannot pin idr_in_use while the\nwalk holds the lock.\n\nv3 supersedes the narrower in-thread diff Tung Quang Nguyen\nposted on 2026-09-23. It keeps his teardown order and adds the\nlookup refusal and the empty-idr unlock.\n\nFixes: c5fa7b3cf3cb (\"tipc: introduce new TIPC server infrastructure\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAssisted-by: LLM\nSigned-off-by: Yuqi Xu \u003cxuyuqiabc@gmail.com\u003e\nReviewed-by: Ren Wei \u003cweir@nebusec.ai\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f7b3ef049a1fee3f64e48a174530ab1c46bf1de9", "tree": "c1282914598b2b812495b6ccaf54b61c992fe87a", "parents": [ "28bc1ef699610ee09ce3d46a00552f5a0a0144bd", "636035157a814f289f293fd0edea1a367a637797" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 07:52:32 2026 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 07:52:32 2026 +0100" }, "message": "Merge branch \u0027dim-overflow\u0027\nShashank Mohan Jain says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nlib/dim: fix 32-bit overflow in dim_calc_stats()\n\nOn 32-bit kernels dim_calc_stats() multiplies the u32 byte, packet and\ncompletion counts of a DIM window by USEC_PER_MSEC (1000L) in 32-bit\nlong arithmetic. Once a window carries more than about 4.3 MB, bpms\nwraps, and net_dim steers interrupt moderation on a meaningless\nthroughput value. At 1 Gbit/s line rate a 64-event window passes that\nsize when there are fewer than about 1,860 DIM events per second,\nwhich is common while NAPI keeps the interrupt masked under load.\n32-bit users of the library include mtk_eth_soc (MT7621, MT7623),\nbcmgenet and bcmsysport on 32-bit ARM, xilinx_axienet on Zynq-7000 and\nMicroBlaze, and virtio_net in 32-bit guests. The overflow goes back to\nthe mlx5e code the library was moved from.\n\nPatch 1 does the multiplications in 64 bits and divides with\nDIV_ROUND_UP_ULL(); the results on 64-bit are unchanged. Patch 2 adds a\nKUnit suite for dim_calc_stats() whose large-window cases fail on\n32-bit without patch 1. It is part of this series as described under\n\"Co-posting selftests\" in maintainer-netdev.rst.\n\nThe series is based on net (a7bfaba4823e) and has no dependencies; both\npatches also apply to mainline (fd179f8a05be) and net-next.\n\nThe bug was found and the patches were prepared with Claude Code\n(Anthropic), model Claude Opus 5.5 (claude-opus-5-5).\n\nTested:\n- KUnit (CONFIG_DIMLIB_KUNIT_TEST\u003dy) on UML i386 (SUBARCH\u003di386):\n without patch 1, 4 of the 7 dim_calc_stats cases fail (many_bytes,\n bytes_32bit_limit, gigabit, many_packets); with it all pass. On UML\n x86_64 all cases pass with and without patch 1. Both were run on\n mainline and on net.\n- W\u003d1 builds of lib/dim/ for UML x86_64 and i386 without warnings;\n dim.o references no libgcc 64-bit division helpers. A native i386\n defconfig build (vmlinux and modules, DIMLIB\u003dy) succeeds.\n- checkpatch --strict. Its \"does MAINTAINERS need updating?\" warning\n on patch 2 does not apply: lib/dim/ is already covered by the\n DYNAMIC INTERRUPT MODERATION entry.\n\nNot tested: 32-bit ARM or MIPS builds (no cross compiler was\navailable), and no run on a 32-bit NIC. The traffic levels at which\nthe drivers hit the overflow are derived from how they count DIM\nevents, not measured.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "636035157a814f289f293fd0edea1a367a637797", "tree": "c1282914598b2b812495b6ccaf54b61c992fe87a", "parents": [ "0843b23890642a02ff85c36406224e8874e30664" ], "author": { "name": "Shashank Mohan Jain", "email": "jain.sm@gmail.com", "time": "Sun Sep 27 10:47:43 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 07:52:31 2026 +0100" }, "message": "lib/dim: add KUnit test for dim_calc_stats()\n\nAdd a KUnit suite for the DIM library that checks the packet, byte,\nevent and completion rates computed by dim_calc_stats(), including\ncounter wraparound and windows whose byte or packet count times\nUSEC_PER_MSEC does not fit in 32 bits. The latter cases fail on 32-bit\narchitectures without the previous commit.\n\nAssisted-by: LLM\nSigned-off-by: Shashank Mohan Jain \u003cjain.sm@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "0843b23890642a02ff85c36406224e8874e30664", "tree": "fe311385457d4ad67c3d3d4b9afaf81731bfd3af", "parents": [ "28bc1ef699610ee09ce3d46a00552f5a0a0144bd" ], "author": { "name": "Shashank Mohan Jain", "email": "jain.sm@gmail.com", "time": "Sun Sep 27 10:47:42 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Oct 02 07:52:31 2026 +0100" }, "message": "lib/dim: fix 32-bit overflow in dim_calc_stats() rates\n\ndim_calc_stats() computes the per-millisecond rates as\n\n\tDIV_ROUND_UP(nbytes * USEC_PER_MSEC, delta_us)\n\nwhere nbytes is a u32 and USEC_PER_MSEC is 1000L. On 64-bit the product\nis done in 64-bit long arithmetic, but on 32-bit architectures long is\n32 bits wide and the product wraps as soon as a measurement window\ncarries more than 4294967 bytes (about 4.3 MB). The same applies to the\npacket and completion counts, although those need more than 4.29\nmillion packets or completions per window.\n\nA DIM window spans DIM_NEVENTS (64) events. Drivers count events per\ninterrupt or per NAPI poll, so under sustained load a window can easily\ncarry more than 4.3 MB: 64 full NAPI polls of 64 MTU-sized frames are\nalready 6.2 MB, and drivers such as mtk_eth_soc count one event per\ninterrupt while NAPI keeps polling with the interrupt masked. On 32-bit\nusers of the library (for example mtk_eth_soc on MT7621, bcmgenet and\nbcmsysport on 32-bit ARM, or virtio_net in a 32-bit guest) bpms then\nbecomes the product modulo 2^32 divided by the window length, and\nnet_dim_stats_compare() makes its BETTER/WORSE decisions on a value\nthat has little to do with the real throughput.\n\nFor example, a 1 Gbit/s link at line rate that moves 5 MB in a 40 ms\nwindow gives bpms \u003d 125000 on 64-bit but 17626 on 32-bit, and 5 million\npackets in 2 s gives ppms \u003d 353 instead of 2500.\n\nWiden the products to 64 bits and divide with DIV_ROUND_UP_ULL(). The\nresults are unchanged on 64-bit.\n\nFixes: cb3c7fd4f839 (\"net/mlx5e: Support adaptive RX coalescing\")\nFixes: 4c4dbb4a7363 (\"net/mlx5e: Move dynamic interrupt coalescing code to include/linux\")\nAssisted-by: LLM\nSigned-off-by: Shashank Mohan Jain \u003cjain.sm@gmail.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "28bc1ef699610ee09ce3d46a00552f5a0a0144bd", "tree": "3ed374a9c1f74c44d2d571d318ef32b6a7007be3", "parents": [ "2d3b94c6076a95553876a3c45c122edf62c27449" ], "author": { "name": "Quchaosheng", "email": "quchaosheng000406@163.com", "time": "Mon Sep 28 19:31:08 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 18:24:13 2026 -0700" }, "message": "net/packet: guard the ll header push in packet_rcv_spkt()\n\npacket_rcv_spkt() restores the link layer header with\n\n\tskb_push(skb, skb-\u003edata - skb_mac_header(skb));\n\nThat subtraction is only meaningful when the device actually has a link\nlayer header. packet_rcv() and tpacket_rcv() both wrap it in\ndev_has_header(), which is also the predicate the block comment at the\ntop of the file states the restore in terms of; packet_rcv_spkt() does\nnot. commit d549699048b4 (\"net/packet: fix packet receive on L3\ndevices without visible hard header\") introduced the helper and changed\nthe two call sites, and this one stayed behind.\n\nA device without a visible ll header can leave skb-\u003emac_header at the\n0xFFFF sentinel that __alloc_skb() initialises it to. A CAN skb does:\ninit_can_skb() sets pkt_type and ip_summed but does not reset the\nheaders, and commit 9f10374bb024 (\"can: remove private CAN skb\nheadroom infrastructure\") dropped the skb_reset_*_header() calls that\nused to be there. skb_mac_header() is then 0xFFFF, the length becomes\na large negative number and skb_push() reports it through\nskb_under_panic() -- from softirq context, so it is a full system panic\neven with panic_on_oops\u003d0:\n\n skbuff: skb_under_panic: text:ffffffff8bd21bc1 len:-65455 put:-65471 head:... data:... tail:0x50 end:0x180 dev:can0\n kernel BUG at net/core/skbuff.c:214!\n RIP: 0010:skb_panic+0x50/0x60\n Call Trace:\n \u003cIRQ\u003e\n skb_push+0x38/0x40\n packet_rcv_spkt+0xe1/0x170\n __netif_receive_skb_core.constprop.0+0x7e8/0xd30\n ...\n Kernel panic - not syncing: Fatal exception in interrupt\n\nThe socket type is reachable: packet_create() accepts SOCK_PACKET\nalongside SOCK_RAW and SOCK_DGRAM behind the same CAP_NET_RAW check,\nand neither the socket length nor a capability check keeps it away\nfrom a CAN interface.\n\nThe missing skb_reset_*_header() calls in init_can_skb() are a\nregression in their own right and are being fixed separately, but a\npacket socket should not turn a link layer that did not initialise its\nmac header into a kernel panic. Guard the push the way the other two\nreceive paths do.\n\nTested on v7.3-rc5 under QEMU with a slcan device on a pty, which is\nthe driver RX path: vcan does not reproduce it, because can_send()\nresets the headers on the way out. One SOCK_PACKET socket bound to\ncan0 and one frame written into the line discipline panics an\nunpatched kernel with the trace above; the same image with this patch\nprints no panic and powers off normally. Both kernels are this tree,\ndefconfig plus CONFIG_CAN_SLCAN\u003dy, differing only in this hunk.\n\nFixes: d549699048b4 (\"net/packet: fix packet receive on L3 devices without visible hard header\")\nCc: stable@vger.kernel.org\nSigned-off-by: Quchaosheng \u003cquchaosheng000406@163.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260928113108.2127215-1-quchaosheng000406@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2d3b94c6076a95553876a3c45c122edf62c27449", "tree": "84d860b87889dfc690b371061ab7d163e25c3f0f", "parents": [ "c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021", "c41817fcaf397f6ff7c530b682581f5eb5465844" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 18:11:13 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 18:11:14 2026 -0700" }, "message": "Merge branch \u0027amt-send-the-relay-s-general-query-directly-from-the-receive-path\u0027\n\nOmar Ramadan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\namt: send the relay\u0027s General Query directly from the receive path\n\nThe relay queues its General Query on the amt device with a raw tunnel\npointer in skb-\u003ecb, and a query that waits in a qdisc can outlive its\ntunnel: a use-after-free in amt_dev_xmit(), reported by Microsoft with\na KASAN reproducer. Patch 1 sends the query directly from\namt_request_handler(), inside the RCU section that found or created\nthe tunnel, so it never waits in a qdisc and nothing is stored in\nskb-\u003ecb.\n\nPatch 2 adds the selftest Taehee asked for. It counts the queries that\nleave the relay through its amt device and expects none. It fails\nwithout patch 1 and passes with it.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260928202312.74574-1-omar@blockcast.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c41817fcaf397f6ff7c530b682581f5eb5465844", "tree": "84d860b87889dfc690b371061ab7d163e25c3f0f", "parents": [ "afae89de73dd693cfa329580ba0fba63bd3f0a11" ], "author": { "name": "Omar Ramadan", "email": "omar@blockcast.net", "time": "Mon Sep 28 23:23:12 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 18:11:09 2026 -0700" }, "message": "selftests: net: amt: check that the relay\u0027s queries bypass the amt device\n\nThe relay used to hand its General Queries to dev_queue_xmit() on the\namt device, where a query could wait in a qdisc and outlive the tunnel\nit pointed to. The previous patch sends them directly from the receive\npath instead.\n\nCount the IGMP and MLD queries that leave the relay through amtr with\ntc flower filters on its egress, installed before the gateway comes\nup, and check that there are none. The forwarding tests before it\nalready show that the gateway received its queries, since it cannot\njoin without one.\n\nWithout the previous patch the new test fails (one run counted 7 IGMP\nand 6 MLD queries); with it, all of amt.sh passes.\n\nSigned-off-by: Omar Ramadan \u003comar@blockcast.net\u003e\nLink: https://patch.msgid.link/20260928202312.74574-3-omar@blockcast.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "afae89de73dd693cfa329580ba0fba63bd3f0a11", "tree": "e37677e99c739452268e85a72e0f1089c2b9fe06", "parents": [ "c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021" ], "author": { "name": "Omar Ramadan", "email": "omar@blockcast.net", "time": "Mon Sep 28 23:23:11 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 18:11:09 2026 -0700" }, "message": "amt: send the relay\u0027s General Query directly from the receive path\n\nAn skb queued in a qdisc can outlive the tunnel it references\nthrough a raw pointer in skb-\u003ecb. For example, with igmp_qrv set\nto 1 on the relay a tunnel lives for 135s, so a netem delay of\n180s on the amt device outlives it; when the tunnel expires and is\nfreed, the subsequent dequeue triggers a use-after-free in\namt_dev_xmit().\n\n BUG: KASAN: slab-use-after-free in amt_dev_xmit+0x2763/0x2e20\n Call Trace:\n amt_dev_xmit+0x2763/0x2e20 [drivers/net/amt.c:1262]\n dev_hard_start_xmit+0x22f/0x620\n sch_direct_xmit+0x12e/0xac0\n netem_dequeue+0x333/0xc50\n net_tx_action+0x35c/0xa60\n\namt_send_igmp_gq() and amt_send_mld_gq() are only called from\namt_request_handler(), inside the rcu_read_lock_bh() section of\namt_rcv(). amt_request_handler() already has the tunnel the query is\nfor: it found or created it inside that section. Queuing the query with\ndev_queue_xmit() only leads back into amt_dev_xmit(), which strips the\nEthernet header and calls amt_send_membership_query() for that tunnel.\n\nMake that call directly from the two senders instead, the same way\namt_send_advertisement() transmits from the receive path. The query\nnever waits in a qdisc, the tunnel is only dereferenced inside the\nRCU section that found or created it, and nothing is stored in\nskb-\u003ecb, so no lookup or refcount is needed. Remove the query branch\nof amt_dev_xmit(), amt_skb_cb() and struct amt_skb_cb, which have no\nusers left.\n\nBehaviour changes:\n - The relay\u0027s own General Queries no longer pass through the amt\n device\u0027s egress path: its qdisc, tc egress (clsact/tcx), the\n netfilter egress hook and packet taps. They are still visible as\n UDP on the underlay.\n - A query that is sent successfully is no longer counted as\n tx_dropped. The old query branch left through the unlock label,\n which counted every sent query as dropped.\n - A query that reaches amt_dev_xmit() on a relay from elsewhere,\n such as a userspace querier, is now dropped at the IGMP/MLD type\n switch. Before, it trusted whatever skb-\u003ecb held, and a NULL\n tunnel hit the WARN_ON(1).\n\nFixes: cbc21dc1cfe9 (\"amt: add data plane of amt interface\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nReported-by: Xiang Mei (Microsoft) \u003cxmei5@asu.edu\u003e\nReported-by: Cen Zhang (Microsoft Security FORGE Labs) \u003ccenzhang@linux.microsoft.com\u003e\nSigned-off-by: Omar Ramadan \u003comar@blockcast.net\u003e\nLink: https://patch.msgid.link/20260928202312.74574-2-omar@blockcast.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c9728fcf2e7fb4a7a8d08ebd9524c3b02ae1a021", "tree": "c1db9732c0500f80a709ffbf565544bb0b179686", "parents": [ "17e73bae400f6a434dc006e3bee92c94cf781954" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Sep 30 03:31:02 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 17:59:43 2026 -0700" }, "message": "net/sched: em_text: reject unterminated algo before autoload\n\nThis is a follow-up to commit 9c572a83037a (\"net/sched: fix potential\nstack infoleak in em_text_dump()\"), which zero-initialised the dump-side\nstruct. Sashiko pointed at a pre-existing bug that exposed the change-side\ninput-validation gap open.\n\nem_text_change() casts the raw netlink attribute payload to struct\ntcf_em_text and passes conf-\u003ealgo, a 16-byte array with no enforced NUL\nterminator, to textsearch_prepare(). On the TS_AUTOLOAD retry\ntextsearch_prepare() calls request_module(\"ts_%s\", algo); vsnprintf()\nwalks %s until it finds a NUL, so an algo[] with no NUL reads past the\narray into the adjacent struct fields and payload and feeds those bytes\nto the usermode helper command line. This is an out-of-bounds read and\na kernel memory disclosure.\n\nReject the attribute when no NUL exists within TC_EM_TEXT_ALGOSIZ bytes,\nmatching the check xt_string has had since 3ab720881b6e.\n\nConditions to recreate the bug:\n- CAP_NET_ADMIN on the target netns (namespace-local via unshare -Urn\n is enough)\n- install clsact on an interface, then add a basic filter with one text\n ematch whose algo[] is 16 bytes with no NUL (e.g. \"A\"*16) and\n pattern_len at least 1\n- the add fails with -ENOENT and the kernel invokes modprobe with a\n module name made of \"ts_\" plus the 16 bytes and the adjacent payload\n\nFixes: d675c989ed2d4 (\"[PKT_SCHED]: Packet classification based on textsearch (ematch)\")\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260918133953.12494-1-bernard.ladenthin%40gmail.com\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-2DIU.v1.20260929183844@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17e73bae400f6a434dc006e3bee92c94cf781954", "tree": "237c9920a741b1809100d3e17db02c6ae80e5af4", "parents": [ "8e9cb398593c1a4bfd50ac221f4ae5ab2a69a5ae" ], "author": { "name": "Chengfeng Ye", "email": "nicoyip.dev@gmail.com", "time": "Tue Sep 29 00:12:46 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 17:15:38 2026 -0700" }, "message": "tipc: hold a reference to nodes found by link name\n\ntipc_node_find_by_name() returns a node after dropping its RCU read lock\nwithout taking a reference. The LINK_SET, LINK_GET and LINK_RESET_STATS\nhandlers then lock and access the node, racing with timer-driven cleanup of\na down peer. Generic netlink serialization does not exclude the node\ntimer.\n\nThe following interleaving can leave a handler using a freed node:\n\n CPU 0: find the node under RCU and release the node read lock\n CPU 1: tipc_node_timeout() clears the links and unlinks the down node\n CPU 1: drop the list and timer references, queuing tipc_node_free()\n CPU 0: leave the RCU read-side critical section\n CPU 1: complete the grace period and free the node\n CPU 0: acquire the node lock through the stale pointer\n\nLINK_SET also uses the node\u0027s media address after releasing the node lock,\nwhen passing queued packets to tipc_bearer_xmit().\n\nKASAN on v7.3-rc5 reported:\n\n BUG: KASAN: slab-use-after-free in _raw_read_lock_bh\n Write of size 4 at addr ffff88807e06f008 by task poc/92\n Call Trace:\n _raw_read_lock_bh kernel/locking/spinlock.c:287\n tipc_nl_node_set_link net/tipc/node.c:2475\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1114\n genl_rcv_msg net/netlink/genetlink.c:1209\n netlink_rcv_skb net/netlink/af_netlink.c:2575\n\n Allocated by task 0:\n tipc_node_create net/tipc/node.c:539\n tipc_node_check_dest net/tipc/node.c:1196\n tipc_disc_rcv net/tipc/discover.c:252\n\n Freed by task 92:\n kfree mm/slub.c:6801\n rcu_core kernel/rcu/tree.c:2919\n\n Last potentially related work creation:\n __call_rcu_common.constprop.0 kernel/rcu/tree.c:3181\n tipc_node_timeout net/tipc/node.c:814\n\nAcquire a reference to the selected node with kref_get_unless_zero() before\nleaving RCU, returning NULL if the node has already been released. Release\nthat reference on every caller exit after the last node access, including\ntransmission in LINK_SET. Keep the existing link lookup order and locking\nso concurrent link removal still takes the existing error paths.\n\nFixes: 6a939f365bdb (\"tipc: Auto removal of peer down node instance\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260928161246.1895273-1-nicoyip.dev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8e9cb398593c1a4bfd50ac221f4ae5ab2a69a5ae", "tree": "c19802af127feb29791b69e0939e940237a602e5", "parents": [ "d24e8ac715de2e16a53c144005b1863660a5fbea", "84bec0bf035258a1073ffd6f6dc8ea61806aa7d4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 15:59:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 15:59:30 2026 -0700" }, "message": "Merge branch \u0027ibmveth-fix-open-fail-unwind-after-lan-registration\u0027\n\nMingming Cao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nibmveth: fix open-fail unwind after LAN registration\n\nibmveth_open() has two independent unwind holes after the logical LAN\nis set up. Neither needs the MQ RX series. This posting is against\ncurrent net.git.\n\nPatch 1 issues h_free_logical_lan() on every post-register failure.\nA pool allocation failure jumped to out_free_buffer_pools without\nthe hypercall, so PHYP still owned the buffer-list page when it was\nunmapped. request_irq() failure already issued H_FREE before taking\nthe same label.\n\n Fixes: d43732ce021f (\"ibmveth: properly unwind on init errors\")\n\nPatch 2 gives TX LTBs their own walk. out_free_buffer_pools reuses\nopen()\u0027s loop index, so after the pool unwind i is -1 and the TX\nbuffers leak. request_irq() failure has the same leak. The TX-fail\ngoto on that walk also skips dma_unmap of the filter list\n(pre-existing since the LTB was added).\n\n Fixes: d926793c1de9 (\"ibmveth: Implement multi queue on xmit\")\n\nThe MQ RX series on net-next keeps the helper versions of these\nguards and does not depend on this pair. If both land, keep the\nhelpers in that series; these two patches are the current\nsingle-queue open-fail path only.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1790357373.git.mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "84bec0bf035258a1073ffd6f6dc8ea61806aa7d4", "tree": "c19802af127feb29791b69e0939e940237a602e5", "parents": [ "af0524bf4ce1a4cbd2946aa81751582951cfcab5" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Fri Sep 25 11:05:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 15:59:28 2026 -0700" }, "message": "ibmveth: fix TX LTB and filter unwind on open-fail\n\nout_free_buffer_pools reuses open()\u0027s loop index for the TX LTB\nwalk. After the pool unwind i is -1, so the TX buffers allocated\nearlier are leaked. request_irq() failure has the same leak.\n\nThe TX-fail goto on that walk also skips dma_unmap of the filter\nlist (pre-existing since the LTB was added). Rewrite the TX walk\nto real_num_tx_queues with a pointer check, and unmap the filter\nlist before those frees.\n\nFixes: d926793c1de9 (\"ibmveth: Implement multi queue on xmit\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nReviewed-by: Dave Marquardt \u003cdavemarq@linux.ibm.com\u003e\nLink: https://patch.msgid.link/d14314c2b10f125f5e578782484ba3cc50564d53.1790357373.git.mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "af0524bf4ce1a4cbd2946aa81751582951cfcab5", "tree": "5e3fd4c1d0bfa8725f6e487656ba478f8370a8f6", "parents": [ "d24e8ac715de2e16a53c144005b1863660a5fbea" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Fri Sep 25 11:05:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 01 15:59:28 2026 -0700" }, "message": "ibmveth: h_free logical LAN on open-fail after register\n\nibmveth_open() registers the logical LAN, then allocates the RX\nbuffer pools. A pool failure jumps to out_free_buffer_pools without\nh_free_logical_lan(), so PHYP still owns the buffer-list page when\nit is unmapped. request_irq() failure already issued the hypercall\nbefore taking the same label.\n\nMove that h_free to the shared post-register unwind so both paths\nderegister before the buffer list is unmapped.\n\nFixes: d43732ce021f (\"ibmveth: properly unwind on init errors\")\nCc: stable@vger.kernel.org\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nReviewed-by: Dave Marquardt \u003cdavemarq@linux.ibm.com\u003e\nLink: https://patch.msgid.link/7a56fbfb9e0674f011f4e310fbd7dfd8e67c30aa.1790357373.git.mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d24e8ac715de2e16a53c144005b1863660a5fbea", "tree": "a4ff1dfd0dc65098e222e3dc0a45b8860babf3f3", "parents": [ "703033e2350c8c9fcacd652f36675e1327221b10", "e23a64eb244356ee47c0620f0722d51bd88db522" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:41:59 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:41:59 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from Bluetooth, WiFi and netfilter.\n\n We are actively retargeting several non-urgent fixes towards next,\n but the traffic on the ML looks ever-increasing, and propagating the\n push-back towards subsystems is not immediate.\n\n No known outstanding regressions.\n\n Current release - regressions:\n\n - netfilter: nft_set_rbtree: skip transaction elements during GC\n\n Previous releases - regressions:\n\n - sched: cls_api: reclaim an empty proto on the error path\n\n - core:\n - fix checksum offsets in skb_splice_from_iter()\n - cap skb-\u003equeue_mapping when the tx queue is picked\n\n - page_pool: fix use-after-free in page_pool_recycle_ring_bulk()\n\n - wifi:\n - mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n - mac80211: drop oversized fragments to avoid extra_len overflow\n\n - netfilter:\n - flowtable: restore ieee80211 forward path\n\n - bluetooth: hci_conn: Lock parent access during enhanced SCO setup\n\n - eth:\n - bcmgenet: allocate RX buffers as page fragments\n - stmmac: fix rx Scatter-Gather support\n - octeontx2-pf: fix aura BPID assignment when CONFIG_DCB is enabled\n - gve: DQO: accept TSO packets with non-protocol gso_type bits\n - r8169: disable EEE on RTL8168h/8111h\n\n Previous releases - always broken:\n\n - tcp: refresh TS.Recent for accepted old ACKs\n\n - wifi:\n - ath11k: reset ar-\u003enum_stations on hardware start\n - cfg80211: fix RTS threshold setting for single-radio PHY\n\n - bluetooth: btintel_pcie: fix plen overflow in btintel_pcie_recv_frame()\n\n - eth: bcmgenet: fix NULL dereference in set_coalesce before first open\n\n Misc:\n - Eric is retiring from google and updating his contact info\"\n\n* tag \u0027net-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (96 commits)\n net: phy: aquantia: fix system interface type not updated in forced mode\n net: usb: qmi_wwan: add Rolling Wireless RN947R\n net: mvneta: clear XDP pfmemalloc flag between frames\n ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()\n net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference\n r8169: disable EEE on RTL8168h/8111h\n octeontx2-pf: Fix RSS indirection table size\n sctp: check RCV_SHUTDOWN after the sendmsg connect wait\n net: sparx5: make ports inherit the switch base mac address type\n net: microchip: vcap: stop scanning after deleting key field\n netfilter: flowtable: restore ieee80211 forward path\n netfilter: flowtable: generalize pending status bit\n netfilter: bpf: reject invalid NAT manipulation types\n netfilter: nft_set_rbtree: skip transaction elements during GC\n ipvs: filter some flags received in the backup server\n ipvs: do not create invisible templates\n ipvs: bound LBLCR and LBLC cache growth\n ipvs: fix missing counter decrement in lblc\n netfilter: nft_flow_offload: drop flowtable reference on init error path\n selftests: net: check timestamp echo after an old ACK\n ...\n" }, { "commit": "703033e2350c8c9fcacd652f36675e1327221b10", "tree": "233cf8780df2ea92103e8a86b643ae3dbbfa5dc4", "parents": [ "5cd9813d848d6565f0ca7825a8405c4e48441cf9", "fdd6553e1e53b0421d89c7469c8a36d2eadb1115" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:31:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 01 06:31:40 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fixes from Joel Granados:\n \"Fix sysctl jiffies conversions errors introduced in 2dc164a48e6f\n (\"sysctl: Create converter functions with two new macros\")\n\n - Ensure that mult_hz does *not* wrap\n\n - Ensure we pass just the magnitude for the negative branch in\n proc_int_k2u_conv_kop\"\n\n* tag \u0027sysctl-7.03-fixes-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n time/jiffies: Saturate in mult_hz() instead of wrapping\n sysctl: Negate before converting in the int read path\n" }, { "commit": "e23a64eb244356ee47c0620f0722d51bd88db522", "tree": "a18ad75b41511e252617333828d0cec7e378de1b", "parents": [ "6e0022b5ae3dc5b833af0fcc1578dc20a1d6bc71", "3ae37eafd36694bb2d3227f60ac98fbf602470a2" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 01 12:00:40 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 01 12:00:40 2026 +0200" }, "message": "Merge tag \u0027nf-26-09-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter/IPVS fixes for net\n\nThe following batch contains Netfilter fixes for net. This batch\nfixes crashes as recent feature regression, one of the due to a\ndependency that has been pulled into -stable:\n\n1) Expand existing ipset fix for bitmap sets to disallow comments\n updates from kernel-side adds, from Florian Westphal.\n\n2) Drop flowtable reference if nf_ct_netns_get() fails, otherwise\n flowtable cannot ever be removed, from Aohan Mei.\n\n3) nft_rbtree GC should collect end elements that contained in\n this transaction batch, new or deleted elements are never\n expired. From Weiming Shi.\n\n4) Restrict nf_nat_bpf so it does not set unknown NF_NAT_MANIP_*\n values, from Fernando F. Mancera.\n\n5) Flowtable GC must skip flows that are pending hardware updates,\n generalize the PENDING flag and use it to inhibit GC.\n\n6) Restore flowtable with ieee80211 which broke due to a relatively\n recent commit, which was pulled in by -stable, causing a regression\n in 6.18 kernels.\n\nAnd the following IPVS fixes:\n\n1) Fix accounting of cache entries in IPVS LBLC for destinations,\n which eventually fills up the table and trigger recurrent\n resizing, from Julian Anastasov.\n\n2) Limit IPVS cache growth for LBLCR and LBLC schedulers,\n from Zhiling Zou.\n\n3) Restrict IP_VS_CONN_F_ONE_PACKET for normal connections,\n do not allow to use it with templates. Also from Julian.\n\n4) Sanitize flags in IPVS sync messages received in the backup.\n From Julian Anastasov.\n\nnetfilter pull request 26-09-30\n\n* tag \u0027nf-26-09-30\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: flowtable: restore ieee80211 forward path\n netfilter: flowtable: generalize pending status bit\n netfilter: bpf: reject invalid NAT manipulation types\n netfilter: nft_set_rbtree: skip transaction elements during GC\n ipvs: filter some flags received in the backup server\n ipvs: do not create invisible templates\n ipvs: bound LBLCR and LBLC cache growth\n ipvs: fix missing counter decrement in lblc\n netfilter: nft_flow_offload: drop flowtable reference on init error path\n netfilter: ipset: do not update comments from kernel-side adds\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260930074142.298353-1-pablo@netfilter.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6e0022b5ae3dc5b833af0fcc1578dc20a1d6bc71", "tree": "95dd72f48c6131ba67f3f5b21741947676c049b7", "parents": [ "7375d38364a9aa66fb31716bcefef38aecad75d8" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Sep 23 17:14:35 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 01 10:15:19 2026 +0200" }, "message": "net: phy: aquantia: fix system interface type not updated in forced mode\n\naqr_gen1_read_status() decodes the MDIO_PHYXS_VEND_IF_STATUS register\nto determine which SerDes interface the PHY is currently using on its\nsystem side and stores the result in phydev-\u003einterface. phylink relies\non this value to configure the MAC.\n\nThe autoneg \u003d\u003d AUTONEG_DISABLE check is not correct:\nMDIO_PHYXS_VEND_IF_STATUS is set by the PHY firmware based on the\nnegotiated link speed, not based on whether autoneg was used to reach\nit. When the link comes up at 1G in forced mode, the register correctly\nreads SGMII, but the early return prevents phydev-\u003einterface from being\nupdated. It stays at whatever value it held before (typically 2500BASE-X\nfrom the initial autoneg run), so phylink configures the MAC for the\nwrong interface and the link cannot come up.\n\nRemove the autoneg guard so that the system interface type is always\ndecoded when the link is up.\n\nCc: stable@vger.kernel.org\nFixes: 110a2432c520 (\"net: phy: aquantia: add downshift support\")\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260923-qcom-sa8255p-emac-v15-1-e82f33720737@oss.qualcomm.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5cd9813d848d6565f0ca7825a8405c4e48441cf9", "tree": "b5c76c9282e22c4319c9a0df927388d3ea91e9be", "parents": [ "551c722f40809618230001baccf219193e22fc5a", "aa650d87a498844060eecb1d336f4d46f4d1b0b3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 30 19:08:10 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 30 19:08:10 2026 -0700" }, "message": "Merge tag \u0027audit-pr-20260930\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit\n\nPull audit fix from Paul Moore:\n \"A single audit fix for a potential UAF error in some audit filter\n configurations\"\n\n* tag \u0027audit-pr-20260930\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/audit:\n audit: fix exe mark UAF in kill_rules()\n" }, { "commit": "7375d38364a9aa66fb31716bcefef38aecad75d8", "tree": "478212fc7e8b3dacc4eba34271f7f4f36710f421", "parents": [ "8f1c2a10500a84a621ff13073f96deea0753ed42" ], "author": { "name": "Reinhard Speyerer", "email": "rspmn@arcor.de", "time": "Fri Sep 25 15:14:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 18:05:08 2026 -0700" }, "message": "net: usb: qmi_wwan: add Rolling Wireless RN947R\n\nAdd Rolling Wireless RN947R 0x9300 composition:\n\nDIAG + ADB + NMEA + MODEM + RMNET + QDSS + ADPL\n\nT: Bus\u003d01 Lev\u003d01 Prnt\u003d01 Port\u003d02 Cnt\u003d02 Dev#\u003d 6 Spd\u003d480 MxCh\u003d 0\nD: Ver\u003d 2.10 Cls\u003def(misc ) Sub\u003d02 Prot\u003d01 MxPS\u003d64 #Cfgs\u003d 1\nP: Vendor\u003d33f8 ProdID\u003d9300 Rev\u003d 0.00\nS: Manufacturer\u003dRolling Wireless\nS: Product\u003dRN947R\nS: SerialNumber\u003dxxxxxxxxxxx\nC:* #Ifs\u003d 7 Cfg#\u003d 1 Atr\u003da0 MxPwr\u003d500mA\nI:* If#\u003d 0 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003dff Prot\u003d30 Driver\u003doption\nE: Ad\u003d01(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d81(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 1 Alt\u003d 0 #EPs\u003d 2 Cls\u003dff(vend.) Sub\u003d42 Prot\u003d01 Driver\u003dusbfs\nE: Ad\u003d02(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d82(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 2 Alt\u003d 0 #EPs\u003d 3 Cls\u003dff(vend.) Sub\u003dff Prot\u003d40 Driver\u003doption\nE: Ad\u003d84(I) Atr\u003d03(Int.) MxPS\u003d 10 Ivl\u003d32ms\nE: Ad\u003d83(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d03(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 3 Alt\u003d 0 #EPs\u003d 3 Cls\u003dff(vend.) Sub\u003dff Prot\u003d40 Driver\u003doption\nE: Ad\u003d86(I) Atr\u003d03(Int.) MxPS\u003d 10 Ivl\u003d32ms\nE: Ad\u003d85(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d04(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d 8 Alt\u003d 0 #EPs\u003d 3 Cls\u003dff(vend.) Sub\u003dff Prot\u003d50 Driver\u003dqmi_wwan\nE: Ad\u003d88(I) Atr\u003d03(Int.) MxPS\u003d 8 Ivl\u003d32ms\nE: Ad\u003d87(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nE: Ad\u003d05(O) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d21 Alt\u003d 0 #EPs\u003d 1 Cls\u003dff(vend.) Sub\u003dff Prot\u003d70 Driver\u003d(none)\nE: Ad\u003d89(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\nI:* If#\u003d22 Alt\u003d 0 #EPs\u003d 1 Cls\u003dff(vend.) Sub\u003dff Prot\u003d80 Driver\u003d(none)\nE: Ad\u003d8a(I) Atr\u003d02(Bulk) MxPS\u003d 512 Ivl\u003d0ms\n\nSigned-off-by: Reinhard Speyerer \u003crspmn@arcor.de\u003e\nLink: https://patch.msgid.link/arZzuOOvLUZtdOlv@arcor.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f1c2a10500a84a621ff13073f96deea0753ed42", "tree": "0c310f71e40001c88bf289d75de624db9a77e539", "parents": [ "8ec454dcd00ce3375119111c6394964455b36d0d" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Tue Sep 29 15:43:03 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 17:39:11 2026 -0700" }, "message": "net: mvneta: clear XDP pfmemalloc flag between frames\n\nmvneta_swbm_add_rx_fragment() sets XDP_FLAGS_FRAGS_PF_MEMALLOC on the\nxdp_buff when a fragment page is a pfmemalloc one (page under memory\npressure). The xdp_buff is reused for the next frame, but only the\nXDP_FLAGS_HAS_FRAGS bit was cleared at frame start, so the pfmemalloc\nbit leaked from one frame into the following ones. mvneta_swbm_build_skb()\npropagates the flag to skb-\u003epfmemalloc through xdp_update_skb_frags_info(),\nso the skb of a subsequent fragmented frame could be wrongly marked as\npfmemalloc even if none of its pages are under pressure.\n\nClear all the xdp_buff flags in mvneta_swbm_rx_frame(), which is invoked\nfor each new frame, instead of just the XDP_FLAGS_HAS_FRAGS bit.\n\nFixes: ed7a58cb40bd (\"net: marvell: rely on xdp_update_skb_shared_info utility routine\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://patch.msgid.link/20260929-mvneta-xdp-clear-frag-fix-v4-1-1e63b25eeed8@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8ec454dcd00ce3375119111c6394964455b36d0d", "tree": "1fc620cd8a7afaeb6ab24e39807bd8176bc8e8bb", "parents": [ "7b97273cbebe9dd4fddc457f0c4f2a124d0e3996" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Mon Sep 28 19:45:24 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 17:37:47 2026 -0700" }, "message": "ipv6: sr: use skb_get_hash_net() in seg6_make_flowlabel()\n\nSince commit d58e468b1112 (\"flow_dissector: implements flow dissector\nBPF hook\") __skb_flow_dissect() needs a net pointer, either from\nskb-\u003edev, skb-\u003esk, or since commit 3cbf4ffba5ee (\"net: plumb network\nnamespace into __skb_flow_dissect\") a caller provided pointer.\n\nsyzbot was able to reach seg6_make_flowlabel() with an skb having\nneither skb-\u003edev nor skb-\u003esk set: a TIPC UDP bearer sends a discovery\nmessage through an IPv4 route using seg6 encap, while\nnet.ipv6.seg6_flowlabel is set to 1.\n\nseg6_make_flowlabel() already has a net pointer, use skb_get_hash_net().\n\nWARNING: net/core/flow_dissector.c:1131 at __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126, CPU#0: syz.0.17/4930\nCall trace:\n __skb_flow_dissect+0x910/0x5368 net/core/flow_dissector.c:1126 (P)\n __skb_get_hash_net+0xe0/0x29c net/core/flow_dissector.c:1903\n skb_get_hash include/linux/skbuff.h:1663 [inline]\n seg6_make_flowlabel+0xcc/0x1ec net/ipv6/seg6_iptunnel.c:132\n __seg6_do_srh_encap+0x320/0xbf4 net/ipv6/seg6_iptunnel.c:161\n seg6_do_srh+0x4b4/0xa44 net/ipv6/seg6_iptunnel.c:431\n seg6_output_core+0x164/0x688 net/ipv6/seg6_iptunnel.c:681\n seg6_output+0x44/0x1ac net/ipv6/seg6_iptunnel.c:744\n lwtunnel_output+0x3d0/0x664 net/core/lwtunnel.c:356\n dst_output include/net/dst.h:470 [inline]\n ip_local_out+0x110/0x148 net/ipv4/ip_output.c:131\n iptunnel_xmit+0x50c/0xd38 net/ipv4/ip_tunnel_core.c:97\n udp_tunnel_xmit_skb+0x220/0x348 net/ipv4/udp_tunnel_core.c:187\n tipc_udp_xmit+0x75c/0x9c0 net/tipc/udp_media.c:202\n tipc_udp_send_msg+0x214/0x374 net/tipc/udp_media.c:274\n tipc_bearer_xmit_skb+0x260/0x3b0 net/tipc/bearer.c:576\n tipc_enable_bearer net/tipc/bearer.c:366 [inline]\n __tipc_nl_bearer_enable+0xc90/0xfb0 net/tipc/bearer.c:1048\n tipc_nl_bearer_enable+0x2c/0x48 net/tipc/bearer.c:1057\n genl_family_rcv_msg_doit+0x1e4/0x2d4 net/netlink/genetlink.c:1114\n\nFixes: d58e468b1112 (\"flow_dissector: implements flow dissector BPF hook\")\nReported-by: syzbot+9408fbe0e6452a12e9ab@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6abac2eb.3654fce1.1bec97.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260928194524.3617299-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7b97273cbebe9dd4fddc457f0c4f2a124d0e3996", "tree": "e8f223647f940d69271238ce5775157207fb3cd6", "parents": [ "3cdeaef1754ab8155cdd828c958ada3d36e9ad9a" ], "author": { "name": "Prathamesh Deshpande", "email": "prathameshdeshpande7@gmail.com", "time": "Sat Sep 26 17:53:57 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 17:37:34 2026 -0700" }, "message": "net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference\n\nDuring XSK TX queue teardown, outstanding descriptors are completed\nwithout a CQE. If one requested a TX timestamp, the completion path\npasses that NULL CQE to mlx5e_xsk_fill_timestamp(), which dereferences\nit.\n\nReturn zero when no CQE is available, indicating that teardown did not\nproduce a TX timestamp.\n\nFixes: ec706a860eba (\"net/mlx5e: Implement AF_XDP TX timestamp and checksum offload\")\nSigned-off-by: Prathamesh Deshpande \u003cprathameshdeshpande7@gmail.com\u003e\nReviewed-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260926165402.5902-1-prathameshdeshpande7@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3cdeaef1754ab8155cdd828c958ada3d36e9ad9a", "tree": "f027408c6ccb466e65322c339f01c620b5394bf7", "parents": [ "9e792901418d814295674d1f53d6b615fb5c15c8" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Fri Sep 25 09:10:40 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 17:18:00 2026 -0700" }, "message": "r8169: disable EEE on RTL8168h/8111h\n\nForce EEE off on the RTL8168h/8111h (RTL_GIGA_MAC_VER_46) at PHY connect\nwith phy_disable_eee().\n\nCommit 202fef9bbbf5 (\"net: phy: realtek: fix EEE advertisement write on\nthe internal PHY MMD path\") made EEE actually advertise on the generic\nRealtek PHY; the write had been a no-op before. On the RTL8168h that\nun-masks a latent defect: once EEE negotiates, RX silently stalls after\n~7-20 minutes. The carrier stays up, no counter or dmesg moves, and only\n\"ip link set down/up\" recovers it; disabling EEE keeps the link stable.\n\nRoot-causing the RTL8168h LPI/RX path needs hardware not available now, so\ndisable EEE for this version. Use phy_disable_eee() rather than dropping\nthe version from rtl_supports_eee(): the latter also skips\nrtl_enable_tx_lpi(), whose disable branch clears the MAC TX-LPI bits (ERI\n0x1b0[1:0]) on link up. rtl_hw_start_8168h_1() does not clear them (the\nRTL8402/RTL8106e init does), so a warm reboot from an EEE-active state\ncould otherwise leave TX-LPI asserted while the PHY no longer negotiates\nEEE. Keeping the version EEE-capable preserves that clear path. This also\ncovers the RTL8168M, which shares RTL_GIGA_MAC_VER_46.\n\nReported-by: Dennis Piecha \u003cd.piecha@ymail.com\u003e\nCloses: https://lore.kernel.org/all/353419280.954808.1790290283530@mail.yahoo.com/\nFixes: 202fef9bbbf5 (\"net: phy: realtek: fix EEE advertisement write on the internal PHY MMD path\")\nCc: stable@vger.kernel.org\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nLink: https://patch.msgid.link/20260925071040.2137178-1-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e792901418d814295674d1f53d6b615fb5c15c8", "tree": "408f015d724e378e0d2e227113f6319d4f9d1afa", "parents": [ "4f1da630d13de0370e2f6361f961f1c8b384af1c" ], "author": { "name": "Jari Seppälä", "email": "jase@nocloud.org", "time": "Mon Sep 28 11:47:11 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 16:58:59 2026 -0700" }, "message": "octeontx2-pf: Fix RSS indirection table size\n\nThe conversion to the dedicated RSS context operations replaced the\npointer to struct otx2_rss_ctx with an inline u32 ind_tbl[] array.\nHowever, otx2_rss_init() still uses sizeof(*rss-\u003eind_tbl) to set rss_size.\nThis now yields the size of one u32 (4), rather than the 256 entries in\nthe indirection table.\n\nThe RSS initialization and hardware programming loops use rss_size,\nso only four entries are initialized and programmed despite the NIX LF\nbeing allocated a 256-entry table. On an OCTEON CN102 with eight RX\nqueues, the table contained 0, 1, 2, 3 followed by zeros. Traffic was\nconcentrated on queue 0 and ethtool -X equal 8 did not correct the table.\n\nUse ARRAY_SIZE() to count the indirection table entries. On the same\nhardware, this restores the full table repeating queue numbers 0 through\n7, and bidirectional multi-flow traffic increments multiple RX queues.\n\nRuntime testing on an Asterfusion ET2500 (OCTEON CN102 A0).\n\nFixes: 62e01d8c4170 (\"eth: otx2: migrate to the *_rxfh_context ops\")\nCc: stable@vger.kernel.org\nCloses: https://lore.kernel.org/netdev/361df563-e29e-43bf-8806-24bdfefed33d@nocloud.org/\nSigned-off-by: Jari Seppälä \u003cjase@nocloud.org\u003e\nReviewed-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260928084711.2462571-1-jase@nocloud.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f1da630d13de0370e2f6361f961f1c8b384af1c", "tree": "402ee299adf6c9b024b82f48ab3ff3653fc1ec56", "parents": [ "5642b1648d5c4561d8ed7a410d0a7017f706604d" ], "author": { "name": "Jun Yang", "email": "junvyyang@tencent.com", "time": "Sat Sep 26 17:55:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 16:55:47 2026 -0700" }, "message": "sctp: check RCV_SHUTDOWN after the sendmsg connect wait\n\nsctp_wait_for_connect() drops the socket lock while it sleeps. An\nout-of-the-blue ABORT can then be processed from the socket backlog and\nunlink the association. If a concurrent shutdown(fd, SHUT_RD) sets\nRCV_SHUTDOWN, the waiter breaks with err \u003d\u003d 0 before checking\nasoc-\u003ebase.dead. Its final sctp_association_put() can then free the\nassociation, leaving sctp_sendmsg_to_asoc() to continue with a dangling\npointer.\n\nCheck RCV_SHUTDOWN along with the wait error in sctp_sendmsg_to_asoc()\nbefore using the association again. The check only accesses the socket,\nso it needs no additional association reference. Return the existing\n-ESRCH so that sctp_sendmsg() skips freeing a new association that may\nalready have been destroyed.\n\nKeep sctp_wait_for_connect() unchanged to preserve its behavior for the\nconnect() caller.\n\nFixes: 668c9beb9020 (\"sctp: implement assign_number for sctp_stream_interleave\")\nCc: stable@vger.kernel.org\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260926095606.68601-1-juny24602@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5642b1648d5c4561d8ed7a410d0a7017f706604d", "tree": "f118e1cca07f80454ffae93115b2a5d71cfbe550", "parents": [ "be35a3e003941fc25b4e72d8d4fd44f8a98ac1af" ], "author": { "name": "Quentin Freimanis", "email": "quentin@q-lab.dev", "time": "Sun Sep 27 21:50:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 16:10:41 2026 -0700" }, "message": "net: sparx5: make ports inherit the switch base mac address type\n\nWhen the switch uses a random base MAC address it does not mark each\nport\u0027s address as random:\n\n $ dmesg | grep \"MAC addr\"\n sparx5-switch e00c0000.switch: MAC addr was not set, use random MAC\n $ cat /sys/class/net/eth0/addr_assign_type\n 0\n\n0 is NET_ADDR_PERM, so userspace thinks this is a stable address.\n\nWith a random MAC reported as NET_ADDR_PERM, systemd\u0027s\nMACAddressPolicy\u003dpersistent [1] leaves it unchanged, so a DHCP client\ngets a new IP address every boot and a static reservation can\u0027t be used.\nReporting it as NET_ADDR_RANDOM makes systemd replace it with a stable\naddress derived from the interface name and machine-id.\n\nFixes: f3cad2611a77 (\"net: sparx5: add hostmode with phylink support\")\nSigned-off-by: Quentin Freimanis \u003cquentin@q-lab.dev\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260928045012.30178-1-quentin@q-lab.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be35a3e003941fc25b4e72d8d4fd44f8a98ac1af", "tree": "7f4b26d1bde1d388ddd773a005e8dc131ff2fb65", "parents": [ "99b43ede9e355ba35244cc9470bf1819774ce39d", "6f63e919fe1e335b8abcb3a28bfd4804a98d875a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 14:05:59 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 30 14:06:00 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-09-30\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nStill more fixes coming in, notably:\n - ath11k: avoid running out of stations on HW restart\n - mac80211:\n - drop too large fragmented MPDUs\n - mesh path handling fixes\n - validation improvements\n - reject CSA with bad 320 MHz bandwidth\n - cfg80211: fix RTS for single radio devices\n\n* tag \u0027wireless-2026-09-30\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless: (27 commits)\n wifi: mac80211: fix slab-out-of-bounds read in ieee80211_monitor_select_queue()\n wifi: mac80211: reject invalid 320 MHz CSA bandwidth\n wifi: mac80211: set info-\u003eband for 802.3 encap offload frames\n wifi: mac80211: prevent AP VLAN tx from other interfaces\n wifi: cfg80211: preserve hidden-group beacon IE ownership\n wifi: mac80211: keep fallback association elements alive\n wifi: mac80211: shut down RX BA session timer on teardown\n wifi: mac80211: validate TX status rate metadata\n wifi: ath9k_htc: bound TX aggregation to MAX_TX_BUF_SIZE\n wifi: ath9k: reject short WMI command responses\n wifi: ath9k: Clean up device initialisation guards\n wifi: ath11k: reset ar-\u003enum_stations on hardware start\n wifi: cfg80211: fix RTS threshold setting for single-radio PHY\n wifi: mac80211: handle empty FILS association request payload\n wifi: mac80211: minstrel_ht: validate fixed rate index\n wifi: p54: validate firmware record lengths\n wifi: mac80211: fix mesh fast xmit path deletion UAF\n wifi: mac80211: drop oversized fragments to avoid extra_len overflow\n wifi: wlcore: Fix runtime PM leak in wlcore_remove()\n wifi: mac80211: drain PS delivery work during station teardown\n ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260930124440.224799-3-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99b43ede9e355ba35244cc9470bf1819774ce39d", "tree": "1453a5a0e4b07d4754a8b7fc912f5da209d14d07", "parents": [ "2e7ea988a03273f7add64218fbaf28d96c963062" ], "author": { "name": "Harshit Mogalapalli", "email": "harshit.m.mogalapalli@oracle.com", "time": "Thu Sep 24 23:39:36 2026 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 30 10:27:59 2026 +0100" }, "message": "net: microchip: vcap: stop scanning after deleting key field\n\nThe only call outside the KUnit tests is in\nsparx5_tc_add_rule_copy(), which passes a fixed key list with no\nduplicate entries. Therefore, the potential double-free is not\ncurrently reachable in tree.\n\nHowever, vcap_filter_rule_keys() is exported and does not require its\nkey list entries to be unique. If a future or external caller supplies\nthe same key at another position that the inner loop visits, it calls\nlist_del() and kfree() a second time on the freed field, leading to a\npotential double-free.\n\nBreak the inner loop after removing a matching field. The outer safe\nlist traversal continues to process the remaining rule fields.\n\nFixes: 465a38a269e9 (\"net: microchip: sparx5: Support for copying and modifying rules in the API\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/all/ahs-lCAXXikkaHky@stanley.mountain/\nSigned-off-by: Harshit Mogalapalli \u003charshit.m.mogalapalli@oracle.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "3ae37eafd36694bb2d3227f60ac98fbf602470a2", "tree": "0357ffe49da40f9e84a8e7a6dbebb5658b954916", "parents": [ "7c549fb7eecd01fdba7c0d12c01da876ef8a3214" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 23 20:46:18 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "netfilter: flowtable: restore ieee80211 forward path\n\nBefore commit 871df5007eda (\"netfilter: flowtable: bail out if forward\npath cannot be discovered\"), there was a fallback to set up a forward\npath in case .ndo_fill_forward_path fails or DEV_PATH_MTK_WDMA was used.\nSuch fallback was used by commit d787a3e38f01 (\"mac80211: add support\nfor .ndo_fill_forward_path\").\n\nOne possibility is to handle DEV_PATH_MTK_WDMA from the flowtable\nforward path discovery. However, this is only used internally by drivers\nto retrieve mtk_wdma information to set up hardware offload. Felix\ndecided to use the .fill_forward_path interface for this purpose due to\nthe lack of a better interface at that time.\n\nAdd a new DEV_PATH_IEEE80211 path which is offered if the new ieee80211\nflag is set on in the struct net_device_path_ctx to restore the\nflowtable with a ieee80211 netdevice. Handle this new DEV_PATH_IEEE80211\npath just like DEV_PATH_ETHERNET and DEV_PATH_DSA, ie. this is the last\nnetdevice in the stack.\n\nThis new ieee80211 flag is implicitly unset for mtk_ppe and airoha which\ncall dev_fill_forward_path() to retrieve a DEV_PATH_MTK_WDMA path.\n\nFixes: 871df5007eda (\"netfilter: flowtable: bail out if forward path cannot be discovered\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "7c549fb7eecd01fdba7c0d12c01da876ef8a3214", "tree": "39e2c07a3e3714e022e94eeaa05c27493263224f", "parents": [ "16d464013ec2267b00a83f4bfbb97b3ecc63bfa7" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 23 10:53:02 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "netfilter: flowtable: generalize pending status bit\n\nRename NF_FLOW_HW_PENDING to NF_FLOW_PENDING and use it to inhibit the\nflowtable GC worker until pending hw offload work has been completed.\n\nApparently, nf_flow_offload_stats() can schedule work to retrieve stats\nwhile the flow is being removed by GC.\n\nAnd this bit can also be used in a follow up patch to disable GC until\nthe flow has been fully added in both directions.\n\nRevert the reordering done in commit d644b23afe1e (\"netfilter:\nflowtable: publish HW_DEAD after worker is done\") to prevent a race\nbetween GC and hw offload handler.\n\nFixes: 2c8897953f3b (\"netfilter: flowtable: Add pending bit for offload work\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "16d464013ec2267b00a83f4bfbb97b3ecc63bfa7", "tree": "ce9d95b768c66a02690575b48e04e949b15ca06a", "parents": [ "86b6471e690c67d4c5a1892993f34e080f1eae9d" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Tue Sep 22 21:18:52 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "netfilter: bpf: reject invalid NAT manipulation types\n\nAs bpf_ct_set_nat_info() is not validating the NAT manipulation type a\nwrong value can be passed directly to nf_nat_setup_info(). This triggers\nthe WARN_ON() at nf_nat_setup_info() and if panic_on_warn isn\u0027t set,\nthen IPS_SRC_NAT_DONE is set without adding nat_bysource and conntrack\ncleanup tries to unlink an uninitialized hlist node.\n\nFix this by checking that NAT manipulation type is correct before\ncalling nf_nat_setup_info(). In addition, if the WARN_ON is hit, return\nNF_DROP instead of continuing with the processing to avoid similar\nsituations in the future.\n\nReported-by: VEGA \u003cvega@nebusec.ai\u003e\nFixes: 0fabd2aa199f (\"net: netfilter: add bpf_ct_set_nat_info kfunc helper\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "86b6471e690c67d4c5a1892993f34e080f1eae9d", "tree": "74e0f2ac8bbc93eb3e0e354adbe8ea9829718fa4", "parents": [ "f96e91748f6304668fe647e686d199d7207d36f1" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Mon Sep 21 10:08:22 2026 +0800" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "netfilter: nft_set_rbtree: skip transaction elements during GC\n\nSince nft_set_commit_update() runs set commit callbacks before processing\nNEWSETELEM transactions, nft_rbtree_gc_scan() can observe elements added by\nthe transaction being committed.\n\nThe scan records an interval end in rbe_end without checking the element\u0027s\ntransaction state. A later, unrelated expired start then moves both\nelements to the expired list. The synchronous GC queue can free the new end\nelement before the transaction subsequently activates it, causing a\nuse-after-free.\n\nOnly consider elements that are fully active in both generations. This\nkeeps transaction-state elements out of the GC scan and preserves interval\npairing across skipped elements.\n\nKASAN reports:\n\n BUG: KASAN: slab-use-after-free in nft_setelem_activate\n nft_setelem_activate net/netfilter/nf_tables_api.c:7047\n nf_tables_commit net/netfilter/nf_tables_api.c:11137\n\n Allocated by task 130:\n nft_set_elem_init net/netfilter/nf_tables_api.c:6794\n nft_add_set_elem net/netfilter/nf_tables_api.c:7523\n\n Freed by task 130:\n nft_trans_gc_trans_free net/netfilter/nf_tables_api.c:10506\n rcu_core kernel/rcu/tree.c:2919\n\nFixes: 1e3b9e1c77fe (\"netfilter: nf_tables: call set ops .commit when building new ruleset blob\")\nReported-by: \u003cco+ee5e50ef2670e5f4@bugs.sh\u003e\nAssisted-by: LLM\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "f96e91748f6304668fe647e686d199d7207d36f1", "tree": "61b36d7e4d854501706b088b5b327ca3874a39b8", "parents": [ "616cf5c06934364ab1002b420ebe975850b4b208" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sat Sep 19 21:07:33 2026 +0300" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "ipvs: filter some flags received in the backup server\n\nWhile the IPVS SYNC protocol is not secure by design\nwe can still protect the backup server from messages that\ncan wreak havoc.\n\nThis commit addresses problems from received connection flags\nor their combinations. We now drop messages as follows:\n\n1. the NO_CPORT+TEMPLATE combination allows lookups for normal\nconnections to hit template which can break in many ways.\nWhile the master does not sync connections with NO_CPORT flag,\ni.e. before they are established, we still accept NO_CPORT\nwithout TEMPLATE.\n\n2. ONE_PACKET: it is not sent by master, so we do not\nexpect it in backup. Before now it was ignored by\nIP_VS_CONN_F_BACKUP_MASK for protocol v1 while protocol\nv0 created connections that are not hashed and dropped\nimmediately. Better to apply the IP_VS_CONN_F_BACKUP_MASK\nalso to the flags from v0 messages for consistency with v1.\n\nFixes: 87375ab47cd0 (\"[IPVS]: ip_vs_ftp breaks connections using persistence\")\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "616cf5c06934364ab1002b420ebe975850b4b208", "tree": "971b7dedc5cdd27bdf0688bc971096287d5dc587", "parents": [ "2a3c3de660f96865f303fd25f1285f2ffbfd521d" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Sat Sep 19 21:07:32 2026 +0300" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "ipvs: do not create invisible templates\n\nThe IP_VS_CONN_F_ONE_PACKET flag was implemented for normal\nconnections. When conn template inherits this flag from\ndest-\u003econn_flags it will not be hashed. As result, we will\ncreate new template for every new normal connection.\n\nFix it to allow one template to be used by many normal\nconnections.\n\nFixes: 26ec037f9841 (\"IPVS: one-packet scheduling\")\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260916231652.127456-1-pablo%40netfilter.org\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "2a3c3de660f96865f303fd25f1285f2ffbfd521d", "tree": "177c77e72adbbfc2a6ec0b6d73d0908b9c18e69b", "parents": [ "bdac17779f46817f60103baf09f0370546c3f023" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Thu Sep 10 13:08:32 2026 +0300" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "ipvs: bound LBLCR and LBLC cache growth\n\nip_vs_lblcr_new() and ip_vs_lblc_new() create cache entries for\nevery previously unseen destination address. The table max_size only\ntells the periodic collector to reclaim entries after the cache has\nalready exceeded the limit. It does not reclaim entries that the\nattacker continues to use.\n\nReject new cache entries once either table reaches max_size * 3 / 2.\nThe extra headroom lets the periodic collector catch up while the\nexisting scheduler fallback continues to use the selected destination\nwhen cache creation fails. New traffic therefore stays serviceable\nwithout growing the tables further.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSuggested-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "bdac17779f46817f60103baf09f0370546c3f023", "tree": "d323605648760c0ef88cda1e0839b1695ae4dc7c", "parents": [ "747928b5d4ff8c8de55138a54c13980e4bb88578" ], "author": { "name": "Julian Anastasov", "email": "ja@ssi.bg", "time": "Thu Sep 10 13:08:31 2026 +0300" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "ipvs: fix missing counter decrement in lblc\n\nLBLC may delete cache entries for destinations that are\nremoved or overloaded and replace them with available ones.\nBut ip_vs_lblc_new() forgets to decrement the tbl-\u003eentries\ncounter after calling ip_vs_lblc_del(). This can lead to\nincreased shrinking of the cache with every new garbage\ncollection.\n\nFixes: 2f3d771a35fe (\"ipvs: do not use dest after ip_vs_dest_put in LBLC\")\nLink: https://sashiko.dev/#/patchset/0bdd5abe9968ded7ca2b9cb6844ba83d94cc8d53.1787318053.git.zhilinz%40nebusec.ai\nSigned-off-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "747928b5d4ff8c8de55138a54c13980e4bb88578", "tree": "98a13dc721b9a4572362b2d84cac4a5763b6f5fb", "parents": [ "a442c8a89fb9c531f9d6ab86120c31decd778d51" ], "author": { "name": "Aohan Mei", "email": "henrymei@tencent.com", "time": "Thu Sep 10 16:33:26 2026 +0800" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Sep 30 09:35:20 2026 +0200" }, "message": "netfilter: nft_flow_offload: drop flowtable reference on init error path\n\nnft_flow_offload_init() bumps the flowtable use count with\nnft_use_inc() before calling nf_ct_netns_get(). When the latter\nfails, the error is returned as-is and the reference is leaked.\n\nThe upper layers do not balance it either: nf_tables_newexpr()\nclears expr-\u003eops when the expression init callback fails, so the\nnft_expr_more() iteration in nft_rule_expr_deactivate() and\nnf_tables_rule_destroy() stops right before the failed expression\nand its -\u003edestroy callback, which would drop the reference, never\nruns.\n\nEach failed rule addition therefore leaks one flowtable reference\nand the flowtable can no longer be removed: NFT_MSG_DELFLOWTABLE\nkeeps reporting -EBUSY even though no rule references it.\n\nSave the nf_ct_netns_get() return value and undo the nft_use_inc()\nwhen it fails, restoring the inc/dec pairing within\nnft_flow_offload_init() itself.\n\nFixes: a3c90f7a2323 (\"netfilter: nf_tables: flow offload expression\")\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nCc: stable@vger.kernel.org\nAssisted-by: CodeBuddy:Kimi-K3\nSigned-off-by: Aohan Mei \u003chenrymei@tencent.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "2e7ea988a03273f7add64218fbaf28d96c963062", "tree": "0fd8219f3835c4ae93b5e7ad36a52c379a27e5af", "parents": [ "0d2c49915bc3aea4521cda5e4d42f24f63b94585", "81fe707ae58e67e5a029a9778c4b0c1b478bcb97" ], "author": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 30 08:02:40 2026 +0100" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 30 08:02:40 2026 +0100" }, "message": "Merge branch \u0027tcp-old-acks\u0027\n\ntcp: correct timestamp echo for accepted old ACKs\n\nLinux can acknowledge newly received data while echoing an outdated\nTCP timestamp. This happens when a reordered packet fills a receive gap\nbut carries an older acknowledgment for traffic in the other direction.\nIf the sender uses this echo to measure round-trip time after a long idle\nperiod, the stale timestamp can inflate its estimate and slow its sending.\n\nChanges in v2, following Eric Dumazet\u0027s review:\n- Remove the redundant SYN_RECV condition and unused flag accumulation.\n- Replace the log-parsing wrapper with a plain packetdrill test that checks\n the timestamp echo directly, using the existing selftest runner.\n- Rebase on net fc6d80eb5044.\n\nv1: https://lore.kernel.org/netdev/20260921222609.50824-4-jeffjo@openai.com/\n\nIn this example, S sends the reordered data and R is the Linux receiver\nbeing patched. All packets shown belong to the same TCP connection, with\noverlapping requests in both directions. Each illustrated request fits in\none TCP packet; request/response names describe application\nmessages, while ACK numbers acknowledge TCP bytes. The numbers are\nillustrative: TS and echo use S\u0027s millisecond clock, and byte numbers are\nrelative to the first post-idle byte in each direction. ACK\u003dN acknowledges\nbytes before N.\n\n Before idle:\n S -\u003e R: sender request 1, TS\u003d999\n R -\u003e S: response to sender request 1, echo\u003d999\n S -\u003e R: TCP ACK, TS\u003d1000 (R saves timestamp 1000)\n\n ... 300 seconds idle ...\n\n After idle (byte ranges include both ends):\n S -\u003e R: sender request 2, bytes 1-17, ACK\u003d1, TS\u003d301000\n (delayed in the network)\n R -\u003e S: receiver request 1, bytes 1-17, ACK\u003d1\n (initiated by R while sender request 2 is still in flight)\n S -\u003e R: sender request 3, bytes 18-34, ACK\u003d18, TS\u003d301005\n (arrives before sender request 2)\n R -\u003e S: TCP ACK\u003d1, SACK for sender request 3, echo\u003d1000\n S -\u003e R: original sender request 2 arrives, still ACK\u003d1, TS\u003d301000\n R -\u003e S: TCP ACK\u003d35, echo\u003d1000 (bug) or echo\u003d301000 (fixed)\n\nR initiates receiver request 1 while sender request 2 is still in flight;\nits ACK\u003d1 means it has not received sender request 2. S receives R\u0027s\nrequest before sending sender request 3, so that packet carries ACK\u003d18.\nSender request 3 reaches R first, making sender request 2\u0027s ACK\u003d1 old.\nThe earlier ACK with SACK correctly echoes 1000 while the gap is open.\nThe bug is retaining 1000 in ACK\u003d35 after the gap closes, instead of\nechoing sender request 2\u0027s timestamp, 301000.\n\nIf S falls back to timestamp-based RTT measurement for ACK\u003d35, subtracting\necho\u003d1000 from its current timestamp (about 301000) produces a roughly\n300-second RTT sample, mistakenly counting the idle period. The inflated\nsmoothed RTT lowers the sender\u0027s calculated pacing rate and, when pacing\nis enforced, unnecessarily delays outgoing packets and slows the transfer.\n\nPatch 1 refreshes the saved timestamp while preserving existing validation.\nPatch 2 checks that the ACK closing the receive gap echoes timestamp\n301000, in IPv4, IPv6 and IPv4-mapped IPv6. It requires packetdrill\u0027s merged\nTSecr verification fix, commit 83f72d3f9085, linked below. Once CI uses a\npacketdrill version containing that fix, the timestamp assertion will\nreject the stale echo on an unfixed kernel and pass with this kernel fix.\nOlder packetdrill versions ignore the comparison and incorrectly pass both.\n\nhttps://github.com/google/packetdrill/commit/83f72d3f9085d0e26eb4d206fe4d7cfab5b6d872\n\nV1 passed 68 focused/control cases on normal and KASAN/UBSAN/lockdep\nARM64 kernels, with no new diagnostics from W\u003d1 allyesconfig/allmodconfig\nbuilds or Sparse. V2 passed the same checks with equivalent results.\n\nEarlier C-socket repro on net 46bc52d13594: after 300 seconds idle, with\ncontrolled reordering, retransmission and fq pacing, a 1 MiB transfer takes\n22.02 seconds without the fix versus 0.38 seconds with it (one run per arm).\n\nAI assistance: Codex generated and revised the fix, reproducers, selftest,\nanalysis and patch messages. The user directed the investigation, asked\nfor real-socket and upstream-kernel comparisons, and requested broader\ntesting. A separate Codex reviewer challenged the v1 code and evidence.\nSparse supplied static analysis.\n\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n\nJeff Jo (2):\n tcp: refresh TS.Recent for accepted old ACKs\n selftests: net: check timestamp echo after an old ACK\n\n net/ipv4/tcp_input.c | 6 +++++\n .../net/packetdrill/tcp_old_ack_ts.pkt | 22 +++++++++++++++++++\n 2 files changed, 28 insertions(+)\n create mode 100644 tools/testing/selftests/net/packetdrill/tcp_old_ack_ts.pkt\n\nbase-commit: fc6d80eb504458d6416b75a94188b268c95c6533\n" }, { "commit": "81fe707ae58e67e5a029a9778c4b0c1b478bcb97", "tree": "0fd8219f3835c4ae93b5e7ad36a52c379a27e5af", "parents": [ "1b92780ae4fc3be64f05d97ed8833c445e73b0cf" ], "author": { "name": "Jeff Jo", "email": "jeffjo@openai.com", "time": "Thu Sep 24 15:44:59 2026 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 30 08:02:39 2026 +0100" }, "message": "selftests: net: check timestamp echo after an old ACK\n\nAdd a regression test for a gap-filling packet whose acknowledgment has\nbecome old. Linux first sends data to the peer. Deliver two peer data\npackets out of order: the later packet acknowledges Linux\u0027s data, while\nthe delayed packet still carries the earlier acknowledgment.\n\nRequire the ACK that closes the receive gap to echo the delayed packet\u0027s\ntimestamp, 301000. Without the fix, Linux accepts the data but still echoes\nthe previously saved timestamp, 1000. Also check that the application can\nread all 34 bytes.\n\nUse a large jump in peer timestamps to represent the idle interval, with\nno real wait, loss or retransmission. The test directly checks the outgoing\ntimestamp echo. It requires packetdrill\u0027s merged TSecr verification fix\n(linked below); older tools incorrectly pass on an unfixed kernel.\n\nUse the existing packetdrill selftest runner for IPv4, IPv6 and\nIPv4-mapped IPv6.\n\nLink: https://github.com/google/packetdrill/commit/83f72d3f9085d0e26eb4d206fe4d7cfab5b6d872\nAssisted-by: LLM\nSigned-off-by: Jeff Jo \u003cjeffjo@openai.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "1b92780ae4fc3be64f05d97ed8833c445e73b0cf", "tree": "695ccd23143912fa72bcb8160ef74f8250e5827a", "parents": [ "0d2c49915bc3aea4521cda5e4d42f24f63b94585" ], "author": { "name": "Jeff Jo", "email": "jeffjo@openai.com", "time": "Thu Sep 24 15:44:58 2026 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 30 08:02:39 2026 +0100" }, "message": "tcp: refresh TS.Recent for accepted old ACKs\n\nA TCP packet can carry new data while acknowledging traffic in the\nopposite direction. With overlapping traffic in both directions, a\ndelayed packet\u0027s acknowledgment can be older than one Linux has already\naccepted, even when that packet fills a gap in the received data.\n\nLinux accepts the data, but tcp_ack() takes the old_ack path and skips\nupdating TS.Recent, the timestamp saved for outgoing acknowledgments.\nThe reply therefore echoes an older timestamp. If the sender uses this\necho to measure round-trip time after a long idle period, its estimate\nincludes the idle time and can reduce its sending rate.\n\nUpdate TS.Recent in old_ack using tcp_replace_ts_recent(), before SACK\nprocessing can trigger a transmission. This reuses the existing timestamp\nand sequence checks, including PAWS protection against old duplicate\npackets. ACK validation already rejects old ACKs in SYN_RECV before this\npath, so no additional state check is needed.\n\nEchoing the timestamp of the packet that fills the receive gap follows\nRFC 7323 section 4.3. In a socket reproduction with 300 seconds idle,\ncontrolled reordering and retransmission to exercise timestamp-based RTT\nsampling, the sender\u0027s smoothed round-trip time was 37.5 seconds without\nthe fix and 15.5 ms with it.\n\nFixes: 12fb3dd9dc3c (\"tcp: call tcp_replace_ts_recent() from tcp_ack()\")\nAssisted-by: LLM sparse\nSigned-off-by: Jeff Jo \u003cjeffjo@openai.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "551c722f40809618230001baccf219193e22fc5a", "tree": "0bf196a56f701d3e13b0faa81ae4513728b9eb3b", "parents": [ "a243ede718463c7b481878656f1ff32a0ce0fd54", "055ef5ce9f67a6a3a1363fa663007f8196cc0fb8" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 18:54:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 18:54:21 2026 -0700" }, "message": "Merge tag \u0027rtc-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux\n\nPull RTC fixes from Alexandre Belloni:\n \"Mostly small issues found using AI. The efi change is to avoid a\n regression on some platforms\n\n Subsystem:\n - fix a possible information leak\n\n Drivers:\n - efi: restore alarm support with runtime capability probe\"\n\n* tag \u0027rtc-7.3-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/abelloni/linux:\n rtc: spear: initialize IRQ state before requesting alarm IRQ\n rtc: mpfs: fix unchecked devm_clk_get() error pointer in probe()\n rtc: ac100: Fix clock provider use-after-free on probe failure\n rtc: ac100: Assign .num before accessing .hws\n rtc: efi: restore alarm support with runtime capability probe\n rtc: dev: zero-initialize struct rtc_wkalrm to prevent information leak\n" }, { "commit": "0d2c49915bc3aea4521cda5e4d42f24f63b94585", "tree": "28c9eb260ad2f70106088acc63da4ebd8a764308", "parents": [ "20f3599d85b416fd292a199364cb1248dcd9c780" ], "author": { "name": "Quentin Freimanis", "email": "quentin@q-lab.dev", "time": "Sun Sep 27 21:45:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 18:54:07 2026 -0700" }, "message": "net: sparx5: skip ptp deinit if init was skipped\n\nsparx5_ptp_init() returns early on the base lan969x variants\nbecause they do not have the SPX5_FEATURE_PTP flag. It also returns early\nwhen no \"ptp\" interrupt is described. Unbinding the driver then causes a\nNULL pointer dereference when cleaning up uninitialized tx_skbs queues:\n\n Unable to handle kernel NULL pointer dereference at virtual address\n 0000000000000008\n Call trace:\n skb_queue_purge_reason+0x68/0x120 (P)\n sparx5_ptp_deinit+0x64/0xc0\n mchp_sparx5_remove+0x38/0x70\n platform_remove+0x20/0x30\n device_remove+0x4c/0x80\n\nBefore per-port tx_skbs were added, a NULL dereference would have happened\nwhen calling ptp_clock_unregister() on the never-registered PTP clocks.\n\nFix by returning early in sparx5_ptp_deinit() if PTP is not used.\n\nFixes: 0933bd04047c (\"net: sparx5: Add support for ptp clocks\")\nSigned-off-by: Quentin Freimanis \u003cquentin@q-lab.dev\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260928044542.29287-1-quentin@q-lab.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "20f3599d85b416fd292a199364cb1248dcd9c780", "tree": "4db617b837e1399d2ffa2891daeca8a37e6985fc", "parents": [ "6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b" ], "author": { "name": "Yongzhao Chen", "email": "yongzhao.derek@gmail.com", "time": "Sun Sep 27 17:51:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 18:31:35 2026 -0700" }, "message": "net: phy: qcom: at803x: Fix IPQ5018 short-cable DAC values\n\nWhen \"qcom,dac-preset-short-cable\" is set, ipq5018_config_init()\nprograms the MDAC (MMD1 0x8100) and EDAC (debug 0x4380) fields. Both\nfields occupy bits 15:8 (IPQ5018_PHY_DAC_MASK), but the value 0x10 is\npassed unshifted as the set argument of phy_modify_mmd() and\nat803x_debug_reg_mask(). Neither helper shifts or masks that argument,\nso both fields are cleared to 0x00 instead of being set to 0x10, and\nbit 4 of the low byte, which is outside the field, is set.\n\nUse FIELD_PREP() to place the value in the field. This matches the\nvendor SDK, which clears bits 15:8 and ORs in the value shifted left\nby 8.\n\nOn a Redmi AX5400 board, where the IPQ5018 internal PHY connects to a\nQCA8337 switch PHY without a cable, MDAC and EDAC read 0x6868 and\n0x7800 before the write. With this change they read back 0x1068 and\n0x1000, with the low byte preserved. Without it, the same writes would\nleave 0x0078 and 0x0010.\n\nNo in-tree DTS sets this property yet, but it is documented in\nqca,ar803x.yaml and used by several IPQ5018 boards in OpenWrt.\n\nFixes: d46502279a11 (\"net: phy: qcom: at803x: Add Qualcomm IPQ5018 Internal PHY support\")\nSigned-off-by: Yongzhao Chen \u003cyongzhao.derek@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260927155136.2489-1-yongzhao.derek@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6f0c2c4f5e7143eba75153ecc8af3a03f7b6a98b", "tree": "179597b64544237225c74e37009b1404ad00c630", "parents": [ "5f0764cb1c81a9712bce605d38efe6d844a70b29" ], "author": { "name": "Sandeep Haemoon", "email": "sandeeph@loljews.com", "time": "Thu Sep 24 23:51:37 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 18:14:28 2026 -0700" }, "message": "net: ethernet: mtk_eth_soc: allocate dummy netdev sooner\n\nThe RX rings and the shared NAPI are carried by an internal \"dummy\" netdev\n(eth-\u003edummy_dev). mtk_probe() creates that dummy device, and adds the\nshared tx/rx NAPI to it, only after the MAC netdevs have been registered.\nThat order has been there since the MT7623 support was added and leaves a\nwindow in which the netdevs are visible to the network core before the\nshared NAPI and the dummy device exist.\n\nIf anything brings the first netdev up during that window (e.g. netifd\nopening the WAN link the instant the interface is registered), the\nfirst-open path runs without them. On NETSYS v2 and later SoCs\nmtk_rx_alloc() -\u003e __xdp_rxq_info_reg() then dereferences eth-\u003edummy_dev \u003d\u003d\nNULL:\n\n WARNING: CPU: ... Missing net_device from driver\n\nin net/core/xdp.c and mtk_open() fails with -ENODEV. On NETSYS v1 SoCs\n(MT7621/MT7622/MT7623/MT7629) there is no page pool, so the same open\ninstead calls napi_enable() on a napi_struct that netif_napi_add() has not\ninitialised yet and dereferences a NULL napi-\u003edev.\n\nAllocate the dummy netdev and add the shared tx/rx NAPI to it before the\nregister_netdev() loop. Both the dummy-allocation failure and a\nregister_netdev() failure now unwind through mtk_unreg_dev(), which\nunregisters the net_device notifiers and the netdevs registered so far,\nstopping a concurrently-opened netdev (ndo_stop) and its NAPI before the\ndummy carrier is freed.\n\nA netdev that opened during the window can also have queued the\nframe-engine reset worker (via the tx watchdog or phylink), so the probe\nerror path now cancels eth-\u003epending_work before freeing the shared state,\nas mtk_cleanup() already does on remove.\n\nFixes: 656e705243fd (\"net-next: mediatek: add support for MT7623 ethernet\")\nSigned-off-by: Sandeep Haemoon \u003csandeeph@loljews.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/patch-e52c13380b0768fec63af04c80e4b487@loljews.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5f0764cb1c81a9712bce605d38efe6d844a70b29", "tree": "bf4565e2f8c6e28fd45c74c6352f684baea9717c", "parents": [ "ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d" ], "author": { "name": "Willem de Bruijn", "email": "willemb@google.com", "time": "Sat Sep 26 10:04:54 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:55:09 2026 -0700" }, "message": "net: extend IPv6 exthdr detection of tunneled packets\n\nCommit c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM\nGSO fallback\") split skb_gso_has_extension_hdr() into mutually exclusive\nbranches on skb-\u003eencapsulation. This did not yet address all paths:\n\n1. With skb-\u003eencapsulation set, the outer header is not checked. IPv6\n tunnels such as ip6_gre and ip6_tunnel add an outer Destination\n Options header by default (encap_limit). Their GSO packets skip\n software GSO, then skb_csum_hwoffload_help() sees the outer extension\n header and calls skb_checksum_help() on the GSO skb, which warns and\n drops it.\n\n2. Tunnels over IPv6 without an outer transport header, such as\n ip6_tunnel, leave skb-\u003etransport_header at the inner transport\n header. skb_network_header_len() then spans the outer IPv6, tunnel\n and inner IP headers, a false positive.\n\n3. UDP tunnels without an inner network header, such as SCTP-in-UDP or\n PSP, have no inner IPv6 header to check. Decide on the outer header\n alone.\n\n4. Directly dereferencing inner_ip_hdr(skb)-\u003eversion without\n skb_header_pointer() is unsafe.\n\nInstead, check ipv6_ext_hdr(nexthdr) on the outer IPv6 header and, if\nset, on the inner IPv6 header. Read the headers with skb_header_pointer().\nKeep the skb_network_header_len() check when !skb-\u003eencapsulation to also\ncatch encapsulated packets without skb-\u003eencapsulation (e.g., virtio).\n\nUse the same helper in skb_csum_hwoffload_help(). Its open coded test\nhas the false positive of (2) and ignores the inner header.\n\nBackground: checksum offload of tunneled packets invariants:\n\nNon-GSO skb:\n- If the inner packet is CHECKSUM_PARTIAL, Local Checksum Offload computes\n the outer checksum in software and the device offloads only the inner L4\n checksum.\n- If the inner packet is CHECKSUM_NONE (e.g., SCTP-in-UDP, ESP-in-UDP,\n Remote Checksum Offload), the device offloads the outer UDP or GRE\n checksum instead.\n\nGSO skb:\n- A device with NETIF_F_GSO_UDP_TUNNEL_CSUM or NETIF_F_GSO_GRE_CSUM\n computes both inner and outer checksums per segment.\n The outer checksum is seeded with only the pseudo-header checksum.\n\nA NETIF_F_IPV6_CSUM device must parse through the outer headers to\nreach the inner ones.\n\nFixes: c4336a07eb6b (\"net: correctly handle tunneled traffic on IPV6_CSUM GSO fallback\")\nCc: stable@vger.kernel.org\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260926140506.2335137-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ea4d4b5dddb5121e64f56fd8e0720bd8b447b63d", "tree": "2a36bbf819ae46b6f012e06dd98aac9b0d122890", "parents": [ "19419faf58dfe5bcc8a9e60e622976c5f8e3ddc1" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Mon Sep 28 08:46:16 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:49:35 2026 -0700" }, "message": "net: cap skb-\u003equeue_mapping when the tx queue is picked\n\nskbedit can set skb-\u003equeue_mapping and raise the per-CPU skip_txqueue\nflag so __dev_queue_xmit() honours the mapping. __dev_queue_xmit()\ncleared the flag before sch_handle_egress() and only read it afterwards,\nso the flag was not confined to the xmit that set it: a nested xmit\n(mirred redirect or mirror, or a drop after skbedit) could set the flag\nand the outer xmit would consume it for an skb that never went through\nskbedit.\n\nA forwarded packet still carries the ingress NIC\u0027s rx_queue + 1 in\nskb-\u003equeue_mapping, so the outer device then indexes its tx queue state\nwith that stale value. Taprio\u0027s child array q-\u003eqdiscs[] is sized to the\ndevice\u0027s queue count, so taprio_enqueue() indexes past its allocation\nand dereferences the result as a struct Qdisc *.\n\nWe (ab)use the skb-\u003enf_skip_egress which means \"skip netfilter egress\nfor this packet\" to tag to \"am I in tc egress?\". Despite the overload\nI dont see it as a conflict since the marker is set only around the\nsingle sch_handle_egress() call and ingress path is guarded by\ntc_at_ingress.\nI will send a followup(net-next) patch once this hits net-next to\nrename the skb-\u003enf_skip_egress bit/flag to skb-\u003eskip_egress\n\nArm the flag only from the egress classifier that can use it: raise\nskip_txqueue from tcf_skbedit_act() only when it runs inside\nsch_handle_egress(), thanks to skb-\u003enf_skip_egress. An egress qdisc\nclassifier runs in q-\u003eenqueue(), after the tx queue has been picked,\nso a mapping it sets cannot affect the current packet; arming the flag\nthere only pollutes it for a later xmit. Then own the flag for the xmit\nframe the egress hook runs in: save the incoming value and clear it just\nbefore sch_handle_egress(), and restore it after the hook - on the\nconsumed (drop) path, or, in the same call that reads it, on the\nsurviving path. The save and the restores stay inside the\negress_needed_key static branch, so a packet pays for them only when\negress hooks are active (2f1e85b1aee4).\n\nStore the value netdev_cap_txqueue() selected back into skb-\u003equeue_mapping\nin netdev_tx_queue_mapping(), as netdev_core_pick_tx() already does, so\nthe skip_txqueue path never hands a later reader on the xmit path a\nmapping the device cannot serve. A store made still later in the same\nframe, by a tc BPF program attached to a transmit qdisc, is outside this\npath and is not re-capped; a separate followup will resolve that path.\n\nnetdev_xmit_skip_txqueue() returns the previous flag value so the\nsave-and-clear is one call, and a no-op stub is provided when\nCONFIG_NET_EGRESS is disabled. skb-\u003enf_skip_egress is compiled under\nCONFIG_NET_EGRESS rather than CONFIG_NETFILTER_SKIP_EGRESS, so\nskb_at_tc_egress() is valid whenever the egress path is built.\n\nA local user in a network namespace can redirect a packet from a device\nwith more TX queues to one with fewer after setting a mapping valid only\non the larger device. That reaches these reads and, under KASAN, faults\nwith \"slab-out-of-bounds in taprio_enqueue\".\n\nConditions to recreate the bug: the report\u0027s own trigger is a local user\nwith CAP_NET_ADMIN in a network namespace, so no eBPF program is needed.\nWith CONFIG_NET_SCH_TAPRIO\u003dy, CONFIG_NET_ACT_SKBEDIT\u003dy,\nCONFIG_NET_ACT_MIRRED\u003dy, CONFIG_NET_CLS_MATCHALL\u003dy,\nCONFIG_NET_SCH_PRIO\u003dy and KASAN enabled, create qa (3 queues), qb\n(2 queues) and qc (1 queue) as dummy devices; put a taprio root on qb\n(num_tc 1, queues 2@0) and clsact on all three; then add an egress\nmatchall filter on every device. On qa: \"action skbedit queue_mapping 2\npipe action mirred egress redirect dev qb\". On qb: \"action mirred egress\nmirror dev qc\". On qc: \"action skbedit queue_mapping 0 pipe\". Send one\npacket out qa. qc\u0027s skbedit sets the flag while qb\u0027s outer xmit is in\nflight; without the fix qb consumes it and reads its two-entry taprio\nchild array with the forwarded packet\u0027s stale mapping. A qc whose\nskbedit is instead installed in a transmit-qdisc classifier (a matchall\nfilter on the qc root qdisc) reaches the same code path the same way\nwithout the fix.\n\nTesting: on a KASAN build with panic_on_warn\u003d1 the unfixed kernel panics\nwith \"BUG: KASAN: slab-out-of-bounds in taprio_enqueue\", a read 0 bytes\npast a 16-byte taprio_init() allocation, for the clsact-setter and the\ntransmit-qdisc-classifier reproducers and for a clsact skbedit-then-tc-BPF\nstore; the fixed kernel runs all three with no report, and the BPF store\nvariant additionally shows the expected \"selects TX queue\" clamp notice\nfrom the write-back.\n\nFixes: 2f1e85b1aee4 (\"net: sched: use queue_mapping to pick tx queue\")\nReported-by: Zero Day Initiative \u003czdi-disclosures@trendmicro.com\u003e\nLink: https://lore.kernel.org/netdev/CANn89iLwYx8nCVf0pCEk_MmEiyC6kQaMwCQT9WkQVeeNzNQHqQ@mail.gmail.com/\nLink: https://lore.kernel.org/netdev/179008581937.2160803.7117814290574262942@kernel.org/\nLink: https://lore.kernel.org/netdev/179033713973.2160803.4914570693994398206@kernel.org/\nLink: https://lore.kernel.org/netdev/20260925180407.63647514@kernel.org/\nLink: https://lore.kernel.org/netdev/CANn89i+k-mZKDQVtvws_MEXeuMTAdaCcOXFZE-RfhcGTu90sjA@mail.gmail.com/\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nTested-by: hybris \u003chybris@mojatatu.ai\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/QDISC-9R8V.v4.20260928081529@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19419faf58dfe5bcc8a9e60e622976c5f8e3ddc1", "tree": "c229fa7e578e1fd97f7c4f57c8c9fd27d41cd836", "parents": [ "8b9993437429c66d11430ae61ffa5937a6abb4ae" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Mon Sep 28 12:56:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:17:18 2026 -0700" }, "message": "net: bcmgenet: fix NULL dereference in set_coalesce before first open\n\nThe Rx ring priv and index are only set in bcmgenet_init_rx_ring(),\nwhich runs at open. Setting the Rx coalescing parameters on an interface\nthat was never opened, e.g. \"ethtool -C eth0 rx-usecs 50\", dereferences\na NULL ring-\u003epriv. The oops happens with RTNL held, so networking\nstays stuck until a reboot:\n\n Unable to handle kernel paging request at virtual address 0000000000002788\n pc : bcmgenet_set_rx_coalesce.isra.0+0x10/0x88\n lr : bcmgenet_set_coalesce+0xe8/0x180\n Call trace:\n bcmgenet_set_rx_coalesce.isra.0+0x10/0x88 (P)\n __ethnl_set_coalesce.isra.0+0x490/0x570\n ethnl_set_coalesce+0x48/0xc0\n ethnl_default_set_doit+0xf4/0x230\n genl_family_rcv_msg_doit+0xe8/0x160\n genl_rcv_msg+0x220/0x2a0\n netlink_rcv_skb+0x68/0x140\n genl_rcv+0x40/0x60\n netlink_unicast+0x338/0x3c0\n netlink_sendmsg+0x19c/0x3f8\n __sock_sendmsg+0x64/0xc0\n __sys_sendto+0x124/0x198\n __arm64_sys_sendto+0x30/0x48\n\nSet priv and index at probe. Writing the registers while the interface\nis down is harmless because open resets the MAC and\nbcmgenet_init_rx_coalesce() reapplies the stored values.\n\nIt was observed on a Raspberry Pi CM4, but should apply to all other\ngenet devices.\n\nFixes: 9f4ca05827a2 (\"net: bcmgenet: Add support for adaptive RX coalescing\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260928105642.856210-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8b9993437429c66d11430ae61ffa5937a6abb4ae", "tree": "956ff04964957eea9afe20a14204c6e2c4ad8ab1", "parents": [ "38b7c470691dc28e5b42b45949cbc024cca3ac4e" ], "author": { "name": "Yoshihisa Yamamoto", "email": "yoshihisa.yamamoto.xn@renesas.com", "time": "Thu Sep 24 10:36:57 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:15:37 2026 -0700" }, "message": "net: pcs: rzn1-miic: Clear MIIC protection state before unprotect sequence\n\nOn RZ/T2H and RZ/N1D MIIC, writing 0x0000 to the MIIC protection\nregister clears the protection state machine.\n\nThe initial protection state cannot be assumed to be constant,\nas it may be influenced by previous activity before the driver\ntakes ownership of the hardware.\n\nClear the protection state before issuing the unprotect sequence\nso that register access always starts from a known state, regardless\nof any previous activity.\n\nFixes: 7dc54d3b8d91 (\"net: pcs: add Renesas MII converter driver\")\nSigned-off-by: Yoshihisa Yamamoto \u003cyoshihisa.yamamoto.xn@renesas.com\u003e\nReviewed-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nLink: https://patch.msgid.link/TYCPR01MB74815955A10817B64BD6FB93A4812@TYCPR01MB7481.jpnprd01.prod.outlook.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "38b7c470691dc28e5b42b45949cbc024cca3ac4e", "tree": "a8936974012905ffbca18a02a53b2eab8448fd39", "parents": [ "2cf81fc9505b148b1b70068303ea6ea4b1212403", "1221246d3bd08d8b5228777e1a9b3361ca946e64" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:11:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:11:35 2026 -0700" }, "message": "Merge branch \u0027fix-udp-splice-checksum-alignment-across-fragments\u0027\n\nAlireza Asgari via says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix UDP splice checksum alignment across fragments\n\nWhen skb_splice_from_iter() appends several pipe fragments, it updates\nskb-\u003elen only after the loop. The software-checksum helper nevertheless\nuses that unchanged length as the checksum position for each fragment.\nAn odd number of bytes already appended during the call therefore gives\nlater fragments the wrong checksum alignment.\n\nA standalone reproducer primes a UDP socket with sendto(MSG_MORE), splices\ndistinct pipe buffers, then uncorks the datagram. The send succeeds, but\nthe receiver drops the packet and increments its checksum-error counter.\n\nPatch 1 passes the actual cumulative offset to the checksum helper without\nchanging the final length update or partial-progress handling. Patch 2\nadds a loopback selftest covering IPv4, IPv6, IPv4-mapped destinations,\nconnected and unconnected sockets, prefixes and fragment boundaries.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260924-fix-udp-splice-checksum-v1-0-fe61d65447a8@asgari.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1221246d3bd08d8b5228777e1a9b3361ca946e64", "tree": "a8936974012905ffbca18a02a53b2eab8448fd39", "parents": [ "febec6a7076499d16b37f556724a942633a270a6" ], "author": { "name": "Alireza Asgari", "email": "alireza@asgari.net", "time": "Thu Sep 24 13:00:25 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:11:30 2026 -0700" }, "message": "selftests: net: cover UDP splice checksum fragment alignment\n\nExercise software UDP checksums when splice() transfers multiple pipe\nfragments into a corked datagram. Use separate source pipes so short writes\ncannot merge, and use odd fragment lengths to expose checksum-position\nerrors between fragments.\n\nCover IPv4, IPv6 and IPv4-mapped destinations, connected and unconnected\nsockets, resident prefixes, even and odd fragment lengths, and a fragment\nstarting near a page boundary. Ordinary sends provide a control. Check the\ncomplete payload and reject extra datagrams after a successful send.\n\nKeep receive waits bounded and skip unavailable address families or pipe\ncapacities. The test uses only loopback sockets with ephemeral ports and\nhas no dependency on the application that exposed the regression.\n\nSigned-off-by: Alireza Asgari \u003calireza@asgari.net\u003e\nLink: https://patch.msgid.link/20260924-fix-udp-splice-checksum-v1-2-fe61d65447a8@asgari.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "febec6a7076499d16b37f556724a942633a270a6", "tree": "5a4c5912756eb1ee6d6723ad570195025915f86c", "parents": [ "2cf81fc9505b148b1b70068303ea6ea4b1212403" ], "author": { "name": "Alireza Asgari", "email": "alireza@asgari.net", "time": "Thu Sep 24 13:00:24 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 17:11:30 2026 -0700" }, "message": "net: fix checksum offsets in skb_splice_from_iter()\n\nskb_splice_from_iter() appends multiple page fragments before updating\nskb-\u003elen. However, skb_splice_csum_page() uses that unchanged length as the\noffset for every fragment checksum. If bytes already appended during the\ncall have an odd total length, a later fragment\u0027s checksum is combined\nwith the wrong parity.\n\nFor example, prime a UDP socket with sendto(MSG_MORE) and splice two\ndistinct pipe buffers containing \"abc\" and \"DEFGH\". Uncorking reports\nsuccess, but the receiver discards the packet for a bad checksum.\nThis also affects IPv6 and fragments beginning near a page boundary.\n\nPass the initial skb length plus the bytes already spliced to the checksum\nhelper. Keep the existing final length update and partial-progress error\nhandling unchanged. CHECKSUM_PARTIAL does not use this helper and remains\nunaffected.\n\nFixes: 2e910b95329c (\"net: Add a function to splice pages into an skbuff for MSG_SPLICE_PAGES\")\nCc: stable@vger.kernel.org\nSigned-off-by: Alireza Asgari \u003calireza@asgari.net\u003e\nLink: https://patch.msgid.link/20260924-fix-udp-splice-checksum-v1-1-fe61d65447a8@asgari.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2cf81fc9505b148b1b70068303ea6ea4b1212403", "tree": "970315514b4fad513872f203a3937f6ec48dec48", "parents": [ "54518e0e827f4ca9229ae657022c60bf60f5c1bf" ], "author": { "name": "Ilkka Lappeteläinen", "email": "ilkka.lappetelainen@gmail.com", "time": "Fri Sep 25 15:48:29 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 29 16:30:17 2026 -0700" }, "message": "net/packet: prevent TX_RING byte count overflow\n\ntpacket_snd() drains every SEND_REQUEST frame in a TX ring and adds\neach valid packet length to the signed int len_sum. Userspace can\nrecycle completed frames concurrently, so a single blocking send call\nis not bounded by the ring size.\n\nAfter enough successful transmissions len_sum wraps into the negative\nrange. In particular, 65536 65535-byte frames followed by a 65007-byte\nframe produce 0xfffffdef, or -EIOCBQUEUED. sock_sendmsg_nosec() treats\nthat as an impossible return and triggers a BUG. On systems configured\nto panic on oops, a CAP_NET_RAW holder can panic the host kernel.\n\nStop before the next frame would make the byte count exceed INT_MAX.\nThe positive short count leaves that frame pending for a later send\ncall.\n\nA two-thread TPACKET_V2 reproducer triggered the BUG on an arm64 build\nof Linux 7.3-rc4. With this change, the same reproducer returned the\nexpected positive short count without an oops.\n\nFixes: 69e3c75f4d54 (\"net: TX_RING and packet mmap\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilkka Lappeteläinen \u003cilkka.lappetelainen@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260925124829.6595-1-ilkka.lappetelainen@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a243ede718463c7b481878656f1ff32a0ce0fd54", "tree": "cd0a20a14f345ee1e6350b7b35810cd552c928ce", "parents": [ "b004c4b1c4180fc7f2326de4ac941d5edfe16076", "1c1a342aceec79528b3ba51f376eca2be5928fe7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 13:45:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 13:45:18 2026 -0700" }, "message": "Merge tag \u0027mtd/fixes-for-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux\n\nPull MTD fixes from Miquel Raynal:\n \"The most important set of fixes are around the handling of the QE bit\n in SPI NAND.\n\n There are also a couple of behavioral fixes (mutex issue in SPI-NOR,\n spurious bitflips on vf610_nfc, OOB bytes count in SPI NAND and\n cfi_cmdset stack usage).\n\n The rest is mostly AI fuzzing results\"\n\n* tag \u0027mtd/fixes-for-7.3-rc6\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mtd/linux:\n mtd: spinand: Do not update the QE bit on devices without one\n mtd: spi-nor: core: Fix mutex leak in spi_nor_rww_start_exclusive()\n mtd: rawnand: cadence: Initialize IRQ state before requesting IRQ\n mtd: rawnand: vf610_nfc: fix false bitflips on reads of erased pages\n mtd: rawnand: vf610_nfc: fix reads on chips with more than 64 bytes of OOB\n mtd: spinand: fix zero oobavail when no ECC engine is used\n mtd: spinand: fix NULL pointer dereference with no ECC engine\n mtd: mtd_intel_dg: reset poll counter for each erase\n mtd: cfi_cmdset_0001: shrink do_write_buffer() stack frame\n mtd: core: call _get_device() with the master MTD\n mtd: core: avoid double-free of OTP NVMEM device\n mtd: spinand: Enable QE on all dies\n mtd: block2mtd: Fix divide error when erase_size is zero\n" }, { "commit": "b004c4b1c4180fc7f2326de4ac941d5edfe16076", "tree": "88abfbd7199ce2848fc5e4a14f1c2e4c28e7236a", "parents": [ "6f8319e3e9a44dd537d17f41565a8453c560a581", "f050c3e61d2a1aaece3170d459e4ce5fa2486c12" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 11:30:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 29 11:30:52 2026 -0700" }, "message": "Merge tag \u0027arc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc\n\nPull ARC fix from Vineet Gupta\n\n - cmpxchg snafu spotted by Bradley and other misc fixes\n\n* tag \u0027arc-fixes-7.3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vgupta/arc:\n ARC: arch_cmpxchg_relaxed to use size of pointed type not pointer\n arc: kernel: Fix clk reference leak in show_cpuinfo()\n arc: remove unused profile.h includes\n ARC: cleanup dead ARC_CANT_LLSC option in Kconfig\n" }, { "commit": "54518e0e827f4ca9229ae657022c60bf60f5c1bf", "tree": "86b4fc0b5037c7432f9bf831e6e9777f61784a6a", "parents": [ "d031465acc362866f27e4f8f79cfecf1037fe2e5" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 26 14:03:28 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 12:49:13 2026 +0200" }, "message": "net/sched: sch_codel: match the no-drop threshold to the packet size\n\ncommit 6439461f1618 (\"net/sched: sch_codel: clamp default mtu to avoid\ndisabling CoDel\") clamped q-\u003eparams.mtu to [256, 1 \u003c\u003c 20]. The value is\nthe CoDel no-drop threshold (codel_impl.h \"*backlog \u003c\u003d params-\u003emtu\"), so\non a link whose maximum transmitted packet size is below 256 the floor\nextends CoDel\u0027s minimum-backlog exemption beyond one packet and delays\ndrop or mark eligibility by several small packets.\n\nKeep the upper bound that guards the original overflow (psched_mtu()\nwrapping to ~2 GiB on a huge-MTU device) but drop the 256 floor, so the\nthreshold tracks the real device packet size.\n\nConditions to recreate the bug: attach a codel qdisc on a link whose\nMTU plus hard_header_len is below 256 (e.g. a CAN interface). At that\nMTU the no-drop threshold must equal the device MTU plus its\nhard-header length; before this patch it was forced to 256.\nRequires CAP_NET_ADMIN in a user namespace.\n\nFixes: 6439461f1618 (\"net/sched: sch_codel: clamp default mtu to avoid disabling CoDel\")\nReported-by: Sashiko (nipa) \u003csashiko-bot@kernel.org\u003e\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260819143136.57350-1-jhs@mojatatu.com\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-34MS.v1.20260925165535@mojatatu.com.2\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d031465acc362866f27e4f8f79cfecf1037fe2e5", "tree": "a603869669e0f0cfbc6c2d2fe2683e3c4139cb55", "parents": [ "0923198be4ae714b46350f742cb19ccd75bfeafa" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 26 14:03:27 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 12:49:07 2026 +0200" }, "message": "net/sched: fq_codel: match the no-drop threshold to the packet size\n\ncommit d9ebd8f9aa8b (\"net/sched: fq_codel: clamp default quantum and mtu\")\nclamped both q-\u003equantum and q-\u003ecparams.mtu to [256, FQ_CODEL_QUANTUM_MAX].\nThe two fields mean different things: quantum is a DRR credit that wants\nthe 256 floor, but cparams.mtu is the CoDel no-drop threshold\n(codel_impl.h \"*backlog \u003c\u003d params-\u003emtu\"). On a link whose maximum\ntransmitted packet size is below 256, the floor extends CoDel\u0027s\nminimum-backlog exemption beyond one packet and delays drop or mark\neligibility by several small packets.\n\nSplit the clamp. quantum keeps [256, FQ_CODEL_QUANTUM_MAX]; cparams.mtu\ntracks psched_mtu() (the device MTU plus its hard-header length) with\nonly the upper bound that guards the original overflow (psched_mtu()\nwrapping to ~2 GiB on a huge-MTU device).\n\nConditions to recreate the bug: attach an fq_codel qdisc on a link\nwhose MTU plus hard_header_len is below 256 (e.g. a CAN interface). At\nthat MTU the no-drop threshold must equal the device MTU plus its\nhard-header length; before this patch it was forced to 256.\nBasic Testing done: with dev-\u003emtu\u003d100 and hard_header_len\u003d14, a\nreturn probe on fq_codel_init() observed cparams.mtu change from 256 to 114\n\nFixes: d9ebd8f9aa8b (\"net/sched: fq_codel: clamp default quantum and mtu\")\nReported-by: Sashiko (nipa) \u003csashiko-bot@kernel.org\u003e\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260819143136.57350-1-jhs@mojatatu.com\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-34MS.v1.20260925165535@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0923198be4ae714b46350f742cb19ccd75bfeafa", "tree": "28da8a6bbc408cbe2216fa1e10087a9a2b033cf8", "parents": [ "f8932b2c0c9ae6fb577bcc05a2080c8498f91c0d" ], "author": { "name": "Sagar Taunk", "email": "sagartaunk@proton.me", "time": "Fri Sep 25 08:55:04 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 12:28:03 2026 +0200" }, "message": "rust: net: netlink: validate attribute length before casting to `c_int`\n\n`put()` trusted an unchecked `as` cast from `usize` to `c_int`.\nWhen the length exceeds `i32::MAX` that cast wraps around to a\nnegative value.\n\nThis ultimately resulted in a kernel panic when the reinterpreted\nvalue via `__nla_reserve()` and `skb_put()` became enormous.\n\nValidate payload and header both fit together in a `u16`, rejecting\nany payload that wouldn\u0027t leave room for `NLA_HDRLEN`.\n\nFixes: 5eaa5fbb6e6c (\"rust: netlink: add raw netlink abstraction\")\nReviewed-by: Alice Ryhl \u003caliceryhl@google.com\u003e\nReviewed-by: Alexandre Courbot \u003cacourbot@nvidia.com\u003e\nReviewed-by: Carlos Llamas \u003ccmllamas@google.com\u003e\nReviewed-by: Gary Guo \u003cgary@garyguo.net\u003e\nSigned-off-by: Sagar Taunk \u003csagartaunk@proton.me\u003e\nLink: https://patch.msgid.link/20260925085449.22553-1-sagartaunk@proton.me\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f8932b2c0c9ae6fb577bcc05a2080c8498f91c0d", "tree": "675988af41d584c004429d5c20dd32955166d7ab", "parents": [ "006c8b834aed8b02bd8fb9fb05e9e7ead37d1763" ], "author": { "name": "Hannu Varjoranta", "email": "hannu@varjosoft.com", "time": "Fri Sep 25 14:52:37 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 12:09:40 2026 +0200" }, "message": "gve: DQO: accept TSO packets with non-protocol gso_type bits\n\nSince commit 014c607f86ab (\"gve: add support for UDP GSO for DQO\nformat\"), gve_prep_tso() matches shinfo-\u003egso_type exactly. gso_type is\na bitmask, though: SKB_GSO_DODGY is set on every GSO packet that comes\nfrom tun/tap, packet sockets or other untrusted sources, and\nSKB_GSO_TCP_ECN and SKB_GSO_TCP_FIXEDID can be set as well. Such packets\nhit the default case, gve_tx_add_skb_dqo() fails and gve_try_tx_skb()\ndrops them, counting them in tx_dropped.\n\nThese packets do reach the driver: tcp_gso_segment() passes DODGY skbs\nthrough unsegmented to devices that support TSO, after recomputing\ngso_segs, so drivers must tolerate the bit.\n\nThis breaks virtual machines behind a tap on GCE instances using the DQO\nqueue formats. Every TSO packet forwarded from a guest (gso_type\nSKB_GSO_TCPV4 | SKB_GSO_DODGY) is dropped, and guest uploads slow to a\ncrawl of retransmissions or stall entirely, while the host\u0027s own TSO\ntraffic (gso_type SKB_GSO_TCPV4) is unaffected. On an n4 instance\n(DQO-QPL) with a Cloud Hypervisor guest, a 64 MB upload from the guest\nwent from a 60 s timeout at ~0.9 MB/s to 0.19 s with this change, with\ntx_dropped no longer increasing.\n\nHost TCP with ECN is hit as well: gve advertises NETIF_F_TSO_ECN, so a\nTSO packet carrying CWR has SKB_GSO_TCP_ECN set and is dropped too.\n\nRestore the bitmask test that commit 1b9f75634441 (\"gve: ignore\nnonrelevant GSO type bits when processing TSO headers\") introduced for\nthe same problem, keeping the UDP GSO support.\n\nWhile here, reload shinfo after skb_cow_head(). If the head was cloned,\npskb_expand_head() moves skb_shared_info to the new head, and the\npointer cached at function entry can then refer to memory that another\nclone frees.\n\nFixes: 014c607f86ab (\"gve: add support for UDP GSO for DQO format\")\nSigned-off-by: Hannu Varjoranta \u003channu@varjosoft.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ankit Garg \u003cnktgrg@google.com\u003e\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nLink: https://patch.msgid.link/20260925115237.56465-1-hannu@varjosoft.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "006c8b834aed8b02bd8fb9fb05e9e7ead37d1763", "tree": "c0deb128cd6ead09e9426cda4cc4a7836c608fa5", "parents": [ "0f17d2e3dd9cda3ee6d94033d5e5489af168920d" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Thu Sep 24 05:15:21 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 12:02:37 2026 +0200" }, "message": "net: gso: limit recursive IP-in-IP segmentation\n\nIP-in-IP GSO can re-enter inet_gso_segment() or ipv6_gso_segment()\nfor each nested IP header. encap_level tracks header bytes, not callback\ndepth, so a deep chain can exhaust the kernel stack. Making\ninet_gso_segment() stackable introduced unbounded IPv4 nesting; IPIP\nGSO/TSO later made the path reachable. The IPv6 stackable path was\nintroduced separately and uses the same guard.\n\nCount IPv4 and IPv6 GSO handler entries in skb_gso_cb, initialized once\nper top-level GSO operation and preserved across GRE/UDP context changes.\nUse the existing IP_TUNNEL_RECURSION_LIMIT for both handlers. The first\nfive entries pass, and the sixth returns -EINVAL before dispatching\nanother GSO callback.\n\nFixes: 3347c9602955 (\"ipv4: gso: make inet_gso_segment() stackable\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nCloses: https://lore.kernel.org/all/cover.1790157745.git.zihanx@nebusec.ai/\nAssisted-by: LLM\nCo-developed-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260924051521.32568-2-zihanx@nebusec.ai\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0f17d2e3dd9cda3ee6d94033d5e5489af168920d", "tree": "c036f55b312fb24a12753e0feda52ee02715b740", "parents": [ "37e02c42a00be692c06343e11779aadc45f45971" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Thu Sep 24 13:52:52 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 29 11:10:55 2026 +0200" }, "message": "pfcp: fix socket lifetime on netdevice registration failure\n\npfcp_newlink() creates the UDP socket before register_netdevice().\nIf registration fails after pfcp_dev_init() succeeds, the core calls\npfcp_dev_uninit(), which releases the socket and clears pfcp-\u003esk.\nThe newlink error path then releases it again, causing a NULL pointer\ndereference. This was observed with failslab fault injection:\n\n FAULT_INJECTION: forcing a failure.\n kobject: kobject_add_internal failed for pfcp0 (error: -12 parent: net)\n BUG: KASAN: null-ptr-deref in udp_tunnel_sock_release+0x1c/0x50\n Read of size 8 at addr 0000000000000120 by task ip/1037\n Call trace:\n show_stack+0x18/0x24 (C)\n dump_stack_lvl+0x78/0x90\n print_report+0x468/0x5cc\n kasan_report+0xa4/0xf0\n __asan_load8+0x7c/0xd0\n udp_tunnel_sock_release+0x1c/0x50\n pfcp_newlink+0x128/0x184\n rtnl_newlink+0x848/0xe44\n rtnetlink_rcv_msg+0x468/0x514\n netlink_rcv_skb+0xc0/0x1f0\n rtnetlink_rcv+0x18/0x24\n netlink_unicast+0x4b8/0x558\n netlink_sendmsg+0x2b8/0x584\n ...\n\nReturn from pfcp_del_sock() if pfcp-\u003esk is NULL.\n\nFixes: 76c8764ef36a5 (\"pfcp: add PFCP module\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260924055252.33488-1-xuanqiang.luo@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fdd6553e1e53b0421d89c7469c8a36d2eadb1115", "tree": "86b8ee26e41c65883a283f114e365abfcb79163e", "parents": [ "e955f14fa8467d70aaeea5830b4d1773d5b25500" ], "author": { "name": "Zhan Xusheng", "email": "zhanxusheng1024@gmail.com", "time": "Mon Sep 28 10:02:05 2026 +0800" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Tue Sep 29 10:00:40 2026 +0200" }, "message": "time/jiffies: Saturate in mult_hz() instead of wrapping\n\nReturn ULONG_MAX for values that don\u0027t fit an unsigned long.\nproc_int_u2k_conv_uop() now correctly rejects a result above INT_MAX.\n\nThis is the erroneous behaviour that is being fixed. The input has to\nexceed ULONG_MAX / HZ for the product to wrap, so the value below is\nspecific to CONFIG_HZ\u003d1000:\n\n # echo 18446744073709552 \u003e /proc/sys/net/ipv4/tcp_keepalive_time\n # cat /proc/sys/net/ipv4/tcp_keepalive_time\n 0\n\nThat value is now rejected with an error.\n\nThe original bound (\"*u_ptr \u003e INT_MAX / HZ\") was removed in commit\n2dc164a48e6f (\"sysctl: Create converter functions with two new macros\").\n\nFixes: 2dc164a48e6f (\"sysctl: Create converter functions with two new macros\")\nCc: stable@vger.kernel.org\nSigned-off-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "e955f14fa8467d70aaeea5830b4d1773d5b25500", "tree": "0582d898792c474fcfabf2dcefbdde5614e12a01", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e" ], "author": { "name": "Zhan Xusheng", "email": "zhanxusheng1024@gmail.com", "time": "Mon Sep 28 10:02:04 2026 +0800" }, "committer": { "name": "Joel Granados", "email": "joel.granados@kernel.org", "time": "Tue Sep 29 09:25:14 2026 +0200" }, "message": "sysctl: Negate before converting in the int read path\n\nproc_int_k2u_conv_kop() reports the sign through *negp and the magnitude\nthrough *u_ptr, but for a negative value it hands the sign-extended int to\nthe converter and negates the result:\n\n\t*u_ptr \u003d k_ptr_op ? -k_ptr_op((ulong)val) : -(ulong)val;\n\nWith div_hz() and CONFIG_HZ\u003d1000 a stored -1000 becomes\n(ulong)-1000 / 1000 \u003d\u003d 18446744073709550, and negating that wraps:\n\n\t# echo -1 \u003e /proc/sys/net/ipv4/tcp_fin_timeout\n\t# cat /proc/sys/net/ipv4/tcp_fin_timeout\n\t-18428297329635842066\n\nThe magnitude is HZ dependent but the wrap is not: the negation happens\nafter the division at every CONFIG_HZ.\n\nTake the magnitude first and convert that, which is what the open-coded\nversion did before commit 2dc164a48e6f (\"sysctl: Create converter\nfunctions with two new macros\") folded it into a macro. The\nk_ptr_op \u003d\u003d NULL branch was already correct.\n\nAll three int converters that pass a k_ptr_op are affected:\nproc_dointvec_jiffies(), proc_dointvec_userhz_jiffies() and\nproc_dointvec_ms_jiffies().\n\nFixes: 2dc164a48e6f (\"sysctl: Create converter functions with two new macros\")\nCc: stable@vger.kernel.org\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Zhan Xusheng \u003czhanxusheng@xiaomi.com\u003e\nSigned-off-by: Joel Granados \u003cjoel.granados@kernel.org\u003e\n" }, { "commit": "6f8319e3e9a44dd537d17f41565a8453c560a581", "tree": "40f22848d969a66da9d35c7b8d6661f3eab346f8", "parents": [ "72d3fcf802c45d00b300f25b848a93c3a2bd7c7e", "976d5e0ddac885b0219252f004f6c561c344df9d" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 28 20:11:31 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Sep 28 20:11:31 2026 -0700" }, "message": "Merge tag \u0027mm-hotfixes-stable-2026-09-27-19-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm\n\nPull MM fixes from Andrew Morton:\n\n - Fix module loading incorrectly returning success after alloc_tag\n codetag setup failed\n\n - Restore MADV_COLLAPSE semantics for shmem so forced collapse ignores\n the shmem THP/mTHP sysfs settings\n\n - Make alloc_tag UAPI structure padding explicit\n\n - Fix DAMON schemes unexpectedly stopping after quotas are disabled\n through the online parameter update interface\n\n - Fix a false SW_TAGS KASAN invalid-access report when freeing vmapped\n task stacks\n\n - Split the MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION MAINTAINERS\n entry into separate MIGRATION and NUMA PLACEMENT entries\n\n - Move memory tiering maintenance under NUMA PLACEMENT\n\n - Add Gregory Price as a NUMA PLACEMENT co-maintainer\n\n - Add Heming Zhao as an ocfs2 reviewer\n\n - Fix mmap_prepare() state being copied onto a merged VMA rather than\n only onto a newly allocated VMA\n\n* tag \u0027mm-hotfixes-stable-2026-09-27-19-12\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm:\n mm/vma: predicate setting mmap_prepare VMA fields on new vma alloc\n MAINTAINERS: add Heming Zhao as ocfs2 reviewer\n MAINTAINERS: make Gregory a co-maintainer of MEMORY MANAGEMENT - NUMA PLACEMENT\n MAINTAINERS: move memory tiering under MEMORY MANAGEMENT - NUMA PLACEMENT\n MAINTAINERS: split up MEMORY MANAGEMENT - MEMORY POLICY AND MIGRATION\n kasan: unpoison task stack below watermark only in generic mode\n mm/damon/core: don\u0027t skip damos_adjust_quota() while esz is not zero\n alloc_tag: avoid implicit padding in uapi\n mm: shmem: ignore sysfs configs for shmem forced collapse\n module: fix lost error code from codetag_load_module()\n" }, { "commit": "37e02c42a00be692c06343e11779aadc45f45971", "tree": "4c8b13dbbc19fe96e503e7b1ed684e3a06154792", "parents": [ "036778a4fad19b54b73ae229a1901665aa8750a2" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Sep 25 13:52:43 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 28 19:31:54 2026 -0700" }, "message": "net: restrict SO_RESERVE_MEM to TCP sockets and cap max value\n\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is true for both TCP and UDP\nsockets.\n\nHowever, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only\nsupported by TCP:\n- On UDP sockets, sk-\u003esk_forward_alloc is protected by\n sk-\u003esk_receive_queue.lock, whereas sock_reserve_memory() and\n sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent\n UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt\n sk_forward_alloc and memcg accounting.\n- udp_rmem_release() reclaims excess sk_forward_alloc without\n accounting for sk_unused_reserved_mem(sk).\n\nRestrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now.\nSupporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and\nhonoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in\na future net-next series if needed.\n\nIn addition, reject val \u003e SZ_1G with -EINVAL in\nsk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near\nINT_MAX cause sk_mem_pages(delta) and (pages \u003c\u003c PAGE_SHIFT) to overflow\n32-bit signed int, corrupting sk-\u003esk_forward_alloc and\nsk-\u003esk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the\npage-rounded sk-\u003esk_reserved_mem reported by getsockopt(SO_RESERVE_MEM)\ncan always be passed back to setsockopt(SO_RESERVE_MEM).\n\nFixes: 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\")\nReported-by: Cai Xinchen \u003ccaixinchen1@huawei.com\u003e\nCloses: https://lore.kernel.org/netdev/5a88421d-10ef-4fca-9acb-85a27a3c1173@huawei.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Wei Wang \u003cweiwan@google.com\u003e\nLink: https://patch.msgid.link/20260925135244.3715196-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "036778a4fad19b54b73ae229a1901665aa8750a2", "tree": "cf6d7a5413e91f69fe416ea991b0bd03b9d4742d", "parents": [ "8ae3f4067ba4ae3a15581392f6dac422e3d3def0" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Fri Sep 25 15:52:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 28 19:26:41 2026 -0700" }, "message": "net: ethtool: let tsconfig reach a PHY-only timestamp provider\n\nTSCONFIG_GET and TSCONFIG_SET reject a device that implements neither\nhwtstamp NDO, even when its PHY can serve the request. The ioctls they\nmeant to replace handle it, so the two interfaces disagree on the same\nhardware and user space has to pick one.\n\nAccept the default timestamping PHY and an already installed provider on\nboth sides. On the set side the test moves into ethnl_set_tsconfig() as\nthe validate callback runs without rtnl. On the get side it stays ahead\nof ethnl_ops_begin(), so a device that can serve nothing keeps failing\nwith EOPNOTSUPP and a dump still skips it rather than stopping there.\n\nA netdev provider needs ndo_hwtstamp_set to be programmed at all, so\ndon\u0027t pick that source without it, and test for ndo_hwtstamp_get before\ncalling it.\n\nFixes: 6e9e2eed4f39 (\"net: ethtool: Add support for tsconfig command to get/set hwtstamp config\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20260925135237.3432266-3-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8ae3f4067ba4ae3a15581392f6dac422e3d3def0", "tree": "f5d332878e6f2eca854b47afe0db4adb1b55b220", "parents": [ "88095728511e0df9c89528944f5a1762ad298983" ], "author": { "name": "Andrea Mayer", "email": "andrea.mayer@uniroma2.it", "time": "Fri Sep 25 15:38:07 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 28 19:19:48 2026 -0700" }, "message": "seg6: ensure packet data is writable before modifying SRH and IPv6 DA\n\nadvance_nextseg() modifies the SRH Segments Left field and the IPv6\ndestination address without ensuring the packet data is writable.\nseg6_next_csid_advance_arg() has the same problem when it advances the\nNEXT-C-SID argument in the destination address.\n\nThe skb may be cloned, for example by an AF_PACKET socket receiving on\nthe ingress device. advance_nextseg() and seg6_next_csid_advance_arg()\nthen write into the packet data shared with the clone. A read from that\nsocket can return the modified packet instead of the received one. The\nsimplified path below shows this for advance_nextseg():\n\n__netif_receive_skb_one_core\n __netif_receive_skb_core\n deliver_skb [orig: users\u003d2, cloned\u003d0]\n packet_rcv\n skb_clone clone queued to the AF_PACKET socket\n consume_skb(orig) [orig: users\u003d1, cloned\u003d1]\n ipv6_rcv\n ip6_rcv_core skb_share_check: no-op [orig: users\u003d1]\n [...]\n input_action_end_core\n advance_nextseg writes into the data shared with the clone\n\nCall skb_ensure_writable() in advance_nextseg() and in\nseg6_next_csid_advance_arg() before they modify the packet data.\nskb_ensure_writable() may reallocate skb-\u003ehead, which invalidates the\npointers into the packet data taken before the call.\nadvance_nextseg() now returns a valid SRH pointer, or NULL if\nskb_ensure_writable() fails.\nseg6_next_csid_advance_arg() takes the pointer to the destination\naddress from the skb after skb_ensure_writable().\nOn failure, the callers drop the packet with SKB_DROP_REASON_NOMEM.\n\nFixes: 140f04c33bbc (\"ipv6: sr: implement several seg6local actions\")\nFixes: 848f3c0d4769 (\"seg6: add NEXT-C-SID support for SRv6 End behavior\")\nSigned-off-by: Andrea Mayer \u003candrea.mayer@uniroma2.it\u003e\nLink: https://patch.msgid.link/20260925133807.32-1-andrea.mayer@uniroma2.it\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "88095728511e0df9c89528944f5a1762ad298983", "tree": "655c0000dbab7482731ac5ff63bf201f430ae9cb", "parents": [ "bdea4980182e3badac74f04df6c07492b91c569e" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Wed Sep 23 11:14:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 28 18:32:23 2026 -0700" }, "message": "net: stmmac: fix rx Scatter-Gather support\n\nWhen a received frame is larger than dma_buf_sz, the DMA scatters it\nacross multiple RX descriptors (rx Scatter-Gather). The secondary RX\nbuffer (sec_page) was only allocated and programmed when split-header\n(SPH) was active, so for regular frames buffer2 was neither allocated\nnor backed by a valid mapping. As soon as an incoming frame overflowed\nbuffer1, the DMA wrote the overflow into the unmapped secondary-buffer\naddress, triggering an SMMU translation fault on IOMMU-based platforms:\n\narm-smmu 15000000.iommu: Unhandled context fault: fsr\u003d0x402, iova\u003d0x00000000, fsynr\u003d0x7f0011, cbfrsynra\u003d0x1c90, cb\u003d11\narm-smmu 15000000.iommu: FSR \u003d 00000402 [Format\u003d2 TF], SID\u003d0x1c90\narm-smmu 15000000.iommu: FSYNR0 \u003d 007f0011 [S1CBNDX\u003d127 WNR PLVL\u003d1]\n\nEnable scatter-gather for non-SPH frames on cores that can program an\nindependent secondary RX buffer (GMAC4/XGMAC): allocate and mark buffer2\nas valid in stmmac_init_rx_buffers() and stmmac_rx_refill(), and account\nfor it in the buffer length computation. Legacy cores have no set_sec_addr\nop, so they keep buffer2 disabled.\n\nSince buffer2 is handed to the DMA at page offset 0, the page pool sync\nwindow is widened to cover both buffers in every mode: offset is set to 0\nand max_len to dma_buf_sz + stmmac_rx_offset().\n\nThe FCS can straddle the buffer1/buffer2 boundary and a descriptor\nboundary, so it is now stripped from the tail of the assembled frame with\npskb_trim() instead of from a single buffer, avoiding an unsigned underflow\nfor frames that overflow a buffer by 1..3 bytes. For single-buffer frames\nthe XDP program must not see the FCS, so it is removed from the XDP buffer\nbefore the program runs.\n\nNative XDP currently only supports single-buffer (linear) frames. An\noversized frame accepted by the MAC (jumbo enabled) is received via\nbuffer2; the XDP program only sees buffer1, so on a TX/REDIRECT verdict\nthe frame is forwarded truncated. XDP multi-buffer support to handle\nthis case is planned as a follow-up.\n\nAF_XDP zero-copy RX is not covered by this change: a ZC queue still\nprograms buffer2 at DMA address 0 (and XGMAC has no buffer2-valid bit),\nso an oversized frame overflowing buffer1 can still trigger the same\nSMMU translation fault. Handling is planned as a follow-up.\n\nFixes: 88ebe2cf7f3f (\"net: stmmac: Rework stmmac_rx()\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260923-stmmac-rx-sg-fix-v3-1-ed26fea7180d@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdea4980182e3badac74f04df6c07492b91c569e", "tree": "8b4db610e97d14879e3ce22a73363a883337a462", "parents": [ "512ccd3d0e91e791fb37442aa0a2599aca19783d" ], "author": { "name": "Mina Almasry", "email": "almasrymina@google.com", "time": "Fri Sep 25 14:41:11 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 28 18:24:05 2026 -0700" }, "message": "net: page_pool: fix use-after-free in page_pool_recycle_ring_bulk()\n\nWith CONFIG_PAGE_POOL_STATS\u003dy, page_pool_recycle_ring_bulk() updates\nthe recycle stats after dropping the producer lock. If it just recycled\nthe last inflight netmems of a pool being destroyed, page_pool_release()\ncan pass its producer-lock barrier and free the pool before\nrecycle_stat_add() runs.\n\nCommit fcc680a647ba7 (\"page_pool: allow mixing PPs within one bulk\")\nmoved this stat update after the unlock. Commit 271683bb2cf32\n(\"page_pool: Fix use-after-free in page_pool_recycle_in_ring\") later\nadded the barrier, but only fixed page_pool_recycle_in_ring(). Move\nthe update back under the lock.\n\nFixes: fcc680a647ba7 (\"page_pool: allow mixing PPs within one bulk\")\nLink: https://lore.kernel.org/r/179028939171.2160803.706522228583664641@kernel.org\nCc: Kaifeng Wang \u003ckaifengw@google.com\u003e\nCc: Dong Chenchen \u003cdongchenchen2@huawei.com\u003e\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://patch.msgid.link/20260925144127.1445667-1-almasrymina@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "512ccd3d0e91e791fb37442aa0a2599aca19783d" }