)]}' { "log": [ { "commit": "7b6ab4dbc156e2f96419715130b3d5738a306c93", "tree": "3d49c6b61fe1a774a1466e439d82c8d20fd34ef2", "parents": [ "4dd16e31135ea8437a720222df34e8745f385d6d", "121ba2ac79689607604750833e0193bbdd7b59af" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:15 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:15 2026 +0100" }, "message": "Merge branch \u0027net-devmem-fix-rx-and-tx-binding-teardown-on-device-unregistration\u0027\n\nMina Almasry says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: devmem: fix RX and TX binding teardown on device unregistration\n\nFix two device-unregistration lifecycle bugs in devmem TCP bindings and\nadd netdevsim support plus selftests covering both RX and TX device\nunregistration. These issues were found via LLM-assisted code review\n(Sashiko) and reproduced and verified with the new nl_netdev.py\nselftests on netdevsim (not tested on real hardware):\n\n1. net: devmem: unmap dma_buf synchronously on queue uninstall\n Synchronously unmap and detach binding-\u003eattachment under binding-\u003elock\n when the last RX queue is uninstalled in mp_dmabuf_devmem_uninstall()\n or closed in net_devmem_unbind_dmabuf(), and unmap remaining unbound RX\n bindings on NETDEV_UNREGISTER, preventing slab-use-after-free in\n dma_unmap_sg_attrs() when the binding is freed after dma_dev. Factor\n out net_devmem_lock_dev() and net_devmem_unlock_dev() to synchronize\n netdev_nl_sock_priv_destroy() and __net_devmem_dmabuf_binding_free()\n against NETDEV_UNREGISTER.\n\n2. net: devmem: detach TX bindings on NETDEV_UNREGISTER\n Extend net_devmem_dev_unregister() to fully detach and unmap TX\n bindings when binding-\u003edev unregisters, or clear binding-\u003evdev alone\n when only a virtual device unregisters while binding-\u003edev lives.\n\n3. netdevsim: support devmem RX and TX bindings\n Enable PP_FLAG_DMA_MAP | PP_FLAG_ALLOW_UNREADABLE_NETMEM, 64-bit DMA mask\n on nsim_bus_dev, and NETMEM_TX_DMA on netdevsim so devmem RX/TX bindings\n can be exercised in software selftests.\n\n4. selftests: net: add devmem RX and TX netdev unregister tests\n Add devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check\n to tools/testing/selftests/net/nl_netdev.py.\n\nv4: https://lore.kernel.org/netdev/20261015163915.1166043-1-almasrymina@google.com/\nv3: https://lore.kernel.org/netdev/20261014161754.3782346-1-almasrymina@google.com/\nv2: https://lore.kernel.org/netdev/20261012174300.2338784-1-almasrymina@google.com/\nv1: https://lore.kernel.org/netdev/20261010025532.839559-1-almasrymina@google.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261030083539.777877-1-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "121ba2ac79689607604750833e0193bbdd7b59af", "tree": "3d49c6b61fe1a774a1466e439d82c8d20fd34ef2", "parents": [ "c153da3993549a420d706b8dced0bc2d84335b6f" ], "author": { "name": "Mina Almasry", "email": "almasrymina@google.com", "time": "Fri Oct 30 08:35:38 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:14 2026 +0100" }, "message": "selftests: net: add devmem RX and TX netdev unregister tests\n\nAdd devmem_bind_rx_unregister_check and devmem_bind_tx_unregister_check\nto nl_netdev.py to verify that unregistering a netdevsim device while a\nnetlink socket holds an active RX or TX devmem binding synchronously\ndetaches the dma_buf attachment and cleanly closes the netlink socket\nwithout use-after-free or page faults.\n\nAdd the dma-buf, udmabuf and devmem options the tests need to\ntools/testing/selftests/net/config.\n\nCc: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nCc: Kaifeng Wang \u003ckaifengw@google.com\u003e\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261030083539.777877-5-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c153da3993549a420d706b8dced0bc2d84335b6f", "tree": "def1e7175667e3a58401af08f1db002dfb44fed4", "parents": [ "ede1618064a9b15f10be156f5de541574e7aa57b" ], "author": { "name": "Mina Almasry", "email": "almasrymina@google.com", "time": "Fri Oct 30 08:35:37 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:14 2026 +0100" }, "message": "netdevsim: support devmem RX and TX bindings\n\nSet a 64-bit DMA mask and UINT_MAX max segment size on nsim_bus_dev in\nnsim_bus_probe() when direct DMA mapping is supported, enable\nNETMEM_TX_DMA on the netdevsim net_device, and configure page_pool\ninstances with PP_FLAG_ALLOW_UNREADABLE_NETMEM and queue_idx, plus\nPP_FLAG_DMA_MAP | PP_FLAG_DMA_SYNC_DEV when a DMA mask and\nPP_DMA_INDEX_BITS are available, so devmem bind-rx and bind-tx netlink\noperations can be tested against netdevsim in software selftests.\n\nThe pp_hold debugfs file allocates pages from the queue 0 page pool, so\nrefuse it when that pool is absent or backed by a memory provider, and\ntake the netdev instance lock there so a concurrent bind-rx cannot swap\nthe pool in between. Since netdevsim forwards TX skbs in software\nwithout a DMA engine, drop unreadable or net_iov skbs in\nnsim_start_xmit().\n\nCc: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nCc: Kaifeng Wang \u003ckaifengw@google.com\u003e\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261030083539.777877-4-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ede1618064a9b15f10be156f5de541574e7aa57b", "tree": "984905668bf9ec45f6e481aba3e337f1d20f8821", "parents": [ "c4466d2c3e776f5f3025868f858e8026432abafc" ], "author": { "name": "Mina Almasry", "email": "almasrymina@google.com", "time": "Fri Oct 30 08:35:36 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:14 2026 +0100" }, "message": "net: devmem: detach TX bindings on NETDEV_UNREGISTER\n\nTX devmem bindings (NETDEV_CMD_BIND_TX) have no bound RX queues, so\nmp_dmabuf_devmem_uninstall() never runs when binding-\u003edev or\nbinding-\u003evdev unregisters. As a result, binding-\u003edev and binding-\u003evdev\ndangle pointing to freed struct net_device memory, and the dma_buf\nremains attached and mapped after device removal.\n\nClosing the netlink socket after netdev unregistration dereferences the\nfreed struct net_device in netdev_nl_sock_priv_destroy():\n\n BUG: unable to handle page fault for address: ffff88824ca9b000\n Oops: Oops: 0000 [#1] SMP KASAN NOPTI\n RIP: 0010:netdev_nl_sock_priv_destroy+0xbd/0x1e0\n Call Trace:\n genl_release+0xf5/0x190\n netlink_release+0xd01/0x18d0\n __sock_release+0xb0/0x270\n sock_close+0x18/0x20\n\nExtend net_devmem_dev_unregister() and __net_devmem_dmabuf_binding_free()\nto TX bindings, including ones whose netlink socket is already closed\nbut which TCP retransmits keep alive:\n- When binding-\u003edev (the physical DMA-capable device) unregisters,\n clear the binding\u0027s NET_DEVMEM_BINDING_LIVE mark, unmap the dma_buf,\n and clear both binding-\u003evdev and binding-\u003edev. No grace period is\n needed: the device is already closed, so nothing hands the DMA\n addresses to the hardware anymore, and concurrent senders only compare\n against binding-\u003edev.\n- When only binding-\u003evdev (virtual device) unregisters while\n binding-\u003edev lives, only clear binding-\u003evdev so no new TX sends match\n the virtual device while allowing in-flight TX packets on binding-\u003edev\n to finish DMA safely.\n\nThis issue was found via LLM-assisted code review (Sashiko) and\nreproduced and verified with the new nl_netdev.py selftest on netdevsim\n(not tested on real hardware).\n\nFixes: bd61848900bf (\"net: devmem: Implement TX path\")\nFixes: 1abe839b34ae (\"net: devmem: support TX over NETMEM_TX_NO_DMA devices\")\nSuggested-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nCc: Kaiyuan Zhang \u003ckaiyuanz@google.com\u003e\nCc: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nCc: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nCc: Kaifeng Wang \u003ckaifengw@google.com\u003e\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261030083539.777877-3-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c4466d2c3e776f5f3025868f858e8026432abafc", "tree": "02502b9c6d8454ef6f13c8e0a4f3223b654e56bd", "parents": [ "4dd16e31135ea8437a720222df34e8745f385d6d" ], "author": { "name": "Mina Almasry", "email": "almasrymina@google.com", "time": "Fri Oct 30 08:35:35 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Nov 03 08:54:14 2026 +0100" }, "message": "net: devmem: unmap dma_buf synchronously on queue uninstall\n\nWhen a bound net_device is unregistered while userspace still holds a\nnetlink or TCP socket reference on a devmem binding,\nmp_dmabuf_devmem_uninstall() clears binding-\u003edev to NULL so\nnetdev_nl_sock_priv_destroy() will not touch the unregistered\nnet_device, but leaves the dma_buf attachment mapped until\n__net_devmem_dmabuf_binding_free() runs later on socket close.\n\nBecause dma_buf_dynamic_attach() does not take a reference on dma_dev,\ndevice removal frees dma_dev while the attachment is still mapped.\nClosing the netlink socket afterwards triggers a slab use-after-free in\ndma_unmap_sg_attrs():\n\n BUG: KASAN: slab-use-after-free in dma_unmap_sg_attrs+0x76/0x2b0\n Read of size 8 at addr ffff88810fae64b0 by task kworker/3:1/53\n Workqueue: events __net_devmem_dmabuf_binding_free\n Call Trace:\n dma_unmap_sg_attrs+0x76/0x2b0\n unmap_udmabuf+0x8e/0x100\n dma_buf_unmap_attachment+0x145/0x330\n dma_buf_unmap_attachment_unlocked+0x96/0x130\n __net_devmem_dmabuf_binding_free+0x156/0x2e0\n Freed by task 9:\n kfree+0x1b8/0x550\n nsim_bus_dev_release+0xe/0x60\n device_release+0xcf/0x250\n\nAdd net_devmem_dmabuf_binding_unmap() serialized under binding-\u003elock\nand null out binding-\u003esgt and binding-\u003eattachment after unmapping so\nunmapping is idempotent across queue uninstall and deferred binding\ndestruction. Call it synchronously when the last bound RX queue is\nuninstalled in mp_dmabuf_devmem_uninstall(), except when a leased\nqueue is unleased: the physical device is still registered and, if\nrestarting its queue failed, may still be using the binding.\n\nThe same use-after-free happens when the netlink socket is closed\nbefore the device is removed but RX tokens keep the binding alive. Once\nits queues are closed, nothing DMAs into an RX binding anymore and the\noutstanding tokens only need the net_iovs, so unmap it in\nnet_devmem_unbind_dmabuf(), and reject RX devmem net_iovs in\nvalidate_xmit_unreadable_skb(). Make netif_mp_close_rxq() return an\nerror when a queue failed to restart and may still be using the binding.\nSuch a binding stays mapped and keeps binding-\u003edev. Record a queue in\nbound_rxqs before opening it, so that a failed bind never leaves a\nqueue using the binding without unbind knowing about it.\n\nKeep bindings in net_devmem_dmabuf_bindings until they are freed and\nhide unbound ones from TX lookups with an xarray mark, so that on\nNETDEV_UNREGISTER the remaining unbound RX bindings of the device can be\nfound, detached and unmapped, unless the device is a virtual device\nleasing queues, for the same reason as above. The walk runs under the\ndevice\u0027s instance lock and is skipped when the device only moves to\nanother netns. Factor out net_devmem_lock_dev() and\nnet_devmem_unlock_dev() and use them in both\nnetdev_nl_sock_priv_destroy() and __net_devmem_dmabuf_binding_free(), so\na binding the walk finds under the xarray lock stays alive while it is\ndetached.\n\nThis issue was found via LLM-assisted code review (Sashiko) and\nreproduced and verified with the new nl_netdev.py selftest on netdevsim\n(not tested on real hardware).\n\nFixes: f8350a4358fc (\"net: page_pool: add a mp hook to unregister_netdevice*\")\nFixes: 0afc44d8cdf6 (\"net: devmem: fix kernel panic when netlink socket close after module unload\")\nSuggested-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nCc: Taehee Yoo \u003cap420073@gmail.com\u003e\nCc: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nCc: Kaifeng Wang \u003ckaifengw@google.com\u003e\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261030083539.777877-2-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4dd16e31135ea8437a720222df34e8745f385d6d", "tree": "004c93006bf6fdd3618249deedab3fbbdc8bee30", "parents": [ "46806af187f448b0d5481f284e7c900a57ee6a6d", "8f44631ba02afe9fff2f0a0fb66560ab19df87fd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:17:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:17:05 2026 -1000" }, "message": "Merge tag \u0027net-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Current release - new code bugs:\n\n - mctp: usblib: fix assertion breaking esoteric builds\n\n Previous releases - regressions:\n\n - Revert advertising the TCP MSS from the configured MTU\n\n - netlink: check sk_rcvbuf before charging the dump skb\n\n - eth:\n - ti: am65-cpts: fix support for PTP_EXTTS_REQUEST2 ioctl\n - mlx4: always create the eth and ib auxiliary devices\n - tg3: invert restart quirk logic to restrict SNP power-down bypass\n - bnxt: recycle agg buffers when Rx head buffer allocation fails\n\n Previous releases - always broken:\n\n - net: fix frag_list leak in skb_segment_list() error path\n\n - sctp: reject forged cookie peer_addr with unknown address family\n\n - vxlan: keep reserved_bits across changelink\n\n - net: limit priority VLAN untag depth\n\n - inet: frags: prevent acceptance of partially authenticated reassembly\n\n - gro: do not GRO GSO packets with inconsistent payload\n\n - tcp: avoid double destroy in tcp_abort() of an unaccepted child\"\n\n* tag \u0027net-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (137 commits)\n tun: drop batched packets while the device is down\n selftests: net: netlink-dumps: start a dump with a notification queued\n netlink: check sk_rcvbuf before charging the dump skb\n net/sched: act_ife: do not consume the inner header on egress\n openvswitch: use eth_type_trans_careful() in internal_dev_recv()\n net: use eth_type_trans_careful() in __dev_forward_skb2()\n loopback: use eth_type_trans_careful()\n net: add eth_type_trans_careful()\n tcp: initialize mapped children before route lookup\n tcp: fix reordering addition overflow in MTU probing\n tcp: avoid double destroy in tcp_abort() of an unaccepted child\n net: bgmac: fix TX DMA unmapping and slot cleanup\n gro: do not GRO GSO packets with inconsistent payload\n net/packet: check TX_RING fragments before memory accounting\n eth: bnxt: hand XDP frags over to the copybreak skb\n eth: bnxt: free XDP frags when xdp_do_redirect() fails\n eth: bnxt: don\u0027t leak buffers when XDP agg buffer allocation fails\n eth: bnxt: resize Rx head buffers when rx-copybreak changes\n eth: bnxt: recycle agg buffers when Rx head buffer allocation fails\n netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts\n ...\n" }, { "commit": "46806af187f448b0d5481f284e7c900a57ee6a6d", "tree": "4a664c1e3f24c91ad6df8b5c5e3bf2fd10b4ee1d", "parents": [ "d011f648a708b231f7ef28c18ff30c815b07fe56", "c8a8a68d3ab4a06c8f5a13a8c00275351c8239b4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:10:23 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 08:10:23 2026 -1000" }, "message": "Merge tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf\n\nPull bpf fixes from Alexei Starovoitov:\n\n - Remove BPF_F_ARENA_SCALAR flag and .arena.data section in libbpf that\n were added for rust-bpf in this merge window. We found a cleaner\n approach that does it on compiler side instead of kernel/libbpf. No\n released kernel has them (Alexei Starovoitov)\n\n - Fix bpf_send_signal_task() returning -EPERM when it is called from a\n kernel thread (Aditya Sharma)\n\n - Various fixes (Alexei Starovoitov):\n - Use emit_rsb_call() to call bpf_unwind_target() in x86 JIT to fix\n objtool warning during the build\n - Fix scalar evolution: clear delta of a widened register, don\u0027t\n widen a pointer to a buffer, don\u0027t clamp a register whose type\n changed in the loop, and reset the range of a clamped packet\n pointer\n - Finish the insn in the state that maybe_fork_scalars() splits\n off, so that pruning doesn\u0027t drop it at the head of a counted\n loop\n - Preserve the registers that carry stack arguments across\n arch_bpf_timed_may_goto() on x86-64, arm64 and riscv64\n - Don\u0027t re-sort subprog_info[] for every new subprogram\n - Fix flaky map_kptr and rcu_reentry selftests\n\n - Use memmove() in bpf_skb_load_bytes(), bpf_skb_load_bytes_relative()\n and bpf_xdp_load_bytes(), since the destination can be a slice of the\n same packet (Ayushman Rout)\n\n - Fixes and follow-ups for scalar evolution: reject pointer operands in\n 32-bit recurrences and latches, don\u0027t intersect with the current\n register range on clamp to avoid a false \u0027verifier bug\u0027, avoid false\n infinite loop reports, and recognize a 32-bit copy of the induction\n variable (Eduard Zingerman)\n\n - Fix out-of-bounds write to btf-\u003etypes[] for split BTF and propagate\n btf_add_type() errors in btf_check_all_metas() (Feng Yang)\n\n - Fix use-after-free in bpf_timer callback that fires after its inner\n map was freed (Mani Tofigh)\n\n - Fix x86 JIT stopping before jumps converge: size backward jumps by\n the insns they jump over (Mykyta Yatsenko)\n\n - Fix use-after-free of struct_ops trampoline: dissociate struct_ops\n progs before the grace period of the map (Qiliang Yuan)\n\n - Validate stack argument reads against the caller state to fix\n out-of-bounds read in the verifier, and reject callbacks with stack\n arguments (Weiming Shi)\n\n - Tie borrowed iterator results and pointers loaded from trusted fields\n to the lifetime of their source, so that iterator next, destroy and\n reference release invalidate them (Xu Yunxiang)\n\n* tag \u0027bpf-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf: (48 commits)\n bpf: Don\u0027t re-sort subprog_info[] for every new subprogram\n bpf: Fix out-of-bounds btf-\u003etypes write for split BTF\n selftests/bpf: Test stack arguments across may_goto\n bpf: Keep stack arguments in arch_bpf_timed_may_goto()\n selftests/bpf: Test maybe_fork_scalars() at the head of a counted loop\n bpf: Finish the insn in the state that maybe_fork_scalars() splits off\n selftests/bpf: Test the clamp of pointers in scalar evolution\n bpf: Reset the range of a packet pointer that scalar evolution clamps\n bpf: Don\u0027t clamp a register whose type changed in the loop\n selftests/bpf: Test a loop that moves a pointer to a buffer\n bpf: Don\u0027t widen a pointer to a buffer in scalar evolution\n selftests/bpf: Avoid a page fault in rcu_reentry while the handler is armed\n selftests/bpf: Wait for the last maps of map_kptr to be freed\n selftests/bpf: Test that a widened register is not linked\n bpf: Clear delta of a register that scalar evolution widens\n bpf, x86: Remove r0_on_stack from fetching atomics in arena\n bpf: Remove BPF_F_ARENA_SCALAR\n selftests/bpf: Remove tests for arena access through numbers\n libbpf: Keep format strings of bpf_printk() in .rodata\n libbpf: Remove .arena.data\n ...\n" }, { "commit": "d011f648a708b231f7ef28c18ff30c815b07fe56", "tree": "eb9ebe5f245eba4a999d7fd7b83914cff83afb21", "parents": [ "cb01c6914ed57a68b4f5d67f47208e24f9a45408", "78ff77ded78f2d3d6040705a3ab5a83cc45275e3" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:49:07 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:49:07 2026 -1000" }, "message": "Merge tag \u0027kthread-fix-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks\n\nPull kthread fix from Frederic Weisbecker:\n \"Fix a bug where dynamic CPU isolation through cpuset isolated\n partitions can move a kthread out of the housekeeping range.\n\n The fix makes sure the fallback affinity is always a set of online\n housekeeper\"\n\n* tag \u0027kthread-fix-for-linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/frederic/linux-dynticks:\n kthread: Fall back when no preferred housekeeping CPU is online\n" }, { "commit": "cb01c6914ed57a68b4f5d67f47208e24f9a45408", "tree": "944deb42e89d56d9f1345826a0f1e6bb27573ff7", "parents": [ "729beb5aa80ce4bcf40f9ff74ed845269393a6ae", "151235bf3d5d4de1a077a83c54ee651e074816ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:46:22 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:46:22 2026 -1000" }, "message": "Merge tag \u0027docs-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux\n\nPull more documentation updates from Jonathan Corbet:\n \"A handful of late-arriving changes, most of which were ready ahead of\n the merge window:\n\n - More Portuguese translation updates\n\n - Some docs-build and self-test fixes\n\n - Bring documentation for the user-space access primitives\n in include/linux/uaccess.h into the docs build.\n\n This revealed a number of malformed kerneldoc comments,\n which are fixed in a subsequent tweak to uaccess.h\"\n\n* tag \u0027docs-7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:\n uaccess: fix some erroneous kerneldoc comments\n docs/translations/pt_BR: admin-guide: add efi-stub.rst\n docs/translations/pt_BR: admin-guide: add kernel-parameters.rst\n docs/translations/pt_BR: admin-guide: add bootconfig.rst\n docs/translations/pt_BR: admin-guide: add perf-security.rst\n docs/translations/pt_BR: admin-guide: add LSM/index.rst\n docs/translations/pt_BR: admin-guide: add hw-vuln/index.rst\n docs/translations/pt_BR: admin-guide: add cputopology.rst\n docs/translations/pt_BR: admin-guide: add sysctl/index.rst\n docs/translations/pt_BR: admin-guide: add sysfs-rules.rst\n docs/translations/pt_BR: admin-guide: add features.rst\n docs: pt_BR: process: translate userspace debugging guide\n docs: kerneldoc.py: preserve headings in kernel-doc output\n docs: xforms_lists: Handle DECLARE_KHOSER_PTR() struct members\n docs: test_doc_build: don\u0027t select urllib3 yanked version\n docs: test_doc_build: address pylint warnings\n docs: test_doc_build: update it to support newer Sphinx versions\n docs: test_doc_build: better handle python version\n docs: admin-guide: Fix typo in kernel-parameters.txt\n docs: core-api: include documentation from linux/uaccess.h\n" }, { "commit": "729beb5aa80ce4bcf40f9ff74ed845269393a6ae", "tree": "2822444fd0b13653fa1d580d722e83702290d642", "parents": [ "2152c755f76a9170218a098f79e2b081a08b1d6c", "af4ed5682e62556beb399b76f2f1274ae1aad9e2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:38:53 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:38:53 2026 -1000" }, "message": "Merge tag \u0027sched_ext-for-7.4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n \"This is a big pull for fixes, but much of it was in the works before\n the merge window.\n\n Most of these fixes are in sub-scheduler support, which nests BPF\n schedulers under a parent that hands them CPUs. It was heavily\n reworked over recent cycles and is now functionally complete. Porting\n real schedulers on it drove the latest additions and keeps finding\n corner cases.\n\n For example, once CPUs are shared and can be taken back, the kernel\n must keep every task moving when its scheduler can\u0027t run it or is\n failing, and those fallbacks interact subtly with each other and with\n other new core features.\n\n - The fallback paths meant to keep a task moving when its scheduler\n can\u0027t run it or is failing could themselves leave it stuck\n\n - The stall watchdog could blame a scheduler for time it wasn\u0027t\n responsible for, even taking down all of sched_ext\n\n - Sub-schedulers were told late, or not at all, which CPUs they could\n use\n\n - Deferred callbacks could stay queued or be dropped under core\n scheduling and proxy execution, with a sched/core fix to the\n duplicate check\n\n - Hardening: tracing programs can no longer call kfuncs that could\n deadlock the CPU\"\n\n* tag \u0027sched_ext-for-7.4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (34 commits)\n sched_ext: Reject scx_bpf_sub_grant/revoke() in tracing programs\n sched_ext: Fix the rescue overload pick ejecting the wrong sub under bypass\n sched_ext: Fix use-after-free of a NONE rescuee leaving its sched while running\n sched_ext: Fix a lone IMMED task waiting behind a kept prev\n sched_ext: Fix queued bypassed tasks stalling when the host loses SCX_CAP_BASE\n sched_ext: Let the bypass load balancer move tasks homed on other cpus\n sched_ext: Factor out bypass_lb_move() and insert with the donor DSQ unlocked\n sched_ext: Fix the bypass load balancer stranding tasks on cpus where the host lacks SCX_CAP_BASE\n sched_ext: Fix bypassed tasks stalling when the host lacks SCX_CAP_BASE\n sched_ext: Expire prev\u0027s slice in dispatch_one() under bypass\n sched_ext: Fix a cpu idling after put_prev_task_scx() queues its task on the local DSQ\n sched_ext: Refuse extending a kernel slice\n sched_ext: Mark the rescue grant as a kernel slice with SCX_TASK_KERNEL_SLICE\n sched_ext: Fix a cpu idling with a runnable rescuee\n sched_ext: Restore a rescuee\u0027s slice after ops.stopping()\n sched_ext: Fix rescue served time disagreeing with the slice under proxy execution\n sched_ext: Move refill_task_slice_dfl() below apply_slice_vtime()\n sched_ext: Fix bypassed tasks looping on a host without SCX_CAP_ENQ\n sched_ext: Fix bypassed tasks stranded by the reenqueue limit\n sched_ext: Clear holding_cpu where the claim is confirmed\n ...\n" }, { "commit": "2152c755f76a9170218a098f79e2b081a08b1d6c", "tree": "de8d773332f39aba7ad4ac190cdfc8e5bb1e3769", "parents": [ "c339f4010dea8b0d754f84ace70cd1b089878ef8", "518cec2def9992192291f5028edc077fb2e475e9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:35:19 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Oct 29 07:35:19 2026 -1000" }, "message": "Merge tag \u0027cgroup-for-7.4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - cgroup.kill did not kill a process whose thread group leader had\n exited while other threads still ran, nor those threads once moved to\n another cgroup, letting a process survive its container being killed\n\n - A cgroup.procs write under favordynmods could migrate a newly forked\n process before fork linked it to its cgroup, corrupting cgroup task\n lists\n\n - cpuset partition fixes for nested hierarchies: invalidation, revival,\n shrinking and switches between root and isolated could leak isolated\n CPUs, skip or miscompute the housekeeping check, or leave wrong\n effective CPUs:\n\n - A root partition can no longer be created under an isolated\n parent or stay valid under one, as disabling it could leave no\n housekeeping CPUs\n\n - Enabling a partition failed when a grandchild held tasks,\n although the parent had none of its own\n\n - Separately, an allocation racing with a cpuset.mems update could\n drop its mempolicy nodemask and land on the wrong node, and a\n memoryless node in cpuset.mems triggered a spurious \"movable\n nodes only\" warning\n\n - Two no-functional-change cleanups of the effective CPU\n computation\n\n* tag \u0027cgroup-for-7.4-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup: (27 commits)\n cgroup/cpuset: Integrate compute_partition_effective_cpumask() into compute_effective_cpumask()\n cgroup/cpuset: Relocate compute_*effective_cpumask() and compute_effective_nodemask()\n cgroup/cpuset: Release invalid isolated CPUs with a shrunk root partition parent\n cgroup/cpuset: Release invalid isolated CPUs in compute_partition_effective_cpumask()\n cgroup/cpuset: Make sure compute_partition_effective_cpumask() is only called for valid partition\n cgroup/cpuset: Prevent recursive call of remote_cpus_update() via update_cpumasks_hier()\n selftests/cgroup: Check for a single range nohz_full CPUs before running test matrix\n cgroup/cpuset: Minor fixes to prstate_housekeeping_conflict()\n cgroup/cpuset: Fix incorrect effective_cpus bug in update_cpumasks_hier()\n cgroup/cpuset: Properly compute effective xcpus in update_parent_effective_cpumask()\n cgroup/cpuset: Find furthest isolated ancestor for invalidated isolated partition\n cgroup: don\u0027t kill migrated processes through their exiting threads\n cgroup/cpuset: check effective mems for a movable-only configuration\n cgroup/cpuset: Fix task checking when enabling a partition\n cgroup: serialize migrations of newly forked processes\n selftests/cgroup: test cgroup.kill with an exited thread group leader\n cgroup: fix cgroup.kill for exited thread group leader\n selftests/cgroup: Skip test_cpuset_prs.sh test if some required CPUs are offline\n selftests/cgroup: Add tests for nohz_full housekeeping check\n selftests/cgroup: Add tests for isolcpus housekeeping check\n ...\n" }, { "commit": "8f44631ba02afe9fff2f0a0fb66560ab19df87fd", "tree": "33b7d15555ef3aadfb8e856bb4785781289fcab3", "parents": [ "5bc3aaaa2d1cd1f8988ee1dceffaa8831a30c832" ], "author": { "name": "Xiao Liang", "email": "shaw.leon@gmail.com", "time": "Tue Oct 27 18:18:27 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:25:58 2026 -0700" }, "message": "tun: drop batched packets while the device is down\n\ntun_sendmsg() handles TUN_MSG_PTR batches from vhost-net by calling\ntun_xdp_one() instead of tun_get_user(). But this path does not check\nIFF_UP, allowing packets from a guest to be injected into the host\nreceive path while the device is administratively down.\n\nCheck IFF_UP in tun_xdp_one() before running XDP or building an skb.\nDrop the packet when the device is down, matching tun_get_user().\n\nFixes: 043d222f93ab (\"tuntap: accept an array of XDP buffs through sendmsg()\")\nSigned-off-by: Xiao Liang \u003cshaw.leon@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261027101830.85327-1-shaw.leon@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5bc3aaaa2d1cd1f8988ee1dceffaa8831a30c832", "tree": "917c3f1132d4d0b288c6cbbed359a3a4cdf9c099", "parents": [ "c9897252a66b43a17d04c19bc7303fd6539a56ba", "e615d0a8b20161fd470ca2748001105bcd3c44b1" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:15:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:15:51 2026 -0700" }, "message": "Merge branch \u0027netlink-fix-a-dump-livelock-with-a-notification-queued\u0027\n\nJhonata Poma-Hansen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetlink: fix a dump livelock with a notification queued\n\nA netlink dump that starts while a notification is still charged to a\nsocket with a small receive buffer fails with ENOBUFS, and every retry\nfrom recvmsg() fails the same way. A reader that peeks before reading,\nas libnl does, never consumes the message at the head of the queue and\nspins forever. I hit this with \"iw dev wlan0 scan\" on an arm64 board.\n\nPatch 1 goes back to checking sk_rcvbuf before charging the dump skb,\nas before commit ae8f160e7eb2. Patch 2 adds a selftest; it fails\nwithout patch 1 and is skipped without the privileges to create a\nnetns.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027-netlink-dump-livelock-v2-0-c4bb05352a33@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e615d0a8b20161fd470ca2748001105bcd3c44b1", "tree": "917c3f1132d4d0b288c6cbbed359a3a4cdf9c099", "parents": [ "b45d37740cfb4bdfccef3fbd9fd970fd3224438f" ], "author": { "name": "Jhonata Poma-Hansen", "email": "jhonata.poma@gmail.com", "time": "Tue Oct 27 15:04:02 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:15:16 2026 -0700" }, "message": "selftests: net: netlink-dumps: start a dump with a notification queued\n\nAdd a test which starts a link dump on a socket with SO_RCVBUF 2048\nwhile a link notification is still queued, after a large read made the\nkernel attempt large dump skbs. It reads like libnl does, peeking\nbefore each read, and expects the dump to complete with a zero status\nand at least one link. The notifications come from bringing lo up and\ndown, so the test runs in its own netns and is skipped without the\nprivileges to create one.\n\nThe test fails without the previous patch.\n\nSigned-off-by: Jhonata Poma-Hansen \u003cjhonata.poma@gmail.com\u003e\nLink: https://patch.msgid.link/20261027-netlink-dump-livelock-v2-2-c4bb05352a33@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b45d37740cfb4bdfccef3fbd9fd970fd3224438f", "tree": "6116bfef438b49b863dd85a9a923357eecd022b4", "parents": [ "c9897252a66b43a17d04c19bc7303fd6539a56ba" ], "author": { "name": "Jhonata Poma-Hansen", "email": "jhonata.poma@gmail.com", "time": "Tue Oct 27 15:04:01 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:15:16 2026 -0700" }, "message": "netlink: check sk_rcvbuf before charging the dump skb\n\nSince commit ae8f160e7eb2 (\"netlink: Fix wraparounds of\nsk-\u003esk_rmem_alloc.\"), netlink_dump() charges the dump skb first and\nqueues it only if sk_rmem_alloc is still below sk_rcvbuf. Commit\na215b5723922 (\"netlink: make sure we allow at least one dump skb\")\nadded an exception for an empty socket.\n\nA dump that starts while something else is still charged to a socket\nwith a small receive buffer fails with ENOBUFS and stays running.\nEvery recvmsg() retries it, fails again and sets sk_err, so a reader\nthat peeks before reading, as libnl does, gets ENOBUFS on the read\nafter each peek, never consumes the message at the head of the queue\nand spins forever.\n\nI hit this with \"iw dev wlan0 scan\" hanging at 100% CPU on an arm64\nboard with a 6.6 based kernel (iw 5.19 sets SO_RCVBUF to 8KiB). A\nkprobe trace showed the scan dump starting while the NEW_SCAN_RESULTS\nnotification iw had just read was still charged to its socket,\nbecause iw had preempted the sender before netlink_broadcast()\nreturned.\n\nCheck the limit before charging, as before ae8f160e7eb2, which also\ncovers the empty socket. netlink_recvmsg() continues a dump only at\nor below half of sk_rcvbuf, so the skb is then always queued, and a\ndump goes over the limit by at most one skb. Refuse a skb that would\ntake sk_rmem_alloc past INT_MAX, so the wraparound stays fixed.\n\nReproduced on net in a KVM guest with a userspace reproducer and the\nselftest in the next patch; both pass with this fix.\n\nFixes: ae8f160e7eb2 (\"netlink: Fix wraparounds of sk-\u003esk_rmem_alloc.\")\nSigned-off-by: Jhonata Poma-Hansen \u003cjhonata.poma@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261027-netlink-dump-livelock-v2-1-c4bb05352a33@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c9897252a66b43a17d04c19bc7303fd6539a56ba", "tree": "36c9d235ac934e9112cb0279ef6be6917351386c", "parents": [ "b7ff0e7a9ae3df2f123807a7e670bc348b1e1b9d", "498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:23 2026 -0700" }, "message": "Merge branch \u0027net-fix-eth_type_trans-crashes-on-skbs-coming-from-the-stack\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: fix eth_type_trans() crashes on skbs coming from the stack\n\neth_type_trans() assumes ETH_HLEN bytes are present in skb-\u003ehead.\nNIC drivers always provide this, and they should keep using the fast\nversion, without an extra pskb_may_pull().\n\nDevices looping skbs from their transmit path back to their receive\npath get skbs built by the stack instead. tc actions (act_vlan pop_eth,\nact_ife decode), BPF helpers (bpf_skb_change_head() before a redirect)\nor OVS actions (pop_eth followed by pop_mpls/pop_nsh) can leave fewer\nthan ETH_HLEN bytes in the linear part, and eth_type_trans() then hits\nthe BUG() in __skb_pull().\n\nInstead of fixing every producer, or adding a check to all\neth_type_trans() users, fix the few consumers exposed to this:\n\n- Patch 1 adds eth_type_trans_careful(), which pulls the Ethernet\n header first and returns a drop reason on failure.\n- Patch 2 uses it in loopback_xmit().\n- Patch 3 uses it in __dev_forward_skb2(), used by BPF redirects to\n ingress and by veth, macvlan, ipvlan, netdevsim and l2tp_eth.\n- Patch 4 uses it in OVS internal_dev_recv(), covering both the MPLS\n (TEB) and NSH pop cases at once (only the MPLS case was tested).\n- Patch 5 (from Jamal) fixes act_ife decode on egress, which was\n consuming the inner Ethernet header. This is no longer a crash after\n patch 2, but egress decode never delivered a correct frame.\n\nOther eth_type_trans() users already pull the header or never see\nsuch skbs:\n- vrf_process_v{4,6}_outbound() already pull ETH_HLEN + IP header\n before vrf_local_xmit().\n- tun already uses pskb_may_pull_reason(skb, ETH_HLEN).\n- XDP: bpf_xdp_adjust_head() and bpf_xdp_adjust_tail() keep at least\n ETH_HLEN bytes in the linear part, and multi-buffer tail shrinking\n only trims frags.\n\nTested under virtme-ng with AF_PACKET reproducers. Without the series,\nall four cases crash in eth_type_trans():\n- lo egress \"action vlan pop_eth\", eth/eth/8192 bytes frame\n- lo egress \"action ife decode pipe\", IFE frame with 8192 bytes payload\n- lo egress \"action vlan pop_eth continue\", then a BPF program doing\n bpf_skb_change_head(skb, 1, 0) + bpf_redirect(veth1, BPF_F_INGRESS)\n- OVS flow \"pop_eth,pop_mpls(0x6558),0\" to the internal port,\n eth/mpls/eth/4096 bytes frame\nWith the series, no crash. An ICMP echo inside an IFE frame decoded\non lo egress is now received and answered. Normal traffic on lo,\nveth (including 8000 byte pings) and vrf is unchanged.\n\nLink: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/\nLink: https://lore.kernel.org/netdev/ACT-N6N4.v3.r0.20261023200137-4@mojatatu.com/\nv1: https://lore.kernel.org/netdev/20261027082604.1485903-1-edumazet@kernel.org/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261028122703.2093730-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "498c631f9c6d74aad4bf43039fa3ce70ae9a8bb7", "tree": "36c9d235ac934e9112cb0279ef6be6917351386c", "parents": [ "b55e5a0159c8f53edefcb7848d95eb93db37bce1" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Wed Oct 28 13:27:03 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:21 2026 -0700" }, "message": "net/sched: act_ife: do not consume the inner header on egress\n\nThe issue:\ntcf_ife_decode() unconditionally calls eth_type_trans(), which pulls\nETH_HLEN. On egress this consumes the inner Ethernet header, and the\ndevice receives an skb whose data points to the L3 header:\n\n- loopback_xmit() parses L3 data as Ethernet: the \"ethertype\" comes\n from the inner IPv4 source address, and the decapsulated packet is\n dropped or misparsed.\n- a real NIC transmits the frame without its Ethernet header.\n\n(The __skb_pull() BUG this used to trigger in loopback_xmit() when the\nremaining linear area was short is handled by \"loopback: use\neth_type_trans_careful()\".)\n\nThe Fix:\nParse the inner Ethernet header with eth_type_trans() in both directions,\nthen restore the egress data position and MAC length. On ingress the\nexisting behavior is unchanged. On egress, push the inner Ethernet header\nback after parsing so the xmit path sees the original frame and later\nactions see a consistent network header.\n\nConditions to recreate the bug:\n- egress tc filter on lo: action ife decode pipe;\n- AF_PACKET SOCK_RAW frame: outer Ethernet with ETH_P_IFE, IFE metadata,\n inner Ethernet + a valid IPv4 ICMP echo request to a local address;\n- before this patch, no echo is received; after it, the echo is\n delivered and answered.\n\nFixes: ef6980b6becb (\"introduce IFE action\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\n[edumazet: reworded changelog, the crash is now handled in loopback]\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20261028122703.2093730-6-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b55e5a0159c8f53edefcb7848d95eb93db37bce1", "tree": "cb9357150b5fede8c4be3d44c1a17c4aad7ed365", "parents": [ "695e1408eb908ac7acf78069933201f92b95727c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 28 13:27:02 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:21 2026 -0700" }, "message": "openvswitch: use eth_type_trans_careful() in internal_dev_recv()\n\nOVS actions like pop_eth followed by pop_mpls(ETH_P_TEB) or pop_nsh\ncan expose an inner Ethernet header which is not in the linear part\nof the skb. Output to an internal port then crashes in eth_type_trans():\n\n flow: in_port(0),eth(),eth_type(0x8847),mpls(lse\u003d0x00010140)\n actions: pop_eth,pop_mpls(0x6558),0\n # AF_PACKET SOCK_RAW on dp0: eth / mpls / eth / 4096 bytes of payload\n\n kernel BUG at include/linux/skbuff.h:2839!\n RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)\n Call Trace:\n internal_dev_recv (net/openvswitch/vport-internal_dev.c:202) openvswitch\n do_execute_actions (net/openvswitch/actions.c:1296) openvswitch\n ovs_execute_actions (net/openvswitch/actions.c:1606) openvswitch\n ovs_dp_process_packet (net/openvswitch/datapath.c:310) openvswitch\n ovs_vport_receive (net/openvswitch/vport.c:448) openvswitch\n internal_dev_xmit (net/openvswitch/vport-internal_dev.c:42) openvswitch\n dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)\n __dev_queue_xmit (net/core/dev.c:5066)\n packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)\n\nUse eth_type_trans_careful(), and drop the packet if the Ethernet\nheader can not be pulled. This covers all OVS actions at the consumer,\ninstead of fixing each producer.\n\nFixes: b2d0f5d5dc53 (\"openvswitch: enable NSH support\")\nFixes: f66b53fdbb22 (\"openvswitch: New MPLS actions for layer 2 tunnelling\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261028122703.2093730-5-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "695e1408eb908ac7acf78069933201f92b95727c", "tree": "5062298ddd6324074fc5c8e372c998ae2cb2a5fb", "parents": [ "093a28998374f4007ffe67cc661f8192c1b062a9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 28 13:27:01 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:20 2026 -0700" }, "message": "net: use eth_type_trans_careful() in __dev_forward_skb2()\n\nA tc egress BPF program can push a tiny link-layer header with\nbpf_skb_change_head() on an skb whose head is almost empty, then\nredirect it to an Ethernet device ingress. __bpf_redirect_common()\nonly checks mac_header \u003c network_header, and __dev_forward_skb2()\ncrashes in eth_type_trans():\n\n tc filter add dev lo egress pref 1 matchall action vlan pop_eth continue\n tc filter add dev lo egress pref 2 bpf da obj prog.o\n # prog: bpf_skb_change_head(skb, 1, 0);\n # return bpf_redirect(veth1_ifindex, BPF_F_INGRESS);\n # AF_PACKET SOCK_RAW on lo: eth / eth / 8192 bytes of payload\n\n kernel BUG at include/linux/skbuff.h:2839!\n RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)\n Call Trace:\n __dev_forward_skb2 (net/core/dev.c:2507)\n dev_forward_skb_nomtu (net/core/dev.c:2546)\n __dev_queue_xmit (net/core/dev.c:4738 net/core/dev.c:4998)\n packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)\n\nUse eth_type_trans_careful(), and drop the packet if the Ethernet\nheader can not be pulled. This also covers other dev_forward_skb()\nusers (veth, macvlan, ipvlan, netdevsim, l2tp_eth).\n\nUpdate the empty_skb BPF selftest: at lwt_xmit, BPF_PROG_TEST_RUN\nstrips the Ethernet header, so the \"veth ETH_HLEN+1\" packet is a 1-byte\nskb. Redirecting it to veth ingress used to read the Ethernet header\npast skb-\u003etail and deliver a 1-byte frame; it is now dropped with\nNET_RX_DROP, as veth_xmit() already does at egress.\n\nFixes: 3a0af8fd61f9 (\"bpf: BPF for lightweight tunnel infrastructure\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261028122703.2093730-4-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "093a28998374f4007ffe67cc661f8192c1b062a9", "tree": "a1f6866ae81c7102ea0644025384cd05ccd4555c", "parents": [ "2519a6fe7a8bba57a961eb804e43e7df35ac40fe" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 28 13:27:00 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:20 2026 -0700" }, "message": "loopback: use eth_type_trans_careful()\n\ntc egress actions can leave an skb with fewer than ETH_HLEN bytes in\nits linear part. loopback_xmit() then crashes in eth_type_trans():\n\n tc qdisc add dev lo clsact\n tc filter add dev lo egress matchall action vlan pop_eth\n # AF_PACKET SOCK_RAW: eth / eth / 8192 bytes of payload\n\n kernel BUG at include/linux/skbuff.h:2839!\n RIP: 0010:eth_type_trans (include/linux/etherdevice.h:635 net/ethernet/eth.c:163)\n Call Trace:\n loopback_xmit (drivers/net/loopback.c:87)\n dev_hard_start_xmit (include/linux/netdevice.h:5455 include/linux/netdevice.h:5464 net/core/dev.c:4057 net/core/dev.c:4073)\n __dev_queue_xmit (net/core/dev.c:5066)\n packet_sendmsg (net/packet/af_packet.c:3157 net/packet/af_packet.c:3189)\n\nThe same happens with \"action ife decode\" on lo egress.\n\nUse eth_type_trans_careful(), and drop the packet if the Ethernet\nheader can not be pulled.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nLink: https://lore.kernel.org/netdev/20261005052249.1914367-2-weir@nebusec.ai/\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261028122703.2093730-3-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2519a6fe7a8bba57a961eb804e43e7df35ac40fe", "tree": "52d75d1b71235d40cd2f0ed9387028e99f9f1607", "parents": [ "b7ff0e7a9ae3df2f123807a7e670bc348b1e1b9d" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Wed Oct 28 13:26:59 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:11:20 2026 -0700" }, "message": "net: add eth_type_trans_careful()\n\neth_type_trans() assumes ETH_HLEN bytes are present in skb-\u003ehead.\nNIC drivers always provide this, and they should keep using the fast\nversion.\n\nDevices looping skbs from their transmit path back to their receive\npath get skbs built by the stack instead. Their link-layer header\nmight have been popped by tc actions (act_vlan pop_eth, act_ife decode)\nor OVS actions (pop_eth + pop_mpls / pop_nsh), leaving fewer than\nETH_HLEN bytes in the linear part. eth_type_trans() then hits\nthe BUG() in __skb_pull().\n\nAdd eth_type_trans_careful(), which first pulls the Ethernet header,\nand returns a drop reason on failure, so that the few devices exposed\nto this can drop such packets.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nAcked-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20261028122703.2093730-2-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7ff0e7a9ae3df2f123807a7e670bc348b1e1b9d", "tree": "212f0d61bae3846c3801f44a5e4b601c871a8d55", "parents": [ "c1df9c0c0536393de43310f84ca4f8b217271a00" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 28 16:41:01 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:06:24 2026 -0700" }, "message": "tcp: initialize mapped children before route lookup\n\nIPv4 passive opens on a dual-stack listener go through\ntcp_v4_syn_recv_sock() with tcp_v6_mapped_child_init() as the optional\ninitializer. The callback currently runs after the output route lookup.\nIf that lookup fails, tcp_done() destroys a clone whose pinet6 and\nipv6_fl_list still refer to the listener\u0027s state.\n\nWith the flowlabel list head in inet_sock, fl6_free_socklist() walks\nthe clone\u0027s list and RCU-frees its nodes without unlinking them from the\nlive listener. Subsequent flowlabel operations can use or free the nodes\nagain. Commit 858d2a4f67ff (\"tcp: fix potential race in\ntcp_v6_syn_recv_sock()\") moved the initializer before ehash insertion,\nbut did not cover this error path.\n\nInvoke the existing initializer after the IPv4 fields it consumes have\nbeen set, but before route lookup can fail. It needs neither the\ndestination nor sk_setup_caps(), and all later disposal paths remain\ncovered.\n\nFixes: 1c17f4373d4d (\"ipv6: Move ipv6_fl_list from ipv6_pinfo to inet_sock.\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261028154101.2153360-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c1df9c0c0536393de43310f84ca4f8b217271a00", "tree": "14d0bdadf431f89315bcc85319d2dc3ea099d92f", "parents": [ "dbd62ad55a4c898f5a4c9edb20c0c062afb799df" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 28 17:02:26 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:05:15 2026 -0700" }, "message": "tcp: fix reordering addition overflow in MTU probing\n\nCommit efb8763d7bbb (\"net: ipv4: bound TCP reordering sysctl writes and\nMTU probe sizes\") widened size_needed and the MSS multiplication, but\ntp-\u003ereordering + 1 is still evaluated as u32. RTAX_REORDERING accepts\nan unrestricted u32, and tcp_init_metrics() can install U32_MAX.\n\nIn that case the extra-data requirement becomes zero. A write queue\nwith probe_size - 1 data bytes and a FIN satisfies the sequence-space\ncheck. The coalescing walk can pass the queue head to\ntcp_skb_can_collapse(), and tcp_clone_payload() can produce an skb\nwhose advertised payload exceeds the data in its fragments. Local\ndelivery followed by TCP_ZEROCOPY_RECEIVE can then walk beyond the\nfragment array. KASAN reports a slab-out-of-bounds read in\ncan_map_frag().\n\nCast reordering before incrementing it so the arithmetic handles the\nentire u32 metric range. For U32_MAX, the required size exceeds the\n32-bit queue and window limits, so the existing checks skip the probe.\nThe calculation is unchanged for all other reordering values.\n\nFixes: efb8763d7bbb (\"net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes\")\nCc: stable@vger.kernel.org\nCc: Wyatt Feng \u003cbronzed_45_vested@icloud.com\u003e\nCc: Ren Wei \u003cn05ec@lzu.edu.cn\u003e\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261028160226.2170244-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dbd62ad55a4c898f5a4c9edb20c0c062afb799df", "tree": "cb7142bf7058d59b712482c122b44dd5803ea53a", "parents": [ "4f45e97b3aac2282f2b436d97338c9c2c484d093" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 28 17:08:47 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:03:51 2026 -0700" }, "message": "tcp: avoid double destroy in tcp_abort() of an unaccepted child\n\ntcp_abort() checks for TCP_CLOSE while only owning the socket lock,\nthen grabs the BH lock before calling tcp_done_with_error().\n\nFor a child still sitting in a listener accept queue (which can be\nreached via SOCK_DESTROY or bpf_sock_destroy()), inet_csk_listen_stop()\ncan run in this window: it only holds the child BH lock, and calls\ninet_child_forget(), which disconnects, orphans and destroys the child.\n\ntcp_abort() then calls tcp_done_with_error() -\u003e tcp_done(), which sees\nSOCK_DEAD and calls inet_csk_destroy_sock() a second time, leading to\na double sock_put() and a use-after-free.\n\nRecheck TCP_CLOSE after acquiring the BH lock, unless we just closed\na listener ourselves, in which case tcp_done_with_error() must still\nrun to report the error.\n\nNote that the WARN_ON(sock_owned_by_user(child)) in\ninet_csk_listen_stop() can still trigger in this window.\n\nFixes: bac76cf89816 (\"tcp: fix forever orphan socket caused by tcp_abort\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\n[edumazet: recheck TCP_CLOSE under the BH lock instead of moving the test, smaller diff]\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261028160847.2170959-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f45e97b3aac2282f2b436d97338c9c2c484d093", "tree": "e6bf315a647c2f4b7f22f41bce15508093c9e814", "parents": [ "de788d8a7032475f900c16e9cc0c1417f4f719eb" ], "author": { "name": "Rosen Penev", "email": "rosenp@gmail.com", "time": "Wed Oct 28 09:48:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:01:39 2026 -0700" }, "message": "net: bgmac: fix TX DMA unmapping and slot cleanup\n\nWhen mapping a fragment fails, bgmac_dma_tx_add() unwinds with the\nwrong slots. It passes the failed fragment\u0027s slot-\u003edma_addr, which\nholds the mapping error, to dma_unmap_single() for the head. The\nfragment loop indexes from ring-\u003eend instead of ring-\u003eend + 1, so it\nunmaps the head a second time as a page and leaves the last mapped\nfragment mapped. None of the affected slots get their dma_addr cleared\neither, which includes the head slot when mapping the head fails.\n\nbgmac_dma_tx_ring_free() unmaps every slot with a non-zero dma_addr,\nso tearing down the ring unmaps these addresses again. It also frees\nthe skbs of pending TX slots but leaves slot-\u003eskb and slot-\u003edma_addr\nset. The slots survive a down/up cycle, and bgmac_dma_tx_add() only\nsets slot-\u003eskb on the last slot of a packet. If a slot with a stale\npointer is later used for the head or a fragment of a scatter/gather\npacket, bgmac_dma_tx_free() frees the old skb a second time when that\nslot completes.\n\nbgmac_dma_tx_ring_free() also picks dma_unmap_single() or\ndma_unmap_page() by looking at slot-\u003eskb, which is set on the last slot\nof a packet, while the head was mapped with dma_map_single() and the\nfragments with skb_frag_dma_map().\n\nIn the error path, unmap the head and each mapped fragment from their\nown slots, and clear dma_addr on every slot the failed packet touched.\nIn bgmac_dma_tx_ring_free(), choose the unmap function by the SOF flag\nof the descriptor like bgmac_dma_tx_free() does, unmap every slot\nbefore freeing any skb, since a packet can wrap around the end of the\nring with its skb on the last slot, and clear both fields.\n\nThis was found through code inspection by an LLM while hitting other\nbugs on an Asus RT-N16. It did not hit these ones specifically.\n\nFixes: 9cde94506eac (\"bgmac: implement scatter/gather support\")\nSigned-off-by: Rosen Penev \u003crosenp@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20261028164839.28605-1-rosenp@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "de788d8a7032475f900c16e9cc0c1417f4f719eb", "tree": "94268e9a16470ee8194995d4cb9b9bd5a5e51a5d", "parents": [ "dc4dd12f80e499dc034710cd8195489abcf0b059" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 28 18:13:50 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 09:01:11 2026 -0700" }, "message": "gro: do not GRO GSO packets with inconsistent payload\n\ntcp_gro_receive() excludes empty non-GSO packets with the unsigned\nlen - 1 check, but its GSO branch only checks that gso_size matches\nthe held packet\u0027s MSS. A trusted TCP GSO skb can reach GRO again with\nno payload after TC pedit increases its TCP data offset.\n\nIf the skb is fully linear, skb_gro_receive() then enters its fragment\ntransfer path with nr_frags \u003d\u003d 0. The do-while loop copies skb_frag_t\nentries backwards beyond both fragment arrays. An unprivileged process\nusing its own user and network namespaces can trigger a KASAN\nslab-out-of-bounds write and panic through veth, pedit and GRE.\n\nMore generally, the payload of such a packet can be shrunk to any\nvalue, making it inconsistent with its gso_segs, and a GSO packet\nwith gso_segs \u003d\u003d 0 contributes no segment to the GRO packet.\n\nDo not aggregate GSO packets with gso_segs \u003d\u003d 0, and require the\npayload of GSO packets to be consistent with gso_segs and gso_size,\nthe last segment being allowed to be short. This rejects the empty\nskb before either TCP merge helper, and covers both IPv4 and IPv6.\n\nFixes: 5eddb24901ee (\"gro: add support of (hw)gro packets to gro stack\")\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\n[edumazet: check payload against gso_segs, refuse gso_segs \u003d\u003d 0]\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261028171350.2205175-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc4dd12f80e499dc034710cd8195489abcf0b059", "tree": "259c00e1fd0aeb560456768838656a2f3a181cc6", "parents": [ "59e72644a7e697fdaf3494e8df8af9ab2b2ba31d" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Wed Oct 28 19:14:50 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:58:08 2026 -0700" }, "message": "net/packet: check TX_RING fragments before memory accounting\n\ntpacket_fill_skb() adds the full non-linear payload length to\nskb-\u003etruesize and sk_wmem_alloc before checking MAX_SKB_FRAGS. With\nPACKET_VNET_HDR, userspace can submit a ring-sized frame even when it\ngreatly exceeds the device MTU.\n\nA near-INT_MAX frame can saturate sk_wmem_alloc before the fragment\nloop rejects it. A subsequent refcount_add(0x40000001) can temporarily\nturn REFCOUNT_SATURATED into 1. A concurrent TX completion can then\ndrop that apparent last reference and free the still-live packet\nsocket before refcount_warn_saturate() restores the counter.\n\nCheck that the remaining payload fits in MAX_SKB_FRAGS pages before\naccounting it. Include the initial page offset in the calculation,\nand move the existing -EFAULT handling out of the fragment loop.\nThis preserves the accepted packet sizes and error code while\npreventing an invalid frame from injecting an oversized byte charge.\n\nFixes: 69e3c75f4d54 (\"net: TX_RING and packet mmap\")\nCc: stable@vger.kernel.org\nCc: Willem de Bruijn \u003cwillemdebruijn.kernel@gmail.com\u003e\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\n[edumazet: use net_warn_ratelimited() instead of pr_err(), add a Fixes: tag]\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261028181450.2221013-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "59e72644a7e697fdaf3494e8df8af9ab2b2ba31d", "tree": "96f737459fef9a49774314746cb1a3330dfbb4ca", "parents": [ "fd0909e963ed8f36967bd072ed484be7babe46de", "364b88b54fc260d22ee318bae862c2d7d8c31dc6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:50:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:50:27 2026 -0700" }, "message": "Merge branch \u0027eth-bnxt-fix-rx-buffer-leaks-under-oom\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\neth: bnxt: fix Rx buffer leaks under OOM\n\nCommit bd3beb5c8691 (\"eth: bnxt: disable rx-copybreak by default\")\nchanged the defaults putting users on buggy(ier) driver paths.\n\nFix various ways bnxt may leak buffers under OOM. The first patch\nfixes the real bug that was hit in production. Second patch fixes\nan issue I hit while testing the first one. The next 3 patches\nfix other Rx buffer leaks pointed out by an LLM during review.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027234940.1267225-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "364b88b54fc260d22ee318bae862c2d7d8c31dc6", "tree": "96f737459fef9a49774314746cb1a3330dfbb4ca", "parents": [ "c10f3420d59859df107838aa97b49357616d9b47" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 27 16:49:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:49:32 2026 -0700" }, "message": "eth: bnxt: hand XDP frags over to the copybreak skb\n\nWith a multi-buffer XDP program attached, a packet only has agg\nbuffers if it filled its head buffer, which in page mode holds most\nof a page. The program can still move the start of the packet forward\nwith bpf_xdp_adjust_head() and leave at most rx_copybreak bytes in the\nhead. bnxt_rx_pkt() then copies the head into a new skb, puts the head\npage back on the ring, and calls bnxt_xdp_build_skb() on the copy.\nbnxt_xdp_build_skb() only sets nr_frags and the skb\u0027s length\naccounting, because it expects an skb built around the head page,\nsharing its shinfo with the xdp_buff. The copy ends up with nr_frags\nset but no frag descriptors, and the stack later reads and releases\nwhatever its frags array happens to contain. The real frags leak.\n\nCopy the frag descriptors to the new skb in bnxt_copy_xdp(), so that\nbnxt_xdp_build_skb() finds the frags where it expects them. The frags\nnow belong to the skb, and the head page goes back on the ring as\nbefore.\n\nPointed out in LLM review of the first patch of the series.\nConfirmed by reading the code, the unfixed kernel was not run with\nthe reproducer below.\nTested on a BCM57504 at MTU 9000 with rx-copybreak raised to 1024\nand a frags-capable XDP program moving the start of multi-buffer\nframes 3000B forward with bpf_xdp_adjust_head(), receiving 8000B\nICMPv6 echo requests (a head and two agg buffers each). All 60k\nframes took the copybreak path with frags attached, the sampled skbs\nreached GRO with len\u003d4998 data_len\u003d4492 nr_frags\u003d2, and were freed by\nthe stack with the page pools\u0027 inflight count staying flat, no KASAN\nor DEBUG_PAGEALLOC splats.\n\nFixes: 1dc4c557bfed (\"bnxt: adding bnxt_xdp_build_skb to build skb from multibuffer xdp_buff\")\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261027234940.1267225-6-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c10f3420d59859df107838aa97b49357616d9b47", "tree": "afa2b73a282bf37bad79d35a96de562072066c64", "parents": [ "1b2f02fb4ba92d01603c8261c94be8d348de65b0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 27 16:49:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:49:32 2026 -0700" }, "message": "eth: bnxt: free XDP frags when xdp_do_redirect() fails\n\nWhen xdp_do_redirect() fails bnxt_rx_xdp() recycles the head page but\nnot the frags of a multi-buffer frame. Their agg ring slots have\nalready been refilled, so the pages leak, and the page pool can\u0027t be\ndestroyed until they are returned, which will never happen. Redirect\nto an AF_XDP socket in copy mode fails this way with -ENOMEM whenever\nthe socket\u0027s fill ring runs out of buffers.\nA socket bound without XDP_USE_SG also fails with -ENOSPC for every\nframe that doesn\u0027t fit in a single chunk.\n\nAll the other drop paths in this function free the frags.\n\nPointed out in LLM review of the first patch of the series.\nTested on a BCM57504 at MTU 9000 by redirecting 60k 8000B ICMPv6\necho requests (a head and two agg buffers each) to lo, which can\u0027t\ntransmit XDP frames. The page pools\u0027 inflight count stayed flat\nrather than growing by two pages per frame.\n\nFixes: a7559bc8c17c (\"bnxt: support transmit and free of aggregation buffers\")\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261027234940.1267225-5-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1b2f02fb4ba92d01603c8261c94be8d348de65b0", "tree": "7f00974e4597cce7964beaa2791abbca5549f121", "parents": [ "09f10efee6f93863ea71489ce84563f4d51787f6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 27 16:49:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:49:32 2026 -0700" }, "message": "eth: bnxt: don\u0027t leak buffers when XDP agg buffer allocation fails\n\nIf a replacement agg buffer can\u0027t be allocated for a packet received\nwith XDP attached, bnxt_rx_pkt() drops the packet without returning\nits head buffer to the ring. The head buffer leaks, and since rx_prod\nstill advances, the device gets a BD with a stale DMA address which\npoints at a buffer the driver no longer owns. When that BD completes\nthe driver finds no buffer in the slot.\n\nThe agg buffers consumed before the failing one have already been\nreplaced on the agg ring, they are referenced only by the frags of\nthe xdp_buff, which nobody frees. bnxt_xdp_buff_frags_free() would\nskip them since the frags flag is set only on success, so set it\nupfront.\n\nPointed out in LLM review of the first patch of the series.\nTested on a BCM57504 at MTU 9000 with a frags-capable XDP_PASS\nprogram, receiving 8000B ICMPv6 echo requests (a head and two agg\nbuffers each) while page_pool_alloc_netmems() called from\nbnxt_rx_agg_netmems_xdp() failed half of the time (bpftrace\noverride()). 44.7k packets were dropped, the page pools\u0027 inflight\ncount stayed flat and there were no KASAN or DEBUG_PAGEALLOC splats.\n\nFixes: 4c6c123c9af9 (\"bnxt: adding bnxt_rx_agg_pages_xdp for aggregated xdp\")\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261027234940.1267225-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "09f10efee6f93863ea71489ce84563f4d51787f6", "tree": "ad8fbc3bb9ff5657a68114123245f19ceb235921", "parents": [ "db2c610df81e34d497f49b68a0a1681c3f203bdb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 27 16:49:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:49:31 2026 -0700" }, "message": "eth: bnxt: resize Rx head buffers when rx-copybreak changes\n\nSince rx-copybreak became configurable, bnxt_set_ring_params() sizes\nthe head buffers to fit at least rx_copybreak bytes, and the copybreak\npath in bnxt_copy_data() syncs rx_copybreak bytes of the head buffer.\nbnxt_set_tunable() however only updates bp-\u003erx_copybreak, and nothing\non the open path recalculates the ring parameters. After raising\nrx-copybreak the head buffers keep their old size until some other\nsetting changes, and bnxt_copy_data() syncs past their end, into the\nnext buffer in the page or past the end of the page:\n\n DMA-API: bnxt_en 0000:01:00.0: device driver tries to sync DMA memory it has not allocated [device address\u003d0x00000002aa210c40] [size\u003d1024 bytes]\n WARNING: kernel/dma/debug.c:1162 at check_sync+0x577/0x1eb0, CPU#22: swapper/22/0\n Call Trace:\n \u003cIRQ\u003e\n debug_dma_sync_single_for_cpu+0x66/0x90\n bnxt_copy_data+0x12f/0x290\n bnxt_rx_pkt+0x24ea/0x50f0\n __bnxt_poll_work+0x42c/0xc00\n bnxt_poll_p5+0x579/0x17a0\n __napi_poll+0x8b/0x2c0\n net_rx_action+0x58f/0xbb0\n\nHere the head buffers were still sized for the 640B HDS threshold,\nfour 1kB buffers per page, while rx-copybreak was raised to 1024.\nWithout coherent DMA or with swiotlb the oversized sync can corrupt\na neighboring buffer owned by the device or by an skb.\n\nThe device must be down for rx-copybreak to change, so recalculate the\nring parameters right away, like bnxt_set_ringparam() does.\n\nHit while testing patch 1, tested on BCM57504 - boot; set rx-copybreak\nto 1024 with the link down (CONFIG_DMA_API_DEBUG); ifup.\n\nFixes: 152f4da05aee (\"bnxt_en: add support for rx-copybreak ethtool command\")\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261027234940.1267225-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "db2c610df81e34d497f49b68a0a1681c3f203bdb", "tree": "9cad93e8a656ef5588cd44cb8d4da1cf9a4c62b4", "parents": [ "fd0909e963ed8f36967bd072ed484be7babe46de" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 27 16:49:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:49:31 2026 -0700" }, "message": "eth: bnxt: recycle agg buffers when Rx head buffer allocation fails\n\nbnxt_rx_pkt() tries to return the aggregation buffers of a packet\nto the ring when the copybreak allocation fails, but the same logic\nis missing on the rx_skb_func() failure path. The agg BDs consumed\nby the device are then never posted again. The agg ring is only\nrefilled one-for-one as completions consume its buffers, so each\nsuch failure permanently shrinks it. Under sustained memory pressure\nthe ring drains completely, and the queue stops receiving anything\nthat does not fit into the head buffer, even once memory is available\nagain. Only re-creating the rings (e.g. ifdown / ifup) recovers it.\n\nCommit 296d5b541639 (\"bnxt_en: Fix aggregation buffer leak under OOM\ncondition.\") fixed the copybreak path only. Recently\ncommit bd3beb5c8691 (\"eth: bnxt: disable rx-copybreak by default\")\nmade the non-copybreak path the default, re-surfacing the issue.\n\nWith XDP, the agg buffers are attached to the xdp_buff as frags by\nthis point. Their agg ring slots have already been refilled.\nWe need to keep the original head page (and therefore shinfo)\naround until the xdp_buff cleanup.\n\nNote the odd split of ownership here: rx_skb_func() only deals with\nthe head buffer, the agg buffers stay with the caller in whatever\nstate they are in, still on the ring without XDP, or frags of the\nxdp_buff with XDP. This complicates rx_skb_func() cleaning up all\nthe buffers (head and frags), which would be more intuitive.\n\nDiscovered in production, severe packet loss would persist after\na transient OOM event. Tested on a BCM57504 by failing the head\nbuffer allocations in bnxt_rx_skb() (bpftrace override() of\nshould_failslab() and should_fail_alloc_page()) while receiving\n1400B ICMPv6 echo requests. 341k packets were dropped on that queue,\nenough to drain its 8188 entry agg ring 40 times over, and the queue\nkept receiving large frames afterwards with no loss and no new HW drops.\nWith a frags-capable XDP_PASS program at MTU 9000, receiving 8000B\nICMPv6 echo requests while napi_build_skb() called from\nbnxt_rx_multi_page_skb() failed, 9.2k packets were dropped,\nthe page pools\u0027 inflight count stayed flat and\nthere were no KASAN or DEBUG_PAGEALLOC splats.\n\nFixes: c0c050c58d84 (\"bnxt_en: New Broadcom ethernet driver.\")\nFixes: 4c6c123c9af9 (\"bnxt: adding bnxt_rx_agg_pages_xdp for aggregated xdp\")\nReviewed-by: Michael Chan \u003cmichael.chan@broadcom.com\u003e\nLink: https://patch.msgid.link/20261027234940.1267225-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd0909e963ed8f36967bd072ed484be7babe46de", "tree": "dbc15442e65e2dfcbecf7e3bf2088aeb28c231b8", "parents": [ "dda51b73721684637ab8e9bd97c78228b99c4bd2" ], "author": { "name": "Naman Gulati", "email": "namangulati@google.com", "time": "Mon Oct 26 22:13:06 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Oct 29 08:43:12 2026 -0700" }, "message": "netdev-genl: ignore NETDEV_UNREGISTER rebroadcasts\n\nnetdev_wait_allrefs_any() re-sends NETDEV_UNREGISTER every second while\nit waits for the last references on a device to be dropped. By then\nnetdev_run_todo() has already marked the device NETREG_UNREGISTERED and\nRTNL has been dropped at least once since the initial notification sent\nby unregister_netdevice_many_notify().\n\nnetdev_genl_netdevice_event() does not tell these rebroadcasts apart\nfrom the initial notification and sends a NETDEV_CMD_DEV_DEL_NTF\nmulticast for each of them. At best this spams NETDEV_NLGRP_MGMT\nlisteners with duplicate notifications; at worst the pernet state of\nthe netns the device belongs to is already gone and the handler\ndereferences a NULL pointer.\n\ndefault_device_exit_batch() only unregisters the devices still listed\nin the exiting netns; it does not wait for in-flight unregistrations of\ndevices that were already unlisted (the barrier doing that was removed\nby commit 8a4fc54b07d7 (\"net: get rid of rtnl_lock_unregistering()\")).\nSo when a device is unregistered by something other than the\ncleanup_net() of its own netns while references on it are still held,\ne.g. a veth whose peer in another netns gets deleted, and that netns\nexits while the device is stuck in netdev_wait_allrefs_any(), the\nremaining pernet exit handlers run and genl_pernet_exit() sets\nnet-\u003egenl_sock to NULL. The next rebroadcast then crashes in\ngenl_has_listeners():\n\n BUG: KASAN: null-ptr-deref in netlink_has_listeners+0x3d/0x3f0 net/netlink/af_netlink.c:1388\n Read of size 8 at addr 0000000000000578 by task syz.0.0/5325\n Call Trace:\n \u003cTASK\u003e\n netlink_has_listeners+0x3d/0x3f0 net/netlink/af_netlink.c:1388\n genl_has_listeners include/net/genetlink.h:644 [inline]\n netdev_genl_dev_notify+0x161/0x450 net/core/netdev-genl.c:93\n netdev_genl_netdevice_event+0x98/0x3c0 net/core/netdev-genl.c:1491\n notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85\n netdev_wait_allrefs_any net/core/dev.c:11690 [inline]\n netdev_run_todo+0x731/0x1060 net/core/dev.c:11808\n rtnl_unlock net/core/rtnetlink.c:157 [inline]\n rtnl_dellink+0x68f/0x810 net/core/rtnetlink.c:3707\n\nsyzbot hit this by moving one end of a veth pair into a short-lived\nnetns while netdevsim\u0027s deferred FIB event processing still held a\nreference on it, and then deleting the other end (repro [1]). While the\nsource of this bug is netdevsim deferring FIB processing for and holding\nonto the device reference for O(seconds) which is being fixed\nseparately [2], any driver may introduce such a delay and trigger the\nnull-ptr-deref.\n\nSkip the rebroadcasts, which are the only NETDEV_UNREGISTER events\ndelivered with reg_state \u003d\u003d NETREG_UNREGISTERED. The notifications sent\nby unregister_netdevice_many_notify() and, for a device leaving a netns,\nby __dev_change_net_namespace() are issued under RTNL in the same\ncritical section that unlists the device, before its netns can be torn\ndown, and keep being handled. This mirrors what ip6_route_dev_notify()\nalready does to cope with the rebroadcasts.\n\nThis change should not break the UAPI spec as it defines dev-del-ntf as\na \"Notification about device disappearing.\" which is a single event. The\nrebroadcast in netdev_wait_allrefs_any() exists to re-kick in-kernel\nsubsystems holding references; netdev-genl happens to be on the notifier\nchain and forwards it.\n\n[1] https://gist.github.com/NamanGulati/2d1b49b8757f9a88b0bd6e55018c02ae\n[2] https://lore.kernel.org/r/20261023191517.607834-1-kuniyu@google.com\n\nFixes: d3d854fd6a1d (\"netdev-genl: create a simple family for netdev stuff\")\nReported-by: syzbot+1269fe6cc2016008124e@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6adf9f64.6200f071.51519.0ed1.GAE@google.com/\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nSigned-off-by: Naman Gulati \u003cnamangulati@google.com\u003e\nLink: https://patch.msgid.link/20261026221306.3151025-1-namangulati@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dda51b73721684637ab8e9bd97c78228b99c4bd2", "tree": "2edb1f1ebdcd21a033d660964d8342dc3ae1a00b", "parents": [ "8daacee78b3d2798fcf92398b6dff364eab64466" ], "author": { "name": "Zhiling Zou", "email": "zhilinz@nebusec.ai", "time": "Tue Oct 27 12:46:49 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 15:37:47 2026 +0100" }, "message": "tcp: check congestion control restriction first\n\ntcp_set_default_congestion_control() takes a reference to an algorithm\nbefore checking whether a non-init network namespace may select it. A\nrejected request returns -EPERM without dropping the reference.\n\nThis affects module-backed algorithms too; BPF is not required. For\nexample, after root loads tcp_bbr, a user with CAP_NET_ADMIN in a\nnon-init network namespace can repeatedly request it as the default\nalthough it is not in tcp_allowed_congestion_control. Each rejected\nwrite leaks a module reference. Since module-\u003erefcnt is an atomic_t,\n2^31 such writes can make it negative; later module_put() calls warn,\nand rmmod can hit the BUG_ON() in try_release_module_ref().\n\nCheck the namespace restriction before acquiring the reference, as\ntcp_set_congestion_control() already does.\n\nFixes: 8d432592f30f (\"net: Only allow init netns to set default tcp cong to a restricted algo\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSuggested-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nSigned-off-by: Zhiling Zou \u003czhilinz@nebusec.ai\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/71c142b2d45af6a2fe7fc6cd4a5ca52c53afbe23.1793075984.git.zhilinz@nebusec.ai\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8daacee78b3d2798fcf92398b6dff364eab64466", "tree": "66828da263399bb9031600ce05030a83ec6bfbf9", "parents": [ "db627e71b6da4416324a2eb599d12fa96959d478" ], "author": { "name": "Jamie Nguyen", "email": "jamien@nvidia.com", "time": "Tue Oct 27 09:29:45 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 15:33:14 2026 +0100" }, "message": "selftests: net: txtimestamp: fix out-of-bounds read in raw UDP checksum\n\nWith -r (SOCK_RAW, IPPROTO_UDP) the test writes only the UDP header and\npayload, and the kernel adds the IP header. get_udp_csum() still expects\nthe IP source and destination addresses to directly precede the UDP\nheader, and reads 2 * alen bytes before the start of the buffer: 8 bytes\nfor IPv4, 32 bytes for IPv6.\n\nASan reports a heap-buffer-overflow for both -4 -r and -6 -r. Without\nASan the read usually goes unnoticed, but it faults when the buffer is\nthe first chunk in the heap. That happens on Ubuntu 26.04, where the\nkselftest runner wraps the test in uutils stdbuf, and txtimestamp.sh\nfails with SIGSEGV on every run.\n\nEven without a crash, -r packets were sent with a checksum computed\nover unrelated heap memory, so their UDP checksum was invalid.\n\nBuild the pseudo-header from the destination address and checksum only\nthe UDP header and payload. -R and -P already write daddr as both the\nsource and destination address, so their checksums are unchanged. With\n-r the kernel selects the source address, which equals daddr for the\nloopback addresses used by txtimestamp.sh.\n\nFixes: b52354aa068e (\"selftests: expand txtimestamp with ipv6 dgram + raw and pf_packet\")\nSigned-off-by: Jamie Nguyen \u003cjamien@nvidia.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20261027162945.2122306-1-jamien@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "db627e71b6da4416324a2eb599d12fa96959d478", "tree": "4a8784c708e541d010f00e14eaab70b61f09f346", "parents": [ "d7314b51341c037973ce022f12c6009fd07b021e" ], "author": { "name": "Anil Kaushik", "email": "anilkaushikwireless@gmail.com", "time": "Tue Oct 27 13:06:23 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 15:14:50 2026 +0100" }, "message": "gtp: Require \u0027CAP_NET_ADMIN\u0027 when joining the gtp multicast group\n\nThe gtp generic netlink family sends notifications on its \"gtp\"\nmulticast group when a PDP context is added or deleted, and for GTP-U\necho responses. They carry the same attributes as a GETPDP reply: the\nMS and peer addresses, and the TEIDs, or the TID and the flow label.\n\nGETPDP requires CAP_NET_ADMIN, but generic netlink lets any user join a\nmulticast group by default, so an unprivileged user in the network\nnamespace of the gtp device can read all of this. Found by code\ninspection.\n\nFix by marking the group with GENL_MCAST_CAP_NET_ADMIN, like the psample\n\"packets\" group, and with uns-admin-perm in the gtp netlink spec. Only\nusers with CAP_NET_ADMIN in the user namespace owning the network\nnamespace can then join it.\n\nThis is still weaker than the check on GETPDP, which needs\nCAP_NET_ADMIN in the initial user namespace: in a network namespace\nowned by another user namespace, its root can join the group, but not\nuse GETPDP. Genetlink has no multicast group flag for the initial user\nnamespace, and ioam6 pairs its ops and its group the same way. This fix\nblocks the unprivileged users.\n\nTested by joining the group as root, as root without CAP_NET_ADMIN, and\nas an unprivileged user:\n\nBefore:\n root: joined\n root without CAP_NET_ADMIN: joined\n nobody: joined\n\nAfter:\n root: joined\n root without CAP_NET_ADMIN: EPERM\n nobody: EPERM\n\nFixes: 50aba46c234e (\"gtp: add notification mechanism\")\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nSigned-off-by: Anil Kaushik \u003canilkaushikwireless@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261027130623.3136658-1-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d7314b51341c037973ce022f12c6009fd07b021e", "tree": "7c623e0864033d7eed8725798c122ff2260b8f45", "parents": [ "6815a2513effd1c6c0bf9c2f1c8c459e597d985d" ], "author": { "name": "Noam D. Eliyahu", "email": "noam.d.eliyahu@gmail.com", "time": "Tue Oct 27 00:09:56 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 12:32:38 2026 +0100" }, "message": "tg3: Invert restart quirk logic to restrict SNP power-down bypass\n\nCommit 9fc3bc764334 (\"tg3: power down device only on SYSTEM_POWER_OFF\")\nbypassed `tg3_power_down()` on system restarts to prevent reboot hangs and\nNMIs on servers where NICs were initialized via SNP (such as Dell PowerEdge\nR650 and R750).\n\nHowever, skipping the power-down flow globally causes the ACPI _PTS method\nto trigger fatal PCIe AER events and hangs on other models. Commit\ne0efe83ed325 (\"tg3: Disable tg3 PCIe AER on system reboot\") attempted to\nmitigate this by adding an AER-disable DMI quirk table. Maintaining a\ngrowing list of models for a secondary symptom misses the root cause,\nleaving systems like the PowerEdge T440 (sharing the BCM5720 NIC) exposed.\n\nFix this by inverting the quirk logic:\n1. Restrict SNP power-down avoidance strictly to\n `tg3_restart_snp_quirk_table` for the specific systems requiring it\n (Dell PowerEdge R650 and R750).\n2. Restore standard power-down behavior for all other systems, eliminating\n the separate AER-disable quirk table.\n\nFor systems affected by the original SNP restart issue, their shutdown flow\nremains completely untouched.\n\nLink: https://lore.kernel.org/netdev/20251221175050.14089-1-noam.d.eliyahu@gmail.com/T/#u\nFixes: 9fc3bc764334 (\"tg3: power down device only on SYSTEM_POWER_OFF\")\nFixes: e0efe83ed325 (\"tg3: Disable tg3 PCIe AER on system reboot\")\nCc: stable@vger.kernel.org\nSigned-off-by: Noam D. Eliyahu \u003cnoam.d.eliyahu@gmail.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20261026220955.473247-1-noam.d.eliyahu@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6815a2513effd1c6c0bf9c2f1c8c459e597d985d", "tree": "a0a9eb0538d785850f2709b8346f0c6d46cbbd33", "parents": [ "85b4bc79dde77aadda0929a22f3532b208a3e1f8" ], "author": { "name": "Dong Yibo", "email": "dong100@mucse.com", "time": "Mon Oct 26 15:54:45 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 12:26:28 2026 +0100" }, "message": "net: rnpgbe: Accept link-down events without speed magic\n\nThe interface can continue reporting carrier up after the link goes\ndown because the driver ignores the firmware\u0027s link-down notification.\n\nFirmware reports link-down events with a zero port_magic and no\nvalid speed or duplex information. The driver requires ST_VALID_MAGIC\nfor every link event and returns before updating the cached link state\nwhen this check fails. It also writes an invalid driver snapshot to\nfirmware instead of acknowledging the link-down state.\n\nValidate the speed magic only for link-up events. This allows link-down\nevents to update the cached state, propagate carrier loss, and update\nthe snapshot exported to firmware. Keep the checks for invalid link-up\nmagic and unsupported speeds.\n\nFixes: 92a671d510a8 (\"net: rnpgbe: Add link status handling support\")\nSigned-off-by: Dong Yibo \u003cdong100@mucse.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/C2DFBBF04F1DCFD2+20261026075445.920572-1-dong100@mucse.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "85b4bc79dde77aadda0929a22f3532b208a3e1f8", "tree": "02469ea7a6633b88b090adc6878188fdd98ad6d3", "parents": [ "829a09df899dcce860dcf5f70e09c1b2d7d425ab" ], "author": { "name": "Linmao Li", "email": "lilinmao@kylinos.cn", "time": "Mon Oct 26 09:23:45 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 12:08:10 2026 +0100" }, "message": "r8152: Use BMSR to detect the link state\n\nr8152 detects carrier from PLA_PHYSTATUS without reading BMSR, so\nBMSR_LSTATUS can remain latched low after link up. Since\ncommit f6f2e946aa4d (\"net: mii: Fix the Speed display when the network\ncable is not connected\"), the first speed query can then report\nSPEED_UNKNOWN, which applications such as NetworkManager may cache\nuntil the next carrier change.\n\nUse BMSR_LSTATUS in set_carrier() so a latched link down can turn\ncarrier off after the link has recovered. If BMSR reports down but\nPLA_PHYSTATUS reports up, reschedule the link work to read the current\nstate without waiting for another notification.\n\nTested on an RTL8153B: NetworkManager reported 1000 Mb/s after 3 of 3\nrebinds, instead of an unknown speed.\n\nFixes: f6f2e946aa4d (\"net: mii: Fix the Speed display when the network cable is not connected\")\nCc: stable@vger.kernel.org\nSuggested-by: Hayes Wang \u003chayeswang@realtek.com\u003e\nSigned-off-by: Linmao Li \u003clilinmao@kylinos.cn\u003e\nReviewed-by: Hayes Wang \u003chayeswang@realtek.com\u003e\nLink: https://patch.msgid.link/20261026012345.1902285-1-lilinmao@kylinos.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "829a09df899dcce860dcf5f70e09c1b2d7d425ab", "tree": "8537c609b873e44a940513b94fd95b93541b4f43", "parents": [ "fb3e026ae548e3dd42ed3ef6420d33258dd91286" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 27 19:44:09 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:51:04 2026 +0100" }, "message": "octeontx2-pf: fix skb use-after-free with ipsec crypto offload\n\notx2_dma_map_skb_frag() calls skb_unclone_full() on its own copy of the\nskb pointer. For a cloned skb, for example with tcpdump running on the\ninterface, this frees the skb and the new copy is lost on return. The\ntransmit path then uses the freed skb and the copy leaks.\n\nMake the skb writable in place in otx2_sq_append_skb() instead, so the\npointer stays valid. Also do this for nonlinear skbs, as the hardware\nwrites the encrypted data back into the frags, which may be shared,\nfor example with the TCP retransmit queue.\n\nFixes: 195c3d463181 (\"octeontx2-pf: map skb data as device writeable\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20261027-nb-otx2-xfrm-unshare-net-v3-1-31dc9d79d11d@tipi-net.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fb3e026ae548e3dd42ed3ef6420d33258dd91286", "tree": "bc87107457cb574799e1bd75c6f2daeb612cdaf4", "parents": [ "46897c169be9c027f9c404037400faeab888487d", "92cb8653970e4efaa7d2c2e2819c6d050b25e462" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:41:10 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:41:11 2026 +0100" }, "message": "Merge branch \u0027octeontx2-pf-fix-ipsec-transmit-error-paths\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nocteontx2-pf: fix ipsec transmit error paths\n\nTwo pre-existing bugs in the ipsec transmit error paths, flagged by the\nclashiko review of my earlier ipsec fix for this driver [1].\n\nBoth look like edge cases to me, but at least the path in patch 1 (an SA\nremoved during rekey or teardown while packets are still queued) looks\nplausible to me. But don\u0027t take my word for it, I\u0027m not an octeontx2 user.\n\nCompile-tested only, I have no octeontx2 hardware.\n\n[1] https://lore.kernel.org/all/20261022-nb-otx2-xfrm-unshare-net-v2-1-5590c9325bcd@tipi-net.de/\n\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027-nb-otx2-ipsec-tx-fixes-net-v1-0-2114c4f10c36@tipi-net.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "92cb8653970e4efaa7d2c2e2819c6d050b25e462", "tree": "bc87107457cb574799e1bd75c6f2daeb612cdaf4", "parents": [ "14d01ff1a4952198abae713a4ad428e07819b4aa" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 27 20:54:07 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:41:08 2026 +0100" }, "message": "octeontx2-pf: pass the skb to otx2_dma_unmap_skb_frags()\n\nAfter a DMA mapping error, the unmap reads an skb pointer that is not\nset yet. It can be NULL or left over from an earlier packet.\n\nFixes: 195c3d463181 (\"octeontx2-pf: map skb data as device writeable\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nAcked-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20261027-nb-otx2-ipsec-tx-fixes-net-v1-2-2114c4f10c36@tipi-net.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "14d01ff1a4952198abae713a4ad428e07819b4aa", "tree": "b47c2e64a96059b396bcee239ace89f48f6dc56e", "parents": [ "46897c169be9c027f9c404037400faeab888487d" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Tue Oct 27 20:54:06 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:41:08 2026 +0100" }, "message": "octeontx2-pf: fix skb use-after-free on ipsec transmit drop\n\nWhen an SA is removed while packets for it are still queued, the\ntransmit path frees the packet but reports the queue as busy. The stack\nthen requeues the freed skb, and the DMA mappings leak.\n\nFixes: 6a77a158848a (\"cn10k-ipsec: Process outbound ipsec crypto offload\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20261027-nb-otx2-ipsec-tx-fixes-net-v1-1-2114c4f10c36@tipi-net.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "46897c169be9c027f9c404037400faeab888487d", "tree": "64ca31dd8ec59f47f6c6b6d843b998d2fce5dc54", "parents": [ "d2bfe74a8fe219a86b86c1f126e1d722a5001790", "782d6bb8f9b8e9d8591181662222bf74cd3ecf79" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:35:17 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:35:18 2026 +0100" }, "message": "Merge branch \u0027net-sched-sch_teql-fix-transmit-path-regressions\u0027\n\nJamal Hadi Salim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: sch_teql: fix transmit-path regressions\n\n- Patch 1/2 is unchanged\n\n- Patch 2/2 now fixes the drop accounting raised by the Sashiko\n review of v1 (both providers): only NETDEV_TX_OK and NET_XMIT_CN\n count as accepted transmits (CN can accompany acceptance of the\n current packet); any other consumed result, e.g. NET_XMIT_DROP,\n is charged to tx_dropped instead of being counted as a good\n transmit. The skb-ownership fix is unchanged (Sashiko-gemini).\n\nThe v2 revision follows the review of patch 2/2\n(https://lore.kernel.org/netdev/179248763469.3135.1739559328868319628@kernel.org/)\nand Simon Horman\u0027s request for a response\n(https://lore.kernel.org/netdev/20261023162821.GN708417@horms.kernel.org/).\n\nTwo independent sch_teql regressions on the transmit path.\n\nPatch 1 makes slaves_lock safe for the hard-IRQ-disabled netpoll path and\nfor PREEMPT_RT by converting it to a raw spinlock taken with IRQs saved.\n\nPatch 2 fixes a use-after-free when a lower virtual device consumes an skb\nbut returns NET_XMIT_DROP rather than NETDEV_TX_OK, and stops counting\nthose consumed drops as good transmits.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "782d6bb8f9b8e9d8591181662222bf74cd3ecf79", "tree": "64ca31dd8ec59f47f6c6b6d843b998d2fce5dc54", "parents": [ "8b2043279dae25483fe1f2d926e76d41ab95c398" ], "author": { "name": "owen kwan", "email": "owen@verialabs.com", "time": "Sat Oct 24 10:34:15 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:35:10 2026 +0100" }, "message": "net/sched: sch_teql: fix use-after-free on lower qdisc drop\n\nThe issue: teql_master_xmit() tests the slave\u0027s ndo_start_xmit() return\nvalue against NETDEV_TX_OK alone. A slave that consumes the skb but\nreturns an error code (rc \u003c NET_XMIT_MASK, e.g. NET_XMIT_DROP) is treated\nas if the skb were still owned, so the loop restores skb-\u003edev and calls\n__skb_pull() on it. A VLAN slave returns the result of dev_queue_xmit()\nfrom its ndo_start_xmit() (propagated since cbbef5e18307), and when the\nlower qdisc drops the packet that value is NET_XMIT_DROP after the skb\nhas been freed, giving a use-after-free in teql_master_xmit().\n\nThe Fix: test for consumption with dev_xmit_complete(), which accepts\nNETDEV_TX_OK and every rc \u003c NET_XMIT_MASK, matching other callers that\nneed to distinguish consumed results from busy. Only NETDEV_TX_OK keeps\nthe packet counted in tx_packets/tx_bytes and advances the slave; a\nconsumed result that is neither a success nor NET_XMIT_CN ends the\nattempt and is charged to tx_dropped, so lower-qdisc drops are no longer\nreported as good transmits. NET_XMIT_CN is counted like success because\nit can accompany acceptance of the current packet: pfifo_head_drop drops\nthe old head, enqueues the current skb and returns NET_XMIT_CN.\n\nConditions to recreate the bug:\nWith CONFIG_NET_SCH_TEQL,\nCONFIG_VLAN_8021Q and CONFIG_DUMMY enabled, add lkrdummy0 (dummy) and\nlkrvlan0 (VLAN id 37 on lkrdummy0); set a pfifo limit 0 root on lkrdummy0\nand a teql0 root on lkrvlan0; bring teql0 up with an address and send one\nUDP packet to it. The VLAN xmit returns NET_XMIT_DROP from the lower\nqdisc while holding a freed skb.\n\nFixes: 572a9d7b6fc7 (\"net: allow to propagate errors through -\u003endo_hard_start_xmit()\")\nLink: https://lore.kernel.org/netdev/179248763469.3135.1739559328868319628@kernel.org/\nLink: https://lore.kernel.org/netdev/20261023162821.GN708417@horms.kernel.org/\nCc: stable@vger.kernel.org\nSigned-off-by: owen kwan \u003cowen@verialabs.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-2@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8b2043279dae25483fe1f2d926e76d41ab95c398", "tree": "97a833c01c129fc49d79483f35678fadb9c1bceb", "parents": [ "d2bfe74a8fe219a86b86c1f126e1d722a5001790" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Oct 24 10:34:14 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 11:35:10 2026 +0100" }, "message": "net/sched: sch_teql: fix slaves_lock IRQ deadlock\n\nThis is a followup of commit e5b811fe7931 (\"net/sched: sch_teql:\nIntroduce slaves_lock to avoid race condition and UAF\") as reported by\nSashiko.\n\nThe issue: master-\u003eslaves_lock serializes the master\u0027s ring of slave\nqdiscs. The control paths -- teql_dequeue(), teql_destroy() and\nteql_qdisc_init() -- take it with spin_lock_bh(), while\nteql_master_xmit() (the master\u0027s ndo_start_xmit) takes it with plain\nspin_lock().\n\nnetpoll_send_skb() wraps the transmit in local_irq_save(), and\n__netpoll_send_skb() asserts lockdep_assert_irqs_disabled(), so\nteql_master_xmit() reached from netconsole always acquires slaves_lock\nwith hard IRQs disabled. On PREEMPT_RT spinlock_t is an rtmutex, and\nDocumentation/locking/locktypes.rst names\n\n\tlocal_irq_disable();\n\tspin_lock(\u0026lock);\n\nas a sequence that breaks there because the rtmutex requires a fully\npreemptible context. This is reachable without any panic: the nbcon\nprinter thread calls netconsole\u0027s write_thread() callback on every\nmessage. The usual remedy -- folding the IRQ disable into the lock with\nspin_lock_irqsave() -- is unavailable because the local_irq_save() is\nnetpoll\u0027s, not ours.\n\nOn non-RT the same asymmetry leaves slaves_lock acquirable with hard IRQs\ndisabled on one path and held with hard IRQs enabled on another. That is\nonly exploitable during the panic console flush (netconsole is\nCON_NBCON_ATOMIC_UNSAFE, so console_is_usable() admits its write_atomic()\nonly from nbcon_atomic_flush_unsafe(), which panic() alone calls), and\neven then an IRQ-saving lock does not help if the holder oopsed inside the\nsection or was stopped by panic_other_cpus_shutdown(). So the non-RT half\nis hardening; the PREEMPT_RT half is the bug.\n\nThe Fix: take slaves_lock as a raw spinlock with IRQs saved at every\nsite. Since skb_queue_purge() takes the queue\u0027s spinlock_t and may not\nnest inside a raw lock on PREEMPT_RT, move its call in teql_destroy()\noutside the raw section; dat-\u003eq is the dying qdisc\u0027s own queue and was\nnever serialized by slaves_lock, so the move is behaviour-neutral.\n\nThe new critical sections contain only RCU pointer assignments and\nnetdev_get_tx_queue(); skb_queue_purge(), netif_wake_queue() and\ndev_reset_queue() are all outside them. teql_destroy()\u0027s ring walk is\nO(slaves), two pointer loads and a compare per iteration, so even a large\nring is microseconds with IRQs off. Keeping the purge conditional rather\nthan dropping it outright is the conservative call for a backport.\n\nSome context: commit 6301f6a34ed8 (\"net/sched: sch_teql: move\nrcu_read_lock()/spin_lock() from _bh variants\") hardened the parent\nfix; together they addressed the master-\u003eslaves resurrection\nuse-after-free and the xmit-side BH warning but left the reverse\ndirection -- a hard IRQ re-entering xmit while a control path holds the\nlock -- unaddressed.\n\nConditions to recreate the bug:\n- CONFIG_PREEMPT_RT, CONFIG_NET_SCH_TEQL, CONFIG_DUMMY and\n CONFIG_NETCONSOLE.\n- Run `ip link add dev teqlslave0 type dummy`, bring teqlslave0 up, attach\n it with `tc qdisc add dev teqlslave0 root teql0`, and bring teql0 up.\n- Configure a netconsole target on teql0 with explicit local and remote\n IP addresses and a remote MAC address, then emit a console message.\n The nbcon printer thread reaches teql_master_xmit() with hard IRQs\n disabled by netpoll; taking slaves_lock as a spinlock_t is invalid on\n PREEMPT_RT. No panic or concurrent qdisc change is required.\n- Reachable by an admin with CAP_NET_ADMIN; teql devices exist only in the\n initial netns (no per-netns ops), so a user namespace does not suffice.\n\nFixes: e5b811fe7931 (\"net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF\")\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260630150922.238714-1-jhs%40mojatatu.com\nLink: https://lore.kernel.org/netdev/20260630150922.238714-1-jhs@mojatatu.com/\nCc: stable@vger.kernel.org\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-Y0BY.v2.r0.20261024060625-1@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d2bfe74a8fe219a86b86c1f126e1d722a5001790", "tree": "deba0478f43aba21c90624b068ca3bd1e6ace175", "parents": [ "fa503935c2d6603856dafff0a0852631ab6e9503" ], "author": { "name": "Joas Antonio dos Santos", "email": "joasantonio108@gmail.com", "time": "Sat Oct 24 19:04:28 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 10:48:51 2026 +0100" }, "message": "net: mctp: free reassembly head skb when key_add fails on SOM\n\nWhen a start-of-message fragment creates a new reassembly key on the\nbroadcast/bind path, mctp_frag_queue() stores the skb as\nkey-\u003ereasm_head before the key is made observable with mctp_key_add().\n\nIf mctp_key_add() fails (a race with another SOM packet for the same\nsource/dest/tag, or the receiving socket going away), the error path\nonly drops the key reference via mctp_key_unref(). The final key\ndestructor frees the key itself but not key-\u003ereasm_head, and since the\nkey was never added to any list, neither the expiry worker nor socket\nteardown can reach it to release the queued fragment. The skb is\nleaked.\n\nFree key-\u003ereasm_head on the key_add failure path before releasing the\nkey. Other teardown paths (__mctp_key_done_in(), EOM delivery) already\nclear reasm_head before the final unref, so this only affects the\nfailure path.\n\nFixes: 4a992bbd3650 (\"mctp: Implement message fragmentation \u0026 reassembly\")\nSigned-off-by: Joas Antonio dos Santos \u003cjoasantonio108@gmail.com\u003e\nReported-by: Guikun Yang \u003cyangguikun19@qq.com\u003e\nCloses: https://lore.kernel.org/all/tencent_43A65D51143E18518EA968DF9323694EFD08@qq.com/\nAcked-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/179287946888.17431.11219154409333681184@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fa503935c2d6603856dafff0a0852631ab6e9503", "tree": "2153cce1f9e1904c1c509c454b05baa116d52863", "parents": [ "fcc00b15cb21a6de76826e5012b2c758505f5e65" ], "author": { "name": "Cosmin Ratiu", "email": "cratiu@nvidia.com", "time": "Mon Oct 26 10:45:03 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Oct 29 10:25:59 2026 +0100" }, "message": "net/mlx5: Only set num_doorbells on a fully initialized SF\n\nThe validation for the num_doorbells devlink param rejects values\ngreater than num_channels. For lightweight SFs, this ends up accessing\na NULL priv-\u003eeq_table, leading to a crash.\n\nFix that by rejecting setting num_doorbells on uninitialized SFs.\n\nFixes: 11bbcfb7668c (\"net/mlx5e: Use the \u0027num_doorbells\u0027 devlink param\")\nSigned-off-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nReviewed-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261026084503.4122732-1-tariqt@nvidia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fcc00b15cb21a6de76826e5012b2c758505f5e65", "tree": "091267536a5e76dac73d3bafc5ffc613233423d6", "parents": [ "280352de4f6b80cbc76e7e11d35f50108978e9af" ], "author": { "name": "Linkui Xiao", "email": "xiaolinkui@kylinos.cn", "time": "Tue Oct 27 16:52:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:13:07 2026 -0700" }, "message": "net: bridge: netlink: do not clear the vlan info dump error\n\nbr_fill_ifinfo() assigns the result of br_fill_vlan_tunnel_info() over\nthe result of br_fill_ifvlaninfo() or br_fill_ifvlaninfo_compressed()\ninstead of only running the second helper when the first one succeeded.\n\nWhen the vlan information no longer fits in the skb but the port has no\nvlan mapped to a tunnel dst, br_fill_vlan_tunnel_info() walks the vlan\nlist and returns 0 without touching the skb. The -EMSGSIZE is lost,\nbr_fill_ifinfo() completes a message whose IFLA_AF_SPEC is truncated,\nand the dump carries on to the next interface instead of stopping, so\nuserspace silently sees an incomplete vlan list.\n\nOnly fill the tunnel information when the vlan information was filled\nsuccessfully.\n\nThis was flagged as a pre-existing issue in the Sashiko review of the\nnet-next series, which noted that the VLAN fill result is overwritten\nbefore it is tested (see the Link tag below). Not triggered or tested.\n\nFixes: efa5356b0d97 (\"bridge: per vlan dst_metadata netlink support\")\nLink: https://lore.kernel.org/bridge/ed1de95e-e112-4076-93f0-6f7668e657ad@blackwall.org/T/#u#5\nSigned-off-by: Linkui Xiao \u003cxiaolinkui@kylinos.cn\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nAcked-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20261027085200.1501599-1-xiaolinkui@126.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "280352de4f6b80cbc76e7e11d35f50108978e9af", "tree": "4ab8ce608c55bc28408dcf69878e496f2e0c325e", "parents": [ "267d47e2d08c24d4287039d8ebf07796a077d4e1", "56af436b90acce7eaa7531189c827773983f7d07" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:09:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:10:08 2026 -0700" }, "message": "Merge branch \u0027ice-e82x-reduced-timestamp-processing-logic-fixes\u0027\n\nJacob Keller says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nice: E82x: reduced timestamp processing logic fixes [part]\n\nThis is a reduced set patches originally posted as part of [1] which\npreviously passes Sashiko review without comments. It does not completely\nresolve the outstanding issues that we had, but can hopefully unblock some\nprogress.\n\nFirst, the locking around the PTP ports list in the adapter structure is\nconverted to use RCU primitives and a spinlock, resolving a couple of\nreports from Petr about places where the original list was accessed without\nlock protection. Note that an older version of this fix used an xarray\ninstead of the list. The xarray has more overhead and results in an\nincrease of ~25 microseconds to the average latency for processing Tx\ntimestamps. The list is simpler and avoids this overhead.\n\nNext, the ice_ptp_request_ts() function is updated to sequence the marking\nof the in_use bitmap in order to work properly with the lockless reader in\nthe IRQ thread. This issue was reported by Sashiko during development.\n\nNext, Przemyslaw Korba fixes the E822 timestamping logic to keep timestamp\nrequests disabled until Vernier calibration completes.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027-reduction-v1-0-81237c67a361@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56af436b90acce7eaa7531189c827773983f7d07", "tree": "4ab8ce608c55bc28408dcf69878e496f2e0c325e", "parents": [ "50870d62116038e6f1e17a6aedcf2a95cec37ec7" ], "author": { "name": "Karol Kolacinski", "email": "karol.kolacinski@intel.com", "time": "Tue Oct 27 17:05:39 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:08:58 2026 -0700" }, "message": "ice: E822: keep Tx timestamps disabled during offset calibration\n\nDo not clear the tx.calibrating flag immediately after starting the PHY\ntimer in ice_ptp_port_phy_restart(). Instead, keep Tx timestamps\ndisabled until the offset verification work (ice_ptp_wait_for_offsets)\nhas confirmed that the Tx PHY offset is properly configured.\n\nPreviously, tx.calibrating was set to true, then immediately back to\nfalse right after ice_start_phy_timer_e82x() returned. This allowed Tx\ntimestamp requests to be served during the window where offset\nverification was still pending. Timestamps produced during this window\nshould have their valid bit cleared, but it is better to prevent requests\nuntil the driver has confirmed calibration is complete.\n\nRename the tx.calibrating field to tx.disabled, and change where it is\ncleared. Only clear it in ice_ptp_wait_for_offsets(), and only after Tx\noffset configuration has completed successfully. This ensures that new Tx\ntimestamp requests are only accepted after the PHY has properly calibrated\nthe Tx offset.\n\nIf ice_start_phy_timer_e82x() fails, do not restore disabled to false.\nThe device is in a state where timestamps cannot succeed properly anyways.\nA dev_err message is already logged on failure to start the timer at the\nend of the function.\n\nRenaming the field improves clarity and will better reflect the nature of\nthe flag in a future change that also applies disabling Tx timestamps in\nsoftware in a following commit.\n\nLog a debug message while offset calibration is still pending, including\nthe specific Tx/Rx error codes to aid debugging stalled calibration.\nThis path is expected on every routine link-up: ov_work is first queued\nwith no delay and the vernier offset cannot be computed until at least\none packet has been transmitted, so the first several invocations\nnormally land here. Use dev_dbg() rather than a rate-limited warning to\navoid emitting KERN_WARNING on every link-up during normal operation.\nLog a debug message when calibration completes successfully.\n\nNote that sashiko review has previously complained that leaving the\ndisabled flag set \"permanently\" disables Tx timestamps if vernier\ncalibration never completes. This is true, but its important to realize\nthat timestamps would still fail regardless of whether the flag is set.\nUntil vernier calibration completes the device will not report valid\ntimestamps regardless. Thus, keeping the calibrating flag set simply\nprevents new timestamp requests from software while it is known that the\nhardware will not complete them.\n\nFixes: 3a7496234d17 (\"ice: implement basic E822 PTP support\")\nSigned-off-by: Karol Kolacinski \u003ckarol.kolacinski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Przemyslaw Korba \u003cprzemyslaw.korba@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261027-reduction-v1-3-81237c67a361@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "50870d62116038e6f1e17a6aedcf2a95cec37ec7", "tree": "247bd8060106690b8c456f31a06031a00e2ed1db", "parents": [ "d5d859a6efff473d799d35999a35aa764dcc185b" ], "author": { "name": "Jacob Keller", "email": "jacob.e.keller@intel.com", "time": "Tue Oct 27 17:05:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:08:58 2026 -0700" }, "message": "ice: set in_use only after preparing Tx timestamp index\n\nThe ice_ptp_request_ts() function is used to request a timestamp index for\nuse with a packet. When reserving an index, it sets the start time and\nsaves a pointer to the skb into the appropriate index. The function marks\nthe in_use bit first before doing any of these steps. The IRQ handler which\nclears the timestamps reads the in_use bits uses a lockless flow for\nreading the in_use bits to determine which ones are in-use. This is\nnecessary as actually processing a complete timestamp must be able to sleep\nso we cannot hold the timestamp tracker lock over the entire sequence.\nAdditionally, blocking the Tx hotpath with such a lock indefinitely would\nbe problematic.\n\nHowever, the existing flow now has a very narrow window where the IRQ\nhandler could see a timestamp as in-use but read a stale value for its\n\"start\" time.\n\nFix this by ordering the sequence to mark the in_use bit last, and add a\nmemory barrier to prevent re-ordering of the previous writes to setup the\nindex.\n\nThis was found and reported by Sashiko while reviewing an unrelated change.\n\nCloses: https://sashiko.dev/#/patchset/20260821-jk-e825c-minimized-fixes-v1-0-9d0731eb4858%40intel.com?part\u003d7\nFixes: ea9b847cda64 (\"ice: enable transmit timestamps for E810 devices\")\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261027-reduction-v1-2-81237c67a361@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5d859a6efff473d799d35999a35aa764dcc185b", "tree": "e3057514cba2327e9eff45d5d0f8d2fe29232f28", "parents": [ "267d47e2d08c24d4287039d8ebf07796a077d4e1" ], "author": { "name": "Jacob Keller", "email": "jacob.e.keller@intel.com", "time": "Tue Oct 27 17:05:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 18:08:58 2026 -0700" }, "message": "ice: use reference counting and SRCU for PTP port access\n\nThe ice adapter structure maintains a list of ports associated with the\nadapter. This is used for supporting PTP, where the clock owner must handle\nmany operations that require access to the PTP port structures of the\nassociated PFs.\n\nThis is implemented using a linked list and a mutex. This sort of works,\nbut a few places within the code do not acquire the mutex when iterating\nthe list. This includes ice_ptp_flush_all_tx_tracker(),\nice_ptp_restart_all_phy(), and ice_ptp_prepare_rebuild_sec().\n\nFixing this is tricky, especially since it is not clear if we can simply\nacquire the lock around the complete iterations.\n\nThe pattern of use for the port list is read-mostly with modifications only\nhappening during PF initialization when elements are inserted. This\ntypically only happens during early boot, though a PF could in principle be\nremoved or loaded at arbitrary times via bind and unbind operations.\n\nThe use of a mutex does mean the driver can sleep while holding it, but it\nstill creates complicates with lock ordering and prevents iterating the\nlist in any code path that *can\u0027t* sleep.\n\nInstead, use SRCU primitives for the port linked list, along with a\nreference count on the port. The kref reference counter ensures that a PF\nwill have a valid lifetime and not be removed until the reference is\nreleased. Note that this change focuses solely on the port list and does\nnot make an effort to resolve access to ctrl_pf, which is currently being\ninvestigated by another developer.\n\nUse of sleepable RCU is required because we often iterate the PTP port list\nand perform operations that might sleep. Attempts at implementing regular\nRCU have thus far not proven to be acceptable.\n\nThe remove path first removes the port from the list, and we use\nkref_get_unless_zero to ensure that such ports are skipped when iterating\nthe list. This ensures that once a port starts removing we will drop\nreferences and no longer be able to acquire new ones. This avoids loop\niterations chaining together to indefinitely block removal.\n\nThe ice_ptp_release_port_srcu() function is used as the release function\nfor the kref_put() call. This uses wake_up_var() to wake the removing\nthread. The waiting thread will block until the final reference has been\nremoved, then it will use synchronize_srcu() to ensure any outstanding SRCU\ncritical sections have had the necessary grace period.\n\nThis flow ensures that accesses to ports via the adapter port list will\nremain valid until both the SRCU critical sections have ended and all the\nreferences to the ports have been dropped. Strictly speaking, SRCU alone\nmight be sufficient for existing code paths, but the reference count allows\nthe option for passing a pointer to the port on to other functions if\nnecessary in the future.\n\nFixes: e800654e85b5 (\"ice: Use ice_adapter for PTP shared data instead of auxdev\")\nReviewed-by: Maciek Machnikowski \u003cmaciej.machnikowski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20261027-reduction-v1-1-81237c67a361@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "267d47e2d08c24d4287039d8ebf07796a077d4e1", "tree": "10d2ad4947860fbcf5e7ad8dd5663b6f953e8503", "parents": [ "a8d0451967fc0a34c4b0c21368986a81b4e14862", "8b97091eae744a577573797e5d5abc3e0da10769" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:37:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:37:42 2026 -0700" }, "message": "Merge branch \u0027bnge-fixes\u0027\n\nVikas Gupta says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbnge fixes\n\nThis series fixes RSS indirection table and context sizing for large RX\nring counts. Patch 1 caps the hardware RSS context count and RX rings\nto the RSS table size, preventing out-of-bounds writes and an oversized\nmemset(). Patch 2 fixes the indirection table sizing so rings above\nthe table size still receive default RSS traffic.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261026092757.9168-1-vikas.gupta@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8b97091eae744a577573797e5d5abc3e0da10769", "tree": "10d2ad4947860fbcf5e7ad8dd5663b6f953e8503", "parents": [ "e8f6ca11167d4753386340ce88444b5445dff831" ], "author": { "name": "Dharmender Garg", "email": "dharmender.garg@broadcom.com", "time": "Mon Oct 26 14:57:57 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:37:40 2026 -0700" }, "message": "bnge: fix RSS table sizing for large RX ring counts\n\nbnge_adjust_pow_two() adds one block before rounding up to a power of\ntwo only when the quotient is 0 or 1. A larger quotient that is\nalready a power of two is returned unchanged, so 129-192 RX rings\nget a 128-entry RSS indirection table and 257-320 rings a 256-entry\none. The rings above the table size never receive default RSS traffic.\nbnxt_calc_nr_ring_pages() always adds one, which is correct.\n\nMake bnge_adjust_pow_two() always add one block before rounding up.\n\nbnge_adjust_pow_two() also sizes the RX, RX aggregation, TX and\ncompletion ring pages. For the default 511-entry rings their page\ncounts do not change. The completion ring is sized from more than\nthe default depth, so its page count changes where the old code\ndropped a partial page. With 8K ring pages, TPA off and the default\nrings, its budget is 1533 entries and the page count goes from 2 to 4.\nWith 4K ring pages and TPA on, when the firmware reports a\nmax_aggs_supported of 260 to 387, it goes from 16 to 32.\nIn these cases the old completion ring held fewer entries than\nits budget.\n\nFixes: 627c67f038d2 (\"bng_en: Add resource management support\")\nSigned-off-by: Dharmender Garg \u003cdharmender.garg@broadcom.com\u003e\nReviewed-by: Vikas Gupta \u003cvikas.gupta@broadcom.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261026092757.9168-3-vikas.gupta@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8f6ca11167d4753386340ce88444b5445dff831", "tree": "a7ea21a0701f4f8501f85e9f71b6034d79823930", "parents": [ "a8d0451967fc0a34c4b0c21368986a81b4e14862" ], "author": { "name": "Dharmender Garg", "email": "dharmender.garg@broadcom.com", "time": "Mon Oct 26 14:57:56 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:37:40 2026 -0700" }, "message": "bnge: cap RSS contexts and RX rings to the RSS table size\n\nThe hardware supports at most BNGE_RSS_TABLE_MAX_TBL (8) RSS contexts.\nThey are stored in vnic-\u003efw_rss_cos_lb_ctx[8] and back a 512-entry\n(BNGE_MAX_RSS_TABLE_ENTRIES) indirection table and DMA buffer, so at\nmost 512 RX rings can be served by RSS.\n\nbnge_cal_nr_rss_ctxs() has no upper bound, so with more RX rings it\nreturns more than 8 contexts: bnge_setup_vnic() writes past\nfw_rss_cos_lb_ctx[], bnge_set_dflt_rss_indir_tbl() and\nbnge_fill_hw_rss_tbl() write past the indirection table and its DMA\nbuffer, and the pad computation in bnge_set_dflt_rss_indir_tbl()\nunderflows into a huge memset().\n\nCap the number of contexts at BNGE_RSS_TABLE_MAX_TBL and the number\nof RX rings at BNGE_MAX_RSS_TABLE_ENTRIES, so the sizes derived from\nthe ring count always fit the arrays.\n\nFixes: 627c67f038d2 (\"bng_en: Add resource management support\")\nSigned-off-by: Dharmender Garg \u003cdharmender.garg@broadcom.com\u003e\nReviewed-by: Vikas Gupta \u003cvikas.gupta@broadcom.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261026092757.9168-2-vikas.gupta@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a8d0451967fc0a34c4b0c21368986a81b4e14862", "tree": "6978f13d5ab64085c2fa0516e60ca1f441e18475", "parents": [ "0de4e69cd021c99d0aa13e1f30aafd13ad74a2a5" ], "author": { "name": "Divyanshu Jha", "email": "divyanshuj2006@gmail.com", "time": "Sat Oct 24 17:50:51 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:34:13 2026 -0700" }, "message": "net: usb: cdc_ncm: add Apple Silicon MacBook Air (05ac:1903) device ID\n\nThe Apple Silicon MacBook Air exposes a CDC-NCM interface (05ac:1903)\nwhen connected host-to-host over USB-C.\n\nThe device tested is an Apple MacBook Air (13-inch, M1, 2020), Model A2337\n(MacBookAir10,1) with an Apple M1 chip. Unlike\ncommit a5148bc2fa27 (\"net: usb: cdc_ncm: add Apple Mac USB-C direct networking quirk\")\nwhich hypothesized all Apple Silicon Macs share PID 0x1905 (\"Mac\"), this\nM1 MacBook Air exposes PID 0x1903 with iProduct string \"MacBook Air\".\n\nLike other Apple CDC-NCM peripherals (0x1902 and 0x1905), Apple\u0027s\nfirmware omits the CDC status interrupt endpoint. This causes the\nstandard cdc_ncm probe to fail with a missing endpoint error:\n\n cdc_ncm 1-7:1.0: bind() failure\n cdc_ncm: probe of 1-7:1.0 failed with error -22\n\nAdd device ID 05ac:1903 to cdc_devs binding to\napple_private_interface_info so the driver bypasses the interrupt\ncheck and initializes host-to-host networking successfully:\n\n cdc_ncm 1-7:1.0 usb0: register \u0027cdc_ncm\u0027 at usb-...,\n CDC NCM (Apple Private), ...\n\nRelevant \u0027lsusb -v\u0027 descriptor output:\n\n Device Descriptor:\n bcdUSB 2.10\n idVendor 0x05ac Apple, Inc.\n idProduct 0x1903 MacBook Air\n bcdDevice 10.01\n iManufacturer 1 Apple Inc.\n iProduct 2 MacBook Air\n Configuration Descriptor:\n Interface Descriptor:\n bInterfaceNumber 0\n bInterfaceClass 2 Communications\n bInterfaceSubClass 13 CDC NCM\n bNumEndpoints 0\n Interface Descriptor:\n bInterfaceNumber 1\n bInterfaceClass 10 CDC Data\n bNumEndpoints 2\n Interface Descriptor:\n bInterfaceNumber 2\n bInterfaceClass 2 Communications\n bInterfaceSubClass 13 CDC NCM\n bNumEndpoints 0\n Interface Descriptor:\n bInterfaceNumber 3\n bInterfaceClass 10 CDC Data\n bNumEndpoints 2\n\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSigned-off-by: Divyanshu Jha \u003cdivyanshuj2006@gmail.com\u003e\nLink: https://patch.msgid.link/20261024122051.14427-1-divyanshuj2006@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0de4e69cd021c99d0aa13e1f30aafd13ad74a2a5", "tree": "3f93f83cf3a2d3a143f95817d6925bc09b393951", "parents": [ "33893757d5f40af69e9a1f80ffffee00a2eb0221" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Mon Oct 26 16:59:27 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:31:34 2026 -0700" }, "message": "ppp: linearize and segment bridged packets when required\n\nPPP channel bridging hands packets received on one channel directly to\nthe start_xmit() of another. Packets received by PPPoE can be\nnon-linear, GSO since commit 55a5d8fca836 (\"net: pppoe: implement\nGRO/GSO support\"), or CHECKSUM_PARTIAL when injected with a\nvirtio_net_hdr. The regular transmit path never sees such packets, and\nonly PPPoE, which uses dev_queue_xmit(), handles them:\n\n- PPP Async reads the whole packet through skb-\u003edata, transmitting\n unrelated memory for non-linear packets.\n- PPP Async and Sync send GSO packets as single frames of up to 64KB,\n and CHECKSUM_PARTIAL packets with a bad L4 checksum.\n- PPTP and L2TP cannot segment a TCP GSO packet once their GRE or UDP\n header is pushed, and do not finish pending checksums.\n\nAdd a xmit_offload flag to struct ppp_channel, set for PPPoE. For other\nchannels, segment GSO packets in software, using the PPP protocol field\nas the L2 header, finish CHECKSUM_PARTIAL checksums (including SCTP\nCRC32c), and linearize packets for channels without direct_xmit, as\nppp_push() does. Packets are dropped if any step fails, or if the\nchannel is busy, as before.\n\nskb-\u003edev is NULL at this point for PPPoE (cleared by __sk_receive_skb()),\nand tunnel and IPv6 UFO GSO handlers dereference it: only TCP, UDP L4\nand fraglist GSO packets without encapsulation are segmented, others\nare dropped.\n\nReceive paths like L2TP pull headers without updating the checksum\nstate, possibly leaving a CHECKSUM_PARTIAL state with csum_start before\nskb-\u003edata. Reset it to CHECKSUM_NONE, as skb_postpull_rcsum() does, so\nthat skb_checksum_help() does not warn, and so that PPPoE does not\noffload a checksum at a wrong offset.\n\nTested in a VM by bridging PPPoE (on a TAP with IFF_NAPI_FRAGS, or on\nveth) to PPP Async on a PTY, PPPoL2TP and PPPoE: non-linear packets no\nlonger leak garbage, GSO packets (including fraglist GRO) are sent as\nvalid segments for IPv4 and IPv6, CHECKSUM_PARTIAL packets get a valid\nchecksum, and PPPoE still receives GSO packets unchanged.\n\nFixes: 4cf476ced45d (\"ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls\")\nFixes: 55a5d8fca836 (\"net: pppoe: implement GRO/GSO support\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260908072135.877364-1-qingfang.deng@linux.dev\nCo-developed-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nCc: Felix Fietkau \u003cnbd@nbd.name\u003e\nCc: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261026155927.707655-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "33893757d5f40af69e9a1f80ffffee00a2eb0221", "tree": "50d80b953a22d018a1a82395ae12b1e472638121", "parents": [ "8146be04908d3efbe3c6e130f551edbfd7a9dab8", "87b88b658b9b983b119f59396c08e4df1a211d59" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:41 2026 -0700" }, "message": "Merge branch \u0027net-pcs-xpcs-fix-runtime-pm-and-clock-lifecycle\u0027\n\nCoia Prant says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: pcs: xpcs: fix runtime PM and clock lifecycle\n\nThis series fixes the runtime PM and CSR clock lifecycle in the DW XPCS\nplatform driver, a misleading error message in the Rockchip glue driver,\nand the MAINTAINERS coverage for the platform driver and its binding.\n\nThe issue was found while using pcs-xpcs-plat.c as a reference for the\nRockchip XPCS glue driver (pcs-xpcs-rk.c). On Rockchip the CSR clock\n(PCLK_XPCS) is required for register access, which exposed two problems\nin the generic platform driver:\n\n - it calls pm_runtime_set_active() before runtime PM is enabled and\n before the clock is prepared/enabled, so a later suspend tries to\n disable a clock that was never enabled;\n\n - with CONFIG_PM disabled, the runtime resume path is compiled out\n and the CSR clock is never enabled at all.\n\nPatch 1 fixes the initial runtime PM status and registers a devm action\nthat force-suspends the device on teardown, so the clock does not leak\nwhen the driver is removed while runtime-active.\n\nPatch 2 handles !CONFIG_PM builds by preparing/enabling the CSR clock\nmanually and disabling it in the cleanup action. It also switches to\nRUNTIME_PM_OPS() and pm_ptr(), which are no-ops when CONFIG_PM is\nenabled, so that the runtime callbacks stay referenced and .pm is NULL\nin !CONFIG_PM builds. Because the CSR clock is optional and both cases\nare handled in the driver, Kconfig is left untouched and no PM\ndependency is added.\n\nPatch 3 rewords the cleanup action error message in the Rockchip glue\ndriver, which was merged into mainline today and currently mentions only\nthe EEE clock even though the action also tears down runtime PM.\n\nPatch 4 lists pcs-xpcs-plat.c and its DT binding under the DW XPCS\nentry. pcs-xpcs-plat.c currently only matches the ETHERNET PHY LIBRARY\nentry, and the binding is only matched by the generic DT and networking\nrules, so the entry does not cover the whole driver.\n\nNo upstream platform currently enables pcs-xpcs-plat with a real CSR\nclock dependency, so neither runtime issue is reachable in mainline\ntoday. Because of that, no Fixes: or Cc: stable tags are included, as\ndiscussed in the v1 thread.\n\nThe patches touch code that is already in mainline: the platform driver\nhas been there since f6bb3e9d98c2, and the Rockchip glue driver was\nmerged today. They are fixes to existing code, not new drivers or new\nfeatures.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261023075214.1793922-2-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "87b88b658b9b983b119f59396c08e4df1a211d59", "tree": "50d80b953a22d018a1a82395ae12b1e472638121", "parents": [ "e7cccfde61367452e9a43257a57eef0a95e7a6bf" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Fri Oct 23 15:52:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:38 2026 -0700" }, "message": "MAINTAINERS: list DW XPCS platform driver and binding under XPCS entry\n\nThe Synopsys DW XPCS entry covers pcs-xpcs.c, pcs-xpcs.h and the public\nheader, but not pcs-xpcs-plat.c or its DT binding. pcs-xpcs-plat.c only\nmatches the ETHERNET PHY LIBRARY entry today, and the binding is only\nmatched by the generic DT and networking rules.\n\nAdd both files so the entry covers the whole driver.\n\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20261023075214.1793922-6-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e7cccfde61367452e9a43257a57eef0a95e7a6bf", "tree": "58f1194da8b429e3f6588b5e39726ae16ce2076c", "parents": [ "eea365ed283cb2a7418b277fef87b462418e2283" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Fri Oct 23 15:52:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:38 2026 -0700" }, "message": "net: pcs: xpcs-rk: fix cleanup action error message\n\nThe devm action registered by xpcs_rk_init_clk() force-suspends the\ndevice and disables the EEE clock, but the current error message only\nmentions the EEE clock. Point at the cleanup action by name instead,\nso the message covers both parts of what the action does.\n\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20261023075214.1793922-5-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eea365ed283cb2a7418b277fef87b462418e2283", "tree": "79dddd1f874a991a11d7f6eedddbe7b988053de2", "parents": [ "49d8bbc21244f0c2d2ebf5ee03fb7352ff019ecc" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Fri Oct 23 15:52:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:38 2026 -0700" }, "message": "net: pcs: xpcs-plat: fix clock lifecycle for !CONFIG_PM builds\n\nWith CONFIG_PM disabled, pm_runtime_enable() and the runtime resume path\nare compiled out, so the CSR clock is never prepared/enabled. On\nplatforms that provide a real \"csr\" clock this makes register access\nfail.\n\nHandle this by preparing/enabling the CSR clock manually in the !PM case\nand disabling it in the devm cleanup action. The CONFIG_PM path is left\nunchanged and still relies on runtime PM to gate the clock.\n\nUse RUNTIME_PM_OPS() and pm_ptr() for the PM ops as well, so that in\n!CONFIG_PM builds the runtime callbacks are still referenced and .pm is\nNULL rather than pointing at an empty ops structure. This also drops the\n__maybe_unused annotations from the callbacks, which were only needed\nbecause SET_RUNTIME_PM_OPS() expands to nothing when CONFIG_PM is\ndisabled. Both changes are no-ops when CONFIG_PM is enabled.\n\nThe CSR clock is optional (devm_clk_get_optional()), so platforms\nwithout a clock keep working in both cases, and clk_prepare_enable()\non a NULL clock is a no-op. Because the !PM case is handled in the\ndriver, there is no need to select or depend on PM in Kconfig for all\nplatforms; keep the current Kconfig as-is to preserve compile coverage.\n\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20261023075214.1793922-4-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "49d8bbc21244f0c2d2ebf5ee03fb7352ff019ecc", "tree": "b61b110f9ff9d15e5a7ef1e45d8244d5147cc5a3", "parents": [ "8146be04908d3efbe3c6e130f551edbfd7a9dab8" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Fri Oct 23 15:52:12 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:29:38 2026 -0700" }, "message": "net: pcs: xpcs-plat: fix runtime PM initialization\n\nThe driver calls pm_runtime_set_active() before runtime PM is enabled and\nbefore the CSR clock is prepared and enabled. If the device is later\nsuspended (e.g. during unbind), the runtime suspend callback tries to\ndisable a clock that was never enabled, producing:\n\n clk_csr already disabled\n clk_csr already unprepared\n\nSet the initial runtime PM status to suspended instead, and register a\ndevm action that force-suspends the device on teardown. Without that\naction the CSR clock would stay enabled if the driver is removed while\nruntime-active, since nothing triggers a runtime suspend on unbind.\npm_runtime_force_suspend() is not checked because the runtime suspend\ncallback cannot fail.\n\nThe clock is enabled on the first runtime resume (e.g. during MDIO\naccess).\n\nNo upstream platform currently enables this driver with a real CSR clock\ndependency, so the issue is not reachable in mainline today. It was\nfound while using this driver as a reference for the Rockchip XPCS glue\ndriver.\n\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nLink: https://patch.msgid.link/20261023075214.1793922-3-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8146be04908d3efbe3c6e130f551edbfd7a9dab8", "tree": "0ffbdf504347db61b362905738055a0c7d03d6c2", "parents": [ "4c6fbb1fbafa85029fa789b5b01f39ebcb459d1a" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Mon Oct 26 11:32:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:25:25 2026 -0700" }, "message": "net: mctp: usblib: Fix broken assertion\n\nThe expression in a static assertion in the kunit tests was not\nconsidered constant by gcc, causing an error. Replace the static assert\nwith a runtime kunit equivalent.\n\nFixes: 1e12f734afc1 (\"net: mctp: usblib: Add initial kunit tx tests\")\nReported-by: Geert Uytterhoeven \u003cgeert@linux-m68k.org\u003e\nCloses: https://lore.kernel.org/netdev/CAMuHMdXTGGdGWZ9sKz5_sQF1237gV844cEhkXr6v_TUHPOb78Q@mail.gmail.com/\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261026-dev-mctp-static-assert-fix-v1-1-ceef9913e891@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c6fbb1fbafa85029fa789b5b01f39ebcb459d1a", "tree": "a75651f79358ba6195a97a5d65a296d66d435de9", "parents": [ "4f43dff327d914cddf7218db1770a32ec4f4e959" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 27 06:52:45 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 17:23:50 2026 -0700" }, "message": "ipv6: Protect multiple routes insertion by table lock.\n\nsyzbot reported the warning below. [0]\n\nWhile call_fib6_multipath_entry_notifiers() is called locklessly,\nfib6_siblings could be changed concurrently, leading to the\nwarning (and later null-ptr-deref).\n\nLet\u0027s protect multiple routes insertion with tb6_lock.\n\nAlong with that, __ip6_ins_rt() and ip6_route_del() are changed\nto fib6_add() and fib6_del().\n\nNote that fib6_del() finally calls rt6_multipath_rebalance(),\nwhich requires rcu_read_lock().\n\n[0]:\ni !\u003d fen6_info-\u003ensiblings\nWARNING: drivers/net/netdevsim/fib.c:831 at nsim_fib6_event_init drivers/net/netdevsim/fib.c:831 [inline], CPU#0: syz.0.157/6279\nWARNING: drivers/net/netdevsim/fib.c:831 at nsim_fib6_prepare_event drivers/net/netdevsim/fib.c:947 [inline], CPU#0: syz.0.157/6279\nWARNING: drivers/net/netdevsim/fib.c:831 at nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1003 [inline], CPU#0: syz.0.157/6279\nWARNING: drivers/net/netdevsim/fib.c:831 at nsim_fib_event_nb+0x1029/0x11d0 drivers/net/netdevsim/fib.c:1043, CPU#0: syz.0.157/6279\nModules linked in:\nCPU: 0 UID: 0 PID: 6279 Comm: syz.0.157 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nRIP: 0010:nsim_fib6_event_init drivers/net/netdevsim/fib.c:831 [inline]\nRIP: 0010:nsim_fib6_prepare_event drivers/net/netdevsim/fib.c:947 [inline]\nRIP: 0010:nsim_fib_event_schedule_work drivers/net/netdevsim/fib.c:1003 [inline]\nRIP: 0010:nsim_fib_event_nb+0x1029/0x11d0 drivers/net/netdevsim/fib.c:1043\nCode: eb 0d 4d 89 fd e8 b7 c5 6c fa be 01 00 00 00 48 89 df e8 5a 38 85 fd 4d 89 ef 4c 8b 6c 24 20 e9 4a f3 ff ff e8 98 c5 6c fa 90 \u003c0f\u003e 0b 90 e9 db fa ff ff 89 e9 80 e1 07 80 c1 03 38 c1 0f 8c df f0\nRSP: 0018:ffffc900047bef10 EFLAGS: 00010293\nRAX: ffffffff875b59a8 RBX: 0000000000000002 RCX: ffff888079770000\nRDX: 0000000000000000 RSI: 0000000000000002 RDI: 0000000000000001\nRBP: ffffc900047bf0a0 R08: ffff88805c0bb02f R09: 1ffff1100b817605\nR10: dffffc0000000000 R11: ffffed100b817606 R12: dffffc0000000000\nR13: 0000000000000000 R14: 0000000000000001 R15: ffff88802c792000\nFS: 00007f334ba076c0(0000) GS:ffff888123ad0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f334ba06ff8 CR3: 000000007a5b2000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n notifier_call_chain+0x1a5/0x3d0 kernel/notifier.c:85\n atomic_notifier_call_chain+0xda/0x180 kernel/notifier.c:223\n call_fib_notifiers+0x31/0x60 net/core/fib_notifier.c:36\n call_fib6_multipath_entry_notifiers+0xf5/0x160 net/ipv6/ip6_fib.c:428\n ip6_route_multipath_add net/ipv6/route.c:5542 [inline]\n inet6_rtm_newroute+0x14f5/0x1a30 net/ipv6/route.c:5664\n rtnetlink_rcv_msg+0x802/0xc00 net/core/rtnetlink.c:7163\n netlink_rcv_skb+0x226/0x4a0 net/netlink/af_netlink.c:2572\n netlink_unicast_kernel net/netlink/af_netlink.c:1335 [inline]\n netlink_unicast+0x7bd/0x940 net/netlink/af_netlink.c:1361\n netlink_sendmsg+0x813/0xb40 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec+0x14e/0x190 net/socket.c:800\n __sock_sendmsg net/socket.c:818 [inline]\n ____sys_sendmsg+0x54e/0x850 net/socket.c:2715\n ___sys_sendmsg+0x2a5/0x360 net/socket.c:2769\n __sys_sendmmsg+0x273/0x4d0 net/socket.c:2858\n __do_sys_sendmmsg net/socket.c:2885 [inline]\n __se_sys_sendmmsg net/socket.c:2882 [inline]\n __x64_sys_sendmmsg+0xa0/0xc0 net/socket.c:2882\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f334ab9e1d9\nCode: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f334ba07028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133\nRAX: ffffffffffffffda RBX: 00007f334ae26090 RCX: 00007f334ab9e1d9\nRDX: 04000000000001f2 RSI: 0000200000000000 RDI: 0000000000000004\nRBP: 00007f334ac35888 R08: 0000000000000000 R09: 0000000000000000\nR10: 00000000000000fc R11: 0000000000000246 R12: 0000000000000000\nR13: 00007f334ae26128 R14: 00007f334ae26090 R15: 00007ffd96688aa8\n \u003c/TASK\u003e\n\nFixes: 169fd62799e8 (\"ipv6: Get rid of RTNL for SIOCADDRT and RTM_NEWROUTE.\")\nReported-by: syzbot+751b587577d0ebca10f2@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/6adbaed6.67317f00.38c4bc.001b.GAE@google.com/T/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20261027065247.2871134-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f43dff327d914cddf7218db1770a32ec4f4e959", "tree": "a64c34df4ee03a073701fef9bd0aca372b678690", "parents": [ "14368b9aa1017fee35d2589be7b17e0485c0f93e", "7c5d62eff7008612fd2ad681e743d1f4adf2459e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:50:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:50:24 2026 -0700" }, "message": "Merge branch \u0027tls-honor-o_nonblock-in-tls_sw_splice_read\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ntls: Honor O_NONBLOCK in tls_sw_splice_read()\n\nExtract the O_NONBLOCK fix from Chuck\u0027s zero-len record series:\nhttps://lore.kernel.org/20261019-tls-follow-on-v6-0-ab01c4ecca0c@kernel.org\n\nThe first patch carries the fix. LLMs love to point out the missing\nO_NONBLOCK as a risk for the zero-len record change so let\u0027s get\nit out of the way before working on the zero-len record fix which\nis more complex.\n\nThe fix itself is almost unchange (I deleted some parens),\nthe selftest was fixed up a little bit to appease the LLM\nreviewers but also no substantial change.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027015215.605919-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c5d62eff7008612fd2ad681e743d1f4adf2459e", "tree": "a64c34df4ee03a073701fef9bd0aca372b678690", "parents": [ "78ded647d43e335891f981f68c5992a2e763cfcc" ], "author": { "name": "Chuck Lever", "email": "cel@kernel.org", "time": "Mon Oct 26 18:52:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:50:20 2026 -0700" }, "message": "selftests: tls: Cover splice on a nonblocking socket\n\nEvery existing splice call in this file either passes\nSPLICE_F_NONBLOCK or runs on a blocking socket, so nothing\nexercises the socket\u0027s own O_NONBLOCK on the splice path. A change\nthat stops consulting sock-\u003efile-\u003ef_flags puts splice(2) and\nsendfile(2) back to sleeping in tls_rx_rec_wait(), and the suite\nstill reports pass.\n\nSplice from a nonblocking socket without SPLICE_F_NONBLOCK, first\nwith no record queued, which must return EAGAIN, then with a record\nto deliver. A kernel that ignores the socket flag sleeps until the\nharness timeout rather than returning.\n\nSigned-off-by: Chuck Lever \u003ccel@kernel.org\u003e\nLink: https://patch.msgid.link/20261027015215.605919-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "78ded647d43e335891f981f68c5992a2e763cfcc", "tree": "bae2b824959ba593eda7bc43ec77ca553021f63f", "parents": [ "14368b9aa1017fee35d2589be7b17e0485c0f93e" ], "author": { "name": "Chuck Lever", "email": "cel@kernel.org", "time": "Mon Oct 26 18:52:14 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:50:20 2026 -0700" }, "message": "tls: Honor O_NONBLOCK in tls_sw_splice_read()\n\ntls_sw_splice_read() takes its blocking behavior from\nSPLICE_F_NONBLOCK alone. When splicing from a socket to a pipe,\ndo_splice() sets that flag from the pipe\u0027s O_NONBLOCK, not the\nsocket\u0027s. On a nonblocking socket, a splice(2) call without\nSPLICE_F_NONBLOCK therefore sleeps in tls_rx_rec_wait() until a\nrecord arrives. tcp_splice_read() instead reads sock-\u003efile-\u003ef_flags\nand returns -EAGAIN.\n\nPolling first does not avoid the sleep once tls_sw_splice_read()\nconsumes zero-length records, as it does after a later patch in this\nseries. tls_sw_sock_is_readable() reports the socket readable while\nany record sits on rx_list, including a zero-length record that\ndelivers no bytes to the pipe. For TLS 1.3 the strparser announces a\nrecord before decryption, when its plaintext length is still unknown,\nso the readiness test cannot screen such a record out. A splice that\nconsumes the record and waits for the next stalls every connection\nan event loop multiplexes.\n\nAn LLM audit of the TLS read paths found this defect.\n\nTreat the socket\u0027s O_NONBLOCK as nonblocking too. A caller that\nsets O_NONBLOCK on the socket and splices without SPLICE_F_NONBLOCK\nnow gets -EAGAIN where the splice blocked before. sendfile(2) from\na TLS socket changes the same way, because do_sendfile() leaves the\ninput file\u0027s O_NONBLOCK out of the splice flags. Both now behave as\nthey do on a plain TCP socket.\n\nFixes: c46234ebb4d1 (\"tls: RX path for ktls\")\nSigned-off-by: Chuck Lever \u003ccel@kernel.org\u003e\nLink: https://patch.msgid.link/20261027015215.605919-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "14368b9aa1017fee35d2589be7b17e0485c0f93e", "tree": "451fdf61e0948e9024aaded845f690c7cb38d8e5", "parents": [ "7cceaba6ffbc34be198ab0ee2a669ca657d6a681" ], "author": { "name": "Antonio Quartulli", "email": "antonio@mandelbit.com", "time": "Mon Oct 26 16:31:12 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:48:18 2026 -0700" }, "message": "net/sched: fix packet reordering on requeue\n\ndev_requeue_skb() appends requeued skbs to the tail of q-\u003egso_skb, while\ndequeue_skb() takes them back one at a time from the head. If the driver\nreturns NETDEV_TX_BUSY again for the first of them, it moves behind the\nskbs still parked there and is sent after them.\n\nThis showed up as heavy TCP reordering while benchmarking over veth,\nwhich returns NETDEV_TX_BUSY whenever its ring is full since\ncommit dc82a33297fc (\"veth: apply qdisc backpressure on full ptr_ring to reduce TX drops\").\n\nRequeue the skbs at the head of gso_skb, keeping their order. With 4 TCP\nstreams over a veth pair with a pfifo qdisc, this removes about 1.3M\nout-of-order segments and 15-37k retransmits per 15 seconds, and raises\nthroughput from about 40 to 76 Gbit/s.\n\nFixes: a53851e2c321 (\"net: sched: explicit locking in gso_cpu fallback\")\nFixes: 9540d977618c (\"net: sched: fix skb leak in dev_requeue_skb()\")\nCc: stable@vger.kernel.org\nSigned-off-by: Antonio Quartulli \u003cantonio@mandelbit.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nLink: https://patch.msgid.link/20261026153113.3275494-1-antonio@mandelbit.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7cceaba6ffbc34be198ab0ee2a669ca657d6a681", "tree": "d24186b5a6e89f9e470cf6396d36575c602ed8dd", "parents": [ "ca87a2dffbb550fc934647d5e8d1c4ae85590132" ], "author": { "name": "Daniel Palmer", "email": "daniel@0x0f.com", "time": "Sun Oct 25 11:45:14 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:34:39 2026 -0700" }, "message": "net: i825xx: 82596: use MMIO accessors for the MVME16x PORT/CA registers\n\nOn the MVME16x the two port registers need to be written in order to latch\nthe correct 32bit value.\n\nThe way the code is currently written means that modern GCC can decide to\noptimize the writes and break that latching.\n\nConvert the MVME16x specific register accesses to use the proper io\naccessors to restore the latching and make the driver functional again.\n\nThe Patch was tested by me on real Hardware (Motorola MVME177).\nOn the Board is a Intel i82596CA 10Mb Ethernet Chip Stepping C.\n\nReported-by: Denis Ahrens \u003cdenis@h3q.com\u003e\nSigned-off-by: Daniel Palmer \u003cdaniel@0x0f.com\u003e\nTested-by: Denis Ahrens \u003cdenis@h3q.com\u003e\nLink: https://patch.msgid.link/20261025024514.802862-1-daniel@0x0f.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ca87a2dffbb550fc934647d5e8d1c4ae85590132", "tree": "d628ed3749c2816f786b7524a706270228f105ab", "parents": [ "775fede6a939d7e7564d9cbb28393ef8fe15a936" ], "author": { "name": "Joas Antonio dos Santos", "email": "joasantonio108@gmail.com", "time": "Sat Oct 24 22:47:24 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:32:49 2026 -0700" }, "message": "net: dcb: initialize PFC value before calling getpfccfg\n\ndcbnl_getpfccfg() and dcbnl_cee_fill() pass the address of an\nuninitialized stack u8 to the driver\u0027s getpfccfg() op and then put it\ninto the netlink reply unconditionally. The op returns void, so the\ncore cannot tell whether the driver wrote the value.\n\ni40e_dcbnl_get_pfc_cfg() and ice_dcbnl_get_pfc_cfg() return without\nwriting *setting unless the DCBX agent is host managed and in CEE mode.\nBoth drivers normally run with firmware managed DCBX\n(DCB_CAP_DCBX_LLD_MANAGED), and i40e with FW LLDP disabled runs host\nmanaged in IEEE mode, so on a DCB capable i40e/ice port the PFC values\nin DCB_CMD_PFC_GCFG and DCB_CMD_CEE_GET replies, and in the CEE part of\nRTNLGRP_DCB notifications, come from uninitialized stack. The same u8\nis reused for all eight priorities, so this is one byte per reply.\n\ndcb_doit() only requires CAP_NET_ADMIN for RTM_SETDCB, so the GET\ncommands are available to unprivileged users.\n\nSet the value to 0 before each call, like the PG config path already\npresets its outputs to DCB_ATTR_VALUE_UNDEFINED. 0 is also what the\nreply contains today on kernels built with CONFIG_INIT_STACK_ALL_ZERO,\nso nothing changes for those.\n\nFound by code inspection, compile-tested only (W\u003d1). I don\u0027t have\ni40e/ice hardware to check the reply.\n\nFixes: b94b013eb626 (\"ice: Implement DCBNL support\")\nFixes: 5effa78e7c94 (\"i40e: Add netlink callbacks support for software based DCB\")\nSigned-off-by: Joas Antonio dos Santos \u003cjoasantonio108@gmail.com\u003e\nLink: https://patch.msgid.link/179289284460.50470.572724041164324949@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "775fede6a939d7e7564d9cbb28393ef8fe15a936", "tree": "ef03aa5f173ccb2e92a92ed935e70afce60422da", "parents": [ "fd1436a75ceb07c7029be02f89e8a1b34a6978c8", "ff8a7c0c06762a2a2333fbd6148d637bbd3d5090" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:12:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:12:38 2026 -0700" }, "message": "Merge branch \u0027net-bcmgenet-fixes-for-a-failed-resume-and-the-ring-rebuild\u0027\n\nNicolai Buchwitz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: bcmgenet: fixes for a failed resume and the ring rebuild\n\nMostly findings sashiko raised during my recent review sessions.\n\nPatch 1 is a resume that fails in bcmgenet_init_dma(), which leaves the\ninterface up with no datapath and the next ifdown hanging in\nnapi_disable() with RTNL held. It is one patch because nothing that\nresume leaves behind is reachable on its own, the second suspend never\nreturns until the hang is fixed.\n\nPatch 2 (was patch 4 in v1) is the Tx coalescing threshold going back\nto the driver default whenever the rings are rebuilt.\n\nPatch 1 fixes the rebuild path, not the root cause. bcmasp for example\nparks the PHY in its WoL suspend and has one deinit with a flag, which\nlooks like the direction for genet too. But one step at a time :)\n\nIt is also prep for the next version of my MTU series [1], which\ndrops the \"hallmark of a bad design\" flag in favour of the ring pointers\nit clears.\n\n[1] https://patch.msgid.link/20261013-nb-genet-mtu-nn-v2-v5-0-076b6fc240be@tipi-net.de\n\nFor backports: the WoL hunks in patch 1 need 254f3239dd07, on older trees\nthey can be dropped. The rest should apply on its own.\n\nTested on BCM2711 (Raspberry Pi CM4) with the resume allocation forced to\nfail. BCM2711 has no WoL irq, so I had to force the capability.\nWith this a magic packet wakes the board and the interface\nrecovers on the next suspend and resume. Thanks to Florian for pointing\nout that s2idle can do this at all.\n\nWoL doesn\u0027t wake the board after a failed resume though: as sashiko\npointed out init_umac() left UMAC_CMD at 10 Mb/s and only adjust_link puts\nit back, so it arms fine and then misses the packet. But this is\npre-existing, arguably even better since it no longer hangs the system\nlike before. IMHO the proper fix is to let resume allocate before it\ntouches the hardware ... I\u0027ll do that after the MTU series.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261022-nb-genet-fini-dma-net-v3-0-6e9fc89c0156@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff8a7c0c06762a2a2333fbd6148d637bbd3d5090", "tree": "ef03aa5f173ccb2e92a92ed935e70afce60422da", "parents": [ "1c1f51c3ee9ccf86462e36548291ed44fecd5355" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Thu Oct 22 10:54:07 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:12:36 2026 -0700" }, "message": "net: bcmgenet: restore the Tx coalescing setting when the rings are rebuilt\n\nbcmgenet_set_coalesce() writes tx_max_coalesced_frames straight into\nDMA_MBUF_DONE_THRESH and keeps no copy of it, while\nbcmgenet_init_tx_ring() programs a fixed 1. An ifdown and ifup or a resume\nthen puts the Tx coalescing back to one frame per interrupt.\n\nRx keeps its value per ring and reapplies it on init. Do the same for Tx.\n\nFixes: 2f9130709d2c (\"net: bcmgenet: Implement TX coalescing control knobs\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20261022-nb-genet-fini-dma-net-v3-2-6e9fc89c0156@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1c1f51c3ee9ccf86462e36548291ed44fecd5355", "tree": "a8c88015d024f0daa42b71d7aa9ffa91dee10772", "parents": [ "fd1436a75ceb07c7029be02f89e8a1b34a6978c8" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Thu Oct 22 10:54:06 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 16:12:35 2026 -0700" }, "message": "net: bcmgenet: recover from a failed resume\n\nA resume that fails in bcmgenet_init_dma() returns with the interface\nstill IFF_UP and the datapath gone. The next ifdown runs the teardown\na second time and napi_disable() waits for a NAPI_STATE_SCHED bit that\nnothing will clear:\n\n task:ip state:D\n usleep_range_state+0xec/0x158\n napi_disable_locked+0x254/0x318\n napi_disable+0x3c/0x68\n bcmgenet_netif_stop+0x1c8/0x318\n bcmgenet_close+0x24/0xd0\n __dev_close_many+0x18c/0x310\n\nRTNL is held across the wait, so everything else blocks behind it.\n\nThe same resume gates the clock and detaches the device. Close releases\nthe clock a second time and ifup fails with -ENODEV. The hardware filters\nstay armed, so the next WoL suspend wakes on any frame. That suspend sets\nCMD_RX_EN for magic packet detection, so the WoL resume reuses rings that\nare gone.\n\nA failed resume should leave a state the ordinary paths can handle. Clear\nrx_cbs and tx_cbs as they are freed so they answer whether a datapath\nexists, and leave the clock alone so close and suspend release it once.\nThe WoL resume rebuilds instead, so stop the PHY first, phy_start() only\ntakes PHY_READY or PHY_HALTED.\n\nFlagged in a sashiko review and reproduced on a CM4 by forcing the resume\nallocation to fail.\n\nFixes: b6e978e50444 (\"net: bcmgenet: add suspend/resume callbacks\")\nFixes: 254f3239dd07 (\"net: bcmgenet: revise suspend/resume\")\t# for the WoL parts\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261022-nb-genet-fini-dma-net-v3-1-6e9fc89c0156@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd1436a75ceb07c7029be02f89e8a1b34a6978c8", "tree": "56b23214027a9e531e9da706e66658aa3105547f", "parents": [ "94cea342e8915812b45f93c56e134041c7fdb4d7", "564313447e545eea13038f74ada9272ab129b3cb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 15:50:44 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 15:51:49 2026 -0700" }, "message": "Merge branch \u0027revert-advertising-the-tcp-mss-from-the-configured-mtu\u0027\n\nEsko Mobius AKA Yongjian Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nRevert advertising the TCP MSS from the configured MTU\n\nCommit 2640e6419594 (\"net: advertise TCP MSS from the configured MTU,\nnot the learned PMTU\") breaks TCP for clients behind networks that\nfilter inbound ICMP, when the server reaches them through a hop with a\nsmaller MTU: the handshake completes, then the connection stalls as\nsoon as the client sends full-size segments. This was reported in [1]\nand confirmed on 7.3-rc7; reverting the commit on top of 7.3-rc7 fixes\nit. Details and numbers are in patch 2.\n\nThe asymmetric (DSR-style) case that commit targets can still be served\nby the existing per-route advmss metric, which overrides the default\nafter the revert; patch 2 includes a test of that as well. If you would\nrather keep the new behaviour as an explicit opt-in some other way, I\nam happy to test or rework this.\n\nPatch 1 removes the packetdrill tests that assert the reverted\nbehaviour, patch 2 is the revert itself.\n\n[1] https://lore.kernel.org/regressions/4F0FAEB6-A13B-47F3-BFF1-C706686C6F64@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261026-advmss-revert-v1-0-272fa4b7ecb6@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "564313447e545eea13038f74ada9272ab129b3cb", "tree": "56b23214027a9e531e9da706e66658aa3105547f", "parents": [ "b4aac29a21d96974ae6e6d8e7b1b01e1f95c4348" ], "author": { "name": "Yongjian Wang", "email": "echoowall@gmail.com", "time": "Mon Oct 26 15:23:09 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 15:51:38 2026 -0700" }, "message": "Revert \"net: advertise TCP MSS from the configured MTU, not the learned PMTU\"\n\nThis reverts commit 2640e6419594 (\"net: advertise TCP MSS from the\nconfigured MTU, not the learned PMTU\").\n\nThat commit stopped the learned PMTU from lowering the MSS we advertise\nin SYN and SYN-ACK. For symmetric paths it argued that \"the peer runs\nits own PMTU discovery and usually already knows the real path MTU\".\nThat only holds if ICMP \"fragmentation needed\" can reach the peer. When\nthe peer sits behind a firewall that drops inbound ICMP, its PMTU\ndiscovery is a black hole (RFC 2923, section 2.1), and the smaller MSS\nwe advertised was the only thing keeping its full-size segments off the\nnarrow hop.\n\nInbound ICMP filtering is very common in enterprise and carrier\nnetworks, and it is pervasive in mainland China. We hit this in\nproduction after the commit was backported to 6.12.111: TCP connections\nthat reach a server through a relay with a smaller-MTU hop complete the\nhandshake, then stall as soon as the client sends full-size segments.\nClients on networks that let ICMP through, and connections that bypass\nthe relay, are unaffected, which made it hard to trace back to the\nkernel.\n\nReproducer, network namespaces on a single host:\n\n cli --(1500)-- r1 --(1456)-- r2 --(1500)-- srv\n\nr1 drops ICMP frag-needed towards cli. srv has already learned PMTU\n1456 towards cli, then cli uploads 1 MB to srv:\n\n kernel SYN-ACK MSS 1 MB upload\n 6.12.107 1416 OK\n 6.12.111 1460 stalls, times out\n 7.3-rc7 1460 stalls, times out\n 7.3-rc7 + this revert 1416 OK\n\nThe asymmetric case the commit was written for does not need a new\ndefault: the advertised MSS can already be set per route with the\nadvmss metric, which takes precedence over default_advmss(). With this\nrevert applied, on an asymmetric path where srv learned PMTU 1456\ntowards cli while cli-\u003esrv is 1500 end to end:\n\n srv route to cli SYN-ACK MSS largest cli-\u003esrv segment\n default 1416 1404\n advmss 1460 1460 1448\n\nSo DSR-style setups can opt in with \"ip route ... advmss \u003cmss\u003e\", while\nhosts whose peers cannot complete PMTU discovery keep working by\ndefault.\n\nFixes: 2640e6419594 (\"net: advertise TCP MSS from the configured MTU, not the learned PMTU\")\nCloses: https://lore.kernel.org/regressions/4F0FAEB6-A13B-47F3-BFF1-C706686C6F64@gmail.com/\nCc: stable@vger.kernel.org\nSigned-off-by: Yongjian Wang \u003cechoowall@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261026-advmss-revert-v1-2-272fa4b7ecb6@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b4aac29a21d96974ae6e6d8e7b1b01e1f95c4348", "tree": "9208ddac9d09c2678acaf9f54993f616a2531eb4", "parents": [ "94cea342e8915812b45f93c56e134041c7fdb4d7" ], "author": { "name": "Yongjian Wang", "email": "echoowall@gmail.com", "time": "Mon Oct 26 15:23:08 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Oct 28 15:51:33 2026 -0700" }, "message": "Revert \"selftests: net: packetdrill: add tests for advertised MSS with PMTU exceptions\"\n\nThis reverts commit e5c8e301b497 (\"selftests: net: packetdrill: add\ntests for advertised MSS with PMTU exceptions\").\n\nThese tests assert the behaviour introduced by commit 2640e6419594\n(\"net: advertise TCP MSS from the configured MTU, not the learned\nPMTU\"), which is reverted in the next patch because it causes a\nregression. Remove them first so the series stays bisectable.\n\nSigned-off-by: Yongjian Wang \u003cechoowall@gmail.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20261026-advmss-revert-v1-1-272fa4b7ecb6@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c339f4010dea8b0d754f84ace70cd1b089878ef8", "tree": "7494ea078a05b0b824c3f263260e45c1f78bcfd3", "parents": [ "d738fbd1a8b9d82ef5ea0d54a9e2b3ab7f1c24dd", "9d3475065167197742b0882aff21cf8e78393277" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:36:32 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:36:32 2026 -1000" }, "message": "Merge tag \u0027platform-drivers-x86-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver updates from Ilpo Järvinen:\n \"The usual updates for laptop quirks from HP, ASUS, Acer, Dell etc:\n - new model names and recent CPU support\n - more special button / function key handling\n - battery and hardware monitoring quirks\n\n Tool updates to intel-speed-select\n\n WMI now supports non-x86 architectures\n\n Miscellaneous cleanups / refactoring / improvements\"\n\n* tag \u0027platform-drivers-x86-v7.4-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (237 commits)\n platform/x86: asus-wmi: name the TUF keyboard RGB state and speed codes\n platform/x86: asus-wmi: fix TUF keyboard power state shutdown naming\n platform/x86: asus-wmi: rename TUF RGB state DEVID to _CMD\n platform/x86: asus-armoury: add power limits quirk for GU605CM\n platform/x86: asus-armoury: add power limits quirk for G533QS\n platform/x86: asus-armoury: add power limits quirk for GA402NV\n platform/x86: asus-armoury: add power limits quirk for FA608UP\n platform/x86: asus-armoury: add power limits quirk for FA608UH\n platform/x86: asus-armoury: add power limits quirk for FA608PM\n platform/x86: asus-armoury: add power limits quirk for G713QR\n platform/x86: ibm_rtl: Fix potential OOB read at signature search\n platform/x86: acer-wmi: Add support for Acer Nitro AN16-41\n platform/x86: acer-wmi: Cycle platform profile on mode key 0x4\n platform/x86: hp-wmi: Disable hwmon attributes when no fans are usable\n platform/x86: gpd pocket fan: Cancel work before releasing GPIOs\n platform/x86: asus-armoury: Add XBOX ROG Ally X 20 Tunables\n platform/x86: msi-wmi: Ignore WMI events for keys also handled by atkbd\n platform/x86: msi-wmi: Sort scancodes numerically\n platform: arm64: Add a driver for the EC found on ASUS Glymur machines\n MAINTAINERS: Add myself as a LENOVO drivers co-maintainer\n ...\n" }, { "commit": "d738fbd1a8b9d82ef5ea0d54a9e2b3ab7f1c24dd", "tree": "c46c8cc0289e1fbc5d23cb461436b9d42738b3c5", "parents": [ "ae3690eb2a994dd74a43639d6bf800b51f18b48c", "27285b099fbc5cb2ae3aef20f3bbd7b3c88b3005" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:32:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:32:13 2026 -1000" }, "message": "Merge tag \u0027media/v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media\n\nPull media update from Mauro Carvalho Chehab:\n \"Revert \u0027media: Don\u0027t hide I²C or SPI drivers by default\u0027\"\n\n* tag \u0027media/v7.4-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mchehab/linux-media:\n Revert \"media: Don\u0027t hide I²C or SPI drivers by default\"\n" }, { "commit": "ae3690eb2a994dd74a43639d6bf800b51f18b48c", "tree": "ada9a122afb164a72176950c9044483535e7b6cc", "parents": [ "e191b05f321b064a973399b7cdc003c0de89e5b9", "aff5e6a77fc69a7c490246465940d18422d7c631" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:27:09 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:27:09 2026 -1000" }, "message": "Merge tag \u0027dmaengine-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine\n\nPull dmaengine updates from Vinod Koul:\n \"This consists of start of work for hiding dmaengine internals and\n adding new APIs for dmaengine calls. Also couple of drivers and device\n and lot of updates esp AI-assisted improvements to drivers.\n\n Core:\n - Better document descriptor flags and clarify ordering rules around\n cookie completion\n - New APIs to start hiding dmaengine guts so that we can start making\n them internal\n\n New Support:\n - Nord and Maili GPI DMAengine support\n - DW axi dma updates and support for UltraRISC DP1000 controller\n - Apple M3 generation ADMACs support\n - Amlogic A9 SoC DMA controller driver\n - Sun6i refactoring and support for Allwinner A733 DMA controller\n\n Updates:\n - Freescale device_prep_peripheral_dma_vec support and dynamic\n scatter/gather chaining\n - TI crossbar and cppi DT schema conversion\n - zynqmp driver updates for error patch handling\n - Link list handling improvements for DW edma driver\n - ST dma40 improvements and corner case handling\"\n\n* tag \u0027dmaengine-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/dmaengine: (149 commits)\n dmaengine: amlogic: Fix regmap error check issue\n dmaengine: ste_dma40: Preserve the LCPA I/O address space\n docs: dmaengine: clarify ordering rules around cookie completion\n dmaengine: move driver-private helpers out of include/linux/dmaengine.h\n dmaengine: add dmaengine_desc_set_callback() helper\n dmaengine: add dmaengine_get_provider_device() API\n dmaengine: add dmaengine_get_max_xor() helper\n dmaengine: add dmaengine_get_cap_mask() and dmaengine_has_cap() helpers\n dmaengine: add dmaengine_get_copy_align() and related alignment getter helpers\n dmaengine: add dmaengine_is_*_aligned() helpers for DMA consumers\n dmaengine: add dmaengine_prep_dma_(pq|pq_val|interrupt|xor)() API\n dmaengine: sh: rcar-dmac: Add support for R-Car Gen5 SoCs\n dt-bindings: renesas,rcar-dmac: Add support for R-Car X5H SoC\n dmaengine: sh: rcar-dmac: SMMU doesn\u0027t need IPMMU workaround\n dmaengine: sh: rcar-dmac: fix style in struct initialization\n dmaengine: qcom: bam_dma: free interrupt before the clock in error path\n dmaengine: ppc4xx: fix typo \"contoller\" in comment\n dmaengine: ste_dma40: Search all blocks for fixed logical channels\n dt-bindings: dma: dma40: Restore disabled-channels\n dmaengine: ste_dma40: Validate memcpy configuration\n ...\n" }, { "commit": "e191b05f321b064a973399b7cdc003c0de89e5b9", "tree": "3d39ae34f3c0662113ee33edb6f4f539499ddb78", "parents": [ "1cb6cfab0916d18f88d44e4a23806b6c4cb355f8", "8f56fdf3d8cb9f1dbdc93bf9ac816698aa6f70b7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:21:13 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:21:13 2026 -1000" }, "message": "Merge tag \u0027phy-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy\n\nPull phy updates from Vinod Koul:\n \"As usual bunch of new device and driver support and updates to\n existing drivers:\n\n New Support:\n - Rockchip rk3576 csi dphy support\n - Mediatek MT8195, MT8196 DisplayPort PHYs. MT8196 PCI-Express Gen4\n S-PHY, MT8189 tphy support\n - Qualcomm Nord eUSB2, QMP USB PHY, QMP PCIe and Gen5x16 PHY support,\n M31 eUSB2 PHY, Maili QMP UFS \u0026 PCIe PHY, Shikra PCIe phy\n - New driver for Qualcomm CSI2 C-PHY/DPHY support and new APIs in\n core to parse phy nodes\n - Nvidia Tegra238 XUSB pad controller support, Tegra264 MPHY driver,\n Tegra264 xusb support\n - Thunderbolt phy support in core and Qualcomm driver support for\n USB4 for X1E platforms\n - Google Tensor SoC USB PHY driver\n - ASPEED AST2700 USB3 PHY driver\n - Microchip MCP2542 can phy support\n\n Updates:\n - FRL TxFFE config support and Samsumg driver support and runtime PM\n for dcphy driver\n - Mediatek optional repeater support for USB2 ports\n - Refactoring and improvements on rockchip usbdp driver\n - Apple USB4 pipehandler state support\n - Rockchip single-lane DP support\"\n\n* tag \u0027phy-for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/phy/linux-phy: (114 commits)\n phy: tegra: Add support for Tegra238 XUSB pad controller\n phy: tegra: xusb: Use dev_err_probe()\n dt-bindings: phy: tegra194: Add compatible for Tegra238\n MAINTAINERS: Add ASPEED USB3 PHY driver\n phy: aspeed: Add AST2700 USB3.2 PHY driver\n dt-bindings: phy: aspeed: Document AST2700 USB3.2 PHY\n phy: rockchip: phy-rockchip-inno-csidphy: add support for rk3576 variant\n dt-bindings: phy: rockchip-inno-csi-dphy: add rk3576 variant\n phy: mediatek: Add support for PCI-Express Gen4 S-PHY\n dt-bindings: phy: Document MT8196 MediaTek PCI-Express Gen4 S-PHY\n phy: tegra: Add Tegra264 MPHY driver\n dt-bindings: phy: Add nvidia,tegra264-mphy\n phy: rockchip: samsung-hdptx: Add support for FRL TxFFE level control\n phy: rockchip: samsung-hdptx: Handle PHY config after module reload\n phy: hdmi: Add optional FRL TxFFE config options\n phy: tegra: xusb: Add Tegra264 support\n phy: tegra: xusb: Increase timeout for USB2_TRK_COMPLETED polling\n phy: tegra: xusb: Use devm_clk_get_optional to fetch USB2 tracking clock\n dt-bindings: phy: tegra-xusb: Add support for Tegra264\n phy: freescale: fsl-samsung-hdmi: initialize default rate\n ...\n" }, { "commit": "1cb6cfab0916d18f88d44e4a23806b6c4cb355f8", "tree": "1f535fb6a2139bafad80bd8ab48983753762ccc4", "parents": [ "0d314add22247c91c74ef6ec093feee43fa2a9aa", "2e9eff8847a46530ab937696f340b9d5bea2e4ef" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:18:59 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:18:59 2026 -1000" }, "message": "Merge tag \u0027soundwire-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire\n\nPull soundwire updates from Vinod Koul:\n\n - CLOCK_STOP_MODE1 support in bus and Intel driver\n\n - DMI quirks for disabling ghost on Lenovo Yoga 7 Pro, Lenovo Yoga\n Slim 7, Lenovo Pro 9, Lenovo Yoga Slim 7i 14IPH11.\n\n - Few more codecs as wake capable, tac5xx2 family, rt718, rt766/rt767\n\n - Qualcomm Shikra SoC support\n\n* tag \u0027soundwire-7.4-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vkoul/soundwire:\n soundwire: intel_auxdevice: add rt766/rt767 codec to wake_capable_list\n soundwire: dmi-quirks: Disable ghost rt711 on Lenovo Yoga Slim 7\n soundwire: dmi-quirks: Disable ghost Realtek on Lenovo Yoga 7 Pro\n soundwire: intel_auxdevice: add rt718 codec to wake_capable_list\n soundwire: dmi-quirks: drop the ghost RT1320 on the Surface Pro 11 (Intel)\n soundwire: qcom: add EE-aware register layout for Shikra\n dt-bindings: soundwire: qcom: add qcom,shikra-soundwire compatible\n soundwire: Intel: stop sdw clock in system suspend\n soundwire: Intel: add wake_enable parameter to stop_bus ops\n soundwire: bus: add CLOCK_STOP_MODE1 support back\n soundwire: dmi-quirks: Disable ghost Realtek on Lenovo Pro 9\n soundwire: qcom: cache SCP_ADDRPAGE1/2 to preserve MBQ atomicity\n soundwire: bus: iterate DT compatibles for class-ID match\n soundwire: fix repeated words in log messages\n soundwire: intel_auxdevice: add tac5xx2 family to wake_capable_list\n soundwire: bus_type: Use devres to free slave IDA\n soundwire: dmi-quirks: add Lenovo Yoga Slim 7i 14IPH11\n soundwire: intel: initialise quirk_mask before reading it\n" }, { "commit": "0d314add22247c91c74ef6ec093feee43fa2a9aa", "tree": "7d75e00d32f9c9d41098460c3f64da8dafef1956", "parents": [ "f9350d59d7c186608a86326f2dad96ee6a2c9842", "7dd4cffdf4c2a496ccf783303a03d687a2127baf" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:17:28 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:17:28 2026 -1000" }, "message": "Merge tag \u0027rpmsg-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux\n\nPull rpmsg updates from Bjorn Andersson:\n\n - Allow virtio rpmsg to use separate transmit and receive buffer counts\n based on the vring sizes, and obtain buffer sizes from virtio config\n space when the feature is negotiated. Document the configuration and\n report the MTU in the sample driver.\n\n - Fix signal interruption and timeout handling while waiting for a\n virtio transmit buffer. Release the device tree node reference on\n MediaTek channel teardown.\n\n - Convert the rpmsg control ioctl comments to kernel-doc format.\n\n* tag \u0027rpmsg-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux:\n rpmsg: virtio: fix error handling in TX buffer wait\n rpmsg: mtk: release channel OF node on device teardown\n samples: rpmsg: Fix mtu printk specifiers\n samples: rpmsg: Add MTU size info\n docs: rpmsg: Add virtio config space details\n rpmsg: virtio_rpmsg_bus: Get buffer size from config space\n rpmsg: virtio_rpmsg_bus: Allow different size of tx and rx bufs\n rpmsg: virtio_rpmsg_bus: Rename rbufs and sbufs\n rpmsg: ctrl: use kernel-doc format for ioctl macros\n" }, { "commit": "f9350d59d7c186608a86326f2dad96ee6a2c9842", "tree": "6d6062e2180864af70a4f938475230dcce80e89d", "parents": [ "3ad1536d831a104b4134924d418b072b3f175e81", "a6e0c839f999007721d060618b6ca2134dad46a9" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:16:05 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:16:05 2026 -1000" }, "message": "Merge tag \u0027rproc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux\n\nPull remoteproc updates from Bjorn Andersson:\n\n - Add Qualcomm QMI Thermal Mitigation Device support for PAS-managed\n remote processors, with cooling device bindings and configurations\n for Hamoa, Kodiak, Lemans, Talos, Monaco, and Shikra CDSP and modem\n subsystems as applicable.\n\n - Add per-power-domain proxy performance states for Hawi CDSP and\n update Hawi, Maili, and SDX75 PAS compatible bindings and the SDX75\n device tree. Correct the Qualcomm ADSP startup timeout.\n\n - Fetch auto-boot firmware only once and synchronize boot work with\n device removal. Bound ELF section header accesses, improve trace\n diagnostics, and update coredump configuration documentation.\n\n - Set 48-bit DMA masks for TI K3 DSP and R5 remote processors, correct\n mailbox message types, and enable compile testing for more TI\n drivers. Fix i.MX address range boundary checks and DSP runtime PM\n ordering, and simplify mailbox notification handling.\n\n - Harden Xilinx mailbox setup and teardown and avoid sending\n notifications when the transmit queue is full. Propagate STM32\n optional IRQ lookup errors and correct the MediaTek MT8188 SCP\n register binding.\n\n* tag \u0027rproc-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/remoteproc/linux: (33 commits)\n remoteproc: qcom_q6v5_pas: Add QMI TMD cooling support for Shikra\n remoteproc: virtio: Remove stray white space\n remoteproc: virtio: Replace kmemdup with kmemdup_array\n remoteproc: virtio: Add vdev_to_rsc() helper\n remoteproc: core: Fetch the auto-boot firmware only once\n remoteproc: xlnx: fix typecast warnings\n remoteproc: qcom_q6v5_pas: enable QMI TMD cooling support\n remoteproc: qcom: pas: add support for TMD thermal cooling devices\n soc: qcom: Add QMI TMD support for remote thermal mitigation\n dt-bindings: remoteproc: qcom,pas: add #cooling-cells property\n remoteproc: qcom_q6v5_pas: add per-PD proxy performance states for Hawi CDSP\n dt-bindings: remoteproc: qcom,sm8550-pas: make qcom,hawi-cdsp-pas standalone\n arm64: dts: qcom: sdx75: Use SM8650 MPSS as fallback compatible\n dt-bindings: remoteproc: qcom,sm8550-pas: Make SDX75 MPSS fallback to SM8650\n dt-bindings: remoteproc: qcom,sm8550-pas: Add Hawi and Maili MPSS as SM8650 fallback\n dt-bindings: remoteproc: Fix MT8188 SCP regs\n remoteproc: Use %p for pointer formatting\n remoteproc: Add compile testing for additional TI drivers\n remoteproc: k3-dsp: Fix usage of omap_mbox_message and mbox_msg_t\n remoteproc: k3: Include what we need and only what we need\n ...\n" }, { "commit": "3ad1536d831a104b4134924d418b072b3f175e81", "tree": "d80bd6a28b6ed3e42b9212009242acd303aff3c7", "parents": [ "0ddbc782c0bb86c902eda146677087a6bfc398ee", "fc5eb1b0631aa3b34c530ae962d01699ed22a0ae" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:13:52 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:13:52 2026 -1000" }, "message": "Merge tag \u0027i3c/for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux\n\nPull I3C updates from Alexandre Belloni:\n \"This introduces the I3C hub support in the core with drivers still\n being worked on. Then we have the usual fixes and cleanups:\n\n Subsystem:\n - Add APIs for I3C hub support\n - Restrict HDR modes to those supported by the bus and target\n - Fix ACPI target enumeration on multi-instance controllers by\n extracting the bus-controller instance number and PID from the\n correct _ADR fields.\n - allocate IBI workqueue with WQ_HIGHPRI\n\n Drivers:\n - dw: Synaptics sl2610 support\n - mipi-i3c-hci: HDR-DDR support, cleanup and fixes\"\n\n* tag \u0027i3c/for-7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/i3c/linux: (28 commits)\n dt-bindings: i3c: Add Synaptics sl2610 i3c\n i3c: dw: switch to array-based exclusive reset control\n dt-bindings: i3c: dw: support up to two reset lines\n i3c: hub: Add support for the I3C interface in the I3C hub\n dt-bindings: i3c: Add NXP P3H2x4x i3c-hub support\n i3c: master: Add controller-only device operation helpers\n i3c: master: Add APIs for I3C hub support\n i3c: master: use named initializers for acpi_device_id\n i3c: master: adi: free the IRQ before unregistering the master\n i3c: master: amd: Report direct CCC read length in payload.actual_len\n i3c: mipi-i3c-hci: Add HDR-DDR support\n i3c: Restrict HDR modes to those supported by the bus and target\n i3c: mipi-i3c-hci: Support configurable device NACK retries\n i3c: mipi-i3c-hci: Remove invalid HDR-BT and Fm/Fm+ definitions\n i3c: mipi-i3c-hci: Remove invalid transfer size limit\n i3c: mipi-i3c-hci: Correct RESP_DATA_LENGTH to bits 15:0\n i3c: mipi-i3c-hci: Stop rings gracefully when suspending\n i3c: mipi-i3c-hci: Move DMA suspend/resume callbacks\n i3c: mipi-i3c-hci: Process multiple IBIs per interrupt\n i3c: mipi-i3c-hci: Fix runtime PM violation in i3c_hci_free_ibi()\n ...\n" }, { "commit": "0ddbc782c0bb86c902eda146677087a6bfc398ee", "tree": "165cb4c1a5f585dc0f4e10e7c9752eb851b34212", "parents": [ "65ba8f34ec886ec72b2c07ddc8cf3d815c32869d", "f0f400459bf6a037e70768de623fff3f8920b8bb" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:06:06 2026 -1000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Oct 28 07:06:06 2026 -1000" }, "message": "Merge tag \u0027for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply\n\nPull power supply and reset updates from Sebastian Reichel:\n \"Power-supply core:\n - introduce LOAD_SWITCH property\n - pack power_supply_desc to optimize memory\n - prevent power-supply device unregistration while callback runs\n - drop last CONFIG_OF build-time dependencies from the core\n - documentation fixes\n\n Power-supply drivers:\n - bq27xxx: add support for bq27z746, bq28z620\n - ab8500: add AB8505 support\n - bq257xx: fix probe time configuration race condition\n - multiple: convert drivers with custom LOAD_SWITCH properties to the\n new standard one\n - cros_charge-control: restore EC state on resume\n - qcom_battmgr: fix USB type reporting, notify charger online state,\n report full batteries and correct capacity on X1E\n - gpio-charger: always report as discharging if input power is\n missing\n - bq24190_charger: don\u0027t reset registers across system suspend\n - qcom_smbx: a lot of independent fixes\n - lots of error and module removal path fixes\n - misc fixes\n\n Reset drivers\n - misc fixes\"\n\n* tag \u0027for-v7.4\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sre/linux-power-supply: (77 commits)\n power: supply: gpio-charger: Report discharging without input power\n power: supply: qcom_battmgr: report full batteries\n power_supply: serialize property access with unregister\n power: supply: bq257xx: Describe the dev field in the driver data structure\n power: supply: qcom_battmgr: Notify charger supplies of online changes\n power: supply: generic-adc-battery: fix status with no supplier\n power: supply: qcom_battmgr: report the USB type from USB_ADAP_TYPE\n power: supply: sysfs: Ratelimit \"unavailable enum value\" warning\n power: supply: cros_charge-control: restore EC state on resume\n power: supply: qcom_smbx: set the charge enable after software control\n power: supply: generic-adc-battery: Propagate charged GPIO errors\n power: supply: sbs-battery: disable polling before supply teardown\n power: supply: pf1550: drain IRQ work before unregistering supplies\n power: supply: bq256xx: Expose VBUS state through extcon\n power: supply: ab8500_fg: Avoid reserved AB8505 CCConf bit\n power: supply: ab8500_fg: Finalize current measurements\n power: supply: ab8500_charger: Recover inactive AB8505 charger\n power: supply: ab8500_charger: Retry AB8505 USB detection\n power: supply: ab8500_charger: Skip absent AB8505 main charger\n power: supply: ab8500_charger: Handle detection errors\n ...\n" }, { "commit": "a6e0c839f999007721d060618b6ca2134dad46a9", "tree": "7313dede68164c50c653255e4e0aa352eeaf749a", "parents": [ "82d0bbd67c42a44f0e18b0b7b0da0f3ace0c9527" ], "author": { "name": "Dipa Ramesh Mantre", "email": "dipa.mantre@oss.qualcomm.com", "time": "Fri Sep 11 10:33:03 2026 +0530" }, "committer": { "name": "Bjorn Andersson", "email": "andersson@kernel.org", "time": "Wed Oct 28 08:14:21 2026 -0500" }, "message": "remoteproc: qcom_q6v5_pas: Add QMI TMD cooling support for Shikra\n\nAdd QMI TMD instance IDs and cooling device name arrays for CDSP\nand MPSS subsystems on Shikra to enable thermal mitigation support.\n\nSigned-off-by: Dipa Ramesh Mantre \u003cdipa.mantre@oss.qualcomm.com\u003e\nLink: https://lore.kernel.org/r/20260911-shikra_qmi_tmd-v1-1-96c1cca82f30@oss.qualcomm.com\nSigned-off-by: Bjorn Andersson \u003candersson@kernel.org\u003e\n" }, { "commit": "94cea342e8915812b45f93c56e134041c7fdb4d7", "tree": "f4c66feb1448cb7742050bffdbed9c4e69850b89", "parents": [ "083aaafd453c3fb14411519d6ada9a8917573fdb" ], "author": { "name": "Fang Xieyan", "email": "fangxy@xiaopeng.com", "time": "Mon Oct 26 17:07:17 2026 +0800" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 11:40:22 2026 +0000" }, "message": "net: sched: em_ipt: validate hook value from netlink\n\nem_ipt_change() accepts the user-provided TCA_EM_IPT_HOOK value\nwithout validating its range.\n\nThe value is later used in check_match() as \"1 \u003c\u003c im-\u003ehook\". A hook\nvalue of 32 or greater causes undefined behavior and may undermine the\nxt match hook-mask validation. The value is also passed to\nnf_hook_state_init() as a hook index.\n\nReject hook values outside the supported IPv4/IPv6 Netfilter hook\nrange after checking the required attributes, before loading the xt\nmatch or allocating the match state.\n\nReviewed-by: Weibin Liu \u003cliuwb@xiaopeng.com\u003e\nSigned-off-by: Fang Xieyan \u003cfangxy@xiaopeng.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "083aaafd453c3fb14411519d6ada9a8917573fdb", "tree": "6b3e12e495d76c7a29c246d840b141c86643d2e2", "parents": [ "1e860f42f41c6fbf3304f6a52be38245b9394982" ], "author": { "name": "Sicong Huang", "email": "congei42@163.com", "time": "Sat Oct 24 12:49:03 2026 +0800" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 10:09:46 2026 +0000" }, "message": "nfp: flower: fix use-after-free in neighbour update work\n\nThe netevent notifier handles neighbour updates and redirects by\nqueuing nfp_tun_neigh_update() on system_highpri_wq. Each work item\nholds a reference to the neighbour, but only stores a pointer to the\nflower app.\n\nDuring device removal, nfp_tunnel_config_stop() unregisters the\nnotifier. This waits for notifier callbacks to return, but does not\nwait for the work they queued. The teardown then frees app-\u003epriv and\napp without waiting for these work items. Flushing cmsg_work in\nnfp_flower_clean() does not cover the neighbour update work.\n\nA pending work item can therefore run after the app has been freed.\nIts call to nfp_flower_get_port_id_from_netdev() can then access freed\nmemory while checking whether the neighbour\u0027s device can be offloaded.\nEven notifications for unrelated devices can reach this check. The\nsame problem affects shutdown and probe error paths that tear down the\napp after the netevent notifier has been registered.\n\nOne possible interleaving is shown below. The neighbour belongs to\nanother network device that remains registered.\n\n CPU0 (remove) CPU1 (notifier / kworker)\n nfp_tun_neigh_event_handler()\n queue_work(system_highpri_wq, ...)\n return\n /* Work has not run yet. */\n nfp_tunnel_config_stop()\n unregister_netevent_notifier()\n /* Notifier callbacks have finished, but work may be pending. */\n nfp_flower_clean()\n vfree(app-\u003epriv)\n app-\u003epriv \u003d NULL\n nfp_app_free()\n kfree(app)\n nfp_tun_neigh_update()\n app \u003d update_work-\u003eapp\n nfp_flower_get_port_id_from_netdev()\n app-\u003epriv /* use-after-free */\n\nThe work items are allocated per event and free themselves, so they\ncannot be cancelled individually, and flushing system_highpri_wq is\nnot allowed. Use a dedicated workqueue for neighbour updates instead.\nIn nfp_tunnel_config_stop(), unregister the notifier and destroy the\nworkqueue before cleaning up the tunnel state. This prevents new work\nfrom being queued and waits for pending and running work to finish\nwhile the app and its resources are still valid.\n\nFound by code inspection.\n\nFixes: 0ad722bd9ee3 (\"nfp: flower: fix for take a mutex lock in soft irq context and rcu lock\")\nSigned-off-by: Sicong Huang \u003ccongei42@163.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "1e860f42f41c6fbf3304f6a52be38245b9394982", "tree": "cac0dbf2dca5261632f604aee9679fc761cc9f08", "parents": [ "d6f81fd6abe209f9803d8f74ce9ec69b8126bad3" ], "author": { "name": "Tristan Madani", "email": "tristan@talencesecurity.com", "time": "Fri Oct 23 19:53:09 2026 +0000" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 09:52:22 2026 +0000" }, "message": "ppp: fix stale pointer access after pskb_may_pull in ppp_ccp_peek\n\nppp_ccp_peek() caches a pointer to skb-\u003edata in dp after the first\npskb_may_pull(), then uses dp after a second pskb_may_pull(skb, len + 2)\nin the CCP_CONFACK handler. If the second pull triggers\npskb_expand_head() due to a cloned skb or frag linearization,\nskb-\u003ehead is freed and reallocated, leaving dp stale.\n\nThe stale dp is subsequently used in CCP_OPT_LENGTH() and passed to\ndecomp_init()/comp_init() which read from the freed memory.\n\nRe-derive dp from skb-\u003edata after the second pskb_may_pull.\n\nFixes: 1da177e4c3f41 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Tristan Madani \u003ctristan@talencesecurity.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "d6f81fd6abe209f9803d8f74ce9ec69b8126bad3", "tree": "320b3793378796cd94515cbf4a73f633a8066f01", "parents": [ "6fb4e32f2ce3234ae0c416872e911706a3484430" ], "author": { "name": "Kyle Zeng", "email": "kylebot@openai.com", "time": "Fri Oct 23 16:02:56 2026 -0400" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 09:49:11 2026 +0000" }, "message": "net: sched: prevent scheduling deactivated qdiscs\n\nTAPRIO can schedule a deactivated qdisc after some_qdisc_is_busy() has\nreported it idle.\n\nCommit 47e8dbb6e763 (\"net/sched: do not reset queues in graft operations\")\nmade graft deactivation skip queue reset, leaving TAPRIO\u0027s timer armed.\n\nA late callback schedules NET_TX softirq work, whose dequeue path can\nrace the unlocked child-queue reset in taprio_reset(). The same skb can\nbe queued for deferred freeing by RTNL and dequeued for transmission.\nIn the reproducer, the TAP reader frees it before __rtnl_unlock() reads\nits next pointer. KASAN reports a slab-use-after-free in\n__rtnl_unlock+0xa3/0xd0, with a read of size 8 from the freed skb.\n\nReject deactivated qdiscs in __netif_schedule(). Callers\u0027 RCU protection\nlets the existing grace period join earlier scheduling calls before the\nbusy check. Restart nonempty transmit queues on reactivation so suppressed\nscheduling does not strand packets.\n\nFixes: 47e8dbb6e763 (\"net/sched: do not reset queues in graft operations\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260805102514.740834-1-david.lee@trailofbits.com/\nAssisted-by: Codex:gpt-5.6-sol Codex:gpt-5.5-cyber\nSigned-off-by: Kyle Zeng \u003ckylebot@openai.com\u003e\nCo-developed-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: David Lee \u003cdavid.lee@trailofbits.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "6fb4e32f2ce3234ae0c416872e911706a3484430", "tree": "29de54aeb6964794bd1fdae21d2a69f31b7ebdb4", "parents": [ "22dd6bb2bafdf8b9740773a1e05cdb4df7a09ca2" ], "author": { "name": "Jérémy Jean", "email": "Jeremy.Jean@oss.cyber.gouv.fr", "time": "Fri Oct 23 18:51:19 2026 +0000" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 09:19:07 2026 +0000" }, "message": "inet: frags: prevent acceptance of partially authenticated reassembly\n\nA reassembled skb retains the secpath from its first fragment, which\nmakes it possible for the final policy check to accept bytes that were\nnot covered by the transform recorded on the skb. This can affect IPsec\ntunnel traffic, including AH and ESP, and allow a packet to be accepted\neven though only part of its payload was authenticated.\n\nReject a fragment when its secpath differs from the fragments already\nin the queue, and keep overlap statistics limited to actual overlaps.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jérémy Jean \u003cJeremy.Jean@oss.cyber.gouv.fr\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "22dd6bb2bafdf8b9740773a1e05cdb4df7a09ca2", "tree": "87edbba6aa6e0e3022089f054c657719190d9232", "parents": [ "1c8a70075235cd733095532a97f2405037c52a7b" ], "author": { "name": "Kiran Kumar K", "email": "kirankumark@marvell.com", "time": "Fri Oct 23 07:19:05 2026 +0000" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 08:58:59 2026 +0000" }, "message": "octeontx2-af: fix inner LC ltype match for RSS flowkey\n\nInner LC ltypes differ from outer LC ltypes, but RSS flowkey programming\nwas using outer LC IP/IP6 ltype masks for inner IP keys.\n\nFor inner IPv4/IPv6, match only the base IP ltype and do not include\nextension-header matches. Keep existing outer LC masks unchanged.\n\nThis fixes inner-tunnel RSS key calculation and prevents mismatches in\ninner IP flow classification.\n\nSigned-off-by: kmahammadraf \u003ckmahammadraf@marvell.com\u003e\nSigned-off-by: Kiran Kumar K \u003ckirankumark@marvell.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "1c8a70075235cd733095532a97f2405037c52a7b", "tree": "8f4fe9a749667ffb1e2289d7ec0278a1bd9533ed", "parents": [ "557d80138618b9d17407733d4ec25b33d3971d60" ], "author": { "name": "Rishikesh Jethwani", "email": "rjethwani@purestorage.com", "time": "Tue Oct 20 15:44:59 2026 -0600" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 08:45:02 2026 +0000" }, "message": "tls: keep TX and RX hardware offload on the same device\n\nAfter TX is offloaded on device A, a route change, or a change in the\nusable-slave set of an 802.3ad or balance-xor (layer3+4) bond, can make\nRX setup program device B. tls_device_attach() sees the existing TLS\ndestructor and keeps ctx-\u003enetdev pointing at A. The RX driver state on B\nis then untracked: tls_dev_resync() and tls_dev_del() are invoked on A\nfor a context it never created, and neither socket close nor\nNETDEV_DOWN on B calls tls_dev_del() for B, so the driver context leaks.\nThe reverse setup order has the same problem.\n\nCheck the shared device binding under device_offload_lock before each\ntls_dev_add(). Permit the first attachment and a second direction on the\nsame device. Reject a different device, including when the old binding\nwas cleared by NETDEV_DOWN: the TLS destructor remains installed and\ntls_device_attach() cannot establish a new binding. Setup then falls\nback to software for the requested direction.\n\nThe RX check precedes allocation and software setup. TX uses its existing\nresource unwind path without calling the driver. Document the shared\nbinding and clarify that fallback is per direction.\n\nThis issue was discovered during code review and subsequently\nreproduced on hardware using mlx5 and TLS 1.2 AES-GCM-128.\n\nChanging the route between TX and RX setup installed the second\ndirection on a different device. Driver traces showed successful adds\non both devices, but both deletes at socket close targeted the first\ndevice, leaving an orphaned context on the second. Both setup orders\nreproduced the leak, even though all current core TLS context counters\nreturned to zero. No crash was observed.\n\nWith the fix, the same tests correctly fall back to software for the\nsecond direction and leave no orphaned hardware context.\n\nFixes: 4799ac81e52a (\"tls: Add rx inline crypto offload\")\nSigned-off-by: Rishikesh Jethwani \u003crjethwani@purestorage.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "557d80138618b9d17407733d4ec25b33d3971d60", "tree": "56b249d33ae0f37e659b0fa9bacb59976c4395db", "parents": [ "5d7f3375cd574fc83f0cd30839b21455c0e79ae2" ], "author": { "name": "Peter Morrow", "email": "pdmorrow@gmail.com", "time": "Tue Oct 20 17:42:39 2026 +0100" }, "committer": { "name": "Dave Miller", "email": "davem@davem-thinkpadp1gen8.ibmlond.csb", "time": "Wed Oct 28 08:36:58 2026 +0000" }, "message": "net/mlx4: always create the eth and ib auxiliary devices\n\nSince commit 7d22b1cb9d84 (\"mlx4: Connect the infiniband part to the\nauxiliary bus\"), mlx4_core creates the \"ib\" auxiliary device only for\nan IB port or a device that advertises IBoE. Before it, each mlx4\ninterface was offered every device and decided in its own add callback.\nmlx4_ib_add() accepted Ethernet ports without IBoE and registered them\nfor raw packet QPs only.\n\nConnectX-3 VFs on Azure have an Ethernet port and no IBoE, so since\nv6.6 they get no RDMA device. DPDK\u0027s mlx4 PMD, which needs only raw\npacket QPs, then cannot open them:\n\n net_mlx4: cannot access device, is mlx4_ib loaded?\n\nRestore the old behaviour by creating both auxiliary devices for every\ndevice and letting mlx4_en and mlx4_ib decide in probe, as their add\ncallbacks did. mlx4_ib_probe() returns -ENODEV when there are no usable\nports, and mlx4_en_probe() binds a device without Ethernet ports but\ncreates no netdevs, as mlx4_en_add() did.\n\nTested on 6.12.111 on an Azure VM with two ConnectX-3 VFs: each gets an\neth and an ib auxiliary device, and DPDK attaches both VFs and passes\ntraffic through them.\n\nFixes: 7d22b1cb9d84 (\"mlx4: Connect the infiniband part to the auxiliary bus\")\nCloses: https://lore.kernel.org/r/20261014133951.3219055-1-pdmorrow@gmail.com\nSuggested-by: Leon Romanovsky \u003cleon@kernel.org\u003e\nAssisted-by: LLM\nSigned-off-by: Peter Morrow \u003cpdmorrow@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nAcked-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nSigned-off-by: Dave Miller \u003cdavem@davem-thinkpadp1gen8.ibmlond.csb\u003e\n" }, { "commit": "c8a8a68d3ab4a06c8f5a13a8c00275351c8239b4", "tree": "6ae442cabe0af6698e32cb3a7deb3c8662654c04", "parents": [ "6c476d2b73056ed151c3f8b884c627c75999ed7c" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Fri Oct 23 15:03:02 2026 +0000" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Oct 28 04:20:25 2026 +0000" }, "message": "bpf: Don\u0027t re-sort subprog_info[] for every new subprogram\n\nadd_subprog() appends new subprog to env-\u003esubprog_info[] and calls sort()\non the whole array, though only the last entry can be out of order.\nMove subprogs that start after the new one up by one entry instead.\n\u0027start\u0027 is unique, so the order of the array doesn\u0027t change. The new entry\ncan land in a used slot, so initialize all of it.\n\nadd_subprog() returns the index of the new subprog instead of the last\none. The callers check for error only.\n\nIt\u0027s a trivial prep for rust-bpf [1] that bumps BPF_MAX_SUBPROGS to 1024.\nRust crates have more than 256 functions that are not inlined.\n\nTime in add_subprogs() when veristat loads sched_ext schedulers from scx\nrepo, 8 cpu VM, usec:\n\n subprogs before after\n arena_selftest 101 386 27\n lavd_enqueue 52 96 16\n lavd_dispatch 48 78 11\n\n[1] https://github.com/4ast/rust-bpf\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Mahe Tardy \u003cmahe.tardy@gmail.com\u003e\nLink: https://patch.msgid.link/20261023150302.4097865-1-alexei.starovoitov@gmail.com\n" }, { "commit": "6c476d2b73056ed151c3f8b884c627c75999ed7c", "tree": "7f29b81c9156d6fa5a28aa3d9dea95b61dac6ff8", "parents": [ "9c3e3e9f4ddf0ef5046f79a545c1d40a62352d87" ], "author": { "name": "Feng Yang", "email": "yangfeng@kylinos.cn", "time": "Wed Oct 28 11:19:33 2026 +0800" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Oct 28 04:13:15 2026 +0000" }, "message": "bpf: Fix out-of-bounds btf-\u003etypes write for split BTF\n\nbtf_add_type() stores the types of a BTF in btf-\u003etypes[], which can hold at\nmost BTF_MAX_TYPE entries. The types of a split BTF get IDs start_id ..\nstart_id + nr_types - 1, so only BTF_MAX_TYPE - start_id of them fit, but\nneither the limit check nor the size used to grow the array accounts for\nstart_id: the check is an equality test against BTF_MAX_TYPE\n(\u0027start_id + btf-\u003etypes_size \u003d\u003d BTF_MAX_TYPE\u0027) and the new size is clamped\nto BTF_MAX_TYPE.\n\nThe check therefore only fires if the array happens to grow to exactly\nBTF_MAX_TYPE - start_id entries. Otherwise, if the module has more than\nBTF_MAX_TYPE types, the array is filled up to BTF_MAX_TYPE entries. The\nnext type that needs to be added reallocates the array to the same size,\nafter which btf-\u003etypes_size no longer equals btf-\u003enr_types and the growth\npath is not taken anymore, so every following type is written past the end\nof the array:\n\n BUG: unable to handle page fault for address: ffffc90006200000\n RIP: 0010:btf_add_type+0x74/0x270\n Call Trace:\n btf_check_all_metas\n btf_parse_module\n\nBound both the array size and the limit check by BTF_MAX_TYPE - start_id.\nBase BTF (start_id \u003d\u003d 0) is unaffected.\n\nFixes: 951bb64621b8 (\"bpf: Add in-kernel split BTF support\")\nSigned-off-by: Feng Yang \u003cyangfeng@kylinos.cn\u003e\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nReviewed-by: Mahe Tardy \u003cmahe.tardy@gmail.com\u003e\nAcked-by: Ihor Solodrai \u003cihor.solodrai@linux.dev\u003e\nLink: https://patch.msgid.link/20261028031933.277550-1-yangfeng59949@163.com\n" }, { "commit": "9c3e3e9f4ddf0ef5046f79a545c1d40a62352d87", "tree": "053cc1a10c0f7cadbe1d9c32b7249b441be76731", "parents": [ "815a0a2a40d6c5985a153041231731651bc4024b", "b433cdb1cc4f599d840ab33d97f8498625bef629" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Oct 28 04:07:03 2026 +0000" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Oct 28 04:07:04 2026 +0000" }, "message": "Merge branch \u0027bpf-remove-bpf_f_arena_scalar-fix-scalar-evolution-and-scalar-forks\u0027\n\nAlexei Starovoitov says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbpf: Remove BPF_F_ARENA_SCALAR, fix scalar evolution and scalar forks\n\nFrom: Alexei Starovoitov \u003cast@kernel.org\u003e\n\nThis series removes BPF_F_ARENA_SCALAR and fixes bugs in scalar evolution,\nin maybe_fork_scalars() and in the trampoline of may_goto. The groups of\npatches do not depend on each other.\n\nv1 was Part 1 of \"bpf: Stack in arena and a verifier that joins states\"\n[1]. Parts 2 and 3 of that series are not here.\n\n - Patches 1-6 remove BPF_F_ARENA_SCALAR, .arena.data and what came with\n them. The flag lets a prog access arena through plain numbers, for\n languages that have no address spaces. The compiler can emit one\n addr_space_cast for each pointer instead. That is cheaper than one more\n insn for each access. No released kernel has the flag.\n - Patches 7-8: scalar evolution does not clear \u0027delta\u0027 in a register that\n it widens. Then the verifier calculates an incorrect range for a linked\n register, and an unsafe prog loads.\n - Patches 9-10 make two selftests reliable: map_kptr and rcu_reentry.\n - Patches 11-12: scalar evolution widens a pointer to a buffer\n (PTR_TO_BUF). The verifier rejects an access to a buffer at a variable\n offset. Thus it rejects a correct loop over the per-cpu values of a map\n element.\n - Patches 13-15: two bugs in the clamp of scalar evolution. A pointer that\n the loop invalidates becomes a scalar with the range of the offsets of\n the pointer. A packet pointer keeps a range that is not valid for its\n new offsets. In the two cases an unsafe prog loads and crashes the\n kernel.\n - Patches 16-17: maybe_fork_scalars() splits a state in two and verifies\n the second state later, from the same insn. In a loop that scalar\n evolution counted, pruning drops the second state. Then no one verifies\n one of the two values, and a prog that reads out of bounds loads.\n - Patches 18-19: arch_bpf_timed_may_goto() does not save the registers in\n which the JITs pass stack arguments. After may_goto such an argument is\n not what the verifier knows about it. An unsafe prog crashes the kernel.\n\nTests on x86-64, compared with the same tests on the base:\n\n test_progs, test_progs-no_alu32, test_progs-cpuv4, no new failure\n test_progs-bpf_gcc, test_verifier, test_maps\n test_progs with KASAN no new failure\n veristat, 36 weekly builds of Cilium, 5032 progs same verdicts,\n insns -0.03%\n veristat, sched-ext/scx, 563 progs same verdicts\n veristat, selftests from clang 21, clang 24 and GCC see below\n\nIn the selftests the verdict changes only for the tests of this series and\nfor the tests of .arena.data. The change in Cilium is from patch 16. arm64\nis compile tested.\n\nv1 -\u003e v2:\n - Rebase on the fixes for scalar evolution from Eduard.\n - Drop \"bpf: One time slice of may_goto for a run of a prog\" and its\n tests. The patch has bugs. The insns at the exit of a subprog change R2,\n which is a part of a 16-byte return value (Ihor). A nested run of the\n prog starts the time slice again. I will send it as a separate series.\n - Patch 7: use clear_scalar_id() (Daniel).\n - Drop \"bpf: Fix a false verifier bug in the clamp of scalar evolution\"\n and its tests. Commit 0c33d612bdd5 (\"bpf: Do not intersect with current\n register range on clamp\") fixes the bug in a better way (Eduard).\n - Patch 5: name the two schedulers in C that set the flag.\n - Patch 11: correct the reason why two selftests load today.\n - Add patches 10, 13-15 and 18-19.\n - Add patches 16-17. They were patch 46 and a part of patch 75 in v1. The\n bug is in the tree today (Ihor). The log in v1 said that no prog is\n affected. That was wrong.\n\n[1] https://lore.kernel.org/bpf/20261026025943.404450-1-alexei.starovoitov@gmail.com/\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261027190314.1440199-1-alexei.starovoitov@gmail.com\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\n" }, { "commit": "b433cdb1cc4f599d840ab33d97f8498625bef629", "tree": "053cc1a10c0f7cadbe1d9c32b7249b441be76731", "parents": [ "4d0f560f4926417f010ce38f8628c41bcad29c9f" ], "author": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Tue Oct 27 19:03:14 2026 +0000" }, "committer": { "name": "Alexei Starovoitov", "email": "ast@kernel.org", "time": "Wed Oct 28 04:07:03 2026 +0000" }, "message": "selftests/bpf: Test stack arguments across may_goto\n\nEach test passes arguments 6-8 on the stack. Thus it uses all the registers\nin which the JITs of x86-64, arm64 and riscv64 pass stack arguments.\n\n may_goto then\n ------------------------------------------- ---------------------------\n 70000 iterations in the callee the callee reads the args\n the time is up in the callee the callee reads the args\n 70000 iterations in the caller, after the the caller calls the callee\n writes of the args\n\n70000 iterations have one look at the clock. Without the fix on x86-64 the\nsecond test fails, and the first test fails with the hpet clocksource. The\nthird test passes there. The result depends on the registers that the C\ncode uses.\n\nSigned-off-by: Alexei Starovoitov \u003cast@kernel.org\u003e\nLink: https://patch.msgid.link/20261027190314.1440199-20-alexei.starovoitov@gmail.com\n" } ], "next": "4d0f560f4926417f010ce38f8628c41bcad29c9f" }