)]}' { "log": [ { "commit": "6ebcf5074cff0402730c6981d2397139fee6322d", "tree": "686df3c240a48183eaf71f50a117ddcd15f121aa", "parents": [ "8c9190bfd18a2548dea677faed7d6ee11f3cb0c8" ], "author": { "name": "Ilya Maximets", "email": "i.maximets@ovn.org", "time": "Wed Sep 02 22:30:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 17:46:43 2026 -0700" }, "message": "net: openvswitch: don\u0027t schedule rebalancing if there are no datapaths\n\nDuring namespace initialization the masks rebalancing work is\nscheduled and automatically re-scheduled every 4 seconds afterwards.\nThis is happening in every namespace. On a large kubernetes node with\n500 pods, i.e., 500+ namespaces, this creates a decent amount of\nunnecessary churn scheduling 500 jobs every 4 seconds that take the\nmutex, check that there are no datapaths in their namespace, release\nthe mutex, re-schedule themselves and exit. These 500 unnecessary\nmutex locks may hold off operations in a single namespace that\nactually has a datapath configured and has real user requests to\nhandle under this lock. They can also add delay to removal of other\nnamespaces as ovs_exit_net() needs to take that lock as well and\nsynchronously waits for the work to be cancelled.\n\nLet\u0027s only fire the job when the first datapath is actually created\nand not re-arm it if there are no more datapaths configured in the\nnamespace.\n\nAnother approach would be to make ovs_mutex per-namespace, but it\u0027s\na much larger change that should be handled separately, and the\nunnecessary work scheduling feels like a waste regardless.\n\nIt\u0027s safe to check and re-arm outside of the mutex as DP_CMD_NEW\nhandler will re-arm if the new datapath appears. The scheduling\nattempt also doesn\u0027t change the work or delay if it is already queued,\nso it\u0027s also safe to call multiple times.\n\nSkipping the re-arming is more elegant than canceling on removal of\nthe last datapath as it allows us to not think about potential race\nconditions at a negligible cost of potentially one extra re-scheduling.\n\nmsecs_to_jiffies() moved to the macro to save on line length.\n\nSigned-off-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nAcked-by: Eelco Chaudron \u003cechaudro@redhat.com\u003e\nLink: https://patch.msgid.link/20260902203200.1416026-1-i.maximets@ovn.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8c9190bfd18a2548dea677faed7d6ee11f3cb0c8", "tree": "c92b378265f53bfb1ed2e301ea24ce917fb15e1f", "parents": [ "e84b89f17a12a7cfc526eb1c18ac02e8777e18c9" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Wed Sep 02 15:58:27 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 17:42:07 2026 -0700" }, "message": "net: phy: dp83848: check phy_read() return value in config_init()\n\ndp83848_config_init() reads BMCR to detect whether auto-negotiation is\nenabled, but does not check the phy_read() return value. On an MDIO read\nfailure phy_read() returns a negative errno, which is then used directly\nin a bitwise test; the auto-negotiation state is left undefined while\nconfig_init() still reports success.\n\nCheck the return value and propagate the error.\n\nCc: stable+noautosel@kernel.org # untested fix to unlikely driver error path\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260902065828.1031113-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e84b89f17a12a7cfc526eb1c18ac02e8777e18c9", "tree": "f25e91cadce3194664ada7bc5dca3cf54313d7c3", "parents": [ "94284e5442bac57a33da5dd48549eb5ec803fa97" ], "author": { "name": "Vitaliy Sochnev", "email": "sochnev.v.74@gmail.com", "time": "Tue Sep 01 19:32:54 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 17:34:46 2026 -0700" }, "message": "net: airoha: grow the small RX rings\n\nRaise the RX_DSCP_NUM() fallback from 16 to 32, the vendor SDK default,\nand give ring 4 the 128 descriptors already used for rings 2/11/15.\n\nRing 4 is the shared \"force to CPU\" ring that airoha_fe_vip_setup()\nroutes BOOTP, PPPoE Discovery, PPP LCP/IPCP/CHAP/PAP/IPv6CP, ISAKMP,\nDHCPv6, SIP and LLDP onto, so it sees the same bursty non-hashed traffic\nas the rings already on 128 while sitting on the smallest allowance.\nBoth CDMs forward to it: REG_CDM_FWD_CFG(1) and (2) each set\nCDM_VIP_QSEL_MASK to 4.\n\nThe NO_CPU_DSCP fix does not cover this. With it in place, at 16\ndescriptors the ring still dies during PPPoE negotiation on a Nokia\nXG-040G-MF: over 6455 devmem samples in 60 s, REG_RX_DMA_IDX advanced\n0x2c -\u003e 0x52 while REG_RX_CPU_IDX stayed at 15, descriptor 15 had DONE\nset on a 60-byte frame, descriptors 0-14 were empty, and q-\u003etail was 0.\nHw had completed a descriptor the strictly sequential consumer in\nairoha_qdma_rx_process() cannot reach, and negotiation never completes.\nAt 16 DHCP still works while PPPoE does not: a dial-up bursts Discovery,\nLCP, IPCP and CHAP where DHCP sends one packet every ~150 s. With this\nseries, 508 forced reconnects over 20 h saw no recurrence.\n\nRX_DONE_INT_MASK covers all 32 rings on both QDMA instances, so this\ncosts 544 more descriptors per instance, 1088 in total: 2.1 MiB of RX\nbuffers at PAGE_SIZE/2 each, plus 34 KiB of coherent descriptor memory.\n\nRing 4 and the VIP classification feeding it are shared driver-wide, with\nno DT or hardware property distinguishing one variant\u0027s ring 4 from\nanother\u0027s, so this is not scoped to a particular SoC.\n\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nSigned-off-by: Vitaliy Sochnev \u003csochnev.v.74@gmail.com\u003e\nLink: https://patch.msgid.link/978fe95e4c5ddb05ceb7d8c4d00ea2d2203b79d0.1788286284.git.sochnev.v.74@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "94284e5442bac57a33da5dd48549eb5ec803fa97", "tree": "b4fe414ad8f4e5a0feffd50603d4ba16d806f66d", "parents": [ "d5f5853f167fe2e584be013e111d03c1207969fe" ], "author": { "name": "Miguel Garcia", "email": "miguelgarciaroman8@gmail.com", "time": "Wed Sep 02 11:57:30 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 17:11:37 2026 -0700" }, "message": "devlink: use direct firmware requests for flash updates\n\nrequest_firmware() may enter the sysfs fallback and call\ntry_to_freeze(). Devlink invokes it while holding the instance lock,\ncausing syzbot to report:\n\n WARNING: syz-executor/... still has locks held!\n\nFirmware flash requests already name a file provided by userspace.\nUse request_firmware_direct() in both flash update paths so a missing\nfile fails immediately instead of entering the sysfs fallback. This\nkeeps the normal devlink locking intact.\n\nOn systems with CONFIG_FW_LOADER_USER_HELPER_FALLBACK\u003dy, devlink flash\ncan no longer obtain a missing image through that fallback. Callers still\nreceive the existing error result, and netlink users retain the extack\nmessage.\n\nCc: stable+noautosel@kernel.org # FW_LOADER_USER_HELPER_FALLBACK\u003dy has no known use\nReported-by: syzbot+372a7d84708b07f64d9b@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d372a7d84708b07f64d9b\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Miguel Garcia \u003cmiguelgarciaroman8@gmail.com\u003e\nLink: https://patch.msgid.link/20260902095739.3587287-1-miguelgarciaroman8@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5f5853f167fe2e584be013e111d03c1207969fe", "tree": "074436ca9f7602e40bacb8b091c7065bdc6e5d2b", "parents": [ "a5249d1d9a618b31e15e191faa4122dc5d9912b1" ], "author": { "name": "Adriano Cordova", "email": "adrianox@gmail.com", "time": "Tue Sep 01 22:57:04 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 16:59:23 2026 -0700" }, "message": "netdevsim: take bus device refcount before registering device\n\nnsim_bus_dev_release() drops nsim_bus_devs when a device is freed, but\nthe matching increment was done in new_device_store() after\nnsim_bus_dev_new() returned. When device_register() failed inside\nnsim_bus_dev_new(), put_device() invoked the release callback and\ndecremented without an increment, driving the refcount to zero; a later\ncreation then incremented from zero (refcount_t: addition on 0).\n\nIncrement nsim_bus_devs in nsim_bus_dev_new() before device_register(),\nand drop the bus reference in nsim_bus_exit() only after every device has\nbeen removed, so the completion cannot be signaled early.\n\nCc: stable+noautosel@kernel.org # netdevsim is a test harness, it\u0027s never loaded on production systems\nReported-by: syzbot+989ff6506f5c6d1ff56b@syzkaller.appspot.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d989ff6506f5c6d1ff56b\nSigned-off-by: Adriano Cordova \u003cadrianox@gmail.com\u003e\nLink: https://patch.msgid.link/20260902025704.34606-1-adrianox@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a5249d1d9a618b31e15e191faa4122dc5d9912b1", "tree": "6696657dccc50ceaccedb532bdc3a1cf10a8fd55", "parents": [ "7042c8c193e5d634198b7c766bb3a01c8e3ee0e2", "adf50c47a47f0f0f0b79dd58ffade9919cddebea" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 06 11:51:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 03 10:48:16 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.3-rc2).\n\nNo conflicts, or adjacent changes.\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "adf50c47a47f0f0f0b79dd58ffade9919cddebea", "tree": "9389cb569c2e813439e401dcc6b16aeebc3e0718", "parents": [ "8ab1afb2eb246ab15b301cd255b5943d208a93c1", "66817a9794263cd2a5dc4e99bf8e5fcc5ff7181e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:18:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:18:12 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from bluetooth.\n\n Previous releases - regressions:\n\n - page_pool: keep frag_offset aligned for odd-sized requests\n\n - sched: fix u32 duplicate handle when node ID pool is exhausted\n\n - udp: create exceptions before socket matching\n\n - igmp: convert struct ip_sf_list to RCU\n\n - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit\n\n - rds: acquire the fastpath locks in rds_conn_shutdown()\n\n - tipc:\n - protect node reset trace dump with node lock\n - fix NULL deref in tipc_named_node_up() on empty publication\n list\n\n - bluetooth:\n - L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n - hci_core: fix race condition during device registration\n\n - eth:\n - mlx5e: prevent stale XSK buffer release on refill retries\n - bridge: don\u0027t truncate the port group walk on teardown\n\n Previous releases - always broken:\n\n - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n\n - sched: fix skb sizing and action leak on reoffload delete\n\n - tcp: fix use-after-free in do_tcp_getsockopt()\n\n - af_packet: don\u0027t cast tpacket_hdr.tp_len to int in\n tpacket_parse_header()\n\n - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration\n\n - iptunnel: fix stale transport header during tunnel decapsulation\n\n - eth:\n - vxlan: fix use-after-free in vxlan_mdb_remote_src_del()\n - bonding: fix uninitialized transport header access in\n alb_determine_nd()\"\n\n* tag \u0027net-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)\n net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset\n net: airoha: enable RX_DONE interrupt for RX queue 31\n net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\n net/rds: acquire the fastpath locks in rds_conn_shutdown()\n net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n net/rds: tcp: don\u0027t force RDS_CONN_RESETTING over a concurrent shutdown\n net/rds: clear cp_flags bits individually in rds_conn_path_reset()\n net/rds: use clear_bit_unlock() in release_refill()\n net/rds: use wq_has_sleeper() in release_in_xmit()\n net: usb: qmi_wwan: add Compal EXM-G1x support\n net: macb: exclude software FCS from TX byte statistics\n net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n net: bridge: mcast: don\u0027t truncate the port group walk on teardown\n bonding: do not clear curr_active_slave prematurely when releasing all slaves\n net: qrtr: Send HELLO message on endpoint register\n octeontx2-af: Fix limiting SRIOV VF count logic\n bonding: alb: fix uninitialized transport header access in alb_determine_nd()\n s390/ctcm: Prevent XID null dereference\n net: psp: do not inherit the Rx association on clone\n ...\n" }, { "commit": "8ab1afb2eb246ab15b301cd255b5943d208a93c1", "tree": "24e95bd603d4bf846f1c247e5e50a191e0f2e1fb", "parents": [ "97be98b94dc8e43a3e4dedccaf9683fb806e49aa", "7ac81e2d2240f2c57bd073b0733e0b2abca38e82" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:30:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:30:45 2026 -0700" }, "message": "Merge tag \u0027for-7.3/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mikulas Patocka:\n\n - fix a dm-crypt race condition that could make errors not being reported\n\n - dm-cache:\n - fix rwsem being locked and unlocked from different processes\n - fix demotion statistics\n\n - dm-integrity:\n - set the \u0027stable writes\u0027 flag\n - fix a buffer overflow introduced in this merge window\n - fix an infinite loop if tag size is greater than 64\n\n - fix NULL pointer dereference in dm-integrity data-recovery mode\n\n - remove a bogus restriction on the dm-ebs starting sector offset\n\n* tag \u0027for-7.3/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm-ebs: fix incorrect device offset check in ebs_ctr()\n dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n dm cache: fix demotion stats in passthrough mode\n dm-integrity: fix infinite loop on discard with large tag size\n dm-integrity: fix buffer overflow with keyed discard\n dm-integrity: require stable writes for internal hash modes\n dm cache: fix issue with background work locking\n dm-crypt: fix a tiny race condition in crypt_dec_pending\n" }, { "commit": "97be98b94dc8e43a3e4dedccaf9683fb806e49aa", "tree": "f61a049a26ba4148e085c985a5d7827c74700f17", "parents": [ "940de590b839f71d6dc846160534bf202401b8b7", "0fecc393f2060e6bc25138df32cb923ec7071c6b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:10:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:10:04 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Serialize truncate, fallocate, and mmap fault paths with\n invalidate_lock, avoiding mmap failures during concurrent size\n changes and exposure of uninitialized data during allocation\n\n - Correct fallocate signal and zeroing error handling\n\n - Fix FITRIM range alignment to prevent discard requests from extending\n into allocated clusters\n\n - Fix free-cluster accounting when cluster-freeing rollback or bitmap\n clearing fails\n\n - Keep volumes marked dirty when ntfs errors have been recorded\n\n - Compute bi_sector in 512-byte units, preventing silent corruption on\n 4Kn devices\n\n - Validate sectors_per_cluster values and prevent undefined shifts when\n parsing MFT and index record sizes\n\n - Bound $AttrDef traversal to the loaded table size\n\n - Fix MFT record resizing, memmove overlap, and kmap_local cleanup\n issues\n\n - Improve error propagation across attribute, EA, and reparse\n operations, including returning -ERANGE for undersized xattr buffers\n\n - Avoid modifying the HasEA flag when setxattr fails and return\n DT_UNKNOWN when directory inode lookup fails\n\n - Reduce contention in WOF decompression by performing block reads\n outside the decompression lock\n\n* tag \u0027ntfs-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits)\n ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n ntfs: take invalidate_lock in ntfs_setattr_size()\n ntfs: handle signal interruption in fallocate\n ntfs: fix FITRIM range alignment\n ntfs: read WOF chunks outside the decompression lock\n ntfs: leave HasEA flag untouched on setxattr failure\n ntfs: fix race between fallocate and mmap reads\n ntfs: fix memmove overlap in ntfs_new_attr_flags\n ntfs: compute bi_sector in 512-byte units\n ntfs: reject invalid sectors_per_cluster in the boot sector\n ntfs: bound $AttrDef table walk to the loaded table size\n ntfs: fix undefined behavior in mft/index record size calculation\n ntfs: treat any nonzero dio zero-range return as an error\n ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize\n ntfs: do not mark the volume clean in sync_fs when errors were recorded\n ntfs: skip free cluster decrement when rollback fails\n ntfs: only count successfully cleared runs when freeing clusters\n ntfs: fix kmap_local leak in write_mft_record_nolock() error paths\n ntfs: return real error from ntfs_non_resident_attr_record_add()\n ntfs: preserve error code in ntfs_resident_attr_record_add()\n ...\n" }, { "commit": "7042c8c193e5d634198b7c766bb3a01c8e3ee0e2", "tree": "abe86edf6b64ddd4d934134a6ba8fef19017bd14", "parents": [ "b35d3d2fae3058265ba937544a3895cedce18d08" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Tue Sep 01 14:56:59 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 15:36:20 2026 +0200" }, "message": "net: libwx: rename wx_pf_flags to wx_flags\n\nThe flags defined in `enum wx_pf_flags` and its terminator\n`WX_PF_FLAGS_NBITS` were originally named with a \"PF\" (Physical Function)\nprefix. However, these flags are not exclusive to PFs and are also\nutilized by Virtual Functions (VFs).\n\nRename the enumeration to `enum wx_flags` and the bit count to\n`WX_FLAGS_NBITS` to accurately reflect their shared usage across both PF\nand VF drivers, and to prevent potential confusion.\n\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/9479B0506F544556+20260901065659.41273-1-jiawenwu@trustnetic.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b35d3d2fae3058265ba937544a3895cedce18d08", "tree": "8f52f93522f6cc9f557e4bf14bbb821d692e2fe7", "parents": [ "60c1bcdeeb8ecacb35a430f516d11d805922d017" ], "author": { "name": "Sang-Heon Jeon", "email": "ekffu200098@gmail.com", "time": "Tue Sep 01 20:09:11 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 12:50:03 2026 +0200" }, "message": "octeon_ep: remove redundant memset in octep_setup_pfvf_mbox()\n\nvzalloc() returns zeroed memory, so the memset after the allocation is\nredundant.\n\nNo functional change.\n\nSigned-off-by: Sang-Heon Jeon \u003cekffu200098@gmail.com\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260901110913.977745-1-ekffu200098@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "60c1bcdeeb8ecacb35a430f516d11d805922d017", "tree": "f3d8cbf0e5c8125b5e18a66efb570bdbe8f9052f", "parents": [ "8e2faf945a13fc73711a5227af8a1077523b590f" ], "author": { "name": "Naveen Mamindlapalli", "email": "naveenm@marvell.com", "time": "Mon Aug 31 11:56:00 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 12:32:40 2026 +0200" }, "message": "octeontx2-pf: Add NIXLF error and poison interrupt handlers\n\nRegister and handle the NIX LF error (NIX_LF_ERR_INT) and poison/RAS\n(NIX_LF_RAS) interrupt vectors, The handlers acknowledge the interrupt\nand log the status (ratelimited) to help debug NIX LF faults.\n\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nSigned-off-by: Naveen Mamindlapalli \u003cnaveenm@marvell.com\u003e\nLink: https://patch.msgid.link/20260831062600.839203-1-nshettyj@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "66817a9794263cd2a5dc4e99bf8e5fcc5ff7181e", "tree": "244b4a550f193d410e66e16d6e10fabdb5eb1ea5", "parents": [ "6b8fed2675fb75d23e6cf2b7e49c94926e884b34" ], "author": { "name": "HW He", "email": "hw.he@mediatek.com", "time": "Tue Sep 01 16:23:12 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 12:20:38 2026 +0200" }, "message": "net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n\nFraglist GRO and hardware GRO can create an fraglist of\nHW-GRO packets. This cannot be segmented back into\nthe original form on TCP tethering scenario.\n\nAvoid constructing such a GSO packet, by flushing an already\nbuilt fraglist GRO packet if a hardware GRO packet arrives.\n\nScenario (Tethering/Forwarding):\n1.Driver submits a single TCP packet, P1. P1 is kept in the\ngro_list as the first packet.\n\n2. The driver submits a TCP GSO skb, P2. P2 has already aggregated\nmultiple TCP packets by HW_GRO, and its non-linear data is stored in\nfrags[].\n\n3. P1 and P2 match the GRO rules, and since there is no local socket,\nthey are aggregated by skb_gro_receive_list(). The resulting skb,\nP3, has a frag_list entry that still contains frags[]:\nP3: [ Linear Data ] -\u003e frag_list -\u003e [ Linear Data ]\n [ frag[1] ]\n [ frag[2] ]\n ...\n4. Later, tcp4_gso_segment() or tcp6_gso_segment() calls\nskb_segment_list() to segment P3. However, skb_segment_list() only\nsegments the entries in frag_list. It does not segment the frags[]\ninside P2, so P3 is not restored to the original packets, which leads\nto IP fragmentation or packet drop in the following path.\n\nCheck skb_is_gso(skb) and current GRO method, make sure fraglist GRO\napplies to consecutive non-GSO skb, others adopt regular GRO path.\n\nFixes: 8d95dc474f85 (\"net: add code for TCP fraglist GRO\")\nSigned-off-by: Zhaoping Shu \u003czhaoping.shu@mediatek.com\u003e\nSigned-off-by: HW He \u003chw.he@mediatek.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260901082312.14596-1-zhaoping.shu@mediatek.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8e2faf945a13fc73711a5227af8a1077523b590f", "tree": "d15853b21b131f597b6ffc4e1b7abfab5dd9a832", "parents": [ "e048669dccec93e8c91a9e88cc3937e3a03979ed" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Aug 31 08:48:33 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 12:03:41 2026 +0200" }, "message": "net: stmmac: drop the queue-0 pinning for GSO frames\n\nstmmac_select_queue() forces every GSO frame (TCPv4/TCPv6/UDP-L4) onto\nTX queue 0, relying on the legacy assumption that at least queue 0 is\nalways TSO/USO capable. This is no longer needed since\nstmmac_features_check() already validates each GSO frame against the\ncapabilities of the queue it is mapped to, clearing the checksum and GSO\nfeatures for queues that cannot perform TSO (e.g. TBS queues or queues\nwithout TX checksum offload support).\n\nRemove stmmac_select_queue() so GSO frames are selected through the\nregular queue selection path (XPS, flow hashing and priority mapping)\nand can be spread across all TX queues. This also fixes the case where\nqueue 0 is not TSO-capable while other queues are, which previously\nforced all TSO traffic into software GSO. Non-GSO traffic is unaffected,\nsince the core already falls back to netdev_pick_tx() when ndo_select_queue\nis not set.\n\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260831-stmmac_select_queue-tso-fix-v3-1-d9c215fe7a85@oss.qualcomm.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e048669dccec93e8c91a9e88cc3937e3a03979ed", "tree": "c987630e9a00c799cea929270d5ec7f28cb3511c", "parents": [ "1ab75e8bbfbff3e93e0ea06f33bd970c5324d31c" ], "author": { "name": "Juuso Rinta", "email": "juuso.rinta@nokia.com", "time": "Tue Sep 01 08:17:36 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 11:48:25 2026 +0200" }, "message": "octeontx2: use dev_err_probe() for deferred probe\n\nThe PF and VF drivers warn and return -EPROBE_DEFER when the AF has\nnot programmed the RVUM revision or does not answer the mailbox READY\nmessage. That is expected until rvu_af has finished initializing, so\nthe warning is repeated on every deferred retry.\n\nUse dev_err_probe() instead of dev_warn() so the expected deferral is\nnot printed at warning level. -EPROBE_DEFER is logged at debug level\nand the reason is recorded in devices_deferred.\n\nSigned-off-by: Juuso Rinta \u003cjuuso.rinta@nokia.com\u003e\nAcked-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260901-octeontx2-dev-err-probe-v1-1-1b5e1affb994@nokia.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6b8fed2675fb75d23e6cf2b7e49c94926e884b34", "tree": "f7238d9d7cb82214b24aa5a914354f8f25512765", "parents": [ "7db28abbea0f7dc1ec4fdfdc149db5fbd9e4c994" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Aug 31 19:06:38 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 11:45:30 2026 +0200" }, "message": "net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset\n\nThe core software reset issued in stmmac_init_dma_engine() during\nndo_open() callback clears the MTL RX packet parser registers, but\nstmmac_rxp_config() is only invoked from the cls_u32 add/delete paths.\nAfter an ifdown/ifup cycle the hardware therefore runs with the default\nall-pass table while priv-\u003etc_entries still reports the filters as\ninstalled. Re-apply the RX packet parser table from priv-\u003etc_entries in\nstmmac_hw_setup(), right after the software reset, so the filters are\nrestored when the interface is brought up again.\n\nFixes: 4dbbe8dde848 (\"net: stmmac: Add support for U32 TC filter using Flexible RX Parser\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260831-stmmac_tc_cls32_reconfigure-v1-1-21cb459e64ae@oss.qualcomm.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7db28abbea0f7dc1ec4fdfdc149db5fbd9e4c994", "tree": "f95fcc38e8737cce543a0e9b9d174088384ff542", "parents": [ "2f38e26a5741abdf152c1b56b22144a06d30fd66" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Sun Aug 30 14:28:27 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 11:40:51 2026 +0200" }, "message": "net: airoha: enable RX_DONE interrupt for RX queue 31\n\nRX queue 31 has always been allocated and filled by airoha_qdma_init_rx()\nsince RX_DONE_INT_MASK spans queues 0-31, but none of the RX_IRQ*\n_BANK_PIN_MASK values covered BIT(31). As a consequence the RX_DONE\ninterrupt for queue 31 was never enabled, airoha_qdma_rx_process() never\nran on that queue and its buffers were never reaped.\n\nRoute RX queue 31\u0027s RX_DONE interrupt to IRQ bank 1 so that the queue\nis drained and its buffers returned to the page pool.\n\nFixes: f252493e1835 (\"net: airoha: Enable multiple IRQ lines support in airoha_eth driver.\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260830-airoha-rxdone-rxq31-v1-1-830a91503f2f@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1ab75e8bbfbff3e93e0ea06f33bd970c5324d31c", "tree": "1c10747113f34f356f1af9dc7b474c1f05a005fb", "parents": [ "e16acadb9a0f7a0f04318e4b3a8e89e8ddd0c905", "6815415d68b98bd34d22aa0631c71b0fb7cbc7f5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 10:31:36 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 10:31:36 2026 +0200" }, "message": "Merge branch \u0027net-stmmac-dwmac4-auto-discover-uc-filter-size\u0027\n\nMaxime Chevallier says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: dwmac4: Auto-discover UC filter size\n\nFollowing my attempts to get clean ethtool selftests runs on stmmac [1],\nseveral issues were found with the unicast filtering.\n\n[1]: https://lore.kernel.org/netdev/20260827134004.45ffb57e@kernel.org/\n\nThis lead to the discovery that on dwmac4 platforms, the unicast filter\nsize is always falling back to the default value of 1 entry. On older\nvariants, the size comes from devicetree.\n\nWith a single-entry filter, we directly fallback to unicast promisc as\nsoon as any entry is added in the dev-\u003euc list.\n\ndwmac4 exposes through the HW_Features0 register the actual size of the\nunicast filter, which is made of 3 banks (details in patch 2). Let\u0027s use\nthis feature to grab the filter size.\n\nResults on actual hardware :\n\n - imx8mp : goes from 1 entry to 64\n - stm32mp1 : goes from 1 entry to 4\n - jh7110 : goes from 1 entry to 9\n - yt6801 : still 1 single entry, on extra implemented in HW\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831070121.349778-1-maxime.chevallier@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6815415d68b98bd34d22aa0631c71b0fb7cbc7f5", "tree": "1c10747113f34f356f1af9dc7b474c1f05a005fb", "parents": [ "384ee2379a66a86903e1acccc30c2f87a3020809" ], "author": { "name": "Maxime Chevallier", "email": "maxime.chevallier@bootlin.com", "time": "Mon Aug 31 09:01:20 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 10:31:34 2026 +0200" }, "message": "net: stmmac: dwmac4: Use the full perfect filter ability for UC filter\n\nContrary to dwmac1000 that gets its number of perfect filter entries\nthrough the \u0027snps,perfect-filter-entries\u0027 property, dwmac4 allows\nreading the filter size from the HW features registers.\n\nPerfect filter is used for Unicast filtering, and can contain up to 128\nentries, each having its own set of registers to access it.\n\nThe registers are always at the same location in the map, regardless\nwhether or not the entry is implemented in hardware. Accessing a register\nfor an un-implemented entry just doesn\u0027t do anything.\n\nThe filter is made of one always-available entry, and 3 configurable\nbanks :\n\n Entry 0 : Always implemented, stores the primary MAC address\n\n Entry 1 \\\n ... + -- Can contain between 0 and 31 entries. Number of available\n Entry 31 / entries in HW_Features0[18:22].\n\n Entry 32 \\\n ... + -- Additional 32 entries, all or nothing. Availability is\n Entry 63 / specified by HW_Features0[23]\n\n Entry 64 \\\n ... + - Additional 64 entries, all or nothing. Availability is\n Entry 127 / specified by HW_Features0[24].\n\nEach of the 3 configurable banks are independently selectable, meaning\nwe can have gaps in the register banks.\n\nFor instance, a setup with 50 addresses enabled will have 17 entries in\nthe first bank and the additional 32 bank enabled (50 \u003d 32 + 17 + 1).\n\nAnother example with 70 addresses : 64 addr bank on, 5 addresses in the\nfirst bank (70 \u003d 64 + 5 + 1).\n\nWhile I haven\u0027t seen HW with gaps in the banks, Synopsys confirmed this\nis a real possibility.\n\nLet\u0027s therefore introduce a dwmac4 helper to get the physical slot\nnumber of a given entry, allowing to configure the correct bank when\npopulating the filter. As we need the HW feature-set to compute the\nindex, store the bank info in the mac_device_info struct.\n\nThe total number of available entries is computed based on the\ndiscovered parameters, instead of using the default value of 1.\n\nResults on HW that uses dwmac4 :\n\n - imx8mp : goes from 1 entry to 64 (1 + 31 + 32)\n - stm32mp1 : goes from 1 entry to 4 (1 + 3)\n - jh7110 : goes from 1 entry to 9 (1 + 8)\n - yt6801 : goes from 1 entry to hum, 1 entry (no extra addresses)\n\nSigned-off-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260831070121.349778-3-maxime.chevallier@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "384ee2379a66a86903e1acccc30c2f87a3020809", "tree": "581c6127980ce19cb73eaf6eb0a140573b6f790a", "parents": [ "e16acadb9a0f7a0f04318e4b3a8e89e8ddd0c905" ], "author": { "name": "Maxime Chevallier", "email": "maxime.chevallier@bootlin.com", "time": "Mon Aug 31 09:01:19 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 10:31:34 2026 +0200" }, "message": "net: stmmac: dwmac4: Read the UC filter size from hardware capabilities\n\ndwmac4 has multiple banks of perfect filter entries, independently\nconfigurable during IP integration.\n\nThe multi_addr bank reports a number between 0 and 31 corresponding to\nthe actual number of entries in that bank, while the 32 and 64 banks\nare all-or-nothing.\n\nExpose these caps over debugfs as well.\n\nSigned-off-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260831070121.349778-2-maxime.chevallier@bootlin.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e16acadb9a0f7a0f04318e4b3a8e89e8ddd0c905", "tree": "48df5602bbe88627da3253abfb9802d7fd94f10c", "parents": [ "3498acda6b68139ec7b8037dbdf1ea720997ed04", "5f28f63c5d1984f71685bc39ea62964c068b1a5d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:59 2026 -0700" }, "message": "Merge branch \u0027net-dsa-motorcomm-add-led-support\u0027\n\nDavid Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: motorcomm: Add LED support\n\nLEDs can be described in the device tree using the standard LED node\nnotation. Currently, only parallel mode and strict 1:1 mapping (i.e. the\nHW default) are supported.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831044818.4103477-1-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5f28f63c5d1984f71685bc39ea62964c068b1a5d", "tree": "48df5602bbe88627da3253abfb9802d7fd94f10c", "parents": [ "9af9a816821365e57736307bfdfcf06d89065556" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Mon Aug 31 12:38:58 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:54 2026 -0700" }, "message": "dt-bindings: net: dsa: yt921x: Add LEDs definition example\n\nAdd LEDs definition example for yt921x to describe how they should be\ndefined for a correct usage.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260831044818.4103477-6-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9af9a816821365e57736307bfdfcf06d89065556", "tree": "642d5fd8d05ef42a5c80f6a4a65a54fe0ba6dd97", "parents": [ "e9423a64d382ba77a2906f365416714ede67328e" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Mon Aug 31 12:38:57 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:54 2026 -0700" }, "message": "net: dsa: motorcomm: Add LED support\n\nEach port has at most 3 LEDs connected and can be declared using the\nstandard LEDs structure.\n\nCurrently, only parallel mode and strict 1:1 mapping (i.e. the HW\ndefault) are supported.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831044818.4103477-5-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e9423a64d382ba77a2906f365416714ede67328e", "tree": "f9e44bf1b4f7991488545c1b0f14c2b008770387", "parents": [ "9c472a0d7c3893e568e1b61728d443a9d10bb3a8" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Mon Aug 31 12:38:56 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:54 2026 -0700" }, "message": "net: dsa: motorcomm: Split SMI module\n\nSMI operations are going to be used across different modules. Minor\nchanges are applied to fix build errors.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831044818.4103477-4-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9c472a0d7c3893e568e1b61728d443a9d10bb3a8", "tree": "b602305dae0e164b5b7955b0e4ac1dcebff0dad1", "parents": [ "b1950d0426aabdda485c86b504106b1d7b11f325" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Mon Aug 31 12:38:55 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:54 2026 -0700" }, "message": "net: dsa: motorcomm: Move to subdirectory\n\nyt921x is already the longest single-file DSA driver, so it\u0027s time to\nsplit it into parts.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831044818.4103477-3-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b1950d0426aabdda485c86b504106b1d7b11f325", "tree": "7167e21304d5c61afd32faaf5e348b3e9787de1e", "parents": [ "3498acda6b68139ec7b8037dbdf1ea720997ed04" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Mon Aug 31 12:38:54 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:58:53 2026 -0700" }, "message": "net: dsa: yt921x: Check lock status with lockdep_assert_held_once()\n\nmutex_is_locked() was used to check the lock status. While it should not\nbe triggered unless a bug is introduced, it does not warn on lock being\nheld by another thread. Fix it with lockdep helpers.\n\nFixes: 186623f4aa72 (\"net: dsa: yt921x: Add support for Motorcomm YT921x\")\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831044818.4103477-2-mmyangfl@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2f38e26a5741abdf152c1b56b22144a06d30fd66", "tree": "cce250f75fa456622621f08487d9932bb3600e45", "parents": [ "08710f033e3e35704e45adf8a95b5043ece34899", "260c6308fe2e19ad519389d44d582e292aecc3af" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:26 2026 -0700" }, "message": "Merge branch \u0027net-rds-own-the-fastpath-locks-across-connection-teardown\u0027\n\nAllison Henderson says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/rds: own the fastpath locks across connection teardown\n\nThis is v5 of the follow-up set to \"net/rds: Bug fix ports, part 2\"\n[1] (v1 at [2], v2 at [3], v3 at [4], v4 at [5]). During review of part 2,\nthe later half of that series needed more work than a respin, so it was\nsplit off into this set together with the companion fixes identified\nalong the way. As discussed on the v2 thread, it is targeted at net.\n\nRDS connection teardown quiesces the transmit and receive-refill fast\npaths by waiting for the RDS_IN_XMIT/RDS_RECV_REFILL bits to be\nsampled clear. Sampling a bit clear is not owning it: the fast path\ncan re-take its bit right after the wait returns and then run\nconcurrently with the transport shutdown and the send-state reset.\nOracle UEK closed this by making teardown acquire the bits as locks\n(\"rds: Make sure transmit path and connection tear-down does not run\nconcurrently\"); patches 5 and 6 do the same for the two\nrds_send_path_reset() call sites upstream.\n\nMaking teardown block on the bits as locks promotes several latent\nordering bugs from rare to load-bearing, so they are fixed first:\n\n Patches 1 and 2 fix the release side of the two bit locks.\n release_in_xmit() and release_refill() both clear their bit and then\n test for waiters, but the barrier is on the wrong side of the clear\n to order the critical section\u0027s stores before the release, and the\n waiter check does not order against the clear. Once teardown blocks\n on these bits as locks (uninterruptible and untimed), a lost wake-up\n or a store observed out of order stops mattering only in theory.\n Use clear_bit_unlock() and wq_has_sleeper(), the pattern already\n half-present in release_in_xmit().\n\n Patch 3: rds_conn_path_reset() wipes the whole cp_flags word with a\n plain store. Once teardown owns bits in that word across the reset,\n a blanket store would end lock ownership early - and it already\n races atomic RMWs on the same word today. Clear the bits the reset\n is responsible for individually, as Oracle UEK also does.\n\n Patch 4: rds_tcp_reset_callbacks() stores RDS_CONN_RESETTING\n unconditionally, which can overwrite the RDS_CONN_ERROR or\n RDS_CONN_DISCONNECTING of a shutdown already in progress on the same\n path and send that shutdown through an extra drop cycle. Once the\n accept path can park for the duration of a teardown (patch 6) that\n window widens, so make the transition conditional first, as Oracle\n UEK does.\n\nWith those in place, patch 5 converts rds_tcp_reset_callbacks() from\nwaiting on RDS_IN_XMIT to acquiring it, holding it across the socket\nswap and rds_send_path_reset(), and patch 6 has rds_conn_shutdown()\nhold both bit locks across the transport shutdown and path reset.\n\nPatch 7 fixes a pre-existing teardown-state hole that this series\nmakes easier to hit but did not introduce. Since commit\ne97656d03ca0 the final transition in rds_conn_shutdown() accepts\nRDS_CONN_ERROR as well as RDS_CONN_DISCONNECTING, so that a FIN\nprocessed during the teardown does not derail the shutdown. But\nconsuming that RDS_CONN_ERROR also consumes the shutdown pass that a\nconcurrent rds_conn_path_drop() queued along with it. For a FIN that\nis harmless; for rds_tcp_accept_one() it is not. A drop can race the\naccept\u0027s DOWN -\u003e CONNECTING path claim, the accept then installs the\nfreshly accepted socket while the drop\u0027s teardown - which sampled\ntc-\u003et_sock before that socket existed - is still running,\nrds_connect_path_complete() fails and drops the path again, and if the\nin-flight shutdown\u0027s final transition then swallows that\nRDS_CONN_ERROR, the pass that should reap the just-installed socket\nfinds the path already RDS_CONN_DOWN and does nothing. The socket is\nleaked with its callbacks armed and its rds_tcp_connection still on\nrds_tcp_tc_list, the peer sees an established connection that nothing\nreads, and the path wedges in RDS_CONN_DOWN. Make the final\ntransition DISCONNECTING -\u003e DOWN only and leave a racing drop\u0027s\nRDS_CONN_ERROR alone, so the pass it queued runs and tears down\nwhatever attached to the path; the branch quiesces the reconnect\ntimer itself, since a pending destroy can suppress that pass (see the\nchanges below).\n\nThis surfaced while re-reviewing v3: whether the\nrelease-then-transition ordering in patch 6 could let a woken waiter\ninstall a socket that the teardown then strands. Chasing that down,\nthe reachable form of the leak turned out to be the accept-vs-drop\nrace above rather than the parked-waiter path (a path mid-teardown is\nnever handed to rds_tcp_reset_callbacks(): rds_tcp_accept_one_path()\nonly claims a path it can move DOWN -\u003e CONNECTING), and it predates\nthis series. It reproduces on an instrumented kernel - a test-only\ndrop injected into the accept window plus a widened teardown-to-tail\nwindow - as an ESTABLISHED socket with an ever-growing receive queue\non a path stuck down; the same kernel runs clean with patch 7.\n\nThe set was built per-commit, run through the rds selftests (tcp and\nrdma/rxe), and exercised with a connection/netns churn load and\nmodule load/unload cycles; the patch 7 destroy-window fix was\nadditionally verified against an instrumented kernel that reproduces\nthe timer-left-armed WARN deterministically (fires on every destroyed\npath unfixed, silent with the fix).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260828223921.202913-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "260c6308fe2e19ad519389d44d582e292aecc3af", "tree": "cce250f75fa456622621f08487d9932bb3600e45", "parents": [ "813f3582ac7ae9f60f917937d54660e0952d5f2d" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:21 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:24 2026 -0700" }, "message": "net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\n\nrds_conn_shutdown() finishes by moving the path from\nRDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts\nRDS_CONN_ERROR as the starting state of that final transition, so that\na FIN processed in softirq context during the teardown does not derail\nthe shutdown into a noisy error path.\n\nBut consuming that RDS_CONN_ERROR also consumes the shutdown pass that\ncame with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues\ncp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN\nis a no-op. For the FIN case that is harmless - the socket the FIN\narrived on is the very socket the teardown just released. It is not\nharmless for a dropper that attached something to the path first.\n\nrds_tcp_accept_one() is such a dropper. Its path claim in\nrds_tcp_accept_one_path() transitions RDS_CONN_DOWN -\u003e\nRDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous\nsocket in softirq context, an administrative reset - can put the path\ninto RDS_CONN_ERROR between that claim and the state check that\nfollows, which accepts RDS_CONN_ERROR. The accept then installs the\nfreshly accepted socket with rds_tcp_set_callbacks() while the queued\nteardown - which sampled tc-\u003et_sock before this socket existed - is\nstill running. rds_connect_path_complete() fails its transition to\nRDS_CONN_UP and drops the path again, queueing the pass that should\nreap the socket it just installed. If the in-flight shutdown\u0027s final\ntransition consumes that drop\u0027s RDS_CONN_ERROR, the queued pass finds\nthe path in RDS_CONN_DOWN and does nothing. The installed socket is\nnever torn down: it sits established with its callbacks armed and its\nrds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that\nnothing ever reads, and the path is wedged in RDS_CONN_DOWN until some\nlater event drops it again. Reproduced with widened race windows as\nan ever-growing receive queue on a socket owned by a path stuck in\nRDS_CONN_DOWN, with the peer\u0027s send path wedged behind it.\n\nMake the final transition only DISCONNECTING -\u003e DOWN. If it fails\nbecause the path is in RDS_CONN_ERROR, a drop raced the teardown:\ncancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one\npiece of the skipped tail that must not be left behind - and return,\nletting the pass the drop queued finish the job: it tears down\nwhatever attached to the path in the meantime, completes the\ntransition to RDS_CONN_DOWN, and re-arms the reconnect from its own\ntail.\n\nThe timer quiesce in that branch matters because the racing drop does\nnot always queue that pass: rds_conn_path_drop() returns without\nqueueing when a destroy is pending - exactly the situation during a\nnetns teardown or module unload, when a FIN on the dying socket is\nprocessed while rds_conn_path_destroy() flushes cp_down_w. If the\nflushed pass is the one that takes this return, no later pass exists,\nand rds_conn_path_destroy() would find cp_conn_w still armed\n(WARN_ON) and then free a path whose reconnect timer can still fire.\nWith the cancel in the branch, every exit of a shutdown pass leaves\nthe timer quiesced no matter which pass completes the transition.\n\nThe FIN case keeps making progress, one pass later and still without\nnoisy logging. Any other state keeps today\u0027s rds_conn_path_error()\nhandling; no current cp_state writer can leave a DISCONNECTING path\nin anything but RDS_CONN_ERROR (every other writer is a cmpxchg from\na non-DISCONNECTING state), so that branch is defensive.\n\nOn kernels without the preceding patches the same hazard exists with\nthe sample-based quiesce; the fix applies there equally.\n\nFixes: e97656d03ca0 (\"rds: tcp: allow progress of rds_conn_shutdown if the rds_connection is marked ERROR by an intervening FIN\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-8-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "813f3582ac7ae9f60f917937d54660e0952d5f2d", "tree": "19de5d2f0ae68ece68ccc342f8d94d72afc4fb2c", "parents": [ "02c5f9dc2efd823e061954d564ce00bacd1bebeb" ], "author": { "name": "Håkon Bugge", "email": "haakon.bugge@oracle.com", "time": "Fri Aug 28 15:39:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: acquire the fastpath locks in rds_conn_shutdown()\n\nrds_conn_shutdown() quiesces the transmit and receive-refill paths by\nwaiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and\nthen runs the transport shutdown and rds_conn_path_reset(). Sampling\nthe bits clear is not the same as owning them: the moment after the\nwait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or\nrds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run\nconcurrently with the teardown.\n\nThe sender does recheck the connection state after taking the lock,\nbut that recheck is a classic store-buffering pattern: teardown writes\nthe state and reads the bit while the sender writes the bit and reads\nthe state. acquire_in_xmit() is only an acquire operation, so on\nweakly ordered architectures both sides can miss each other\u0027s write,\nand the transmit path then runs while the transport zeroes its rings\n(e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the\ntransmit state under it.\n\nOracle UEK fixed the same class of crashes - a 14-year tail of\nBUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL\ndereferences in rds_ib_send_cqe_handler() during failover testing -\nby making the teardown path *acquire* the fastpath bit locks instead\nof testing them (\"rds: Make sure transmit path and connection\ntear-down does not run concurrently\"). Ownership of a single word is\ndecided by RMW atomicity, so no cross-variable ordering is needed.\n\nDo the same here: take both locks before calling the transport\nshutdown, hold them across rds_conn_path_reset(), and release them\nexplicitly with a wake-up afterwards. Both are released with\nclear_bit_unlock(), so that the ring re-initialization done by the\ntransport shutdown and the transmit state rewritten by\nrds_send_path_reset() are ordered before either bit is seen clear by\nthe next acquire_in_xmit() or acquire_refill().\n\nThe fastpath users of these bits - rds_send_xmit() and\nrds_ib_recv_refill() - are trylock style and back off while teardown\nowns the locks, so no new lock dependency is introduced for them.\nrds_tcp_reset_callbacks() is different: since the previous patch it\nacquires RDS_IN_XMIT as well, and it blocks doing so, so its wait now\nspans the teardown instead of at most one send batch. That waiter\nruns from rds_tcp_accept_one() on the single-threaded krdsd workqueue\nand holds rds_tcp_accept_lock and t_conn_path_lock while it waits, so\na duelling SYN accepted while its path is being torn down parks\naccept processing for the duration of the teardown - for TCP bounded\nby the (up to 5 s) drain loop in rds_tcp_conn_path_shutdown(). An IB\npath\u0027s drain in rds_ib_conn_path_shutdown() has no round cap, but no\nblocking waiter either: rds_tcp_reset_callbacks() is the only blocking\nacquirer of these bits and waits only on its own TCP path, and the\nfastpaths are trylock-and-back-off on both transports, so a long IB\ndrain lengthens only that path\u0027s own quiesce. The\nwindow is narrow: the accept-side state check has to pass before the\nteardown moves the path to RDS_CONN_DISCONNECTING.\n\nBecause krdsd is a single global workqueue, everything else queued\nthere - accept processing for other connections and network\nnamespaces, and the flush_workqueue(rds_wq) in rds_tcp_listen_stop()\nduring namespace teardown - waits behind the parked accept worker for\nthat time. It cannot deadlock, although the waits do point at each\nother: the teardown blocks until the bit\u0027s holder releases it, and\nthe holder may be that krdsd accept worker. The holder finishes\nwithout needing anything the teardown owns: the sync cancels\nrds_tcp_reset_callbacks() issues target cp_send_w and cp_recv_w on\nthe path\u0027s ordered cp_wq, whose only execution slot is occupied by\nthe blocked cp_down_w itself, so they are pending at most and cancel\nwithout flushing - a reliance on cp_wq being ordered that is now\nnoted next to those cancels (on the allocation-failure fallback where\na path shares rds_wq, the work items simply serialize).\nNor is the blocking wait itself new: rds_tcp_reset_callbacks() has\nwaited on RDS_IN_XMIT from the krdsd work item since\ncommit 335b48d980f6 (\"RDS: TCP: Add/use rds_tcp_reset_callbacks to\nreset tcp socket safely\"); this patch stretches its worst case from\na sender\u0027s batch to the teardown\u0027s drain. The alternative to parking\nis the accept path racing the teardown, which is what these patches\nclose; making the teardown itself non-blocking is a separate item.\n\nOne observable side effect: the SENDING flag reported by rds-info has\nalways mirrored RDS_IN_XMIT, so it now also covers the window where\nteardown owns the bit.\n\nThe comments that describe the old sample-based handshake or name\nrds_send_xmit() as the only other holder of these bits - in\nrds_send_xmit(), above rds_conn_path_reset(), in rds_ib_recv_refill()\nand in rds_tcp_reset_callbacks() - are updated to match.\n\nFor anyone backporting this patch standalone: it depends on\n\"net/rds: clear cp_flags bits individually in rds_conn_path_reset()\"\nand \"net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\"\nearlier in this series. Without the former, the blanket cp_flags\nclear in rds_conn_path_reset() would drop both held bits in the middle\nof the teardown; without the latter, rds_tcp_reset_callbacks() would\nstill sample t_sock without owning RDS_IN_XMIT. \"net/rds: use\nclear_bit_unlock() in release_refill()\" is needed for the refill\nside\u0027s release to pair with the acquire added here, and the follow-up\n\"net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\"\ncompletes the teardown-state handling for the waiter this patch\nparks; a backport should carry all four.\n\nFixes: 0f4b1c7e89e6 (\"rds: fix rds_send_xmit() serialization\")\nSigned-off-by: Håkon Bugge \u003chaakon.bugge@oracle.com\u003e\n[achender: reimplement for net-next shutdown path: acquire the existing\n RDS_IN_XMIT/RDS_RECV_REFILL bit locks in rds_conn_shutdown() and release\n after teardown; update comments and commit message]\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-7-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02c5f9dc2efd823e061954d564ce00bacd1bebeb", "tree": "f716f6c75f5fa2ab2cf7809d63fed75a58da18c3", "parents": [ "e8e60d74fec49ccae2aea9b04a6eb162feb8d9af" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n\nrds_tcp_reset_callbacks() quiesces the transmit path by setting the\npath state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to\nbe sampled clear before swapping the underlying socket and calling\nrds_send_path_reset().\n\nSampling the bit clear is not the same as owning it: rds_send_xmit()\ncan re-acquire RDS_IN_XMIT right after the wait_event() returns. Its\nstate recheck after taking the lock is a store-buffering pattern (the\nresetter writes the state and reads the bit, the sender writes the\nbit and reads the state) and acquire_in_xmit() is only an acquire\noperation, so on weakly ordered architectures both sides can miss\neach other\u0027s write and the transmit path then runs concurrently with\nrds_send_path_reset() rewriting cp_xmit_* state - which is exactly\nwhat the comment above rds_send_path_reset() tells its callers to\nprevent.\n\nTake the lock instead, hold it across the socket swap and\nrds_send_path_reset(), and release it with a wake-up at the end. The\nlock-ordering constraint documented above the wait still holds: the\nlock is acquired before lock_sock(), so a sender inside tcp_sendmsg()\ncan never be waited on while we hold the socket lock.\n\nTwo details of the old code go away with the same change:\n\n - t_sock is now read only after the lock is acquired. The old code\n cached it before waiting; the teardown in rds_conn_shutdown()\n releases that socket and clears t_sock, so a pointer cached before\n the wait can be stale by the time the accept path resumes. Reading\n it under RDS_IN_XMIT is what makes the exclusion complete once the\n teardown owns the same lock, which the next patch arranges; until\n then the teardown still only samples the bit, and the two paths\n remain as exposed to each other as they are today.\n\n - The old !osock early path called rds_send_path_reset() with no\n serialization at all. It now runs under the lock like the normal\n path. The conditional RDS_CONN_RESETTING transition of the\n previous patch happens before the socket check either way: a path\n found without a socket is either still connecting (its reconnect\n worker blocked on t_conn_path_lock) and legitimately goes\n RESETTING -\u003e UP on the new socket, or it has been torn down\n meanwhile and is dropped.\n\nThe in-function comment describing the old wait-based quiesce is\nrewritten to describe the lock-based one, and the stale block comment\nabove the function (which still described a return value and an\nincomplete list of t_sock writers) is refreshed to name all four\nwriters - the connect, accept, teardown and swap paths - and what\nserializes each of them.\n\nFixes: 335b48d980f6 (\"RDS: TCP: Add/use rds_tcp_reset_callbacks to reset tcp socket safely\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-6-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8e60d74fec49ccae2aea9b04a6eb162feb8d9af", "tree": "e971742be58b45b05808c4ffb2f5112d79bc94a7", "parents": [ "103c4b13c4f50322910078d1c02f29334a574122" ], "author": { "name": "Gerd Rausch", "email": "gerd.rausch@oracle.com", "time": "Fri Aug 28 15:39:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: tcp: don\u0027t force RDS_CONN_RESETTING over a concurrent shutdown\n\nrds_tcp_reset_callbacks() resolves a duelling SYN by storing\nRDS_CONN_RESETTING into cp_state unconditionally. Nothing serializes\nthat store against the shutdown path: rds_tcp_accept_one() checks\nfor RDS_CONN_CONNECTING or RDS_CONN_ERROR under t_conn_path_lock, but\nneither rds_conn_path_drop(), which forces RDS_CONN_ERROR, nor\nrds_conn_shutdown(), which moves the path to RDS_CONN_DISCONNECTING\nunder cp_cm_lock, takes that lock. The store can therefore land on\ntop of a shutdown that is already in progress, or that gets queued\nright after the accept-side check.\n\nWhen it does, the shutdown worker\u0027s final DISCONNECTING -\u003e DOWN\ntransition fails and the path goes through rds_conn_path_error() and\na second drop/shutdown cycle instead of a clean reconnect, tearing\ndown the socket the accept path has just installed. Before commit\nad22d24be635 (\"net/rds: No shortcut out of RDS_CONN_ERROR\") a path\nfound in RDS_CONN_RESETTING even made rds_conn_shutdown() bail out\naltogether.\n\nMake the transition conditional: move CONNECTING -\u003e RESETTING (or\nstay in RESETTING from an earlier duel), and drop the path in any\nother state. The drop has side effects of its own: it replaces the\nshutdown\u0027s RDS_CONN_DISCONNECTING (or RDS_CONN_ERROR) with\nRDS_CONN_ERROR and queues one more cp_down_w run. The difference is\nthat rds_conn_shutdown() accepts RDS_CONN_ERROR in its final\ntransition to RDS_CONN_DOWN, so the shutdown in flight completes\nnormally instead of through rds_conn_path_error(); the extra\ndown-work pass then finds the path already down and falls through to\nthe reconnect check, or catches a reconnect that has already started\nand restarts it. The accept path still installs the new socket,\nrds_connect_path_complete() then fails its RESETTING -\u003e UP transition\nand drops it: the raced socket ends up torn down as it does today.\nThe comment at that call site, which promised that\nrds_connect_path_complete() marks the path RDS_CONN_UP, is updated to\nname this outcome as well.\n\nThe state can change again between the failed transitions and the\ndrop. That is inherent to rds_conn_path_drop(), which the socket\nstate-change callbacks also call unconditionally, and costs at most\none extra drop/reconnect cycle.\n\nBased on Oracle UEK commit \"net/rds: Don\u0027t force state\nRDS_CONN_RESETTING\" by Gerd Rausch.\n\nFixes: 9c79440e2c5e (\"RDS: TCP: fix race windows in send-path quiescence by rds_tcp_accept_one()\")\nSigned-off-by: Gerd Rausch \u003cgerd.rausch@oracle.com\u003e\n[achender: port to net-next: use the two-argument\n rds_conn_path_transition()/rds_conn_path_drop() and rewrite the\n changelog for the upstream shutdown path]\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-5-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "103c4b13c4f50322910078d1c02f29334a574122", "tree": "55c18f8b84e75d4be091acfa58b7ae7ecc3ab02f", "parents": [ "17c4476dbb9c3bfd34193a6c22f2c3da8747134a" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: clear cp_flags bits individually in rds_conn_path_reset()\n\nrds_conn_path_reset() wipes the whole flag word with a plain\ncp-\u003ecp_flags \u003d 0 store. Every other accessor of that word uses\natomic bitops, and some of them can run concurrently with the reset:\nRDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the\ntransport completion paths, neither of which holds anything that\nexcludes the shutdown worker. A plain store racing an atomic\nread-modify-write on the same word is a data race, and whichever\nside loses has its update silently discarded.\n\nClear the two bits the reset is actually responsible for instead.\nRDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they\nbelong to the caller, rds_conn_shutdown(), which waits for both to be\nclear before calling the transport shutdown and this reset.\n\nThis also gives every bit in cp_flags a single well-defined writer\ndiscipline, which the following patches rely on when they turn\nRDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the\nteardown: a blanket store mid-teardown would destroy lock ownership\nthat an atomic clear preserves.\n\nOracle UEK carries the same conversion (\"net/rds: Preserve essential\nconnection state flags\"), motivated by its asynchronous shutdown\nstate machine, whose progress and destroy flags must survive the\nreset. UEK\u0027s variant also clears RDS_IN_XMIT and RDS_RECV_REFILL\nbecause there the reset runs as the final step of a teardown that\nowns both bits, making those clears its unlock. Upstream that\nrelease belongs in rds_conn_shutdown(): once a later patch in this\nseries turns the two bits into locks held across the teardown, ending\nownership needs release semantics and a wake-up that a plain clear\ninside the reset would not provide.\n\nBased on Oracle UEK commit \"net/rds: Preserve essential connection\nstate flags\" by Gerd Rausch.\n\nFixes: 00e0f34c6166 (\"RDS: Connection handling\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-4-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17c4476dbb9c3bfd34193a6c22f2c3da8747134a", "tree": "10a8da810c0f185e1a2f5ecbe04d7c0d84109e4a", "parents": [ "6d0c8b7073913011459cf968cbbadd341e166bc3" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: use clear_bit_unlock() in release_refill()\n\nrelease_refill() drops the RDS_RECV_REFILL bit with a plain\nclear_bit(). clear_bit() has no ordering semantics, and the\nsmp_mb__after_atomic() that follows it sits on the wrong side for a\nlock release: it orders the clear against the waitqueue_active() load\nbelow it, but does nothing to order the refill critical section\u0027s ring\nand descriptor stores before the clear itself.\n\nThat matters once connection teardown owns RDS_RECV_REFILL as a lock\nacross the transport shutdown and path reset, rather than sampling it\nclear, which \"net/rds: acquire the fastpath locks in\nrds_conn_shutdown()\" later in this series arranges: on a weakly\nordered architecture the teardown can win the bit and start the\nshutdown and reset while some of the refill\u0027s stores are not yet\nvisible to it. The same gap existed under the sample-based scheme - a\nwaiter that saw the bit clear had no guarantee it also observed the\nrefill\u0027s stores - but taking the bit as a lock makes the missing\nrelease pairing load-bearing.\n\nSwitch to clear_bit_unlock(), which orders the critical section before\nthe release, and replace the open-coded barrier-plus-waitqueue_active()\nwith wq_has_sleeper(), whose internal full barrier keeps the\nstore-buffering guarantee between clearing the bit and checking for\nsleepers. This mirrors what \"net/rds: use wq_has_sleeper() in\nrelease_in_xmit()\" does for RDS_IN_XMIT.\n\nThe fast-path acquire side, acquire_refill(), uses test_and_set_bit(),\na full-barrier RMW that pairs with this release. The teardown at this\npoint in the series still samples the bit, so on its own this change\nis release-side hardening; the shutdown-conversion patch named above\nmakes the teardown acquire the bit with the same RMW, completing the\npairing at the end of the series.\n\nFixes: 73ce4317bf98 (\"RDS: make sure we post recv buffers\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-3-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6d0c8b7073913011459cf968cbbadd341e166bc3", "tree": "39e53a090abe24c871e94b1bfefda11b377f345d", "parents": [ "08710f033e3e35704e45adf8a95b5043ece34899" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: use wq_has_sleeper() in release_in_xmit()\n\nrelease_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then\nchecks waitqueue_active() to decide whether anyone needs waking.\nclear_bit_unlock() is only a release operation: it orders the\ncritical section before the bit clear, but does not order the\nsubsequent plain load of the wait queue head after it. The waiter\nside does the mirror image - it adds itself to the wait queue and\nthen tests the bit. That is the classic store-buffering pattern: the\nreleasing CPU can read the wait queue as empty while the waiting CPU\nstill reads the bit as set, so the sleeper is never woken.\n\nThe waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),\nboth in uninterruptible wait_event() with no timeout. A lost wake-up\nstrands the shutdown worker on its single-threaded workqueue until\nsome other sender releases the bit again - and on a connection that\nis being torn down precisely because it failed, there may never be\nanother sender.\n\nThe barrier used to be there: release_in_xmit() did clear_bit()\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (\"rds:\nintroduce acquire/release ordering in acquire/release_in_xmit()\")\nfolded both into clear_bit_unlock(), which strengthened the lock\nhand-off but silently dropped the full barrier the wake-up check\ndepends on. The refill counterpart, release_refill() in\nnet/rds/ib_recv.c, still carries its smp_mb__after_atomic() for\nexactly this reason.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier.\n\nFixes: 1422f28826d2 (\"rds: introduce acquire/release ordering in acquire/release_in_xmit()\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-2-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08710f033e3e35704e45adf8a95b5043ece34899", "tree": "e162c4988cecb4093ab0fa38b49e68810bb4170a", "parents": [ "d85f521a9afb786b1d95bbcb218d3afdf3fe73ab" ], "author": { "name": "Ian Lin", "email": "jisayme@gmail.com", "time": "Mon Aug 31 16:41:24 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:24:38 2026 -0700" }, "message": "net: usb: qmi_wwan: add Compal EXM-G1x support\n\nThe Compal EXM-G1x is a Qualcomm SDX12-based LTE modem. Add support for\nits QMI WWAN interface 8 using the DTR quirk.\n\nTested on a Compal EXM-G1x modem.\n\nSigned-off-by: Ian Lin \u003cjisayme@gmail.com\u003e\nLink: https://patch.msgid.link/20260831084124.65074-1-jisayme@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d85f521a9afb786b1d95bbcb218d3afdf3fe73ab", "tree": "8c0ba499247c7f4e662185c2c9cf06a9ef6811a9", "parents": [ "debac3a20dec524a59625cf10fa2f18571127824" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Mon Aug 31 13:31:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:22:53 2026 -0700" }, "message": "net: macb: exclude software FCS from TX byte statistics\n\nFrames for which macb_pad_and_fcs() supplies the FCS have four FCS\nbytes appended, and TX completion then accounts the grown skb-\u003elen.\ntx_bytes is defined to exclude the FCS, so these frames are reported\nfour bytes too large.\n\nTrack only the number of FCS bytes appended in software, 0 or\nETH_FCS_LEN, and subtract that from skb-\u003elen at completion. skb-\u003elen\nalready reflects the padded length by then, so there is nothing else\nto store. macb_pad_and_fcs() already returns 0 on every non-error\npath. Return the FCS length from there instead, rather than\nrecomputing the same check in the caller. BQL stays on the padded\nskb-\u003elen that netdev_tx_sent_queue() saw.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260831113128.1678674-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3498acda6b68139ec7b8037dbdf1ea720997ed04", "tree": "b11d2c2ab75b9636ed9eb405ff81d6c26d8db7a8", "parents": [ "17d7aa69540822d6ef1cd47bf069213941022806" ], "author": { "name": "Ziyou Xu", "email": "xuziyougm@gmail.com", "time": "Sat Aug 29 11:38:43 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:19:29 2026 -0700" }, "message": "net: phy: air_en8811h: restore AN8811HB LED GPIO after MCU restart\n\nCommit 03b4702fc5e3 (\"net: phy: air_en8811h: move LED GPIO\nconfiguration to config_init\") moved the EN8811H LED GPIO setup from\nprobe to config_init because an MD32 restart clears the output-enable\nbits.\n\nAN8811HB follows the same initialization sequence: an8811hb_probe()\nenables GPIO3/4/5, and later config_init() calls restart MD32.\n\nMove the AN8811HB GPIO setup to the end of an8811hb_config_init(),\nmatching the current EN8811H path.\n\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Ziyou Xu \u003cxuziyougm@gmail.com\u003e\nLink: https://patch.msgid.link/20260829033844.1975-1-xuziyougm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17d7aa69540822d6ef1cd47bf069213941022806", "tree": "1ea56cfb813d3298b3ec00ef7f6f880ae392f3cd", "parents": [ "fcfb5ff9dfc3c77094159c4eb15d0539bfa3111d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 09:41:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:15:21 2026 -0700" }, "message": "netdev: don\u0027t use dev-\u003eflags for IFF_UP\n\ndev-\u003eflags are not technically ops lock protected. The IFF_UP flag\nwill not change when dev-\u003elock is held, but other flags may change\nso KCSAN would probably not be impressed. Because of this we added\na dedicated dev-\u003eup which is safe to read under dev-\u003elock.\n\nqstats want to make sure device is up, use dev-\u003eup.\n\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831164159.1124679-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fcfb5ff9dfc3c77094159c4eb15d0539bfa3111d", "tree": "28595367ff521bd7c114ab0af09d1962f3f1d778", "parents": [ "e8965b0523f2fb0b6d42deeaaa94c0ede7ce4ebb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 09:41:56 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:15:18 2026 -0700" }, "message": "netdev: correct error code in netdev_nl_queue_fill_lease()\n\nnetdev_nl_queue_fill_lease() returns ENOMEM on nla_put failures.\nThis is wrong, the error code should be EMSGSIZE. But it doesn\u0027t\nmatter, caller of netdev_nl_queue_fill_lease() just checks if\nthe retcode is zero or not, and uses EMSGSIZE.\n\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nAcked-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831164159.1124679-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8965b0523f2fb0b6d42deeaaa94c0ede7ce4ebb", "tree": "f64c4bbd768f15481674f614daa2e52da3b57a06", "parents": [ "795eb0feb4012eddf8dad45cb358351125cf5f8a" ], "author": { "name": "Vincent Jardin", "email": "vjardin@free.fr", "time": "Wed Sep 02 19:12:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:13:03 2026 -0700" }, "message": "net: pcs: lynx: add support for 25GBASE-R\n\nThe Lynx PCS never supported 25GBASE-R. Add it, so that a 25G DPMAC on\nLX2160A can be driven by phylink.\n\nThe SerDes side had the mode since the commit\n 1cab8fba5073 (\"phy: lynx-28g: add support for 25GBASER\")\nand dpaa2-mac maps DPMAC_ETH_IF_CAUI to PHY_INTERFACE_MODE_25GBASER,\nbut the PCS never handled it, so phylink_validate() failed with the\ninterface.\n\n25GBASE-R is a serial mode without clause-37 in-band autonegotiation,\nexactly like 10GBASE-R: it does not needs any configuration, its state\nis read with phylink_mii_c45_pcs_get_state(), and it reports\nLINK_INBAND_DISABLE.\n\nphylink_mii_c45_pcs_get_state() is extended in the same patch because\nwithout it the link comes up reporting Unknown/Unknown.\n\nSuggested-by: Ioana Ciornei \u003cioana.ciornei@nxp.com\u003e\nCo-developed-by: Ioana Ciornei \u003cioana.ciornei@nxp.com\u003e\nSigned-off-by: Ioana Ciornei \u003cioana.ciornei@nxp.com\u003e\nSigned-off-by: Vincent Jardin \u003cvjardin@free.fr\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260922-for-upstream-lynx-25gbaser-v1-v2-1-1e6cf79c7b52@free.fr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "795eb0feb4012eddf8dad45cb358351125cf5f8a", "tree": "1d00086c57567aa80a013460f97528b264b183d8", "parents": [ "277c1de206e00843a8932df778bd81edd7048740", "e5ed29f1560338c634ef8b68e7fc8501a715c251" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:08 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:08 2026 -0700" }, "message": "Merge branch \u0027net-dsa-mt7530-modernise-register-access-and-add-two-dsa-ops\u0027\n\nDaniel Golle says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: mt7530: modernise register access and add two DSA ops\n\nThe mt7530 driver carries its own register accessors that predate the\nregmap conversion and now largely duplicate what regmap already\nprovides, including locking. Most of this series removes that layer.\n\nIt first moves the MDIO bus locking into the switch regmap via\n.lock/.unlock callbacks, matching the PCS regmaps, so any path reaching\nthe regmap is serialised automatically. With the wrappers no longer\nadding locking, the thin mt7530_mii_* indirection is folded away and the\nremaining accessors are replaced mechanically with the plain regmap API,\nusing the coccinelle semantic patches included in the commit messages.\nThe two remaining reset polls are converted to\nregmap_read_poll_timeout() and the then-unused dummy poll machinery is\ndropped. Open-coded register fields are converted to\nFIELD_GET/FIELD_PREP. None of this is intended to change behaviour.\n\nThe last two patches implement .port_fast_age, which flushes dynamically\nlearned MAC entries on topology changes, and .port_change_conduit, which\nmoves a user port\u0027s CPU-port affinity at runtime.\n\nThe swallowed MDIO errors Sashiko flagged on v4 5/8 have meanwhile been\nfixed in tree by \"fix swallowed MDIO read errors\" and \"fix remaining\nswallowed MDIO access errors\", both merged into net-next. This respin is\nrebased on top of them: regmap_* return values are no longer ignored,\nwhich is what most of the semantic patches had to be reworked for.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e5ed29f1560338c634ef8b68e7fc8501a715c251", "tree": "1d00086c57567aa80a013460f97528b264b183d8", "parents": [ "e1d532b6b056bc72c51523aeb2187e9f5142f75f" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:39:26 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: implement port_change_conduit op\n\nAllow changing the CPU port affinity of user ports at runtime via the\nIFLA_DSA_CONDUIT netlink attribute. This updates the port matrix to\nforward to the new CPU port instead of the old one.\n\nLimit the operation to MT7531. There, trapped link-local frames follow\nthe per-port affinity, as the MT7531_CPU_PMAP destination mask is\nfurther restricted by the port matrix. A conduit change is hence fully\nhonoured by the hardware, for regular traffic as well as for trapped\nframes.\n\nThe MT7530 switch, including the variant embedded in the MT7621 SoC,\ninstead traps frames to the single CPU port set in the CPU_PORT field\nof the MFC register, regardless of the affinity of the inbound user\nport. With user ports affine to different CPU ports there is no\ncorrect value for that field, so per-port CPU affinity cannot be fully\nimplemented for trapped frames. Routing a WAN port via the second SoC\nGMAC is conventionally covered by the PHY muxing feature on these\nswitches, which bypasses the switch fabric and does not involve a CPU\nport at all.\n\nThe switches on the MT7988, EN7581, AN7583 and EN7528 SoCs only have a\nsingle CPU port, leaving no other conduit to change to.\n\nAs the op lives in the shared mt7530_switch_ops, populate the extack\nwhen rejecting the unsupported variants instead of returning a bare\n-EOPNOTSUPP. Also reject a conduit that belongs to a different switch\nin the tree, whose port index has no meaning in the local port matrix.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nAcked-by: Chester A. Unal \u003cchester.a.unal@arinc9.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/cfc6a478a384a7f309f08d9f76be8fd029c1f202.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e1d532b6b056bc72c51523aeb2187e9f5142f75f", "tree": "996978a8d6010e8e00ec7cbb2de987d4ef041a19", "parents": [ "3d8ca6f904750af5fb8a04d7f792e73fc24770ca" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:39:13 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: implement port_fast_age\n\nImplement the .port_fast_age DSA operation by flushing all non-static\n(dynamically learned) MAC address entries from the address table.\n\nThe switch does not offer a combined \"non-static AND per-port\" match\nmode, so the flush is global and the port argument is not used. Unlike\nb53 and realtek, which flush the dynamic entries of the affected port\nonly, an STP topology change on one port therefore also flushes the\ndynamically learned entries of the other ports; they are quickly\nrelearned.\n\nAccess the address table control register under priv-\u003ereg_mutex, as done\nby all other ATC users (FDB and MDB add/del/dump), to serialise the\nwrite-then-poll command sequence, and log a message should the command\nfail.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/60f83ade0e371dfe2d974d5d192056935c3ab5c9.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3d8ca6f904750af5fb8a04d7f792e73fc24770ca", "tree": "ecacd00d87b10e1c981a6cc272d3e2694992cb5f", "parents": [ "d7110c1dab444c76048244f585532c276a58f93a" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:39:00 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: convert to use field accessor macros\n\nUse FIELD_GET and FIELD_PREP instead of open-coding register fields.\nReplace 0x1f constant with (PHY_MAX_ADDR - 1).\n\nSome field macros (ATC_HASH, VTCR_VID and STAG_VPID) were previously\ndefined as object-like macros referencing an undeclared \u0027x\u0027 and were\ntherefore unusable; convert them into proper FIELD_PREP() accessors.\n\nThe masks are equivalent to the open-coded values they replace, with\none exception: mt7530_vlan_cmd() now masks vid through VTCR_VID(vid)\ninstead of OR-ing it in raw, guarding the adjacent VTCR_FUNC field\nagainst any bits set above the 12-bit VID width. VLAN IDs are always\nin 0-4094, so this is a no-op in practice; it is a real hardening\nrather than a strictly equivalent mechanical substitution.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/bd4eaf10fb6aa7a1bd056514b61b4481175708a5.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7110c1dab444c76048244f585532c276a58f93a", "tree": "3a64275837847b9d99c4edb1b131b7c0192e80a3", "parents": [ "10d9d8328e8ab4503ef44b7fc958bf57364a2e09" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:38:46 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: drop the dummy poll machinery\n\nConvert the two remaining switch reset polls to\nregmap_read_poll_timeout() and remove struct mt7530_dummy_poll,\nINIT_MT7530_DUMMY_POLL() and the mt7530_mii_poll() helper. As with the\ncommand polls addressed by the preceding fixes, a failed read now\nterminates the poll with an error instead of being fed to the loop\ncondition as a zero value.\n\nGenerated using the following semantic patch, plus removal of the two\nnow-unused definitions from mt7530.h:\n\n// Poll the register through regmap so a failed read ends the poll.\n@@\nexpression priv, reg;\nidentifier p, ret, val;\n@@\n-\tINIT_MT7530_DUMMY_POLL(\u0026p, priv, reg);\n-\tret \u003d readx_poll_timeout(mt7530_mii_poll, \u0026p, val, val !\u003d 0,\n-\t\t\t\t 20, 1000000);\n+\tret \u003d regmap_read_poll_timeout(priv-\u003eregmap, reg, val, val !\u003d 0,\n+\t\t\t\t 20, 1000000);\n\n@@\nidentifier p;\n@@\n- struct mt7530_dummy_poll p;\n ... when !\u003d p\n\n@@\nidentifier p;\ntype T;\n@@\n-static T mt7530_mii_poll(struct mt7530_dummy_poll *p) { ... }\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/609dcd8dd0c335e36bbc8df41413da58af1dbfb4.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "10d9d8328e8ab4503ef44b7fc958bf57364a2e09", "tree": "eb11b016d808c330173833bb9349b5d6aef48046", "parents": [ "f6692ee8def416c10c47cda97ee5b01e6c7260cf" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:38:35 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: replace mt7530_read with regmap_read\n\nReplace all mt7530_read() calls with direct regmap_read() calls and\nremove the wrapper function. The wrapper returned 0 on failed reads;\npreserve that behaviour by zeroing the read-back buffer at the start of\nmt7530_regmap_read(), so callers that do not check the return code keep\nseeing a deterministic value. The WARN_ON_ONCE error logging is dropped.\n\nMost callsites follow the val \u003d mt7530_read(priv, reg) pattern and are\nconverted mechanically using the following semantic patch:\n\n@@\nexpression priv, reg;\nidentifier val;\n@@\n-val \u003d mt7530_read(priv, reg);\n+regmap_read(priv-\u003eregmap, reg, \u0026val);\n\nRemaining inline uses are converted by hand.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/a1dc338ae368554ec6faa974df7ba6f3660ae12b.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6692ee8def416c10c47cda97ee5b01e6c7260cf", "tree": "d21a172dd138c61c7419cd9bbe666fcf5938d3c3", "parents": [ "63ba2b758938d6f2028d2d5935ea7b5ec29443dd" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:38:26 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:06 2026 -0700" }, "message": "net: dsa: mt7530: replace mt7530_rmw/set/clear with regmap API\n\nReplace all mt7530_rmw() calls with regmap_update_bits(), mt7530_set()\nwith regmap_set_bits(), and mt7530_clear() with regmap_clear_bits().\nRemove the wrapper function definitions.\n\nGenerated using the following semantic patch:\n\n@@\nexpression priv, reg, mask, set;\n@@\n-mt7530_rmw(priv, reg, mask, set)\n+regmap_update_bits(priv-\u003eregmap, reg, mask, set)\n\n@@\nexpression priv, reg, val;\n@@\n-mt7530_set(priv, reg, val)\n+regmap_set_bits(priv-\u003eregmap, reg, val)\n\n@@\nexpression priv, reg, val;\n@@\n-mt7530_clear(priv, reg, val)\n+regmap_clear_bits(priv-\u003eregmap, reg, val)\n\nSix regmap_update_bits() call sites with multi-line masks are rewrapped\nby hand afterwards, as spatch joins their argument lines.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/182be19b483e77eb1d4ed835813359a27acd8e9c.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "63ba2b758938d6f2028d2d5935ea7b5ec29443dd", "tree": "04abc1d7ab826cfa96208d35f5fdc8164a448fb8", "parents": [ "b62351d125adbfea3b292f41bba2a8f2e1922d33" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:38:16 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:05 2026 -0700" }, "message": "net: dsa: mt7530: replace mt7530_write with regmap_write\n\nReplace all mt7530_write() calls with direct regmap_write() calls\nand remove the wrapper function. The per-call error logging is\ndropped -- regmap has its own tracing infrastructure.\n\nGenerated using the following semantic patch:\n\n@@\nexpression priv, reg, val;\n@@\n-mt7530_write(priv, reg, val)\n+regmap_write(priv-\u003eregmap, reg, val)\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/fbb6ee8860fa60326a8af132ed114555e7163350.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b62351d125adbfea3b292f41bba2a8f2e1922d33", "tree": "3c9f7d642bdb457eaa4f93b78f68c52e0c0d637e", "parents": [ "fbf5096f540dd9257a3eb372f8c9daac7e3a375b" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:38:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:05 2026 -0700" }, "message": "net: dsa: mt7530: fold mt7530_mii_write/read into mt7530_write/read\n\nWith the lock wrappers removed in the previous commit, mt7530_write()\nwas a trivial wrapper around mt7530_mii_write(), and mt7530_read()\naround mt7530_mii_read() via _mt7530_read(). Fold the function bodies\nand eliminate the intermediate functions.\n\nThe _mt7530_read() poll helper for readx_poll_timeout() is renamed to\nmt7530_mii_poll() and calls mt7530_read().\n\nCallers are updated using the following semantic patch:\n\n@@\nexpression E1, E2, E3;\n@@\n-mt7530_mii_write(E1, E2, E3)\n+mt7530_write(E1, E2, E3)\n\n@@\nexpression E1, E2;\n@@\n-mt7530_mii_read(E1, E2)\n+mt7530_read(E1, E2)\n\n@@\nexpression list args;\n@@\n-readx_poll_timeout(_mt7530_read, args)\n+readx_poll_timeout(mt7530_mii_poll, args)\n\nThe two readx_poll_timeout() call sites keep their original line\nwrapping, which spatch reflows for the longer helper name.\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/591c4e7ff5b1b6d39aac7f0f04eb67f36f40d8a2.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fbf5096f540dd9257a3eb372f8c9daac7e3a375b", "tree": "3fc480231a673cf0cf0fea389a0d07546f1d3c28", "parents": [ "277c1de206e00843a8932df778bd81edd7048740" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:37:55 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:10:05 2026 -0700" }, "message": "net: dsa: mt7530: move MDIO bus locking into regmap\n\nThe switch register regmap was created with .disable_locking \u003d true,\nrelying on callers to manually lock the MDIO bus. Move the locking\ninto the regmap using .lock/.unlock callbacks, matching the PCS\nregmaps that already do this. This allows any code path reaching the\nregmap to be automatically protected.\n\nWith regmap handling bus locking, the manual mt7530_mutex_lock/unlock\ncalls in mt7530_write(), _mt7530_read(), mt7530_rmw() and\nmt7530_port_change_mtu() become redundant and are removed, as is the\nbus lock held across the ATC/VTCR command poll sequences.\n\nThe handle_mask_sync callback added by commit dd52b3df25ed (\"net: dsa:\nmt7530: serialize the regmap IRQ chip like every other user\") to hold\nmt7530_mutex_lock() around the regmap-irq mask register write is\nlikewise removed. With the regmap now self-locking, regmap-irq\u0027s\ndefault unmask_base sync is serialized on its own, and so are the\nstatus read, ack write and init_ack_masked write that had no hook,\nclosing the gaps that commit left open. The per-device copy of the irq\nchip it needed goes away too.\n\nThe MT7531 indirect PHY access functions need serialization of their\nmulti-step register sequences, but no longer need to hold bus-\u003emdio_lock\nacross the whole operation. Switch them to reg_mutex.\n\ncore_write()/core_rmw() are the only remaining callers of\nmt7530_mutex_lock(). They access TRGMII core PHY registers via the\nclause 22 MMD indirect protocol -- a separate register space that\nbypasses regmap and needs manual bus-\u003emdio_lock protection.\n\nThe lock removals are generated using the following semantic patch:\n\n// Collapse mt7530_write() now that regmap serialises bus access.\n@@\nexpression priv, reg, val;\nidentifier ret;\n@@\n {\n-\tint ret;\n-\n-\tmt7530_mutex_lock(priv);\n-\n-\tret \u003d mt7530_mii_write(priv, reg, val);\n-\n-\tmt7530_mutex_unlock(priv);\n-\n-\treturn ret;\n+\treturn mt7530_mii_write(priv, reg, val);\n }\n\n// Remove mt7530_mutex_lock/unlock around single regmap-based calls.\n@@\nexpression priv, reg, mask, set;\n@@\n {\n-\tmt7530_mutex_lock(priv);\n-\n \tregmap_update_bits(priv-\u003eregmap, reg, mask, set);\n-\n-\tmt7530_mutex_unlock(priv);\n }\n\n@@\nexpression p;\nidentifier val;\n@@\n {\n-\tu32 val;\n-\tmt7530_mutex_lock(p-\u003epriv);\n-\tval \u003d mt7530_mii_read(p-\u003epriv, p-\u003ereg);\n-\tmt7530_mutex_unlock(p-\u003epriv);\n-\treturn val;\n+\treturn mt7530_mii_read(p-\u003epriv, p-\u003ereg);\n }\n\n@@\nexpression priv;\nidentifier val;\n@@\n-\tmt7530_mutex_lock(priv);\n \tval \u003d mt7530_mii_read(priv, MT7530_GMACCR);\n \t...\n \tmt7530_mii_write(priv, MT7530_GMACCR, val);\n-\tmt7530_mutex_unlock(priv);\n\n// The ATC/VTCR command polls no longer need the bus lock held across\n// the poll and the status read-back.\n@@\nexpression priv, reg, cond;\nidentifier ret, val;\n@@\n-\tmt7530_mutex_lock(priv);\n-\n \tret \u003d regmap_read_poll_timeout(priv-\u003eregmap, reg, val, cond, 20, 20000);\n \tif (!ret)\n \t\tret \u003d regmap_read(priv-\u003eregmap, reg, \u0026val);\n-\n-\tmt7530_mutex_unlock(priv);\n\n// The MT7531 indirect PHY sequences keep serialising themselves, but\n// against reg_mutex rather than the MDIO bus lock.\n@@\nexpression priv;\nidentifier ret, val;\n@@\n-\tmt7530_mutex_lock(priv);\n+\tmutex_lock(\u0026priv-\u003ereg_mutex);\n \tret \u003d regmap_read_poll_timeout(priv-\u003eregmap, MT7531_PHY_IAC, val, ...);\n\n@@\nexpression priv;\n@@\n out:\n-\tmt7530_mutex_unlock(priv);\n+\tmutex_unlock(\u0026priv-\u003ereg_mutex);\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/6927a774b87238800de5d6c0c717b0afd02d320b.1788190568.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "277c1de206e00843a8932df778bd81edd7048740", "tree": "5f2d8ae09e50871d947f57e0349e43c228119c74", "parents": [ "1d91ec5b15a13093a676b99f1099a7580f32f5a4", "d4ce2cef189ef4c267d5bcec922f5d390a85bc22" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:08 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:55 2026 -0700" }, "message": "Merge branch \u0027net-mdio-realtek-rtl9300-add-rtl83xx-support\u0027\n\nMarkus Stockhausen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mdio: realtek-rtl9300: Add RTL83xx support\n\nThe Realtek Otto switch platform consists of four different series\n\n- RTL838x aka maple : 28 port 1G Switches\n- RTL839x aka cypress : 52 port 1G Switches\n- RTL930x aka longan : 28 port 1G/2.5G/10G Switches\n- RTL931x aka mango : 56 port 1G/2.5G/10G Switches\n\nWhile the MDIO hardware polling unit and its necessity for the MAC\nlayer was always well known, no detailed documentation was available.\nFor this series the MDIO bus was inspected with a logic analyzer for\na better understanding how polling and kernel access interact on the\nbus. All this will be explained now in the driver comments.\n\nThis patch series adds support for the RTL83xx devices. For this\n\n- Enhance device tree binding.\n- Add special handling for limitations enforced by hardware polling.\n These already have minor side effects on RTL93xx devices but are even\n more critical for the RTL83xx hardware.\n- Add RTL83xx coding.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831143439.2404484-1-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d4ce2cef189ef4c267d5bcec922f5d390a85bc22", "tree": "5f2d8ae09e50871d947f57e0349e43c228119c74", "parents": [ "11b8be84ccafc946c5b3124ad41988e9243309a0" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:55 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: reword Kconfig and module description\n\nThe Realtek MDIO driver has been enhanced to support multiple\ndevices from the RTL83xx/RTL93xx series. Reword Kconfig and\nmodule description accordingly.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-14-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "11b8be84ccafc946c5b3124ad41988e9243309a0", "tree": "726743785acee3c212f44992540ff78f738d3dc7", "parents": [ "6ab6cb66b3b94239ae1007de4185c17756040279" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:55 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Add support for RTL839x\n\nThe MDIO driver has been prepared for multiple device support. Add all\nrequired bits for the RTL839x (aka cypress) series. This is straightforward\nbut some things are worth mentioning.\n\n- The device has a lot in common with the RTL931x series. It has 8192\n (Realtek) pages and 7 MMIO registers.\n- There are two SMI buses for 1G PHYs. Neither the bus nor address map\n registers exist.\n- The hardware has not much to configure. So the setup_controller()\n function is not needed.\n- The bit specific registers (polling \u0026 port_mask) are 2x32 bit wide. The\n ports 0..31 got to \u003creg\u003e and the ports 32..51 go to \u003creg+4\u003e.\n- C22 read/write functions must be called with PARK_PAGE \u003d 0. Keep code\n clean and avoid setting it to zero, matching the behavior of the RTL9310\n logic.\n- As per SDK the broadcast register allows to write to multiple ports\n at the same time. Unlike RTL9310 where this is filled with a bit mask\n for the current port RTL8390 does not use it for normal reads/writes.\n It is simply set to 0 like the SDK does.\n- The SDK fills the EXT_PAGE register with 0x1ff for C22 access and with\n 0x0 for C45 access. The reason for this is currently unknown and a\n meaningful name can not be given. Align the driver coding with the\n RTL9300_PHY_CTRL_PARK_PAGE settings and simply fill the hardcoded value.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-13-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ab6cb66b3b94239ae1007de4185c17756040279", "tree": "63ba2a41ca7f05410f1658c6c6e536f1435fda68", "parents": [ "cc7a5bfaea142ebaa84bbcd8ddd14a3b21cc5bd5" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:55 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Add support for RTL838x\n\nThe MDIO driver has been prepared for multiple device support. Add all\nrequired bits for the RTL838x (aka maple) series. This is straightforward\nbut some things are worth mentioning.\n\n- The device has a lot in common with the RTL930x series. It has 28 ports,\n 4096 (Realtek) pages and 4 MMIO registers. With this a lot of the\n existing RTL9300 defines could be reused. But to avoid confusion and\n for better readability duplicate the defines with a proper prefix.\n- The MDIO engine has no fail bit. Thus the mask is set to zero.\n- There is only one SMI bus for 1G PHYs. No bus_map_base register exists.\n- The setup_controller() function needs no C45 configuration as polling\n only works in C22 mode\n- The PHY access must be activated by a special register flag.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-12-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cc7a5bfaea142ebaa84bbcd8ddd14a3b21cc5bd5", "tree": "d4156e5e4deb24136af3ee56071e2314325c88f4", "parents": [ "6be4be074be82ea1196bec504bf1490b6fe6037f" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:54 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Open up C22 and C45 space in parallel\n\nUntil now the MDIO driver supports either access to the C22 or to\nthe C45 address space of the PHYs. This is due to the fact that\nthe polling configuration favours one of the address spaces and\nlimits access to the other space. E.g. when polling is set to\nC22 most of the C45 space can not be accessed.\n\nThere are however some exceptions from that. EEE register access\nis allowed independently from the polling mode [1]. As the\ndownstream driver already allows parallel C22/C45 access [2] do\nthis in upstream too.\n\n[1] https://github.com/openwrt/openwrt/blob/main/target/linux/realtek/files-6.18/drivers/net/phy/realtek/realtek_multiport.c#L349\n[2] https://github.com/openwrt/openwrt/blob/main/target/linux/realtek/files-6.18/drivers/net/mdio/mdio-realtek-otto.c#L1072\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-11-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6be4be074be82ea1196bec504bf1490b6fe6037f", "tree": "8820ca6d370477d20aedb2d37433a1bff13899a5", "parents": [ "cc3cb8db1eef9fbe6f2c520312cf6384cf2c2ce7" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:54 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Increase MDIO timeout\n\nRTL838x devices with 28 ports produce PHY access timeout errors during\none of three boots while waiting for MDIO command completion. This is\ncurrently set to 1ms.\n\nBackground: Access to the Realtek Otto ethernet MDIO bus must wait for\na free slot between two hardware polls. The polling sequence consists\nof at least 17 commands on the RTL838x devices. This delay can be nicely\nseen when disabling polling completely. The following times are measured\non a bus running on the default 2.5MHz. Time measured is from the last\nregister write that sets the command-start-bit until the hardware\nresponds with the command-finished-bit set.\n\n- average c22 read with polling enabled on all ports: ~380us\n- average c22 read with polling enabled on one port: ~380us\n- average c22 read with polling completely disabled: ~180us\n\nFor this bus frequency the bare hardware runtime for a single command\n(32 bit preamble + 32 bit data) is ~25us. So the hardware adds quite\nsome overhead. On top of this comes the fact that the RTL838x devices\nare low on resources (500Mhz 4Kec core with 16K cache).\n\nIncrease the timeout to 10ms to be on the safe side.\n\nRemark! In a future patch the bus clock frequency will be made\nconfigurable with a minimum frequency of 1.25MHz. Setting this\n(e.g. for debugging purposes) doubles the command run times but\nwill safely stay below 10ms.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-10-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cc3cb8db1eef9fbe6f2c520312cf6384cf2c2ce7", "tree": "fae3b17cad8225678c214441d5096de8f9178a8a", "parents": [ "ee18e22c63424ed9eddacaa3b4480413e29862bc" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:34 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:42 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Add page tracking\n\nThe hardware polling unit of the Realtek switches has a very special\nhandling for c22 PHY register 31 (aka Realtek page register) in place.\n\n- On the RTL838x it is permanently reset to zero.\n- On other devices there is some magic saving/restoring (aka parking)\n in the background in place.\n\nThis makes access to PHYs a gamble.\n\nIt is vital to keep the polling alive so the MAC layer can rely on\nconsistent data. Intercept access to c22 register 31 and handle it\ninternally. Store the desired value for each port in the driver. When\nissuing hardware access to other registers add the page to the command\ntowards the controller. Given this, the hardware will run two c22\ncommands that are not interrupted by polling.\n\n ... hardware poll ...\n phy_write(phy, 31, page)\n phy_write(phy, reg, value)\n ... hardware poll ...\n\nLooking at this implementation one might argue that disabling/enabling\npolling might be a cleaner solution. But one must remember that\n\n- This driver differentiates clearly between C22 and C45 buses. During\n probing it enables only one of the protocols for a bus.\n- All known devices run RTL8218 (B/D/E) or RTL8214FC on 1G\n- RTL839x gives link flapping when deactivating polling for a port\n\nSo a solution for a Realtek-only ecosystem is required. This commit\ncopies the downstream-proven driver-only page handling patch without\nany new MDIO callbacks and is the lowest common denominator. If a\nnon-Realtek PHY is identified on a c22 bus the attachment aborts. It\nshould be noted that bus scan runs with the page handling already in\nplace before the check in notify_phy_attach(). This is accepted for\nnow.\n\nRemark: To keep this simple, writes to register 31 are only accepted\nif they are lower than the device specific raw page - 0..4094/8190.\nOtherwise -EINVAL is returned. Under the above assumption (Only 1G\nRealtek PHYs on a c22 bus) this is no limitation.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-9-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee18e22c63424ed9eddacaa3b4480413e29862bc", "tree": "c10a4d1365f30f3b7130abb1e41d9070e83f51d2", "parents": [ "fe7a07ff5194e3b0168ca65c5e0ebde689eb73a9" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:08 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Configure hardware polling during probing\n\nDuring PHY probing and configuration complex configuration sequences\nmight be issued and firmware might be loaded. Hardware polling can\ninterfere badly with that. E.g. a hardware polling MMD c45 over c22\nrequest might break an ongoing firmware loading sequence.\n\nTo avoid such issues the polling of the Realtek Otto switches can be\n(de)activated with one or two 32 bit mask registers. Each bit enables\n(\u003d1) or disables (\u003d0) the polling of the corresponding port. Make use\nof this as follows:\n\n- Disable polling for all ports when the MDIO driver starts.\n- Reenable polling just after the PHY has been attached.\n- Disable polling just before the PHY is being detached.\n\nThis synchronizes the kernel and hardware polling to some extent. It\ngracefully handles deferred probing of PHYs in case the driver is\nloaded asynchronously during boot. Additionally it brings the hardware\npolling into a consistent operation mode for devices where U-Boot does\nnot take care.\n\nImportant notes about the implementation:\n\nRealtek is very inconsistent about its register naming. RTL930x uses\nSMI_POLL_CTRL for polling control while it is SMI_PORT_POLLING_CTRL\non RTL931x. Keep these vendor names.\n\nThese devices do not support power management for the whole system.\nSo mdio_bus_phy_resume() is not used and it is not required to\ndisable/enable hardware polling for that usecase.\n\nThese devices have no CPU MAC to PHY design. Thus abort phy_attach()\nin case PHYs are not mapped to valid switch ports. All MDIO bus\ncommands will fail afterwards, leaving it in an unusable state.\n\nEnabling/disabling hardware polling is a simple regmap bit access.\nFor this it is enough to rely on the regmap internal lock.\n\nThis polling enabling/disabling does not solve the current inability\nof the driver to handle C45-over-C22 access during normal operation.\nFor all existing designs this is not needed.\n\n[1] https://github.com/openwrt/openwrt/blob/main/target/linux/realtek/files-6.18/drivers/net/mdio/mdio-realtek-otto.c#L818\n[2] https://lore.kernel.org/netdev/680696024a8648535ce6dee771fe4de67802e0e8.1769053496.git.daniel@makrotopia.org/\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-8-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fe7a07ff5194e3b0168ca65c5e0ebde689eb73a9", "tree": "66a33a3ecfd54068f221838b7fa86978639a87e0", "parents": [ "4b1d5d51528a2178aa9abeea4881e15f2344285d" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:57:04 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: suppress sysfs bind/unbind attributes\n\nThe Realtek MDIO driver relies on devm managed resources for lifetime\nmanagement and allocates its internal central controller structure\notto_emdio_priv via devm_kzalloc(). This can lead to a use-after-free\nin the following sitauation:\n\n- If the driver is removed or unbound via sysfs the controller devm\n cleanup is triggered immediately. A corrupt devicetree might produce\n a load failure and a cleanup too.\n- However the MDIO buses are allocated with devm_mdiobus_alloc_size()\n and are reference counted. So if a MAC driver still holds a reference\n to a PHY device on the bus, the mii_bus will remain alive.\n- Any action that is run for the buses afterwards still relies on the\n availability of the central priv structure. This will access already\n freed memory.\n\nThere are multiple mitigations to choose from\n\n- Clone all controller-\u003epriv data into the bus-\u003epriv structure.\n- disable sysfs bind/unbind attributes\n- Check for \"bus-\u003estate !\u003d MDIOBUS_REGISTERED\" in all callbacks\n\nThis SoC-integrated MDIO controller cannot be physically hot-plugged\nand manual unbinding gives no benefit. The driver is usually\nintegrated into the kernel and not loaded as a module. Avoid a\ncomplex driver rewrite (data duplication) for now and set\nsuppress_bind_attrs to true to prevent unbinding via sysfs. This\nmitigates issues for the known use cases.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-7-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b1d5d51528a2178aa9abeea4881e15f2344285d", "tree": "4dce53acdc164e71663446f0e37f0670c4ee8d7e", "parents": [ "2df76677c1c08f622cc577a49f0645a5976d7c91" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Mon Aug 31 16:34:31 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:56:40 2026 -0700" }, "message": "net: phy: add (*notify_phy_attach/detach)() hooks to struct mii_bus\n\nSome MDIO buses require programming PHY polling registers depending\non the PHY type. RealTek switch SoCs are the most prominent example\nof a DSA switch which doesn\u0027t allow to program MAC speed, duplex and\nflow-control settings without using PHY polling to do so [1].\n\nAvoid a half-baked solution in the MDIO bus driver because\n\n- it must reinvent the bus scanning to determine the PHYs and\n- it must anticipate the right point in time (e.g. deferred PHYs).\n\nHence there is a need to inform the MDIO bus driver that a PHY is\nbeing attached or detached. Provide two hooks in struct mii_bus\n\n- notify_phy_attach(): called in phy_attach_direct() after PHY\n hardware has been initialized and just before PHY is resumed.\n- notify_phy_detach(): called in phy_detach() right after PHY\n has been suspended.\n\nWorth to notice: As of now phy_detach() is not 100% LIFO symmetric\nto phy_attach_direct(). E.g. sysfs links are torn down before\nsuspend while being created before resume. Without reordering of the\ndetach function the above mentioned notifier placement is the best\npossible symmetric implementation. An unconditional call of\nnotify_phy_detach() was favoured [3].\n\nRemark! A slightly different version of this patch was part of a\nformer series [2]. The discussion already showed that an initialization\nhook should be placed somewhere late during the whole setup. This\ncommit implants it right after phy_init_hw() as suggested. On top of\nthis it adds the detach hook.\n\n[1] https://github.com/openwrt/openwrt/pull/21515#discussion_r2714069716\n[2] https://lore.kernel.org/netdev/cover.1769053496.git.daniel@makrotopia.org/\n[3] https://lore.kernel.org/netdev/9e40f50b-357a-4a93-9f59-94847850835d@lunn.ch/#t\n\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-6-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2df76677c1c08f622cc577a49f0645a5976d7c91", "tree": "8df7c2e79e44042fa6109afe5438b051fbc86ca8", "parents": [ "3383b50c1695f7a7f0895b235706a3f2acf4ab11" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:30 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:56:40 2026 -0700" }, "message": "net: phy: add phy_detach_internal() helper\n\nFor the upcoming MDIO bus notification enhancements the PHY detach path\nneeds to inform the bus about these actions. Until now phy_detach() is\nused for the regular detach path as well as from the phy_attach_direct()\nerror paths So in the future there must be a clear indication if a\nnotification is needed (normal path) or not (cleanup path).\n\nCarve out the phy_detach() code into a new helper phy_detach_internal()\nand make phy_detach() a short stub that calls the new helper.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-5-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3383b50c1695f7a7f0895b235706a3f2acf4ab11", "tree": "5d4745034873a36bc0f6ee9369d47ca9f58a8b8f", "parents": [ "1c86cd6937165b8ea702d8931d09f1df238c2a44" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:29 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:56:40 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: deny C45 over C22 access\n\nHardware polling breaks C45 over C22 PHY access. Currently this\nis accepted by the driver but it silently fails with undefined\nresults. Make the situation clear to the caller by adding checks,\nreturning an error and giving a one-time warning message.\n\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-4-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1c86cd6937165b8ea702d8931d09f1df238c2a44", "tree": "eb149d80df735e57df1ab4c492a61fed7cdaad57", "parents": [ "c3a1b6763f4d76d69cb00e4e3a82ce7e18729507" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:56:40 2026 -0700" }, "message": "net: mdio: realtek-rtl9300: Add polling documentation\n\nAdd a detailed explanation how the hardware polling unit in the\nRealtek Otto switches works. This simplifies developing future\npatches and reviewing them.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-3-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c3a1b6763f4d76d69cb00e4e3a82ce7e18729507", "tree": "726801a1d7f806d40656c2ee61d7235d450a939d", "parents": [ "1d91ec5b15a13093a676b99f1099a7580f32f5a4" ], "author": { "name": "Markus Stockhausen", "email": "markus.stockhausen@gmx.de", "time": "Mon Aug 31 16:34:27 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:56:40 2026 -0700" }, "message": "dt-bindings: net: realtek,rtl9301-mdio: Add RTL83xx series\n\nThe lower end Realtek Otto switches provide 1G only and are divided into\ntwo series:\n\n- Maple : RTL838x up to 28 ports\n- Cypress: RTL839x up to 52 ports\n\nThe Maple based devices have 3 different SoCs: RTL8380, RTL8381 and\nRTL8382. The Cypress series consists of the RTL8391, RTL8392 and\nRTL8393 SoCs. The MDIO controller of these switches works like the\nexisting RTL93xx logic but has different characteristics and different\nregisters. Add new compatibles in the device tree.\n\nWith the extended compatibility list change the title to better reflect\nits scope. Especially add the \"Ethernet\" tag as these devices have\nmultiple MDIO controllers.\n\nSigned-off-by: Markus Stockhausen \u003cmarkus.stockhausen@gmx.de\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260831143439.2404484-2-markus.stockhausen@gmx.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d91ec5b15a13093a676b99f1099a7580f32f5a4", "tree": "7113f5be8feda8703953f7e069631ce1532be402", "parents": [ "7c0ec6288b497fc4dd190e243141a8d429488fd2", "534b188139745e0f31274fdb24e7abbeee2df204" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:41:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:41:20 2026 -0700" }, "message": "Merge branch \u0027usb-replace-page-allocator-calls-with-kmalloc\u0027\n\nMike Rapoport says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nUSB: replace page allocator calls with kmalloc()\n\nThis is a (small) part of larger work of replacing page allocator calls\nwith kmalloc.\n\nMy initial intention a few month ago was to remove ugly casts [1], but then\nwilly pointed out that Linus objected to something like this [2] and it\nlooks like more than a decade old technical debt.\n\nLargely, anything that doesn\u0027t need struct page (or a memdesc in the\nfuture) should just use kmalloc() or kvmalloc() to allocate memory.\nkmalloc() guarantees alignment, physical contiguity and working\nvirt_to_phys() and beside nicer API that returns void * on alloc and\ndoesn\u0027t require to know the allocation size on free, kmalloc() provides\nbetter debugging capabilities than page allocator.\n\nAnother thing is that touching these allocation sites gives the reviewers\nopportunity to see if a PAGE_SIZE buffer is actually needed or maybe\nanother size is appropriate.\n\nFor larger allocations that don\u0027t need physically contiguous memory\nkvmalloc() can be a better option that __get_free_pages() because under\nmemory pressure it\u0027s is easier to allocate several order-0 pages than a\nphysically contiguous chunk with the same number of pages.\n\nAnd last, but not least, removing needless calls to page allocator should\nhelp with memdesc (aka project folio) conversion. There will be way less\nplaces to audit to see if the user was actually using struct page.\n\nThe patches are deliberately kept small: each one deals with a single\ndriver or subsystem and with a single type of allocation, so that every\nconversion can be reviewed, and if needed reverted, on its own.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260830-usb-v1-0-aa349c302246@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "534b188139745e0f31274fdb24e7abbeee2df204", "tree": "7113f5be8feda8703953f7e069631ce1532be402", "parents": [ "a3b4826138d453ce74cc7de4adaca08c622b6e07" ], "author": { "name": "Mike Rapoport (Microsoft)", "email": "rppt@kernel.org", "time": "Sun Aug 30 11:10:39 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:41:19 2026 -0700" }, "message": "USB: speedtch: replace __get_free_page() with kmalloc()\n\nspeedtch_upload_firmware() allocates a temporary buffer used to feed the\nfirmware to the device.\n\nThis buffer can be allocated with kmalloc() as there\u0027s nothing special\nabout it to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of __get_free_page() with kmalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nLink: https://patch.msgid.link/20260830-usb-v1-3-aa349c302246@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a3b4826138d453ce74cc7de4adaca08c622b6e07", "tree": "0a81ae3589206852bba85794fdb07687e64b63f0", "parents": [ "7c0ec6288b497fc4dd190e243141a8d429488fd2" ], "author": { "name": "Mike Rapoport (Microsoft)", "email": "rppt@kernel.org", "time": "Sun Aug 30 11:10:38 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:41:19 2026 -0700" }, "message": "USB: cxacru: replace __get_free_page() with kmalloc()\n\ncxacru_fw() allocates a temporary buffer used to feed the firmware to the\ndevice and cxacru_bind() allocates the transfer buffers for the command\nURBs.\n\nThese buffers can be allocated with kmalloc() as there\u0027s nothing special\nabout them to go directly to the page allocator.\n\nkmalloc() provides a better API that does not require ugly casts and\nkfree() does not need to know the size of the freed object.\n\nPerformance difference between kmalloc() and __get_free_pages() is not\nmeasurable as both allocators take an object/page from a per-CPU list for\nfast path allocations.\n\nFor the slow path the performance is anyway determined by the amount of\nreclaim involved rather than by what allocator is used.\n\nReplace use of __get_free_page() with kmalloc() and free_page() with\nkfree().\n\nLink: https://lore.kernel.org/all/635405e4-9423-4a25-a6e7-e03c8ea0bcbe@redhat.com\nSigned-off-by: Mike Rapoport (Microsoft) \u003crppt@kernel.org\u003e\nLink: https://patch.msgid.link/20260830-usb-v1-2-aa349c302246@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c0ec6288b497fc4dd190e243141a8d429488fd2", "tree": "97da4b8667d3670541d0061a513e312dfb78ab58", "parents": [ "5add7c8d59fa3a54ebf7b662ef68dce9d44ddbef" ], "author": { "name": "Sebastian Andrzej Siewior", "email": "bigeasy@linutronix.de", "time": "Tue Sep 01 18:03:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:38:16 2026 -0700" }, "message": "net: Replace %pK output with 0\n\nCommit 71338aa7d050c (\"net: convert %p usage to %pK\") which is from\n2011 and changed the %p annotation for pointer to %pK. Back then the\ndefault behaviour for %p was to print the pointer. The %pK modifier was\nintroduced to able to control the behaviour of specific pointer values\nwithout changing the behaviour of %p for everyone. It was dedicated to\navoid leaking pointers via /proc.\n\nThere was also the idea to remove the check from formatting the string\nand move to the open callback with some helpers but this did not happen.\n\nThings changed over time. The default behaviour for %p is now to print a\nhash pointer which does not leak the address but allows to correlate if\ntwo pointers are equal.\nThe policy on %p is to not introduce new ones. This is somehow in\nbetween since it already exists. The pointer are usually socket pointers\nand I don\u0027t see any value in exposing them. Therefore I am following the\nrecommendation of removing them. Since their usage in /proc/ can be\nconsidered ABI I replace the pointer with a 0.\n\nReplace the %pK annotation with 0 value. Correct the spacing for the\ncases where pointer is at the beginning.\n\nReviewed-by: Kees Cook \u003ckees@kernel.org\u003e\nSigned-off-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nLink: https://patch.msgid.link/20260901160345.eeknHmY2@linutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5add7c8d59fa3a54ebf7b662ef68dce9d44ddbef", "tree": "628a6c156aee709ec8c899d30d22ae35484153de", "parents": [ "25a477c8d9a390d3f1cde8fbe985157d4c89481e" ], "author": { "name": "Jiayuan Chen", "email": "jiayuan.chen@linux.dev", "time": "Tue Sep 01 14:18:50 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:34:58 2026 -0700" }, "message": "netdevsim: fix panic when NETIF_F_LOOPBACK is set on a VF port\n\nA netdevsim VF port cannot process incoming data. It never runs\nnsim_queue_init(), so ns-\u003erq is NULL, and nsim_vf_netdev_ops has no\n-\u003endo_open, so its NAPI is never set up either.\n\nnsim_setup() offers NETIF_F_LOOPBACK to both PF and VF ports. Turning\nit on for a VF makes nsim_start_xmit() take ns itself as peer_ns and\ndereference peer_ns-\u003erq[], which panics.\n\nA VF cannot deliver packets at all: it can\u0027t be linked as a peer either,\nsince netdev_is_nsim() only matches the PF netdev_ops, so ns-\u003epeer is\nalways NULL and every skb ends up dropped. Give VF ports a dedicated\nxmit that just drops the traffic, so VFs no longer depend on PF-only\nstate in nsim_start_xmit().\n\nReproduce in qemu:\n modprobe netdevsim\n echo \"90 1\" \u003e /sys/bus/netdevsim/new_device\n echo 2 \u003e /sys/bus/netdevsim/devices/netdevsim90/sriov_numvfs\n devlink dev eswitch set netdevsim/netdevsim90 mode switchdev\n ethtool -K eth2 loopback on # eth2 is the vfnum 0 port\n ip link set eth2 up\n\nPanic:\n KASAN: null-ptr-deref in range [0x0000000000000000-0x0000000000000007]\n CPU: 0 UID: 0 PID: 141 Comm: kworker/0:3 Not tainted 7.2.0+ #338 PREEMPT\n Workqueue: mld mld_ifc_work\n RIP: 0010:nsim_start_xmit (drivers/net/netdevsim/netdev.c:159)\n dev_hard_start_xmit ( net/core/dev.c:3953)\n sch_direct_xmit (net/sched/sch_generic.c:372)\n __dev_queue_xmit (net/core/dev.c:4262 net/core/dev.c:4884)\n neigh_resolve_output (net/core/neighbour.c:1616)\n ip6_finish_output2 (net/ipv6/ip6_output.c:138)\n ip6_finish_output (net/ipv6/ip6_output.c:221)\n ip6_output (net/ipv6/ip6_output.c:248)\n ......\n\nCc: stable+noautosel@kernel.org # netdevsim is a test harness, it\u0027s never loaded on production systems\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20260901061851.61734-1-jiayuan.chen@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "25a477c8d9a390d3f1cde8fbe985157d4c89481e", "tree": "41bcdc17a7c3d0c53d071ad92a6e3fc8d95ca8a7", "parents": [ "577b53589d420609e126fb710f23360d8ae96a3b", "34d89dee719bb5509a50858756ed3d314ceb6af6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:33:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:33:36 2026 -0700" }, "message": "Merge branch \u0027selftests-drv-net-split-up-gro-py\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests: drv-net: split up gro.py\n\ngro.py runs its full set of cases three times over - against SW GRO,\nHW GRO and LRO. It\u0027s our test with the longest runtime. The 318 cases\ntake 12m30s on mlx5 with a debug kernel.\n\nWe will likely add more subcases here as the time goes on, so it\u0027s\ntime to start splitting it up. Long runtime wastes time on retries\n(if any of the 300+ cases fails we try to check if it\u0027s a real failure\nor flake an re-run the whole thing). It also forces us to increase\ntimeout for the whole test suite.\n\nv1: https://lore.kernel.org/20260831163734.1121891-1-kuba@kernel.org\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260901200728.2063720-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "34d89dee719bb5509a50858756ed3d314ceb6af6", "tree": "41bcdc17a7c3d0c53d071ad92a6e3fc8d95ca8a7", "parents": [ "f225a7317c18f2009fb4cdcc75337c726b6dda88" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 13:07:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:33:33 2026 -0700" }, "message": "selftests: drv-net: bump the timeout to 15min\n\nThe XDP test takes 9m30s on the slowest NIC with debug kernel.\nLet\u0027s give ourselves a 50% margin and set the timeout to 15min.\n\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260901200728.2063720-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f225a7317c18f2009fb4cdcc75337c726b6dda88", "tree": "ab2d5300119461f8f3341c8a416a2428694bc133", "parents": [ "889b0cca6b29df5bb92507745000e783cc46bf5d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 13:07:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:33:33 2026 -0700" }, "message": "selftests: drv-net: split gro.py into one test per coalescing mode\n\ngro.py runs its full set of cases three times over - against SW GRO,\nHW GRO and LRO. It\u0027s our test with the longest runtime. The 318 cases\ntake 12m30s on mlx5 with a debug kernel.\n\nBumping the timeout for all tests feels wrong when we can so easily\nsplit the GRO test by execution mode. Shorter runtime also helps retry\njust the failing portion / mode (we retry failing tests to try to\ndetect flakes vs real failures).\n\nMove the main logic to gro_lib.py and add one program per mode -\ngro_sw.py, gro_hw.py and gro_lro.py, 102 cases each. Move PPPoE to\na dedicated test. It has been tacked onto the tests in an ugly way,\nand it only runs against SW GRO anyway.\n\nNote that unfortunately this will case a rename of all test cases.\nThe mode moves from the case name to the test name\n\n gro.py test.sw_ipv4_data_same\n\nbecomes\n\n gro_sw.py test.ipv4_data_same\n\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260901200728.2063720-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "889b0cca6b29df5bb92507745000e783cc46bf5d", "tree": "95cdd7a07d0baab4622177dabe97404f187cd4df", "parents": [ "577b53589d420609e126fb710f23360d8ae96a3b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 13:07:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:33:33 2026 -0700" }, "message": "selftests: drv-net: hw: rename gro_hw.py to gro_stats.py\n\nWe need to free up the gro_hw.py name for the HW-GRO half of gro.py,\nwhich we need to split by mode (sw / hw / lro). The file checks mostly\nqstat counters, so name it after stats.\n\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260901200728.2063720-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "577b53589d420609e126fb710f23360d8ae96a3b", "tree": "72d264490be6981e6854136f88a37a04ad1b1e0d", "parents": [ "8f051d2d0680ff8c8f07ed34317e22f84567380e" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@oss.qualcomm.com", "time": "Tue Sep 01 08:12:56 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:32:50 2026 -0700" }, "message": "dt-bindings: net: fsl,fman-dtsec: Drop redundant pcs-handle-names dependency\n\nThe binding references ethernet-controller.yaml schema, which already\ndefines a dependency of pcs-handle-names on pcs-handle, thus duplicating\nit here is redundant.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260901061255.25734-2-krzysztof.kozlowski@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "debac3a20dec524a59625cf10fa2f18571127824", "tree": "e5b6dd1577de39abcf7cf853d8f8215380860412", "parents": [ "5a3f7a683aee56e1f15c9d53041f3236767eaae7" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Sep 01 00:55:44 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:30:00 2026 -0700" }, "message": "net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n\nsyzbot reported the warning in cfg80211_pernet_exit(). [0]\n\nThe repro does the following:\n\n 1. create two device in root netns and non-root netns\n 2. assign the same altname for the two devices\n 3. remove the non-root netns\n\nSince commit 7663d522099e (\"net: check for altname conflicts\nwhen changing netdev\u0027s netns\"), cfg80211_switch_netns() and\ncfg802154_switch_netns() fail if init_net has a device with the\nconflicting altname.\n\ndefault_device_exit_net() had the same issue and commit d09486a04f5d\n(\"net: fix removing a namespace with conflicting altnames\") fixed it.\n\ncfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.\n\nLet\u0027s generalise the fix by removing conflicting altnames for dying\nnetns in __dev_change_net_namespace().\n\n[0]:\ncfg80211_switch_netns(rdev, \u0026init_net)\nWARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160\nModules linked in:\nCPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 \u003c0f\u003e 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20\nFS: 0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253\n cleanup_net+0x572/0x810 net/core/net_namespace.c:706\n process_one_work kernel/workqueue.c:3387 [inline]\n process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551\n kthread+0x38b/0x480 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFixes: 36fbf1e52bd3 (\"net: rtnetlink: add linkprop commands to add and delete alternative ifnames\")\nReported-by: syzbot+74f338e09f1ef3ee6457@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260901005550.2042357-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f051d2d0680ff8c8f07ed34317e22f84567380e", "tree": "7b846cc2e781688bbe3335d0a297377ad370f093", "parents": [ "4187c29c2abdd2144f5bcf5936c7f997d1fdef66", "bd6b764f08deb2356f95d026c3143d5e19280496" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:26:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:26:50 2026 -0700" }, "message": "Merge branch \u0027net-dsa-realtek-enable-rtl8365mb-power-supplies\u0027\n\nOleksij Rempel says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: dsa: realtek: enable RTL8365MB power supplies\n\nThe RTL8365MB family has several external power rails (analog, digital I/O\nand PLL supplies) that on some boards are gated by regulators. Until now the\ndriver assumed they were always on, so it could not be used on designs that\nkeep these rails software-controlled.\n\nThis series adds a device-tree description for those supplies and enables\nthem in the driver before the chip is accessed:\n\nThe supplies are optional: boards that hard-wire the rails work unchanged\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831123637.666457-1-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd6b764f08deb2356f95d026c3143d5e19280496", "tree": "7b846cc2e781688bbe3335d0a297377ad370f093", "parents": [ "f82364499682159e369e453922fd25d27c3a833f" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Mon Aug 31 14:36:37 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:26:48 2026 -0700" }, "message": "net: dsa: realtek: rtl83xx: use dev_err_cast_probe() for reset GPIO\n\nReplace the open-coded dev_err() + ERR_CAST() on the reset GPIO error\npath with dev_err_cast_probe(), matching the reset controller above and\nstaying quiet on -EPROBE_DEFER.\n\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nReviewed-by: Luiz Angelo Daros de Luca \u003cluizluca@gmail.com\u003e\nLink: https://patch.msgid.link/20260831123637.666457-4-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f82364499682159e369e453922fd25d27c3a833f", "tree": "88f084aca69153096aabc8bbf228c115f11e1b69", "parents": [ "f4d02541872152b5248e84864e72e863902aa495" ], "author": { "name": "Ahmad Fatoum", "email": "a.fatoum@pengutronix.de", "time": "Mon Aug 31 14:36:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:26:48 2026 -0700" }, "message": "net: dsa: realtek: rtl83xx: add support for enabling supplies\n\nThe power supplies powering the IC may not necessarily be enabled by the\ntime the driver probes. The binding describes the power rails, so enable\nthem at probe with devm_regulator_bulk_get_enable(), before the reset line\nis requested and driven, so the chip is powered before its pins are driven.\n\nBoards that do not describe these supplies fall back to dummy regulators\n(with a \"supply not found\" warning) and keep working as before.\n\nA board that describes supplies but no reset line still needs to wait for\nthe chip to boot before the first register access, so apply the existing\nstart delay in that case too.\n\nSigned-off-by: Alvin Šipraga \u003calsi@bang-olufsen.dk\u003e\nSigned-off-by: Ahmad Fatoum \u003ca.fatoum@pengutronix.de\u003e\nCo-developed-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Luiz Angelo Daros de Luca \u003cluizluca@gmail.com\u003e\nLink: https://patch.msgid.link/20260831123637.666457-3-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f4d02541872152b5248e84864e72e863902aa495", "tree": "5e6296781fafe45cc57ec3e7546c60d2d0e9b33c", "parents": [ "4187c29c2abdd2144f5bcf5936c7f997d1fdef66" ], "author": { "name": "Oleksij Rempel", "email": "o.rempel@pengutronix.de", "time": "Mon Aug 31 14:36:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:26:48 2026 -0700" }, "message": "dt-bindings: net: dsa: realtek: add RTL8365MB power supplies\n\nDocument the RTL8365MB power rails as optional supplies. They are optional\nbecause the rails are often always-on; some designs break them out for\ngranular hwmon monitoring and regulator control.\n\nThey are scoped to realtek,rtl8365mb: different Realtek switch families use\ndifferent power-rail naming schemes, so these rails do not apply to other\nfamilies such as realtek,rtl8366rb (VDDA/VDD_CORE/VDDIO/...).\n\nSigned-off-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nReviewed-by: Luiz Angelo Daros de Luca \u003cluizluca@gmail.com\u003e\nAcked-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260831123637.666457-2-o.rempel@pengutronix.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a3f7a683aee56e1f15c9d53041f3236767eaae7", "tree": "6cb0613b9f4cf74a6070a2977c5fb07a19c6e954", "parents": [ "af602c7aa5fedc9be3043244017aef4f26c96b70" ], "author": { "name": "Jun Yang", "email": "littleddfu@gmail.com", "time": "Mon Aug 31 19:13:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:25:35 2026 -0700" }, "message": "net: bridge: mcast: don\u0027t truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport-\u003emglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator\u0027s saved next node, hlist_del_init()\nclears its -\u003enext and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling -\u003ekey.port after del_nbp() frees the port:\n\n BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n __mdb_fill_info+0x1191/0x1320\n br_mdb_dump+0x594/0xe40\n rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving -\u003enext.\nbr_multicast_del_pg() and the teardown walks run under\nbr-\u003emulticast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving -\u003enext means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp-\u003eports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port-\u003emglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case.\n\nFixes: b08123684bd5 (\"net: bridge: mcast: install S,G entries automatically based on reports\")\nCc: stable@vger.kernel.org\nSuggested-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831111330.199543-1-junvyyang@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4187c29c2abdd2144f5bcf5936c7f997d1fdef66", "tree": "906244443a5cd3a9e59ae1cc4b30561ad72d91ed", "parents": [ "1c03d3ae5c9640b162c70492bf42b1b36fa3d7d6" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 15:41:29 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:20:36 2026 -0700" }, "message": "net: optimize netif_is_l3_master() and netif_is_l3_slave()\n\nIFF_L3MDEV_MASTER and IFF_L3MDEV_SLAVE flags are only set and used\nby the VRF driver (CONFIG_NET_VRF).\n\nnetif_is_l3_master() and netif_is_l3_slave() are called in multiple\nperformance-critical fast paths (such as GRO, IP routing/FIB lookups,\nTCP/UDP processing, etc.).\n\nWhen CONFIG_NET_VRF is disabled, neither flag can ever be set on any\nnet_device.\n\nAdding IS_ENABLED(CONFIG_NET_VRF) allows the compiler to optimize\nthese checks away as false at compile time, eliminating unnecessary\nconditional branches in the fast path when VRF is not enabled.\n\nscripts/bloat-o-meter shows a nice code size reduction on a kernel\nbuilt with CONFIG_NET_VRF\u003dn (and CONFIG_NET_L3_MASTER_DEV\u003dy):\n\nadd/remove: 2/5 grow/shrink: 18/71 up/down: 1593/-5642 (-4049)\nFunction old new delta\nipip6_tunnel_lookup.constprop - 931 +931\ntcp_v6_parse_md5_keys 1607 1742 +135\nipip6_err 617 738 +121\nbpf_lwt_xmit_reroute 1492 1555 +63\nip6_pol_route 1810 1843 +33\nrt6_multipath_rebalance.part 1448 1480 +32\nbpf_msg_pull_data 1255 1287 +32\n__unlikely_text_end 3092 3124 +32\nipv6_add_addr 2257 2287 +30\n__ip4_datagram_connect 1131 1158 +27\nip6_rt_cache_alloc 476 500 +24\nfib6_clean_tohost 308 328 +20\nsit_exit_rtnl_net 461 477 +16\nnf_nat_register_fn 581 597 +16\nip6_forward 4573 4589 +16\ninet_rtm_getroute 2906 2922 +16\n__pfx_ipip6_tunnel_lookup.constprop - 16 +16\n__ip_do_redirect 2005 2021 +16\n__bpf_skc_lookup 449 464 +15\naddrconf_add_dev 134 136 +2\nip6_rcv_finish 203 201 -2\nicmp6_dev 159 153 -6\nipip6_tunnel_bind_dev 419 409 -10\nbpf_xdp_skc_lookup_tcp 122 107 -15\nbpf_tc_skc_lookup_tcp 125 110 -15\nrt6_nh_dump_exceptions 243 227 -16\nip_mc_source 1385 1369 -16\nip6_fragment 2450 2434 -16\ninput_action_end_x 278 262 -16\nfib6_nh_age_exceptions.part 822 806 -16\n__pfx_ipip6_tunnel_lookup 16 - -16\n__pfx_ip6_rt_get_dev_rcu 16 - -16\n__addrconf_sysctl_register 365 349 -16\nbpf_xdp_sk_lookup_udp 155 138 -17\nbpf_xdp_sk_lookup_tcp 155 138 -17\nbpf_tc_sk_lookup_udp 158 141 -17\nbpf_tc_sk_lookup_tcp 158 141 -17\naddrconf_addr_gen 339 322 -17\nip6_rcv_core 2084 2066 -18\nfib_nl2rule_locked 517 499 -18\nl3mdev_master_upper_ifindex_by_index_rcu 61 42 -19\nipip6_rcv 1960 1941 -19\naddrconf_notify 2563 2543 -20\nl3mdev_fib_table_by_index 304 282 -22\nnf_nat_inet_fn 777 754 -23\nattach_rules 176 150 -26\nipv6_rcv 867 840 -27\nip_sublist_rcv 1342 1315 -27\nip6_sublist_rcv 1528 1501 -27\nsit_tunnel_rcv 498 470 -28\nndisc_send_redirect 1474 1445 -29\nip_mr_input 1175 1143 -32\nip6_mr_input 627 595 -32\ntcp_ao_add_cmd.cold 33 - -33\nip_error 1059 1023 -36\nraw_sendmsg 5291 5253 -38\nend_dt_vrf_core 466 426 -40\nip_rcv 886 844 -42\nip_send_unicast_reply 1487 1443 -44\nudp_sendmsg 4135 4089 -46\ndelete_tempaddrs 259 211 -48\nudp6_gro_receive 1142 1092 -50\nudp4_lib_lookup_skb 259 208 -51\nl3mdev_fib_rule_match 337 286 -51\nping_v4_sendmsg 2692 2640 -52\ntcp6_check_fraglist_gro 341 288 -53\nl3mdev_master_ifindex_rcu 69 16 -53\nip6_dst_lookup_tail.constprop 1533 1480 -53\nudp4_gro_receive 1139 1085 -54\nigmp_rcv 3215 3160 -55\nndisc_recv_ns 1699 1642 -57\nfib_netdev_event 771 714 -57\nl3mdev_link_scope_lookup 124 65 -59\nudp6_lib_lookup_skb 173 113 -60\n__ip_local_out 1182 1120 -62\nipv6_frag_rcv 3670 3601 -69\nip_route_output_key_hash_rcu 3024 2951 -73\n__ip6_local_out 1164 1091 -73\ntcp_v6_send_response 3056 2982 -74\nrt6_fill_node 4103 4027 -76\nrawv6_sendmsg 6225 6149 -76\nl3mdev_fib_table_rcu 92 16 -76\ntcp4_gro_receive 1375 1295 -80\nip6_xmit 2771 2690 -81\nfib_select_path 2190 2105 -85\ntcp_v4_parse_md5_keys 1160 1058 -102\nip_route_input_slow 4471 4354 -117\nip6_pkt_drop.isra 572 453 -119\nl3mdev_update_flow 516 360 -156\nip6_rt_get_dev_rcu 182 - -182\n__ipv6_chk_addr_and_flags 750 568 -182\nip_route_input_rcu.part 941 743 -198\nnf_confirm 1222 960 -262\nipv6_dev_get_saddr 1321 918 -403\ntcp_ao_add_cmd 2643 2211 -432\nipip6_tunnel_lookup 1004 - -1004\nTotal: Before\u003d33195512, After\u003d33191463, chg -0.01%\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260831154129.4048178-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "af602c7aa5fedc9be3043244017aef4f26c96b70", "tree": "1765282fb7828988c3d2e18fc8a4e040fee2a496", "parents": [ "544d85de4dc22c01badfd8cefa59829ce35c4858" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 20:30:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:19:19 2026 -0700" }, "message": "bonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all \u003d\u003d true),\n__bond_release_one() unconditionally clears bond-\u003ecurr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info-\u003eprimary_is_promisc \u003d 1.\n\nBecause bond-\u003ecurr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent \u003d\u003d slave, bond_change_active_slave(bond, NULL) already sets\nbond-\u003ecurr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all \u003d\u003d true. Replace the if (all) branch with\nif (!all \u0026\u0026 oldcurrent \u003d\u003d slave).\n\nFixes: 0896341a44bf (\"bonding: fix bond_release_all inconsistencies\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831203042.164466-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1c03d3ae5c9640b162c70492bf42b1b36fa3d7d6", "tree": "e5261b273ebdf3c0b75c4fd78281f1982f55b43e", "parents": [ "d0ec95a8a4e79f2fd6063fc8932415db8c227689", "4cef95f72bbd0d5edb232143751251717efb5928" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:17:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:17:56 2026 -0700" }, "message": "Merge branch \u0027bonding-fix-tlb-load-tracking-overflow-on-high-speed-nics\u0027\n\nHangbin Liu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbonding: fix TLB load-tracking overflow on high-speed NICs\n\nThe bonding TLB (Transmit Load Balancing) mode tracks per-slave and\nper-client transmit byte counts in u32 fields. At sustained throughput\nabove ~3.2 Gbit/s over the 10-second rebalance interval these counters\nwrap, causing compute_gap() to produce incorrect gap values and\nmis-select transmit slaves. Such speeds are routine on modern NICs\nunder heavy traffic.\n\nThis two-patch series fixes the overflow by widening the relevant\nfields to u64.\n\nPatch 1 converts the unbalanced_load counter to per-cpu state as a\npreparatory step. The counter sits in the transmit hot path, so\nconverting it to per-cpu before widening avoids introducing cross-CPU\nsynchronization overhead for a u64. Also use a prev_total_unbalanced\nto store the previous total load to avoid reset per-cpu data.\n\nPatch 2 widens tx_bytes, load_history, load, and the per-cpu\nunbalanced_load tx_bytes from u32 to u64. It adds u64_stats_sync\nprotection for the per-cpu counter to prevent tearing on 32-bit\narchitectures, and reworks compute_gap() to use s64 arithmetic with\nREAD_ONCE() on slave-\u003espeed.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831-bond_overflow-v6-0-ffb0ed1f7268@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4cef95f72bbd0d5edb232143751251717efb5928", "tree": "e5261b273ebdf3c0b75c4fd78281f1982f55b43e", "parents": [ "e14761563588281909beaef0a4b5d1b735c7404c" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@kylinos.cn", "time": "Mon Aug 31 09:51:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:17:47 2026 -0700" }, "message": "bonding: fix u32 overflow in compute_gap()\n\nThe TLB load-tracking fields tx_bytes, load_history, load, and\nunbalanced_load are all u32. At sustained throughput above ~3.2 Gbit/s\nover the 10-second rebalance interval the byte counters wrap, causing\ncompute_gap() to produce incorrect gap values and mis-select slaves.\nSuch speeds are common on modern NICs under heavy traffic.\n\nWiden these fields to u64. Use u64_stats_sync to protect the per-cpu\nunbalanced_load_stats against tearing on 32-bit architectures, and\ndiv_u64() for the 64-bit divisions. The tx_bytes and load_history\nare protected in spin_lock. Also protect the slave load writing in\nbond_alb_monitor() with spin_lock in case of tear on 32-bit.\n\nFor compute_gap(), we still use s64 arithmetic throughout, so we can\npreserve the existing calculation logic. This order of magnitude is\nsufficiently large, there is no need to worry about overflow for now.\n\nDetected by AI code review.\n\nCc: stable+noautosel@kernel.org # never worked\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nAcked-by: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nLink: https://patch.msgid.link/20260831-bond_overflow-v6-2-ffb0ed1f7268@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e14761563588281909beaef0a4b5d1b735c7404c", "tree": "0b77b421c5af00fb2030692fb10005a858381d59", "parents": [ "d0ec95a8a4e79f2fd6063fc8932415db8c227689" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@kylinos.cn", "time": "Mon Aug 31 09:50:59 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:17:44 2026 -0700" }, "message": "bonding: convert unbalanced_load to per-cpu state\n\nA later patch widens the bonding TLB tx counters from u32 to u64. The\nunbalanced_load counter sits in the transmit hot path, and cross-CPU\nsynchronization of a u64 would introduce measurable overhead. Convert\nunbalanced_load to a per-cpu counter first so that the subsequent\nwidening only touches per-cpu data local to each CPU.\n\nIntroduce struct unbalanced_load_stats to hold the per-cpu counter,\nand move the aggregation into a helper, reset_unbalanced_load(), which\nsums all per-cpu instances. Use the delta of current total load vs\nvariable prev_total_unbalanced to calculate the loading.\n\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nSigned-off-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nAcked-by: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nLink: https://patch.msgid.link/20260831-bond_overflow-v6-1-ffb0ed1f7268@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "940de590b839f71d6dc846160534bf202401b8b7", "tree": "78525ca9a4261293fd0f604b925a12f016ec1962", "parents": [ "89a312991dc6e638a36adc43ccb91dbc25504c04", "2625480a1bf79c62ffb09aafdf61778e682da492" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 02 16:02:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 02 16:02:02 2026 -0700" }, "message": "Merge tag \u0027hardening-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening fix from Kees Cook:\n\n - Default randstruct off with rust for better allmodconfig coverage\n (Mark Brown)\n\n* tag \u0027hardening-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n hardening: Default randstruct off with rust for better allmodconfig support\n" }, { "commit": "7ac81e2d2240f2c57bd073b0733e0b2abca38e82", "tree": "f8becdfebbfa1c31fe32742c3b88a283b98911a5", "parents": [ "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84" ], "author": { "name": "Genjian Zhang", "email": "zhanggenjian@kylinos.cn", "time": "Fri Aug 07 23:57:15 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 17:01:13 2026 +0200" }, "message": "dm-ebs: fix incorrect device offset check in ebs_ctr()\n\n\u003coffset\u003e is a backing-device sector offset; ti-\u003elen is the virtual\ntarget length. Comparing them rejects valid tables, e.g.:\n\n dmsetup create ebs0 --table \"0 1048576 ebs /dev/sda 2097152 1 8\"\n -\u003e ebs: Invalid device offset sector (-EINVAL)\n\nDrop the check. Bounds against the backing device are already\nenforced later by device_area_is_invalid() via ebs_iterate_devices().\n\nCc: stable@vger.kernel.org\nFixes: d3c7b35c20d6 (\"dm: add emulated block size target\")\nSigned-off-by: Genjian Zhang \u003czhanggenjian@kylinos.cn\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84", "tree": "814282e8a747330133608e277d85efd5715873a4", "parents": [ "2ccb8878c149443c6acf628b438c9c942c20abb2" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 16:36:26 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 16:36:26 2026 +0200" }, "message": "dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the \u0027R\u0027 mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the \u0027R\u0027 mode.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nFixes: 468dfca38b1a (\"dm integrity: add a bitmap mode\")\nCc: stable@vger.kernel.org\n" }, { "commit": "544d85de4dc22c01badfd8cefa59829ce35c4858", "tree": "f89cbe4551c52a00f618587111faf2dae71686a7", "parents": [ "f695390ea63941a9e412bf1f3afe65ab245fc681" ], "author": { "name": "Chris Lew", "email": "christopher.lew@oss.qualcomm.com", "time": "Thu Aug 27 17:48:46 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 02 12:14:32 2026 +0100" }, "message": "net: qrtr: Send HELLO message on endpoint register\n\nHELLO is currently handled entirely by the name server (NS): it is\nsent once as a broadcast when the NS initializes, and again as a\nreply whenever the NS receives an inbound HELLO from a remote.\n\nSome remote QRTR endpoints (e.g. an external WLAN chipset attached\nover MHI) operate in a slave role: they only ever send a HELLO in\nresponse to one they receive, and never initiate. Since the host cannot\ntell in advance which remotes behave this way, if the host also only\nreplies, both sides wait on the other to speak first and no HELLO is\never exchanged, stalling further communication.\n\nTo fix this:\n- Transfer HELLO handshake ownership to the core layer. A HELLO is\n now sent once, per endpoint, at registration time.\n- Schedule a delayed work item on endpoint registration to send a\n HELLO once the name server is bound. The work reschedules itself\n with a 100ms backoff if the name server socket is not yet bound or\n if allocating the control packet fails, so a transient startup\n condition does not abandon the handshake permanently.\n- Enforce HELLO-first ordering by dropping non-HELLO packets and\n returning -EAGAIN until the HELLO is confirmed sent, using bool\n hello_sent guarded by ep_lock to make the gate check atomic with\n xmit().\n- Skip nodes with nid \u003d\u003d QRTR_EP_NID_AUTO in bcast_enqueue(), to avoid\n broadcasting control packets with QRTR_EP_NID_AUTO as the destination\n node ID.\n- Remove say_hello() from the name server\u0027s ctrl_cmd_hello() handler\n and from qrtr_ns_init(); the core layer is now the sole sender of\n the outbound HELLO. This removes the NS\u0027s reply-on-receive\n behaviour without a replacement.\n\nSigned-off-by: Chris Lew \u003cchristopher.lew@oss.qualcomm.com\u003e\nCo-developed-by: Deepak Kumar Singh \u003cdeepak.singh@oss.qualcomm.com\u003e\nSigned-off-by: Deepak Kumar Singh \u003cdeepak.singh@oss.qualcomm.com\u003e\nCo-developed-by: Pranav Mahesh Phansalkar \u003cpranav.phansalkar@oss.qualcomm.com\u003e\nSigned-off-by: Pranav Mahesh Phansalkar \u003cpranav.phansalkar@oss.qualcomm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "d0ec95a8a4e79f2fd6063fc8932415db8c227689", "tree": "d5c6a66ed3bf0d8bee98772f5a9ed8500d0a5123", "parents": [ "c29b37ed7a4d9856ed758a82282456d69cee2ed1" ], "author": { "name": "Dexuan Cui", "email": "decui@microsoft.com", "time": "Fri Aug 28 14:23:25 2026 -0700" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 02 10:09:01 2026 +0100" }, "message": "hv_netvsc: Advertise the SR-IOV capability for CoCo VMs\n\nThis basically reverts the Feb 2021 change:\ncommit 96854bbda24f (\"hv_netvsc: Restrict configurations on isolated guests\")\n\nIn Feb 2021, PCI device assignment for CoCo VMs on Hyper-V was not\nsupported: if the host offered a PCI VF NIC device to the VM, the VM\ncouldn\u0027t handle it properly, so the 2021 commit was made to tell the host\n\"I\u0027m unable to handle SR-IOV NICs, so please don\u0027t offer a VF to me\".\nIf the host offers a VF NIC to the VM anyway, the change to\nnetvsc_receive_inband() ignores the VF NIC.\n\nSince Mar 2023, the VM is able to support PCI device assignment due to\ncommit 2c6ba4216844 (\"PCI: hv: Enable PCI pass-thru devices in Confidential VMs\")\nand related commits, so hv_netvsc can functionally work with a VF NIC, but\nwe haven\u0027t advertised the SR-IOV capability because the MANA NIC driver\n(drivers/net/ethernet/microsoft/mana/) hadn\u0027t been hardened, so a\nmalicious MANA NIC might be able to attack the VM.\n\nRecently, we have finished hardening the MANA driver, so we can safely\nuse the MANA NIC in a CoCo VM now. Note: currently the MANA driver in a\nCoCo VM still uses bounce buffering (i.e. shared decrypted memory)\nfor DMA. In the future, it will be able to use private encrypted\nmemory for DMA with the help of TDISP.\n\nNow, advertises the SR-IOV capability for CoCo VMs.\n\nNote: for MANA to work properly for CoCo VMs, the following earlier\ncommits are also required:\ncommit 2e2a83b4998a (\"net: mana: Validate the packet length reported by the NIC\")\ncommit c72a0f09c57f (\"net: mana: Sync page pool RX frags for CPU\")\n\nNote: the host might offer a VF NIC device that\u0027s not MANA -- in that\ncase, if the corresponding VF NIC driver isn\u0027t hardened for CoCo VMs,\nthe driver should be blacklisted in CoCo VMs.\n\nSigned-off-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nReviewed-by: Michael Kelley \u003cmhklinux@outlook.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f695390ea63941a9e412bf1f3afe65ab245fc681", "tree": "4916480f4c770fe841b600e2ebdbb923e2991c72", "parents": [ "70f3995830d3f1e79faa14eb0605914f778feca9" ], "author": { "name": "Sunil Goutham", "email": "sgoutham@marvell.com", "time": "Fri Aug 28 14:49:45 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 02 09:49:27 2026 +0100" }, "message": "octeontx2-af: Fix limiting SRIOV VF count logic\n\nWhen RVU PF0/AF\u0027s VFs are SDP instead of LBK, limiting the VF count\nbased on the LBK channel count is incorrect.\n\nApply LBK channel-based VF limits only when the VF device ID matches\nthe LBK RVU AFVF device.\n\nFixes: 9bd6caf33567 (\"octeontx2-af: Enable sriov on AF to create VFs\")\nSigned-off-by: Sunil Goutham \u003csgoutham@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "c29b37ed7a4d9856ed758a82282456d69cee2ed1", "tree": "31a2b3b2a48b997e6e60e0a4043c5a53998c6bce", "parents": [ "0a1071aa322cb387084f15ea8ba076974ee98271" ], "author": { "name": "Pengpeng Hou", "email": "pengpeng@iscas.ac.cn", "time": "Sun Aug 30 22:24:58 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 17:31:46 2026 -0700" }, "message": "net: fbnic: validate mailbox TLV extents\n\nThe mailbox path warns when a message claims more bytes than the descriptor\nbut still parses it. The attribute walkers also validate a child TLV before\nproving that its declared span fits in the parent remainder.\n\nReject invalid mailbox message extents and bound each child attribute\nbefore type-specific validation.\n\nCc: stable+noautosel@kernel.org # assumes malicious PCIe device\nSigned-off-by: Pengpeng Hou \u003cpengpeng@iscas.ac.cn\u003e\nLink: https://patch.msgid.link/20260830142516.38145-1-pengpeng@iscas.ac.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0a1071aa322cb387084f15ea8ba076974ee98271", "tree": "f52e50c6f3c9167892ad6f845f3150b39445791d", "parents": [ "c8ea08ba34f2a2e9bfb18ff3d69eb2d69b324f49", "dbe45b209edf9b43ec56a1e6858c055c1eb332c3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 17:11:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 17:11:29 2026 -0700" }, "message": "Merge branch \u0027net-prepare-skb-extensions-for-reuse-across-scrubs\u0027\n\nJakub Sitnicki says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Prepare skb extensions for reuse across scrubs\n\nFollowing Florian\u0027s suggestion from the discussion in [1].\n\nThe skb extension allocator retains the extension\u0027s offset after the\nextension is deleted. This, in theory, allows skb_ext_add() to reuse the\nexisting storage instead of appending another copy when an extension is\nadded again. However, it also means that we can\u0027t rely on the offset as an\nindicator that the extension is present.\n\nMake the extension cleanup safe, even when the offset is already allocated\nand set, by making the individual extension put helpers idempotent, so that\nthey can be called multiple times.\n\nThis is preparatory work to support skb extension chunk area reuse after\nskb scrubbing, which would be needed to persist BPF metadata skb extension\nacross scrubs [2].\n\n[1] https://lore.kernel.org/ao9UV9S7rUkyQ8jv@strlen.de\n[2] https://lore.kernel.org/64365932-c765-472e-bf6c-b07c9ee25eaf@kernel.org\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831-skb-ext-prep-work-v1-0-ecc2a8542fd9@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dbe45b209edf9b43ec56a1e6858c055c1eb332c3", "tree": "f52e50c6f3c9167892ad6f845f3150b39445791d", "parents": [ "d7470cba6dfaac917710ef77192a94d57cb69f00" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Mon Aug 31 08:27:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 17:11:26 2026 -0700" }, "message": "net: Make skb_ext_put_mctp() idempotent\n\nThe MCTP flow extension can be released either when it is deleted from an\nskb or when the last skb holding the extension block is freed. Handle the\nrelease in __skb_ext_del(), which is currently missing, and make\nskb_ext_put_mctp() safe to call from both paths.\n\nThis will let __skb_ext_put() release the MCTP key without checking whether\nthe extension is present first, which is needed if we want to reuse skb_ext\nchunks area after skb scrubbing.\n\nSuggested-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nAcked-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20260831-skb-ext-prep-work-v1-2-ecc2a8542fd9@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7470cba6dfaac917710ef77192a94d57cb69f00", "tree": "cba47e155f66b3678010e199f7ae148252b6056a", "parents": [ "c8ea08ba34f2a2e9bfb18ff3d69eb2d69b324f49" ], "author": { "name": "Jakub Sitnicki", "email": "jakub@cloudflare.com", "time": "Mon Aug 31 08:27:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 17:11:26 2026 -0700" }, "message": "net: Make skb_ext_put_sp() idempotent\n\nThe sec_path extension can be released either when it is deleted from an\nskb or when the last skb holding the extension block is freed. Make\nskb_ext_put_sp() safe to call from both paths by returning when\nsec_path-\u003elen is zero and clearing it after dropping the XFRM state\nreferences.\n\nThis will let __skb_ext_put() release the sec_path without checking whether\nthe extension is present first, which is needed if we want to reuse skb_ext\nchunks area after skb scrubbing.\n\nSigned-off-by: Jakub Sitnicki \u003cjakub@cloudflare.com\u003e\nLink: https://patch.msgid.link/20260831-skb-ext-prep-work-v1-1-ecc2a8542fd9@cloudflare.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "70f3995830d3f1e79faa14eb0605914f778feca9", "tree": "258805c3c89124d24e0f55b3202e4a52dae51130", "parents": [ "b264d8422779d69febce914efc47a92a85cc382c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 19:46:26 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 16:59:21 2026 -0700" }, "message": "bonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb-\u003etransport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb-\u003ehead.\nAlso remove the unused bond argument from alb_determine_nd().\n\nFixes: 0da8aa00bfcf (\"net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260831194626.119371-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b264d8422779d69febce914efc47a92a85cc382c", "tree": "0b9193a691ddf1ee83a0d6ce612a7b7bb46e9ba1", "parents": [ "1d2929d0850fff683b8aff051275945e65f082c8" ], "author": { "name": "Aswin Karuvally", "email": "aswin@linux.ibm.com", "time": "Thu Aug 27 08:34:08 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 16:55:04 2026 -0700" }, "message": "s390/ctcm: Prevent XID null dereference\n\nThe mpc_validate_xid() function sets grp-\u003esaved_xid2-\u003exid2_flag2 to 0x40\nto signal XID validation error. If peer XID is NULL or r/w channel\npairing mismatch happens, grp-\u003esaved_xid2 is never initialized. An\nattempt to set the flag in such case leads to NULL dereference.\n\nFix this by using the always available priv-\u003exid-\u003exid2_flag2 instead of\ngrp-\u003esaved_xid2-\u003exid2_flag2 for validation errors.\n\nFixes: 293d984f0e36 (\"ctcm: infrastructure for replaced ctc driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aswin Karuvally \u003caswin@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260827063408.2168914-1-aswin@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2625480a1bf79c62ffb09aafdf61778e682da492", "tree": "a5da694565264ddb176a7edb8261311645ea3141", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Sep 01 23:50:02 2026 +0100" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Tue Sep 01 16:01:35 2026 -0700" }, "message": "hardening: Default randstruct off with rust for better allmodconfig support\n\nCurrently randstruct does not support rust so we have Kconfig dependencies\nwhich prevent rust being enabled when randstruct is. Unfortunately this\nprevents rust being enabled in allmodconfig, our standard coverage build.\nrandstruct gets turned on by default, then the dependency on !RANDSTRUCT\ncauses rust to get disabled.\n\nWork around this by disabling randstruct by default if we have a usable\nrust toolchain and rust support for the architecture, circular\ndependencies prevent us directly depending on !RUST. This means we might\nend up with a configuration that disables both rust and randstruct but\nhopefully it\u0027s more likely go give the expected result.\n\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nAcked-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nLink: https://patch.msgid.link/20260901-rust-reverse-randstruct-dep-v4-1-3bfa19efe1fa@kernel.org\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\n" }, { "commit": "89a312991dc6e638a36adc43ccb91dbc25504c04", "tree": "0c5c6eb4c4213f6289a43c16d3bc1fc9bd5b6131", "parents": [ "9a58da80053f992b285b6b7bebc694b0f284c443", "4aa2c106aef4bf3dfd97c30842db0767b26e8428" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 13:37:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 13:37:14 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc2\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - Fixes for fallocate range operations (insert, collapse, zero, punch\n hole)\n\n The insert range implementation copied overlapping chunks in the\n wrong direction, corrupting file data on every server except Windows.\n\n Several related issues in the same area are also addressed — stale\n page cache and FS-Cache readback, an integer truncation on large\n files, missing RLIMIT_FSIZE validation and missing sparse file\n marking.\n\n - Data corruption fixes in the O_TRUNC open path: one where i_size was\n zeroed before the server confirmed the truncate and another where the\n lack of locking allowed concurrent buffered writes to be silently\n discarded\n\n - Heap overflow fixes in legacy SMB1 paths: one in extended attribute\n writes and one in POSIX ACL handling, both exploitable via\n unprivileged setxattr(2)\n\n - Fix for multiuser mount with krb5 failing because the username option\n was not propagated to new per-user connections\n\n - Fix for split debug message in __release_mid() after a printk\n conversion\n\n* tag \u0027cifs-fixes-7.3-rc2\u0027 of https://git.manguebit.org/linux:\n smb: client: reject SetEA requests that do not fit the request buffer\n smb: client: fix data corruption with concurrent writes and O_TRUNC\n cifs: don\u0027t update i_size in cifs_do_truncate without a cached handle\n smb: client: fix heap overflow in cifs_do_set_acl()\n smb: client: fix multiuser mount with krb5\n smb: client: transport: Fix debug printing in __release_mid()\n smb/client: invalidate fscache for fallocate range operations\n smb/client: fix stale page cache in insert/collapse range\n smb/client: fix integer truncation in collapse range\n smb/client: fix data corruption in emulated insert range\n smb/client: mark file sparse before emulating insert range\n smb/client: validate new EOF for zero range\n smb/client: validate new EOF for insert range\n cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()\n" }, { "commit": "9a58da80053f992b285b6b7bebc694b0f284c443", "tree": "100bb5aa8acd494958dcbe23e2c9350d8b075224", "parents": [ "786262be6048deab760f68c8acc2c85607165894", "ba9572bc43d04d71ba52ae7f20645f1eafe86875" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 08:17:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 08:17:01 2026 -0700" }, "message": "Merge tag \u0027ksmbd-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server fixes from Namjae Jeon:\n\n - Prevent unintended data exposure by clearing pipe compound padding\n and the response buffer\n\n - Initialize missing fields in FS_OBJECT_ID_INFORMATION,\n FS_CONTROL_INFORMATION, and FS_POSIX_INFORMATION\n\n - Propagate DACL parsing and allocation failures so malformed security\n descriptors are rejected\n\n - Rate-limit errors for unmapped SIDs to prevent kernel log flooding\n\n - Drain multichannel sessions during LOGOFF, wake deferred locks and\n cancellable requests, and ensure cancellation callbacks run only once\n\n - Fix listener kthread reference handling and teardown ordering during\n netdevice events\n\n - Validate normalized-name and IPC share configuration response lengths\n\n - Update the KSMBD MAINTAINERS entry and add Paulo Alcantara as an\n SMBDIRECT co-maintainer\n\n* tag \u0027ksmbd-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: validate normalized name response length\n ksmbd: fix listener task lifetime on netdev events\n ksmbd: prevent out-of-bounds reads in share config responses\n ksmbd: rate limit unmapped SID errors\n ksmbd: propagate DACL parsing errors\n ksmbd: zero pipe read compound padding\n ksmbd: safely drain sessions during logoff\n MAINTAINERS: Update the KSMBD entry\n MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer\n ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION\n ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION\n ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n" } ], "next": "2ccb8878c149443c6acf628b438c9c942c20abb2" }