)]}' { "log": [ { "commit": "3893edd0e3a36c4286abeab84be85fc3a7e3f52b", "tree": "08543980532f0ef453cf257d09df3363e6bf8f77", "parents": [ "1c0153a3b04824e9524eb758666767777d0f24ad" ], "author": { "name": "Matthieu Baerts", "email": "matttbe@kernel.org", "time": "Fri May 01 07:58:28 2026 +0000" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:07:44 2026 +0200" }, "message": "DO-NOT-MERGE: mptcp: enabled by default\n\nThis commit is useful for automated builds, e.g. from Intel\u0027s kbuild.\n\nSigned-off-by: Matthieu Baerts \u003cmatttbe@kernel.org\u003e\n" }, { "commit": "1c0153a3b04824e9524eb758666767777d0f24ad", "tree": "f41eebd03647b45b9fdf171916a5c9c8167301d4", "parents": [ "bd3bdc9fa8c385de826ca6dac972f8a45fa0117b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri May 01 07:57:56 2026 +0000" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:07:31 2026 +0200" }, "message": "mptcp: fix rx timestamp corruption on fastopen\n\nThe skb cb offset containing the timestamp presence flag is cleared\nbefore loading such information. Cache such value before MPTCP CB\ninitialization.\n\nFixes: 36b122baf6a8 (\"mptcp: add subflow_v(4,6)_send_synack()\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\n" }, { "commit": "bd3bdc9fa8c385de826ca6dac972f8a45fa0117b", "tree": "a148af131c6617ff64c93015f32b4795ca9da89f", "parents": [ "bc7b823476d16cd3f7cdb1d01065d20ff3f8fa97" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 07:57:54 2026 +0000" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:07:30 2026 +0200" }, "message": "mptcp: sockopt: increase seq in mptcp_setsockopt_all_sf\n\nmptcp_setsockopt_all_sf() was missing a call to sockopt_seq_inc(). This\nis required not to cause missing synchronization for newer subflows\ncreated later on.\n\nThis helper is called each time a socket option is set on subflows, and\nfuture ones will need to inherit this option after their creation.\n\nFixes: 51c5fd09e1b4 (\"mptcp: add TCP_MAXSEG sockopt support\")\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\n" }, { "commit": "bc7b823476d16cd3f7cdb1d01065d20ff3f8fa97", "tree": "f80affb5e929b0d591c5cd5de080707ece4d8ea5", "parents": [ "7ac5d090b62fd9d90097e5d808b329675a97e246" ], "author": { "name": "Shardul Bankar", "email": "shardul.b@mpiricsoftware.com", "time": "Fri May 01 07:57:42 2026 +0000" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:07:29 2026 +0200" }, "message": "mptcp: use MPTCP_RST_EMPTCP for ACK HMAC validation failure\n\nWhen HMAC validation fails on a received ACK + MP_JOIN in\nsubflow_syn_recv_sock(), the subflow is reset with reason\nMPTCP_RST_EPROHIBIT (\"Administratively prohibited\"). This is\nincorrect: HMAC validation failure is an MPTCP protocol-level\nerror, not an administrative policy denial.\n\nThe mirror site on the client, in subflow_finish_connect(), already\nuses MPTCP_RST_EMPTCP (\"MPTCP-specific error\") for the same kind of\nHMAC failure on the SYN/ACK + MP_JOIN. Use the same reason on the\nserver side for symmetry and accuracy.\n\nSuggested-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nFixes: 443041deb5ef (\"mptcp: fix NULL pointer in can_accept_new_subflow\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shardul Bankar \u003cshardul.b@mpiricsoftware.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\n" }, { "commit": "7ac5d090b62fd9d90097e5d808b329675a97e246", "tree": "20ca26b32b03d405eed30eac2697644eaec33b34", "parents": [ "9aa33a293c02b20cc7403c5a6fd719b2081e3321" ], "author": { "name": "Shardul Bankar", "email": "shardul.b@mpiricsoftware.com", "time": "Fri May 01 07:57:55 2026 +0000" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:07:28 2026 +0200" }, "message": "mptcp: use MPJoinSynAckHMacFailure for SynAck HMAC failure\n\nIn subflow_finish_connect(), HMAC validation of the server\u0027s HMAC\nin SYN/ACK + MP_JOIN increments MPTCP_MIB_JOINACKMAC (\"HMAC was\nwrong on ACK + MP_JOIN\") on failure. The function processes the\nSYN/ACK, not the ACK; the matching MPTCP_MIB_JOINSYNACKMAC counter\n(\"HMAC was wrong on SYN/ACK + MP_JOIN\") exists but is not\nincremented anywhere in the tree.\n\nThe mirror site on the server, subflow_syn_recv_sock(), already\nuses JOINACKMAC correctly for ACK HMAC failure. Use JOINSYNACKMAC\nat the SYN/ACK validation site so each counter reflects the packet\nwhose HMAC actually failed.\n\nSuggested-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nFixes: fc518953bc9c (\"mptcp: add and use MIB counter infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Shardul Bankar \u003cshardul.b@mpiricsoftware.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\n" }, { "commit": "9aa33a293c02b20cc7403c5a6fd719b2081e3321", "tree": "146a63ec56a5d451fd21558c1b97890f01baf0b1", "parents": [ "85da3965df5e6f1e1c48d2c435e140c5b66625ef" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:06:35 2026 +0200" }, "committer": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Fri May 01 18:06:35 2026 +0200" }, "message": "EDITME: cover title for net-mptcp-misc-fixes-7.1-rc3\n\n# Describe the purpose of this series. The information you put here\n# will be used by the project maintainer to make a decision whether\n# your patches should be reviewed, and in what priority order. Please be\n# very detailed and link to any relevant discussions or sites that the\n# maintainer can review to better understand your proposed changes. If you\n# only have a single patch in your series, the contents of the cover\n# letter will be appended to the \"under-the-cut\" portion of the patch.\n\n# Lines starting with # will be removed from the cover letter. You can\n# use them to add notes or reminders to yourself. If you want to use\n# markdown headers in your cover letter, start the line with \"\u003e#\".\n\n# You can add trailers to the cover letter. Any email addresses found in\n# these trailers will be added to the addresses specified/generated\n# during the b4 send stage. You can also run \"b4 prep --auto-to-cc\" to\n# auto-populate the To: and Cc: trailers based on the code being\n# modified.\n\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\n\n--- b4-submit-tracking ---\n# This section is used internally by b4 prep for tracking purposes.\n{\n \"series\": {\n \"revision\": 1,\n \"change-id\": \"20260501-net-mptcp-misc-fixes-7-1-rc3-902fc2a5d499\",\n \"prefixes\": [\n \"net\"\n ],\n \"presubject\": \"\"\n }\n}\n" }, { "commit": "85da3965df5e6f1e1c48d2c435e140c5b66625ef", "tree": "146a63ec56a5d451fd21558c1b97890f01baf0b1", "parents": [ "75df490c9e8457990c8b227650f6491218ce018b", "bc968f61bf0ad4f085559e5e3d168105fdf88204" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:19 2026 -0700" }, "message": "Merge branch \u0027octeontx2-af-npc-cn20k-mcam-fixes\u0027\n\nRatheesh Kannoth says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nocteontx2-af: npc: cn20k: MCAM fixes\n\nThis series tightens Marvell OcteonTX2 AF NPC support for CN20K silicon\naround MCAM key typing, optional debugfs setup, defrag allocation rollback,\ndefrag entry relocation bookkeeping, logical MCAM clear and programming,\ndefault-rule index handling with explicit teardown, and NIXLF reserved-slot\nlookup when default rules are missing.\n\nPatches 1 through 3 focus on AF error handling: propagate\nnpc_mcam_idx_2_key_type() failures through cn20k MCAM enable, config, copy,\nand read paths; treat cn20k NPC debugfs nodes as optional so probe does not\nfail when debugfs is unavailable; and fix defrag MCAM allocation rollback\nso allocation errno is not overwritten during subbank index resolution.\n\nPatch 4 fixes npc_defrag_move_vdx_to_free(): when an MCAM line is moved to\na new physical index, move entry2target_pffunc[] association to the new\nslot, clear the old slot, and retarget the matching mcam_rules entry so\nsoftware state matches hardware after defrag.\n\nPatches 5 through 7 refine cn20k MCAM programming: clear entries using the\nlogical MCAM index and resolved key width, fix bank/CFG sequencing in\nnpc_cn20k_config_mcam_entry(), and read action metadata from the correct\nbank in npc_cn20k_read_mcam_entry().\n\nPatches 8 through 10 complete default-rule lifecycle handling: initialize\ndefault-rule index outputs eagerly, tear down reserved default MCAM rules\nexplicitly (coordinated with npc_mcam_free_all_entries()), and reject\nUSHRT_MAX sentinel indices from npc_get_nixlf_mcam_index() on cn20k.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260429022722.1110289-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bc968f61bf0ad4f085559e5e3d168105fdf88204", "tree": "146a63ec56a5d451fd21558c1b97890f01baf0b1", "parents": [ "013717353c03b65f5b00a5cefa1515b6b45777b7" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:22 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:17 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Reject missing default-rule MCAM indices\n\nWhen cn20k default L2 rules are not installed,\nnpc_cn20k_dft_rules_idx_get() leaves broadcast, multicast, promiscuous, and\nunicast slots at USHRT_MAX. npc_get_nixlf_mcam_index() previously returned\nthat sentinel as a valid MCAM index, so callers could program hardware with\nan invalid index.\n\nReturn -EINVAL from the cn20k branches of npc_get_nixlf_mcam_index() when\nthe requested slot is still USHRT_MAX. Harden cn20k NPC MCAM entry helpers\nto reject out-of-range indices before touching hardware.\n\nDrop the early bounds check in npc_enable_mcam_entry() for cn20k so invalid\nindices are validated inside npc_cn20k_enable_mcam_entry() instead of being\nsilently ignored.\n\nIn rvu_npc_update_flowkey_alg_idx(), treat negative MCAM indices like\nout-of-range values, and only update RSS actions for promiscuous and\nall-multi paths when the resolved index is non-negative.\n\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nFixes: 6d1e70282f76 (\"octeontx2-af: npc: cn20k: Use common APIs\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-11-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "013717353c03b65f5b00a5cefa1515b6b45777b7", "tree": "3d15579e24ed4415a7819782fdf4eaee7f25c9e5", "parents": [ "afb474bd4ffc314de766afc295ac64b42856f48e" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:21 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:17 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Tear down default MCAM rules explicitly on free\n\nnpc_cn20k_dft_rules_free() used the NPC MCAM mbox \"free all\" path, which\ndoes not match how cn20k tracks default-rule MCAM slots indexes.\n\nResolve the default-rule indices, then for each valid slot clear the bitmap\nentry, drop the PF/VF map, disable the MCAM line, clear the target\nfunction, and npc_cn20k_idx_free(). Remove any matching software mcam_rules\nnodes. On hard failure from idx_free, WARN and stop so the box stays up for\nanalysis.\n\nIn npc_mcam_free_all_entries(), prefetch the same default-rule indices and,\non cn20k, skip bitmap clear and idx_free when the scanned entry is one of\nthose reserved defaults (they are released by npc_cn20k_dft_rules_free).\n\nFixes: 09d3b7a1403f (\"octeontx2-af: npc: cn20k: Allocate default MCAM indexes\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-10-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "afb474bd4ffc314de766afc295ac64b42856f48e", "tree": "02ef4eb236f62c6accb739a5ae69f0d946431887", "parents": [ "f6803eb070bfb9a5114d16ae15053106bc7842ae" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:20 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:17 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Initialize default-rule index outputs up front\n\nnpc_cn20k_dft_rules_idx_get() wrote USHRT_MAX into individual outputs only\non some error paths (lbk promisc lookup, VF ucast lookup, and the PF rule\nwalk), which could leave other caller slots stale across retries.\n\nSet every non-NULL bcast/mcast/promisc/ucast pointer to USHRT_MAX once at\nentry, then drop the duplicate assignments on failure. Successful lookups\nstill overwrite the relevant slot before returning.\n\nFixes: 09d3b7a1403f (\"octeontx2-af: npc: cn20k: Allocate default MCAM indexes\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-9-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6803eb070bfb9a5114d16ae15053106bc7842ae", "tree": "1d898f1046ab61a91b375032e15c34e5a0a6355c", "parents": [ "2b6d6bb7282c34dd8c04ee782393231acf5a26e2" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:19 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:16 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Fix MCAM actions read\n\nnpc_cn20k_read_mcam_entry() always reloaded action and vtag_action from\nbank 0 after programming the CAM words. Use the bank returned by\nnpc_get_bank() for the ACTION reads as well, and read those registers once\nup front so both X2 and X4 paths share the same metadata.\n\nReturn directly from the X2 keyword path now that the action fields are\nalready populated.\n\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nFixes: 6d1e70282f76 (\"octeontx2-af: npc: cn20k: Use common APIs\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-8-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2b6d6bb7282c34dd8c04ee782393231acf5a26e2", "tree": "9a3557767cfab5438d441a0dc53b4d0bdb022731", "parents": [ "d2dabf09632c84b7acdc0fb2eeb6b6fe9c0f9106" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:18 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:16 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Fix bank value\n\nFor X4 keys its loop reused the bank parameter as the loop counter, so bank\nno longer reflected the caller\u0027s bank after the loop and the control flow\nwas hard to follow.\n\nProgram NPC_AF_CN20K_MCAMEX_BANKX_CFG_EXT directly in\nnpc_cn20k_config_mcam_entry(): one CFG write for X2 using the computed\nbank, and one CFG write per bank inside the X4 action loop. Enable the\nentry at the end with npc_cn20k_enable_mcam_entry(..., true) instead of\nembedding the enable bit in bank_cfg via the removed helper.\n\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nFixes: 4e527f1e5c15 (\"octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-7-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d2dabf09632c84b7acdc0fb2eeb6b6fe9c0f9106", "tree": "f7bd5ed60d9b8179dd2dac0f27e2c299b7490488", "parents": [ "d7e5940c4c508df73b15d9bc29628a83b3674fff" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:17 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:16 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Clear MCAM entries by index and key width\n\nReplace the old four-argument CN20K MCAM clear with a per-bank static\nhelper and npc_cn20k_clear_mcam_entry() that takes a logical MCAM index,\nresolves the key width via npc_mcam_idx_2_key_type(), and clears either one\nbank (X2) or every bank (X4).\n\nCall it from npc_clear_mcam_entry() on cn20k and log when key-type lookup\nfails. Use the per-bank helper from npc_cn20k_config_mcam_entry() for\npre-program clears.\n\nFor loopback VFs, use the promisc MCAM index as ucast_idx when copying RSS\naction for promisc, matching cn20k default-rule layout.\n\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nFixes: 6d1e70282f76 (\"octeontx2-af: npc: cn20k: Use common APIs\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-6-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7e5940c4c508df73b15d9bc29628a83b3674fff", "tree": "31f7ba864ae05453d0324ada2b3f49d4f93016ce", "parents": [ "adb5ff41efbc0a9d86fabf880076973379db6e49" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:16 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:16 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Fix target map and rule\n\nnpc_defrag_move_vdx_to_free() disables, copies, and enables the MCAM entry\nat a new index but previously left entry2target_pffunc[] and the mcam_rules\nlist still keyed to the old index. Copy the target PF association to the\nnew slot, clear the old one, and retarget the rule entry so software state\nmatches the relocated hardware context.\n\nFixes: 645c6e3c1999 (\"octeontx2-af: npc: cn20k: virtual index support\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-5-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "adb5ff41efbc0a9d86fabf880076973379db6e49", "tree": "39f057a9ade630011fb8f1224dbff5157cce1253", "parents": [ "1100af13fd14b523f1b0634c14be497b41c78958" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:15 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:16 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Propagate errors in defrag MCAM alloc rollback\n\nnpc_defrag_alloc_free_slots() allocates MCAM indexes in up to two passes on\nbank0 then bank1. On failure it rolls back by freeing entries already\nplaced in save[].\n\n__npc_subbank_alloc() can return a negative errno while only part of the\nindexes are valid. The rollback loop used rc for\nnpc_mcam_idx_2_subbank_idx() as well, so a successful lookup stored zero in\nrc and a later __npc_subbank_free() failure could still end with return 0\nwhen the allocation path had also left rc at zero (for example shortfall\nafter zero return values from the alloc helpers).\n\nJump to the rollback path immediately when either __npc_subbank_alloc()\ncall fails, preserving its errno. If both calls succeed but the total\nallocated count is still less than cnt, set rc to -ENOSPC before rollback.\nUse a separate err variable for npc_mcam_idx_2_subbank_idx() so a\nsuccessful lookup no longer clears a non-zero rc from the allocation phase.\n\nCc: Dan Carpenter \u003cerror27@gmail.com\u003e\nFixes: 645c6e3c1999 (\"octeontx2-af: npc: cn20k: virtual index support\")\nLink: https://lore.kernel.org/netdev/adjNJEpILRZATB2N@stanley.mountain/\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-4-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1100af13fd14b523f1b0634c14be497b41c78958", "tree": "f42800b9e67253445b6e79c8d692e815f5a0a45e", "parents": [ "aaadccde312f1f6c752461e015adcaa25d463cbc" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:14 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:15 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Drop debugfs_create_file() error checks in init\n\ndebugfs is not intended to be checked for allocation failures the way other\nkernel APIs are: callers should not fail probe or subsystem init because a\ndebugfs node could not be created, including when debugfs is disabled in\nKconfig. Replacing NULL checks with IS_ERR() checks is similarly wrong for\noptional debugfs.\n\nRemove dentry checks and -EFAULT returns from npc_cn20k_debugfs_init().\nSee:\nhttps://staticthinking.wordpress.com/2023/07/24/\ndebugfs-functions-are-not-supposed-to-be-checked/\n\nCc: Dan Carpenter \u003cerror27@gmail.com\u003e\nFixes: 528530dff56b (\"octeontx2-af: npc: cn20k: add debugfs support\")\nLink: https://lore.kernel.org/netdev/adjNGPWKMOk3KgWL@stanley.mountain/\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-3-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aaadccde312f1f6c752461e015adcaa25d463cbc", "tree": "00c16d0c96664728bda73264053bf6ec380c171b", "parents": [ "75df490c9e8457990c8b227650f6491218ce018b" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Wed Apr 29 07:57:13 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:50:15 2026 -0700" }, "message": "octeontx2-af: npc: cn20k: Propagate MCAM key-type errors on cn20k\n\nnpc_mcam_idx_2_key_type() can fail; callers used to ignore it and still\nused kw_type when enabling, configuring, copying, and reading MCAM entries.\nThat could program or decode hardware with an undefined key type.\n\nReturn -EINVAL when key-type lookup fails. Return -EINVAL from\nnpc_cn20k_copy_mcam_entry() when src and dest key types differ instead of\nfailing silently.\n\nChange npc_cn20k_{enable,config,copy,read}_mcam_entry() to return int on\nsuccess or error. Thread those errors through the cn20k MCAM write and read\nmbox handlers, the cn20k baseline steer read path, NPC defrag move\n(disable/copy/enable with dev_err and -EFAULT), and the DMAC update path in\nrvu_npc_fs.c.\n\nMake npc_copy_mcam_entry() return int so the cn20k branch can return\nnpc_cn20k_copy_mcam_entry() without a void/int mismatch, and fail\nNPC_MCAM_SHIFT_ENTRY when copy fails.\n\nCc: Suman Ghosh \u003csumang@marvell.com\u003e\nCc: Dan Carpenter \u003cerror27@gmail.com\u003e\nFixes: 6d1e70282f76 (\"octeontx2-af: npc: cn20k: Use common APIs\")\nLink: https://lore.kernel.org/netdev/adiQJvuKlEhq2ILx@stanley.mountain/\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260429022722.1110289-2-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75df490c9e8457990c8b227650f6491218ce018b", "tree": "776f747990728b44545c34048d7ffbbf0319a124", "parents": [ "7a33345153eeeda195c55f15be27074e4c3b5109" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Wed Apr 29 14:02:31 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:08:48 2026 -0700" }, "message": "net: airoha: Move entries to queue head in case of DMA mapping failure in airoha_dev_xmit()\n\nIn order to respect the original descriptor order and avoid any\npotential IOMMU fault or memory corruption, move pending queue entries\nto the head of hw queue tx_list if the DMA mapping of current inflight\npacket fails in airoha_dev_xmit routine.\n\nFixes: 3f47e67dff1f7 (\"net: airoha: Add the capability to consume out-of-order DMA tx descriptors\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260429-airoha-xmit-unmap-error-path-v2-1-32e43b7c6d25@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7a33345153eeeda195c55f15be27074e4c3b5109", "tree": "8db8efd4baa662c9f2766435dfaf771667ba406b", "parents": [ "694de316f607fe2473d52ca0707e3918e72c1562" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Wed Apr 29 16:37:43 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:07:21 2026 -0700" }, "message": "net: libwx: use request_irq for VF misc interrupt\n\nCurrently, request_threaded_irq() is used with a primary handler but a\nNULL threaded handler, while also setting the IRQF_ONESHOT flag. This\nspecific combination triggers a WARNING since the commit aef30c8d569c\n(\"genirq: Warn about using IRQF_ONESHOT without a threaded handler\").\n\nWARNING: kernel/irq/manage.c:1502 at __setup_irq+0x4fa/0x760\n\nFix the issue by switching to request_irq(), which is the appropriate\ninterface or a non-threaded interrupt handler, and removing the\nunnecessary IRQF_ONESHOT flag.\n\nFixes: eb4898fde1de (\"net: libwx: add wangxun vf common api\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/786DDC7D5CCA6D0A+20260429083743.88961-2-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "694de316f607fe2473d52ca0707e3918e72c1562", "tree": "62fdd39989494e9050c1071391c62db3b2b27afc", "parents": [ "26ebd12e67bfc3543d77ce586c33ef29fcafab20" ], "author": { "name": "Jiawen Wu", "email": "jiawenwu@trustnetic.com", "time": "Wed Apr 29 16:37:42 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 18:07:21 2026 -0700" }, "message": "net: libwx: fix VF illegal register access\n\nRegister WX_CFG_PORT_ST is a PF restricted register. When a VF is\ninitialized, attempting to read this register triggers an illegal\nregister access, which lead to a system hang.\n\nWhen the device is VF, the bus function ID can be obtained directly from\nthe PCI_FUNC(pdev-\u003edevfn).\n\nFixes: a04ea57aae37 (\"net: libwx: fix device bus LAN ID\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nLink: https://patch.msgid.link/4D1F4452D21DE107+20260429083743.88961-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "26ebd12e67bfc3543d77ce586c33ef29fcafab20", "tree": "eaa8b0e97393104f0fbb2eda57ef655adea9e468", "parents": [ "3744b0964d5267c0b651bcd8f8c25db6bf4ccbac" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Wed Apr 29 16:19:30 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 17:35:56 2026 -0700" }, "message": "net: enetc: fix VSI mailbox timeout handling and DMA lifecycle\n\nIn the current VSI mailbox implementation, the VSI allocates a DMA buffer\nto store the message sent to the PSI. When the PSI receives the message\nrequest from the VSI, the hardware copies the message data from this DMA\nbuffer to PSI\u0027s DMA buffer for processing.\n\nWhen enetc_msg_vsi_send() times out, two scenarios can occur:\n\n1) Use-after-free: If the hardware hasn\u0027t completed message copying when\n the VSI frees the buffer, the hardware may subsequently copy the data\n from freed memory to PSI\u0027s DMA buffer.\n\n2) Message race: If PSI hasn\u0027t processed the previous message when the\n next message is sent, the VSI may receive the previous message\u0027s\n reply, leading to incorrect handling.\n\nTo address these issues, implement the following changes:\n\n- Check the mailbox busy status before sending a new message. If the\n mailbox is in busy state, it indicates the previous message is still\n being processed, so return an error immediately.\n\n- Add the \u0027msg\u0027 field to struct enetc_si to preserve the DMA buffer\n information. The caller of enetc_msg_vsi_send() no longer frees the\n DMA buffer. Instead, defer freeing until it is safe to do so (when\n mailbox is not busy on next send).\n\n- Add cleanup in enetc_vf_remove() to free the last message buffer.\n\nThis ensures the DMA buffer remains valid during message copying and\nprevents message reply mismatches.\n\nFixes: beb74ac878c8 (\"enetc: Add vf to pf messaging support\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260429081930.3259824-1-wei.fang@nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3744b0964d5267c0b651bcd8f8c25db6bf4ccbac", "tree": "c4d095b2dd40d18d977fc4c532b2757f78c42af3", "parents": [ "e027c218c482c6a0ae1948129ccda3b0a2033368" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Wed Apr 29 17:46:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 17:21:45 2026 -0700" }, "message": "ipv6: Implement limits on extension header parsing\n\nipv6_{skip_exthdr,find_hdr}() and ip6_{tnl_parse_tlv_enc_lim,\nprotocol_deliver_rcu}() iterate over IPv6 extension headers until they\nfind a non-extension-header protocol or run out of packet data. The\nloops have no iteration counter, relying solely on the packet length\nto bound them. For a crafted packet with 8-byte extension headers\nfilling a 64KB jumbogram, this means a worst case of up to ~8k\niterations with a skb_header_pointer call each. ipv6_skip_exthdr(),\nfor example, is used where it parses the inner quoted packet inside\nan incoming ICMPv6 error:\n\n - icmpv6_rcv\n - checksum validation\n - case ICMPV6_DEST_UNREACH\n - icmpv6_notify\n - pskb_may_pull() \u003c- pull inner IPv6 header\n - ipv6_skip_exthdr() \u003c- iterates here\n - pskb_may_pull()\n - ipprot-\u003eerr_handler() \u003c- sk lookup\n\nThe per-iteration cost of ipv6_skip_exthdr itself is generally\nlight, but skb_header_pointer becomes more costly on reassembled\npackets: the first ~1232 bytes of the inner packet are in the skb\u0027s\nlinear area, but the remaining ~63KB are in the frag_list where\nskb_copy_bits is needed to read data.\n\nInitially, the idea was to add a configurable limit via a new\nsysctl knob with default 8, in line with knobs from commit\n47d3d7ac656a (\"ipv6: Implement limits on Hop-by-Hop and Destination\noptions\"), but two reasons eventually argued against it:\n\n- It adds to UAPI that needs to be maintained forever, and\n upcoming work is restricting extension header ordering anyway,\n leaving little reason for another sysctl knob\n- exthdrs_core.c is always built-in even when CONFIG_IPV6\u003dn,\n where struct net has no .ipv6 member, so the read site would\n need an ifdef\u0027d fallback to a constant anyway\n\nTherefore, just use a constant (IP6_MAX_EXT_HDRS_CNT). All four\nextension header walking functions are now bound by this limit.\n\nNote that the check in ip6_protocol_deliver_rcu() happens right\nbefore the goto resubmit, such that we don\u0027t have to have a test\nfor ipv6_ext_hdr() in the fast-path.\n\nThere\u0027s an ongoing IETF draft-iurman-6man-eh-occurrences to enforce\nIPv6 extension headers ordering and occurrence. The latter also\ndiscusses security implications. As per RFC8200 section 4.1, the\noccurrence rules for extension headers provide a practical upper\nbound which is 8. In order to be conservative, let\u0027s define\nIP6_MAX_EXT_HDRS_CNT as 12 to leave enough room for quirky setups.\nIn the unlikely event that this is still not enough, then we might\nneed to reconsider a sysctl.\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Justin Iurman \u003cjustin.iurman@gmail.com\u003e\nLink: https://patch.msgid.link/20260429154648.809751-1-daniel@iogearbox.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e027c218c482c6a0ae1948129ccda3b0a2033368", "tree": "df83a0a3325507312840504c4ac60d30cf05caf9", "parents": [ "a54c9a13cfc17943afb46f74ccb412666e8967f5" ], "author": { "name": "Robert Marko", "email": "robert.marko@sartura.hr", "time": "Tue Apr 28 15:41:01 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 16:49:23 2026 -0700" }, "message": "net: phy: micrel: fix LAN8814 QSGMII soft reset\n\nLAN8814 QSGMII soft reset was moved into the probe function to avoid\ntriggering it for each of 4 PHY-s in the package.\n\nHowever, that broke QSGMII link between the MAC and PHY on most LAN8814\nPHY-s, specificaly for us on the Microchip LAN969x switch.\nReading the QSGMII status registers it was visible that lanes were only\npartially synced.\n\nIt looks like the reset timing is crucial, so lets move the reset back\ninto the .config_init function but guard it with phy_package_init_once()\nto avoid it being triggered on each of 4 PHY-s in the package.\nChange the probe function to use phy_package_probe_once() for coma and PtP\nsetup.\n\nFixes: 96a9178a29a6 (\"net: phy: micrel: lan8814 fix reset of the QSGMII interface\")\nSigned-off-by: Robert Marko \u003crobert.marko@sartura.hr\u003e\nLink: https://patch.msgid.link/20260428134138.1741253-1-robert.marko@sartura.hr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a54c9a13cfc17943afb46f74ccb412666e8967f5", "tree": "37a622aeb27da4bbcebb41b450cc41033e43eccb", "parents": [ "08d0d3466664000ba0670e0ef0d447f23459e0d4", "76872971064133474d9b891da05db8f7586fcc11" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 13:36:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 13:36:49 2026 -0700" }, "message": "Merge branch \u0027net-mctp-test-minor-kunit-test-fixes\u0027\n\nJeremy Kerr says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mctp: test: minor kunit test fixes\n\nThis series provides two fixes in the MCTP kunit tests - one exposed by\nktr, and one found while debugging the former on different VM configs.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-0-1127b7425809@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "76872971064133474d9b891da05db8f7586fcc11", "tree": "37a622aeb27da4bbcebb41b450cc41033e43eccb", "parents": [ "18ed60e33e6c77d62409c1343dec1c61bae3d2e7" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Wed Apr 29 16:21:42 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 13:36:47 2026 -0700" }, "message": "net: mctp: test: Use dev_direct_xmit for TX to our test device\n\nIn our test cases, we typically feed a packet sequence into the routing\ncode, then inspect the device\u0027s TXed skbs to assert specific behaviours.\n\nUsing dev_queue_xmit() for our TX path introduces a fair bit of\ncomplexity between the test packet sequence and the test device\u0027s\nndo_start_xmit callback; which may mean that the skbs have not hit the\ndevice at the point we\u0027re inspecting the TXed skb list.\n\nUse dev_direct_xmit instead, as we want a direct a path as possible\nhere, and the test dev does not need any queueing, scheduling or flow\ncontrol.\n\nFixes: 6ab578739a4c (\"net: mctp: test: move TX packetqueue from dst to dev\")\nReported-by: kernel test robot \u003coliver.sang@intel.com\u003e\nCloses: https://lore.kernel.org/oe-lkp/202604281320.525eee17-lkp@intel.com\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-2-1127b7425809@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "18ed60e33e6c77d62409c1343dec1c61bae3d2e7", "tree": "dd4e7f98fab7c2688fd18d167078eb5099037a08", "parents": [ "08d0d3466664000ba0670e0ef0d447f23459e0d4" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Wed Apr 29 16:21:41 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 13:36:47 2026 -0700" }, "message": "net: mctp: test: use a zeroed struct sockaddr_mctp\n\nInvalid sockaddr padding will cause bind() to fail; ensure we have a\nzeroed address in the testcase.\n\nFixes: 0d8647bc74cb (\"net: mctp: don\u0027t require a route for null-EID ingress\")\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260429-dev-mctp-test-fixes-v1-1-1127b7425809@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08d0d3466664000ba0670e0ef0d447f23459e0d4", "tree": "5ec3400307dfa373fdfb64cc2338bf0eed5716cc", "parents": [ "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "1e01abec856593e02cd69fd95b784c10dd46880c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Current release - regressions:\n\n - ipmr: free mr_table after RCU grace period.\n\n Previous releases - regressions:\n\n - core: add net_iov_init() and use it to initialize -\u003epage_type\n\n - sched: taprio: fix NULL pointer dereference in class dump\n\n - netfilter: nf_tables:\n - use list_del_rcu for netlink hooks\n - fix strict mode inbound policy matching\n\n - tcp: make probe0 timer handle expired user timeout\n\n - vrf: fix a potential NPD when removing a port from a VRF\n\n - eth: ice:\n - fix NULL pointer dereference in ice_reset_all_vfs()\n - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\n Previous releases - always broken:\n\n - page_pool: fix memory-provider leak in error path\n\n - sched: sch_cake: annotate data-races in cake_dump_stats()\n\n - mptcp: fix scheduling with atomic in timestamp sockopt\n\n - psp: check for device unregister when creating assoc\n\n - tls: fix strparser anchor skb leak on offload RX setup failure\n\n - eth:\n - stmmac: prevent NULL deref when RX memory exhausted\n - airoha: do not read uninitialized fragment address\n - rtl8150: fix use-after-free in rtl8150_start_xmit()\n\n Misc:\n\n - add Ido Schimmel as IPv4/IPv6 maintainer\n\n - add David Heidelberg as NFC subsystem maintainer\"\n\n* tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)\n net/sched: cls_flower: revert unintended changes\n sfc: fix error code in efx_devlink_info_running_versions()\n net: tls: fix strparser anchor skb leak on offload RX setup failure\n ice: add dpll peer notification for paired SMA and U.FL pins\n ice: fix missing dpll notifications for SW pins\n dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n ice: fix SMA and U.FL pin state changes affecting paired pin\n ice: fix missing SMA pin initialization in DPLL subsystem\n ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n ice: fix NULL pointer dereference in ice_reset_all_vfs()\n iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n iavf: wait for PF confirmation before removing VLAN filters\n iavf: stop removing VLAN filters from PF on interface down\n iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n net: airoha: Do not return err in ndo_stop() callback\n hv_sock: fix ARM64 support\n MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n selftests: drv-net: clarify linters and frameworks in README\n ...\n" }, { "commit": "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "tree": "f97f638c106ae2b337ee198a868a70a8f828b4ab", "parents": [ "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "163f6494233e1679ec6fa6a4803f74ae7b1c94db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "message": "Merge tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Fix a reference leak on device_register() failure in pata_parport\n\n* tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: pata_parport: switch to dynamic root device\n" }, { "commit": "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "tree": "d23dfa6ede142650bdf84a2be288ed389ba77158", "parents": [ "e75a43c7cec459a07d91ed17de4de13ede2b7758", "e052a1f7199260eda4d6ca08a59c3b98738f8491" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A bunch of small fixes. One minor fix is found in the core side for\n data race in PCM OSS layer, while remaining changes are various\n device-specific fixes and quirks.\n\n - Core: PCM OSS data race fix\n\n - HD-audio: Fixes for TAS2781, CS35L56, and Realtek/Conexant quirks;\n avoidance of a WARN_ON for HDMI channel mapping\n\n - USB-audio: Improvements in UAC3 parsing robustness (leaks, size\n checks) and fixes for potential endless loops\n\n - ASoC: Driver-specific fixes for CS35L56, Intel bytcr_wm5102,\n Spacemit, AW88395, and others, plus a new quirk for Steam Deck\n OLED\n\n - Misc: A UAF fix in aloop driver, division by zero fix in ua101\n driver and leak fixes in caiaq driver\"\n\n* tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (32 commits)\n ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages \u003e1\n ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()\n ALSA: hda/conexant: Fix missing error check for jack detection\n ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks\n ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB\n ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size\n ASoC: spacemit: move hw constraints from hw_params to startup\n ASoC: codecs: ab8500: Fix casting of private data\n ASoC: cs35l56: Fix illegal writes to OTP_MEM registers\n ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error\n ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()\n ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams\n ALSA: caiaq: Don\u0027t abort when no input device is available\n ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path\n ASoC: aw88395: Fix kernel panic caused by invalid GPIO error pointer\n ALSA: caiaq: fix usb_dev refcount leak on probe failure\n sound: ua101: fix division by zero at probe\n ALSA: usb-audio: apply quirk for Playstation PDP Riffmaster\n ALSA: hda: Remove duplicate cmedia entries in codecs Makefile\n ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P\n ...\n" }, { "commit": "1e01abec856593e02cd69fd95b784c10dd46880c", "tree": "8faa6af8c4511bf2689ef016fadea0c06857c1a3", "parents": [ "051ffb001b8a232cfa6e72f38bb5f51c4270a60b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Apr 29 09:39:11 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:47:01 2026 +0200" }, "message": "net/sched: cls_flower: revert unintended changes\n\nWhile applying the blamed commit 4ca07b9239bd (\"net: mctp i2c: check\nlength before marking flow active\"), I unintentionally included\nunrelated and unacceptable changes.\n\nRevert them.\n\nFixes: 4ca07b9239bd (\"net: mctp i2c: check length before marking flow active\")\nReported-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCloses: https://lore.kernel.org/netdev/bd8704fe0bd53e278add5cde4873256656623e2e.camel@codeconstruct.com.au/\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nLink: https://patch.msgid.link/043026a53ff84da88b17648c4b0d17f0331749cb.1777447863.git.pabeni@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "051ffb001b8a232cfa6e72f38bb5f51c4270a60b", "tree": "367d3065e8dbf4acdd6f2d0ed7bf3631fe2aef37", "parents": [ "58689498ca3384851145a754dbb1d8ed1cf9fb54" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Wed Apr 29 09:48:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:44:30 2026 +0200" }, "message": "sfc: fix error code in efx_devlink_info_running_versions()\n\nReturn -EIO if efx_mcdi_rpc() doesn\u0027t return enough space.\n\nFixes: 14743ddd2495 (\"sfc: add devlink info support for ef100\")\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nReviewed-by: Edward Cree \u003cecree.xilinx@gmail.com\u003e\nLink: https://patch.msgid.link/afGpsbLRHL4_H0KS@stanley.mountain\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "58689498ca3384851145a754dbb1d8ed1cf9fb54", "tree": "3cb276b27203c391f68522db2fd63018ae7b3a91", "parents": [ "47888597a3b41b5088e758ab8ca36bf624d46327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 16:15:59 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:38:29 2026 +0200" }, "message": "net: tls: fix strparser anchor skb leak on offload RX setup failure\n\nWhen tls_set_device_offload_rx() fails at tls_dev_add(), the error path\ncalls tls_sw_free_resources_rx() to clean up the SW context that was\ninitialized by tls_set_sw_offload(). This function calls\ntls_sw_release_resources_rx() (which stops the strparser via\ntls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),\nbut never frees the anchor skb that was allocated by alloc_skb(0) in\ntls_strp_init().\n\nNote that tls_sw_free_resources_rx() is exclusively used for this\n\"failed to start offload\" code path, there\u0027s no other caller.\n\nThe leak did not exist before commit 84c61fe1a75b (\"tls: rx: do not use\nthe standard strparser\"), because the standard strparser doesn\u0027t try\nto pre-allocate an skb.\n\nThe normal close path in tls_sk_proto_close() handles cleanup by calling\ntls_sw_strparser_done() (which calls tls_strp_done()) after dropping\nthe socket lock, because tls_strp_done() does cancel_work_sync() and\nthe strparser work handler takes the socket lock.\n\nFixes: 84c61fe1a75b (\"tls: rx: do not use the standard strparser\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260428231559.1358502-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47888597a3b41b5088e758ab8ca36bf624d46327", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6", "9e5dead140af10e8b5f975b8f04e46197d48d274" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:43 2026 +0200" }, "message": "Merge branch \u0027intel-wired-lan-update-2026-04-27-ice-iavf\u0027\n\nJacob Keller says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Update 2026-04-27 (ice, iavf)\n\nPetr Oros from RedHat has accumulated a number of fixes for the Intel ice\nand iavf drivers, bundled together in this series.\n\nFirst, a series of 4 fixes to resolve issues with the iavf driver logic for\nhandling VLAN filters. This includes keeping VLAN filters while the\ninterface is brought down, waiting for confirmation on filter deletion\nbefore deleting filters from the driver tracking structures, and handling\nthe VIRTCHNL_OP_ADD_VLAN for the old v1 VLAN_ADD command.\n\nA fix for a crash in ice_reset_all_vfs(), properly checking for errors when\nice_vf_rebuild_vsi() fails.\n\nA fix for a possible infinite recursion in ice_cfg_tx_topo() that occurs\nwhen trying to apply invalid Tx topology configuration.\n\nA fix to initialize the SMA pins in the DPLL subsystem properly.\n\nA fix to change the SMA and U.FL pin state for paired pins, ensuring that\nall flows changing one pin will also update its shared pin appropriately.\n\nA preparatory patch to export __dpll_pin_change_ntf() so that drivers can\nnotify pin changes while already holding the dpll_lock.\n\nA fix to ensure DPLL notifications are sent for the software-controlled\npins which wrap the physical CGU input/output pins.\n\nA fix to add DPLL notifications for peer pins when changing the SMA or U.FL\npins, ensuring DPLL subsystem is notified about the paired connected pins.\n\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-0-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9e5dead140af10e8b5f975b8f04e46197d48d274", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:23 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: add dpll peer notification for paired SMA and U.FL pins\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2). When one pin\u0027s state changes via a PCA9575 GPIO write,\nthe paired pin\u0027s state also changes, but no notification is sent for\nthe peer pin. Userspace consumers monitoring the peer via dpll netlink\nsubscribe never learn about the update.\n\nAdd ice_dpll_sw_pin_notify_peer() which sends a change notification for\nthe paired SW pin. Call it from ice_dpll_pin_sma_direction_set(),\nice_dpll_sma_pin_state_set(), and ice_dpll_ufl_pin_state_set() after\npf-\u003edplls.lock is released. Use __dpll_pin_change_ntf() because\ndpll_lock is still held by the dpll netlink layer (dpll_pin_pre_doit).\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-11-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7", "tree": "ae0f4e5fe3a86ab625e8cc72117f236f867d6f80", "parents": [ "620055cb1036a6125fd912e7a14b47a6572b809b" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:22 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix missing dpll notifications for SW pins\n\nThe SMA/U.FL pin redesign (commit 2dd5d03c77e2 (\"ice: redesign dpll\nsma/u.fl pins control\")) introduced software-controlled pins that wrap\nbacking CGU input/output pins, but never updated the notification and\ndata paths to propagate pin events to these SW wrappers.\n\nThe periodic work sends dpll_pin_change_ntf() only for direct CGU input\npins. SW pins that wrap these inputs never receive change or phase\noffset notifications, so userspace consumers such as synce4l monitoring\nSMA pins via dpll netlink never learn about state transitions or phase\noffset updates. Similarly, ice_dpll_phase_offset_get() reads the SW\npin\u0027s own phase_offset field which is never updated; the PPS monitor\nwrites to the backing CGU input\u0027s field instead.\n\nFix by introducing ice_dpll_pin_ntf(), a wrapper around\ndpll_pin_change_ntf() that also notifies any registered SMA/U.FL pin\nwhose backing CGU input matches. Replace all direct\ndpll_pin_change_ntf() calls in the periodic notification paths with\nthis wrapper. Fix ice_dpll_phase_offset_get() to return the backing\nCGU input\u0027s phase_offset for input-direction SW pins.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-10-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "620055cb1036a6125fd912e7a14b47a6572b809b", "tree": "5b2c64040626789e1f3b21897cfa7d43da8b82ff", "parents": [ "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Mon Apr 27 22:22:21 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n\nExport __dpll_pin_change_ntf() so that drivers can send pin change\nnotifications from within pin callbacks, which are already called\nunder dpll_lock. Using dpll_pin_change_ntf() in that context would\ndeadlock.\n\nAdd lockdep_assert_held() to catch misuse without the lock held.\n\nAcked-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44", "tree": "a6be3b768a9ab77971f9b0cac5ccce5a330b333e", "parents": [ "56a643aed0f0af5c29ebb4593d4917b78344dd48" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:20 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix SMA and U.FL pin state changes affecting paired pin\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2) controlled by the PCA9575 GPIO expander. Each pair can\nonly have one active pin at a time: SMA1 output and U.FL1 output share\nthe same CGU output, SMA2 input and U.FL2 input share the same CGU\ninput. The PCA9575 register bits determine which connector in each\npair owns the signal path.\n\nThe driver does not account for this pairing in two places:\n\nice_dpll_ufl_pin_state_set() modifies PCA9575 bits and disables the\nbacking CGU pin without checking whether the U.FL pin is currently\nactive. Disconnecting an already inactive U.FL pin flips bits that\nthe paired SMA pin relies on, breaking its connection.\n\nice_dpll_sma_direction_set() does not propagate direction changes to\nthe paired U.FL pin. For SMA2/U.FL2 the ICE_SMA2_UFL2_RX_DIS bit is\nnever managed, so U.FL2 stays disconnected after SMA2 switches to\noutput. For both pairs the backing CGU pin of the U.FL side is never\nenabled when a direction change activates it, so userspace sees the\npin as disconnected even though the routing is correct.\n\nFix by guarding the U.FL disconnect path against inactive pins and by\nupdating the paired U.FL pin fully on SMA direction changes: manage\nICE_SMA2_UFL2_RX_DIS for the SMA2/U.FL2 pair and enable the backing\nCGU pin whenever the peer becomes active.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-8-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "56a643aed0f0af5c29ebb4593d4917b78344dd48", "tree": "918eaa44dc55d8aac4681acb6fdabcf775469f2d", "parents": [ "70ad216411e030f67b1743774e245601194aee6a" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:19 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix missing SMA pin initialization in DPLL subsystem\n\nThe DPLL SMA/U.FL pin redesign introduced ice_dpll_sw_pin_frequency_get()\nwhich gates frequency reporting on the pin\u0027s active flag. This flag is\ndetermined by ice_dpll_sw_pins_update() from the PCA9575 GPIO expander\nstate. Before the redesign, SMA pins were exposed as direct HW\ninput/output pins and ice_dpll_frequency_get() returned the CGU\nfrequency unconditionally — the PCA9575 state was never consulted.\n\nThe PCA9575 powers on with all outputs high, setting ICE_SMA1_DIR_EN,\nICE_SMA1_TX_EN, ICE_SMA2_DIR_EN and ICE_SMA2_TX_EN. Nothing in the\ndriver writes the register during initialization, so\nice_dpll_sw_pins_update() sees all pins as inactive and\nice_dpll_sw_pin_frequency_get() permanently returns 0 Hz for every\nSW pin.\n\nFix this by writing a default SMA configuration in\nice_dpll_init_info_sw_pins(): clear all SMA bits, then set SMA1 and\nSMA2 as active inputs (DIR_EN\u003d0) with U.FL1 output and U.FL2 input\ndisabled. Each SMA/U.FL pair shares a physical signal path so only\none pin per pair can be active at a time. U.FL pins still report\nfrequency 0 after this fix: U.FL1 (output-only) is disabled by\nICE_SMA1_TX_EN which keeps the TX output buffer off, and U.FL2\n(input-only) is disabled by ICE_SMA2_UFL2_RX_DIS. They can be\nactivated by changing the corresponding SMA pin direction via dpll\nnetlink.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-7-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70ad216411e030f67b1743774e245601194aee6a", "tree": "e1494f675d4da476f6c896f0fdf3dc1783e7c55e", "parents": [ "54ef02487914c24170c7e1c061e45212dc55365e" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:18 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\nOn certain E810 configurations where firmware supports Tx scheduler\ntopology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo()\nmay need to apply a new 5-layer or 9-layer topology from the DDP\npackage. If the AQ command to set the topology fails (e.g. due to\ninvalid DDP data or firmware limitations), the global configuration\nlock must still be cleared via a CORER reset.\n\nCommit 86aae43f21cf (\"ice: don\u0027t leave device non-functional if Tx\nscheduler config fails\") correctly fixed this by refactoring\nice_cfg_tx_topo() to always trigger CORER after acquiring the global\nlock and re-initialize hardware via ice_init_hw() afterwards.\n\nHowever, commit 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end\nof deinit paths\") later moved ice_init_dev_hw() into ice_init_hw(),\nbreaking the reinit path introduced by 86aae43f21cf. This creates an\ninfinite recursive call chain:\n\n ice_init_hw()\n ice_init_dev_hw()\n ice_cfg_tx_topo() # topology change needed\n ice_deinit_hw()\n ice_init_hw() # reinit after CORER\n ice_init_dev_hw() # recurse\n ice_cfg_tx_topo()\n ... # stack overflow\n\nFix by moving ice_init_dev_hw() back out of ice_init_hw() and calling\nit explicitly from ice_probe() and ice_devlink_reinit_up(). The third\ncaller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw()\nduring its reinit, it only needs the core HW reinitialization. This\nbreaks the recursion cleanly without adding flags or guards.\n\nThe deinit ordering changes from commit 8a37f9e2ff40 (\"ice: move\nice_deinit_dev() to the end of deinit paths\") which fixed slow rmmod\nare preserved, only the init-side placement of ice_init_dev_hw() is\nreverted.\n\nFixes: 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end of deinit paths\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "54ef02487914c24170c7e1c061e45212dc55365e", "tree": "420a92651ea7be9dcdad0c6bca7e57540c7a0fa3", "parents": [ "34d33313b52eeac3a97ad2e3176d523ec70d9283" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:17 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix NULL pointer dereference in ice_reset_all_vfs()\n\nice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().\nWhen the VSI rebuild fails (e.g. during NVM firmware update via\nnvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,\nleaving txq_map and rxq_map as NULL. The subsequent unconditional call\nto ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in\nice_ena_vf_q_mappings() when it accesses vsi-\u003etxq_map[0].\n\nThe single-VF reset path in ice_reset_vf() already handles this\ncorrectly by checking the return value of ice_vf_reconfig_vsi() and\nskipping ice_vf_post_vsi_rebuild() on failure.\n\nApply the same pattern to ice_reset_all_vfs(): check the return value\nof ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and\nice_eswitch_attach_vf() on failure. The VF is left safely disabled\n(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can\nbe recovered via a VFLR triggered by a PCI reset of the VF\n(sysfs reset or driver rebind).\n\nNote that this patch does not prevent the VF VSI rebuild from failing\nduring NVM update — the underlying cause is firmware being in a\ntransitional state while the EMP reset is processed, which can cause\nAdmin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This\npatch only prevents the subsequent NULL pointer dereference that\ncrashes the kernel when the rebuild does fail.\n\n crash\u003e bt\n PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: \"kworker/u512:5\"\n #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee\n #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba\n #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540\n #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda\n #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997\n #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595\n #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2\n [exception RIP: ice_ena_vf_q_mappings+0x79]\n RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206\n RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000\n RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040\n R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000\n R13: 0000000000000010 R14: R15:\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice]\n #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice]\n #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice]\n #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4\n #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de\n #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663\n #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9\n\n The panic occurs attempting to dereference the NULL pointer in RDX at\n ice_sriov.c:294, which loads vsi-\u003etxq_map (offset 0x4b8 in ice_vsi).\n\n The faulting VSI is an allocated slab object but not fully initialized\n after a failed ice_vsi_rebuild():\n\n crash\u003e struct ice_vsi 0xff34c9efc27d4828\n netdev \u003d 0x0,\n rx_rings \u003d 0x0,\n tx_rings \u003d 0x0,\n q_vectors \u003d 0x0,\n txq_map \u003d 0x0,\n rxq_map \u003d 0x0,\n alloc_txq \u003d 0x10,\n num_txq \u003d 0x10,\n alloc_rxq \u003d 0x10,\n num_rxq \u003d 0x10,\n\n The nvmupdate64e process was performing NVM firmware update:\n\n crash\u003e bt 0xff34c9edd1a30000\n PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: \"nvmupdate64e\"\n #0 [ff72159bcd617618] __schedule at ffffffffab5333f8\n #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice]\n #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice]\n #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice]\n #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice]\n #8 [ff72159bcd6178b8] ice_read_flat_nvm at ffffffffc0a4034c [ice]\n #9 [ff72159bcd617918] ice_devlink_nvm_snapshot at ffffffffc0a6ffa5 [ice]\n\n dmesg:\n ice 0000:13:00.0: firmware recommends not updating fw.mgmt, as it\n may result in a downgrade. continuing anyways\n ice 0000:13:00.1: ice_init_nvm failed -5\n ice 0000:13:00.1: Rebuild failed, unload and reload driver\n\nFixes: 12bb018c538c (\"ice: Refactor VF reset\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-5-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "34d33313b52eeac3a97ad2e3176d523ec70d9283", "tree": "9e5bb72e361e644f61c5763bb573c71a85d6ee63", "parents": [ "bbcbe4ed70dea948849549af7edf44bd42bbd695" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:16 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n\nThe V1 ADD_VLAN opcode had no success handler; filters sent via V1\nstayed in ADDING state permanently. Add a fallthrough case so V1\nfilters also transition ADDING -\u003e ACTIVE on PF confirmation.\n\nCritically, add an `if (v_retval) break` guard: the error switch in\niavf_virtchnl_completion() does NOT return after handling errors,\nit falls through to the success switch. Without this guard, a\nPF-rejected ADD would incorrectly mark ADDING filters as ACTIVE,\ncreating a driver/HW mismatch where the driver believes the filter\nis installed but the PF never accepted it.\n\nFor V2, this is harmless: iavf_vlan_add_reject() in the error\nblock already kfree\u0027d all ADDING filters, so the success handler\nfinds nothing to transition.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-4-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bbcbe4ed70dea948849549af7edf44bd42bbd695", "tree": "7765699a79e01b685bae6f905800c1f751b1cfad", "parents": [ "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:15 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: wait for PF confirmation before removing VLAN filters\n\nThe VLAN filter DELETE path was asymmetric with the ADD path: ADD\nwaits for PF confirmation (ADD -\u003e ADDING -\u003e ACTIVE), but DELETE\nimmediately frees the filter struct after sending the DEL message\nwithout waiting for the PF response.\n\nThis is problematic because:\n - If the PF rejects the DEL, the filter remains in HW but the driver\n has already freed the tracking structure, losing sync.\n - Race conditions between DEL pending and other operations\n (add, reset) cannot be properly resolved if the filter struct\n is already gone.\n\nAdd IAVF_VLAN_REMOVING state to make the DELETE path symmetric:\n\n REMOVE -\u003e REMOVING (send DEL) -\u003e PF confirms -\u003e kfree\n -\u003e PF rejects -\u003e ACTIVE\n\nIn iavf_del_vlans(), transition filters from REMOVE to REMOVING\ninstead of immediately freeing them. The new DEL completion handler\nin iavf_virtchnl_completion() frees filters on success or reverts\nthem to ACTIVE on error.\n\nUpdate iavf_add_vlan() to handle the REMOVING state: if a DEL is\npending and the user re-adds the same VLAN, queue it for ADD so\nit gets re-programmed after the PF processes the DEL.\n\nThe !VLAN_FILTERING_ALLOWED early-exit path still frees filters\ndirectly since no PF message is sent in that case.\n\nAlso update iavf_del_vlan() to skip filters already in REMOVING\nstate: DEL has been sent to PF and the completion handler will\nfree the filter when PF confirms. Without this guard, the sequence\nDEL(pending) -\u003e user-del -\u003e second DEL could cause the PF to return\nan error for the second DEL (filter already gone), causing the\ncompletion handler to incorrectly revert a deleted filter back to\nACTIVE.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-3-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2", "tree": "fddd2a408a9276640ab1ea06a0d4d5f931a027c1", "parents": [ "70d62b669f1f9080a25278fc90b64309f4ae8959" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:14 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: stop removing VLAN filters from PF on interface down\n\nWhen a VF goes down, the driver currently sends DEL_VLAN to the PF for\nevery VLAN filter (ACTIVE -\u003e DISABLE -\u003e send DEL -\u003e INACTIVE), then\nre-adds them all on UP (INACTIVE -\u003e ADD -\u003e send ADD -\u003e ADDING -\u003e\nACTIVE). This round-trip is unnecessary because:\n\n 1. The PF disables the VF\u0027s queues via VIRTCHNL_OP_DISABLE_QUEUES,\n which already prevents all RX/TX traffic regardless of VLAN filter\n state.\n\n 2. The VLAN filters remaining in PF HW while the VF is down is\n harmless - packets matching those filters have nowhere to go with\n queues disabled.\n\n 3. The DEL+ADD cycle during down/up creates race windows where the\n VLAN filter list is incomplete. With spoofcheck enabled, the PF\n enables TX VLAN filtering on the first non-zero VLAN add, blocking\n traffic for any VLANs not yet re-added.\n\nRemove the entire DISABLE/INACTIVE state machinery:\n - Remove IAVF_VLAN_DISABLE and IAVF_VLAN_INACTIVE enum values\n - Remove iavf_restore_filters() and its call from iavf_open()\n - Remove VLAN filter handling from iavf_clear_mac_vlan_filters(),\n rename it to iavf_clear_mac_filters()\n - Remove DEL_VLAN_FILTER scheduling from iavf_down()\n - Remove all DISABLE/INACTIVE handling from iavf_del_vlans()\n\nVLAN filters now stay ACTIVE across down/up cycles. Only explicit\nuser removal (ndo_vlan_rx_kill_vid) or PF/VF reset triggers VLAN\nfilter deletion/re-addition.\n\nFixes: ed1f5b58ea01 (\"i40evf: remove VLAN filters on close\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-2-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70d62b669f1f9080a25278fc90b64309f4ae8959", "tree": "2de08f80a19a0edff011324a5bb342804ca748cf", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:13 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n\nRename the IAVF_VLAN_IS_NEW state to IAVF_VLAN_ADDING to better\ndescribe what the state represents: an ADD request has been sent to\nthe PF and is waiting for a response.\n\nThis is a pure rename with no behavioral change, preparing for a\ncleanup of the VLAN filter state machine.\n\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-1-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e75a43c7cec459a07d91ed17de4de13ede2b7758", "tree": "84382cb8f3addaf5ee15a6fa8c1ce24dac0f900f", "parents": [ "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix inverted check of registering the stats for branch tracing\n\n When calling register_stat_tracer() which returns zero on success and\n negative on error, the callers were checking the return of zero as an\n error and printing a warning message. Because this was just a normal\n printk() message and not a WARN(), it wasn\u0027t caught in any testing.\n\n Fix the check to print the warning message when an error actually\n happens.\n\n - Fix a typo in a comment in tracepoint.h\n\n - Limit the size of event probes to 3K in size\n\n It is possible to create a dynamic event probe via the tracefs system\n that is greater than the max size of an event that the ring buffer\n can hold. This basically causes the event to become useless.\n\n Limit the size of an event probe to be 3K as that should be large\n enough to handle any dynamic events being created, and fits within\n the PAGE_SIZE sub-buffers of the ring buffer.\n\n* tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probes: Limit size of event probe to 3K\n tracepoint: Fix typo in tracepoint.h comment\n tracing: branch: Fix inverted check on stat tracer registration\n" }, { "commit": "5ef343614db766acdc01c56d66e780a1b43c6ac6", "tree": "0b31b19657617984e4945bb4afa0209289f1adb2", "parents": [ "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e" ], "author": { "name": "Hasan Basbunar", "email": "basbunarhasan@gmail.com", "time": "Tue Apr 28 19:07:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 19:11:49 2026 -0700" }, "message": "page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n\nWhen page_pool_create_percpu() fails on page_pool_list(), it falls\nthrough to its err_uninit: label, which calls page_pool_uninit().\nAt that point page_pool_init() has already taken two references\nwhen the user requested PP_FLAG_ALLOW_UNREADABLE_NETMEM:\n\n\tpool-\u003emp_ops-\u003einit(pool)\n\tstatic_branch_inc(\u0026page_pool_mem_providers);\n\nNeither is undone by page_pool_uninit(); both are only undone by\n__page_pool_destroy() (success-side teardown). The error path\ntherefore leaks the per-provider reference taken by mp_ops-\u003einit\n(io_zcrx_ifq-\u003erefs in the io_uring zcrx provider, the dmabuf\nbinding refcount in the devmem provider) plus one increment of\nthe page_pool_mem_providers static branch on every failure of\nxa_alloc_cyclic() inside page_pool_list().\n\nThe leaked io_zcrx_ifq-\u003erefs in turn pins everything\nio_zcrx_ifq_free() would release on cleanup: ifq-\u003euser (uid),\nifq-\u003emm_account (mmdrop), ifq-\u003edev (device refcount),\nifq-\u003enetdev_tracker (netdev refcount), and the rbuf region.\nThe leaked static branch increment forces all subsequent\npage_pool_alloc_netmems() and page_pool_return_page() callers to\ntake the slow mp_ops branch for the lifetime of the kernel.\n\nReachable via the io_uring zcrx path:\n\n\tio_uring_register(IORING_REGISTER_ZCRX_IFQ) /* CAP_NET_ADMIN */\n\t -\u003e __io_uring_register\n\t -\u003e io_register_zcrx\n\t -\u003e zcrx_register_netdev\n\t -\u003e netif_mp_open_rxq\n\t -\u003e driver ndo_queue_mem_alloc\n\t -\u003e page_pool_create_percpu\n\t -\u003e page_pool_init succeeds (mp_ops-\u003einit runs, branch++)\n\t -\u003e page_pool_list fails (xa_alloc_cyclic -ENOMEM)\n\t -\u003e goto err_uninit \u003c-- leak\n\nThe same shape applies to the devmem dmabuf provider via\nmp_dmabuf_devmem_init()/mp_dmabuf_devmem_destroy().\n\nRestore the cleanup symmetry by moving the mp_ops-\u003edestroy() and\nstatic_branch_dec() calls out of __page_pool_destroy() and into\npage_pool_uninit(), so page_pool_uninit() is again the strict\ninverse of page_pool_init(). page_pool_uninit() has only two\ncallers (the err_uninit: path and __page_pool_destroy()), so this\npreserves the single-call invariant on the success path while\nfixing the err path. The error path of page_pool_init() itself\nstill skips the mp_ops cleanup correctly: mp_ops-\u003einit is the\nlast action that takes a reference before page_pool_init() returns\n0, so when it returns an error neither the refcount nor the static\nbranch has been touched.\n\nTriggering the bug requires xa_alloc_cyclic() to fail with -ENOMEM,\nwhich under normal GFP_KERNEL retry behaviour is rare. It is\ndeterministic under CONFIG_FAULT_INJECTION with fail_page_alloc /\nxa fault injection, or under sustained memory pressure. The leak\nis silent: there is no warning, and the released kernel build\ncontinues running with a permanently-incremented static branch.\n\nFixes: 0f9214046893 (\"memory-provider: dmabuf devmem memory provider\")\nSigned-off-by: Hasan Basbunar \u003cbasbunarhasan@gmail.com\u003e\nLink: https://patch.msgid.link/20260428170739.34881-1-basbunarhasan@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e", "tree": "b29a78420378d62cea69de50210636f01b9ac31f", "parents": [ "4ca01292ea2f2363660610a65ba0285d7c3309ed" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 28 12:32:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:32:02 2026 -0700" }, "message": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n process_one_work kernel/workqueue.c:3302 [inline]\n process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n kthread+0x22a/0x280 kernel/kthread.c:436\n ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)\nTainted: [W]\u003dWARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\n\nFixes: 47e91f56008b (\"bonding: use RCU protection for 3ad xmit path\")\nReported-by: syzbot+9bb2ff2a4ab9e17307e1@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nCc: Andrew Lunn \u003candrew+netdev@lunn.ch\u003e\nLink: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ca01292ea2f2363660610a65ba0285d7c3309ed", "tree": "9db972c62902c0d9f0dcc771bae9887e055f9bbe", "parents": [ "b31681206e3f527970a7c7ed807fbf6a028fc25b" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Apr 28 08:53:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:29:54 2026 -0700" }, "message": "net: airoha: Do not return err in ndo_stop() callback\n\nAlways complete the airoha_dev_stop() routine regardless of the\nairoha_set_vip_for_gdm_port() return value, since errors from\nndo_stop() are ignored by the networking stack and the interface is\nalways considered down after the call.\n\nFixes: 23020f049327 (\"net: airoha: Introduce ethernet support for EN7581 SoC\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260428-airoha-ndo-stop-not-err-v1-1-674506d29a91@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b31681206e3f527970a7c7ed807fbf6a028fc25b", "tree": "ddfd6607f932c271a0d55281b1a894a5052df638", "parents": [ "e73cafaf4acea5445df2e5ee021a335d717c1697" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Tue Apr 28 08:53:39 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:30:45 2026 -0700" }, "message": "hv_sock: fix ARM64 support\n\nVMBUS ring buffers must be page aligned. Therefore, the current value of\n24K presents a challenge on ARM64 kernels (with 64K pages). So, use\nVMBUS_RING_SIZE() to ensure they are always aligned and large enough to\nhold all of the relevant data.\n\nCc: stable@vger.kernel.org\nFixes: 77ffe33363c0 (\"hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication\")\nTested-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nReviewed-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260428125339.13963-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e73cafaf4acea5445df2e5ee021a335d717c1697", "tree": "d809154cd32ce098ab99e043b88c2dc6f95f504f", "parents": [ "72e9647e2b20c31b4f2febf981566e3c5cdef90e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:39:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:52:33 2026 -0700" }, "message": "MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n\nThe IPv4/IPv6 and routing code is not very well separated from\nthe TCP/UDP code. Scope it down properly by providing a more\naccurate file list, instead of net/ipv4/ and net/ipv6/\n\nNow that the entry is more accurately representing layer 3\nand routing merge in the nexthop entry into it.\n\nAdd Ido Schimmel as a co-maintainer, Ido\u0027s git history speaks\nfor itself.\n\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260428203924.1229169-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72e9647e2b20c31b4f2febf981566e3c5cdef90e", "tree": "769d62592321826f880a9f536764626a65ba7c65", "parents": [ "c3388f8c1cbb5aae3731749b586499ed126b4156" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:33:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:48:21 2026 -0700" }, "message": "selftests: drv-net: clarify linters and frameworks in README\n\nMinor clarifications in the README:\n - call out what linters we expect to be clean\n - make it clear that by \"frameworks\" we mean code under lib/\n not just factoring code out in the same file\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n\n" }, { "commit": "c3388f8c1cbb5aae3731749b586499ed126b4156", "tree": "52808a0aa42c3d233682986b3e3aaa386c748e2e", "parents": [ "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9" ], "author": { "name": "David Heidelberg", "email": "david@ixit.cz", "time": "Tue Apr 28 16:24:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:46:51 2026 -0700" }, "message": "MAINTAINERS: Add myself as NFC subsystem maintainer\n\nAdd myself and update the mailing list.\n\nSigned-off-by: David Heidelberg \u003cdavid@ixit.cz\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9", "tree": "e91db943670e99cad9c3ae0fc10ff8e2baab6df5", "parents": [ "0c7a5ba011d336df4fcd1f667fcc16ea5549be12" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 19:53:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:40:08 2026 -0700" }, "message": "net: add net_iov_init() and use it to initialize -\u003epage_type\n\nCommit db359fccf212 (\"mm: introduce a new page type for page pool in\npage type\") added a page_type field to struct net_iov at the same\noffset as struct page::page_type, so that page_pool_set_pp_info() can\ncall __SetPageNetpp() uniformly on both pages and net_iovs.\n\nThe page-type API requires the field to hold the UINT_MAX \"no type\"\nsentinel before a type can be set; for real struct page that invariant\nis established by the page allocator on free. struct net_iov is not\nallocated through the page allocator, so the field is left as zero\n(io_uring zcrx, which uses __GFP_ZERO) or as slab garbage (devmem,\nwhich uses kvmalloc_objs() without zeroing). When the page pool then\ncalls page_pool_set_pp_info() on a freshly-bound niov,\n__SetPageNetpp()\u0027s VM_BUG_ON_PAGE(page-\u003epage_type !\u003d UINT_MAX) fires\nand the kernel BUGs. Triggered in selftests by io_uring zcrx setup\nthrough the fbnic queue restart path:\n\n kernel BUG at ./include/linux/page-flags.h:1062!\n RIP: 0010:page_pool_set_pp_info (./include/linux/page-flags.h:1062\n net/core/page_pool.c:716)\n Call Trace:\n \u003cTASK\u003e\n net_mp_niov_set_page_pool (net/core/page_pool.c:1360)\n io_pp_zc_alloc_netmems (io_uring/zcrx.c:1089 io_uring/zcrx.c:1110)\n fbnic_fill_bdq (./include/net/page_pool/helpers.h:160\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:906)\n __fbnic_nv_restart (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2470\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2874)\n fbnic_queue_start (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2903)\n netdev_rx_queue_reconfig (net/core/netdev_rx_queue.c:137)\n __netif_mp_open_rxq (net/core/netdev_rx_queue.c:234)\n io_register_zcrx (io_uring/zcrx.c:818 io_uring/zcrx.c:903)\n __io_uring_register (io_uring/register.c:931)\n __do_sys_io_uring_register (io_uring/register.c:1029)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63\n arch/x86/entry/syscall_64.c:94)\n \u003c/TASK\u003e\n\nThe same path is reachable through devmem dmabuf binding via\nnetdev_nl_bind_rx_doit() -\u003e net_devmem_bind_dmabuf_to_queue().\n\nAdd a net_iov_init() helper that stamps -\u003eowner, -\u003etype and the\n-\u003epage_type sentinel, and use it from both the devmem and io_uring\nzcrx niov init loops.\n\nFixes: db359fccf212 (\"mm: introduce a new page type for page pool in page type\")\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nAcked-by: Byungchul Park \u003cbyungchul@sk.com\u003e\nReviewed-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nAcked-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/20260428025320.853452-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a", "tree": "4687d9d5c912c18448bda8fd59d5e4e8fe262648", "parents": [ "5ec07d5204b4544271f32f6261ee097fe53cb081" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 12:23:02 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Apr 29 16:07:38 2026 -0400" }, "message": "tracing/probes: Limit size of event probe to 3K\n\nThere currently isn\u0027t a max limit an event probe can be. One could make an\nevent greater than PAGE_SIZE, which makes the event useless because if\nit\u0027s bigger than the max event that can be recorded into the ring buffer,\nthen it will never be recorded.\n\nA event probe should never need to be greater than 3K, so make that the\nmax size. As long as the max is less than the max that can be recorded\nonto the ring buffer, it should be fine.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nFixes: 93ccae7a22274 (\"tracing/kprobes: Support basic types on dynamic events\")\nLink: https://patch.msgid.link/20260428122302.706610ba@gandalf.local.home\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "tree": "6c70b7a6aa9eb203f4ceb558151b8c56ea33f487", "parents": [ "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "39f1c201b93f4ff71631bac72cff6eb155f976a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm updates from Paolo Bonzini:\n \"On top of a lot of Arm fixes, this includes a massive rename of types\n and variables in tools/testing/selftests/kvm - these were\n unnecessarily different from what the kernel uses, so they\u0027re being\n made consistent.\n\n arm64:\n\n - Allow tracing for non-pKVM, which was accidentally disabled when\n the series was merged\n\n - Rationalise the way the pKVM hypercall ranges are defined by using\n the same mechanism as already used for the vcpu_sysreg enum\n\n - Enforce that SMCCC function numbers relayed by the pKVM proxy are\n actually compliant with the specification\n\n - Fix a couple of feature to idreg mappings which resulted in the\n wrong sanitisation being applied\n\n - Fix the GICD_IIDR revision number field that could never been\n written correctly by userspace\n\n - Make kvm_vcpu_initialized() correctly use its parameter instead of\n relying on the surrounding context\n\n - Enforce correct ordering in __pkvm_init_vcpu(), plugging a\n potential pin leak at the same time\n\n - Move __pkvm_init_finalise() to a less dangerous spot, avoiding\n future problems\n\n - Restore functional userspace irqchip support after a four year\n breakage (last functional kernel was 5.18...)\n\n - Spelling fixes\n\n Selftests:\n\n - Rename types across all KVM selftests to more closely align with\n types used in the kernel:\n\n vm_vaddr_t -\u003e gva_t\n vm_paddr_t -\u003e gpa_t\n\n uint64_t -\u003e u64\n uint32_t -\u003e u32\n uint16_t -\u003e u16\n uint8_t -\u003e u8\n\n int64_t -\u003e s64\n int32_t -\u003e s32\n int16_t -\u003e s16\n int8_t -\u003e s8\n\n - Fix Loongarch compilation\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (31 commits)\n KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch\n KVM: arm64: Wake-up from WFI when iqrchip is in userspace\n KVM: arm64: Fix initialisation order in __pkvm_init_finalise()\n KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n KVM: arm64: Fix kvm_vcpu_initialized() macro parameter\n KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer\n KVM: arm64: Fix typo in feature check comments\n KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer\n KVM: arm64: Reject non compliant SMCCC function calls in pKVM\n KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value\n KVM: selftests: Replace \"paddr\" with \"gpa\" throughout\n KVM: selftests: Replace \"u64 nested_paddr\" with \"gpa_t l2_gpa\"\n KVM: selftests: Replace \"u64 gpa\" with \"gpa_t\" throughout\n KVM: selftests: Replace \"vaddr\" with \"gva\" throughout\n KVM: selftests: Clarify that arm64\u0027s inject_uer() takes a host PA, not a guest PA\n KVM: selftests: Rename translate_to_host_paddr() \u003d\u003e translate_hva_to_hpa()\n KVM: selftests: Rename vm_vaddr_populate_bitmap() \u003d\u003e vm_populate_gva_bitmap()\n KVM: selftests: Rename vm_vaddr_unused_gap() \u003d\u003e vm_unused_gva_gap()\n KVM: selftests: Drop \"vaddr_\" from APIs that allocate memory for a given VM\n KVM: selftests: Use u8 instead of uint8_t\n ...\n" }, { "commit": "e052a1f7199260eda4d6ca08a59c3b98738f8491", "tree": "c5d97c6c4671d44037e8707cf75b1f8f6126c42a", "parents": [ "90df4957a3271adf391b3432cd76a40887cf3273" ], "author": { "name": "Shenghao Ding", "email": "shenghao-ding@ti.com", "time": "Wed Apr 29 13:42:06 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:51:17 2026 +0200" }, "message": "ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages \u003e1\n\nIn TAS2781 SPI mode, when accessing non-book-zero or page numbers greater\nthan 1 in book 0, an additional byte must be read. The first byte in such\ncases is a dummy byte and should be ignored.\n\nFixes: 9fa6a693ad8d (\"ALSA: hda/tas2781: Remove tas2781_spi_fwlib.c and leverage SND_SOC_TAS2781_FMWLIB\")\nSigned-off-by: Shenghao Ding \u003cshenghao-ding@ti.com\u003e\nLink: https://patch.msgid.link/20260429054206.429-1-shenghao-ding@ti.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "90df4957a3271adf391b3432cd76a40887cf3273", "tree": "42c40128fa8691e66a5d6d0be4f84265297ff85d", "parents": [ "b0e2333a231107adedd38c6fcfe1adc6162716fc" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Tue Apr 28 14:05:31 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:50:16 2026 +0200" }, "message": "ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()\n\nEliminate the uninitialized \u0027nval\u0027 in cs35l56_hda_read_acpi() if a\nsystem-specific quirk overrides processing of the dev-index property.\nThe value is now stored in a new \u0027num_amps\u0027 member of struct cs35l56_hda\nso that the quirk handler can set the value.\n\nThe quirk for the Lenovo Yoga Book 9i GenX replaces the values from the\ndev-index property with hardcoded indexes. So cs35l56_hda_read_acpi() would\nthen skip reading the property. But this left the \u0027nval\u0027 local variable\nuninitialized when it is later passed to cirrus_scodec_get_speaker_id().\n\nFixes: 40b1c2f9b299 (\"ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-sound/aenFesLAStjrVNy8@stanley.mountain/T/#u\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260428130531.169600-1-rf@opensource.cirrus.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "b0e2333a231107adedd38c6fcfe1adc6162716fc", "tree": "dfe55fa1a9b86fb98c136abbcee7738627690ea4", "parents": [ "077c593dacf7ee33511468e4f29417d795cf07a4" ], "author": { "name": "wangdicheng", "email": "wangdicheng@kylinos.cn", "time": "Tue Apr 28 16:04:50 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:49:44 2026 +0200" }, "message": "ALSA: hda/conexant: Fix missing error check for jack detection\n\nIn cx_probe(), the return value of snd_hda_jack_detect_enable_callback()\nis ignored. This function returns a pointer, and if it fails (e.g., due\nto memory allocation failure), it returns an error pointer which must\nbe checked using IS_ERR().\n\nIf the registration fails, the driver continues to probe, but the jack\ndetection callback will not be registered. This can lead to a kernel\ncrash later when the driver attempts to handle jack events or accesses\nthe uninitialized structure.\n\nCheck the return value using IS_ERR() and propagate the error via\nPTR_ERR() to the probe caller.\n\nFixes: 7aeb25908648 (\"ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140\")\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260428080450.108801-1-wangdich9700@163.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "077c593dacf7ee33511468e4f29417d795cf07a4", "tree": "d2871d6a61ff214c59f4d95afde9661aa8257ebd", "parents": [ "2d80392a97cf205a766d75539b4c814a4f5e7490" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Apr 28 08:17:56 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:49:09 2026 +0200" }, "message": "ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks\n\nAt parsing the channel mapping for HDMI, the current code may spew\nWARN_ON() unnecessarily for the case where only invalid (zero) channel\nmaps are given from the hardware. Drop WARN_ON() and reorganize the\ncode a bit for avoiding the hdmi_slot over the array size.\n\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221390\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260428061800.80527-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2d80392a97cf205a766d75539b4c814a4f5e7490", "tree": "b0c5ae65cfb03bd245274f2313c5f521f590ebd7", "parents": [ "a7b75a11c6f16c049a2ea17cf9d1aaaa57201cf3" ], "author": { "name": "Abhinav Mahadevan", "email": "abhi220204@gmail.com", "time": "Tue Apr 28 21:20:00 2026 +0530" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:54 2026 +0200" }, "message": "ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB\n\nThe quirk entry for PreSonus AudioBox USB was mistakenly placed inside\na disabled #if 0 block. Move it to the correct position after the\n\nFixes: 34fe4a9df247 (\"ALSA: usb-audio: Add quirk for PreSonus AudioBox USB\")\nSigned-off-by: Abhinav Mahadevan \u003cabhi220204@gmail.com\u003e\nLink: https://patch.msgid.link/20260428155117.5170-1-abhi220204@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "a7b75a11c6f16c049a2ea17cf9d1aaaa57201cf3", "tree": "a156862cf2a94e17ab55ee8c17658c8f3b2b942f", "parents": [ "6e7247d8f5fefeceb0bb9cc80a5388a636b219cd", "03dcb5b68a96b51157ec2d17042fa2f0106828ae" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:33 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:33 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc1\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nWe\u0027ve had quite a lot of fixes come in this past week, all driver stuff\nrather than any broad systematic issue. All quite routine stuff.\n" }, { "commit": "03dcb5b68a96b51157ec2d17042fa2f0106828ae", "tree": "3b04c2a0e2409b45c7e93876639e5bfb0dd4f959", "parents": [ "6b4afbaaa342eaa52172e0be5ef8d1fcbf9ff460" ], "author": { "name": "Troy Mitchell", "email": "troy.mitchell@linux.spacemit.com", "time": "Wed Apr 29 09:38:48 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 11:41:32 2026 +0900" }, "message": "ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size\n\nSet both TX and RX FIFO trigger thresholds (TFT/RFT) to 0xF (half of\nthe 32-entry FIFO) instead of 5. This provides better DMA efficiency\nby allowing more data to accumulate before triggering a DMA request,\nreducing the number of DMA transactions needed.\n\nSigned-off-by: Troy Mitchell \u003ctroy.mitchell@linux.spacemit.com\u003e\nLink: https://patch.msgid.link/20260429-k3-i2s-v1-3-2fe99db11ecb@linux.spacemit.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "6b4afbaaa342eaa52172e0be5ef8d1fcbf9ff460", "tree": "9fa5eb2c0361d0dcf882fb1b8f76c95c0ad076c4", "parents": [ "a201aef1a88b675e9eb8487e27d14e2eef3cef80" ], "author": { "name": "Troy Mitchell", "email": "troy.mitchell@linux.spacemit.com", "time": "Wed Apr 29 09:38:47 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 11:41:32 2026 +0900" }, "message": "ASoC: spacemit: move hw constraints from hw_params to startup\n\nHardware constraints should be applied in the startup callback rather\nthan hw_params, as hw_params may be called too late for the constraints\nto take effect properly.\n\nMove the channel count and format constraints for I2S and DSP_A/DSP_B\nmodes into a new startup callback. This also tightens the I2S mode\nchannel constraint from 1-2 to exactly 2, matching the actual hardware\nbehavior.\n\nSigned-off-by: Troy Mitchell \u003ctroy.mitchell@linux.spacemit.com\u003e\nLink: https://patch.msgid.link/20260429-k3-i2s-v1-2-2fe99db11ecb@linux.spacemit.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0c7a5ba011d336df4fcd1f667fcc16ea5549be12", "tree": "fa86fec95728a585ba2eb119525e0eade1c3afb1", "parents": [ "21a7bb5cde5585aded53a47f21d6534d7da2ae48", "1774d3cf3cf17baaf30c095606cda496268283b3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:29 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-1-rc2\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.1-rc2\n\nHere are various unrelated fixes:\n\n- Patches 1-2: set timestamp flags on \u0027ssk\u0027, not \u0027sk\u0027 (typo); Plus do\n that with sleepable lock_sock/release_sock. A fix for v5.14.\n\n- Patch 3: respect SO_LINGER(1, 0) by sending MP_FASTCLOSE at close time\n as expected. A fix for v6.1.\n\n- Patch 4: reset fullmesh counter after a flush. A fix for v6.19.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-0-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1774d3cf3cf17baaf30c095606cda496268283b3", "tree": "fa86fec95728a585ba2eb119525e0eade1c3afb1", "parents": [ "f14d6e9c3678a067f304abba561e0c5446c7e845" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Mon Apr 27 21:54:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: pm: kernel: reset fullmesh counter after flush\n\nThis variable counts how many MPTCP endpoints have a \u0027fullmesh\u0027 flag\nset. After having flushed all MPTCP endpoints, it is then needed to\nreset this counter.\n\nWithout this reset, this counter exposed to the userspace is wrong, but\nalso non-fullmesh endpoints added after the flush will not be taken into\naccount to create subflows in reaction to ADD_ADDRs.\n\nFixes: f88191c7f361 (\"mptcp: pm: in-kernel: record fullmesh endp nb\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260422-mptcp-inc-limits-v6-0-903181771530%40kernel.org?part\u003d15\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-4-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f14d6e9c3678a067f304abba561e0c5446c7e845", "tree": "5e0a4304d86aa2df8e73676c1bbb398c27b3a409", "parents": [ "b5c52908d52c6c8eb8933264aa6087a0600fd892" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Mon Apr 27 21:54:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: fastclose msk when linger time is 0\n\nThe SO_LINGER socket option has been supported for a while with MPTCP\nsockets [1], but it didn\u0027t cause the equivalent of a TCP reset as\nexpected when enabled and its time was set to 0. This was causing some\nbehavioural differences with TCP where some connections were not\npromptly stopped as expected.\n\nTo fix that, an extra condition is checked at close() time before\nsending an MP_FASTCLOSE, the MPTCP equivalent of a TCP reset.\n\nNote that backporting up to [1] will be difficult as more changes are\nneeded to be able to send MP_FASTCLOSE. It seems better to stop at [2],\nwhich was supposed to already imitate TCP.\n\nValidated with MPTCP packetdrill tests [3].\n\nFixes: 268b12387460 (\"mptcp: setsockopt: support SO_LINGER\") [1]\nFixes: d21f83485518 (\"mptcp: use fastclose on more edge scenarios\") [2]\nCc: stable@vger.kernel.org\nReported-by: Lance Tuller \u003clance@lance0.com\u003e\nCloses: https://github.com/lance0/xfr/pull/67\nLink: https://github.com/multipath-tcp/packetdrill/pull/196 [3]\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-3-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b5c52908d52c6c8eb8933264aa6087a0600fd892", "tree": "425819243d9dc066614e36b6670b6d0cf6498aa0", "parents": [ "5f95c21fc23a7ef22b4d27d1ed9bb55557ffb926" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Mon Apr 27 21:54:34 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: fix scheduling with atomic in timestamp sockopt\n\nUsing lock_sock_fast() (atomic context) around sock_set_timestamp()\nand sock_set_timestamping() is unsafe, as both helpers can sleep.\n\nReplace lock_sock_fast() with sleepable lock_sock()/release_sock()\nto avoid scheduling while atomic panic.\n\nFixes: 9061f24bf82e (\"mptcp: sockopt: propagate timestamp request to subflows\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260420093343.16443-1-gang.yan@linux.dev\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-2-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5f95c21fc23a7ef22b4d27d1ed9bb55557ffb926", "tree": "a83dfab44bf6e0f9bbb5008e1fec7ed8c776b170", "parents": [ "21a7bb5cde5585aded53a47f21d6534d7da2ae48" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Mon Apr 27 21:54:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: sockopt: set timestamp flags on subflow socket, not msk\n\nBoth mptcp_setsockopt_sol_socket_tstamp() and\nmptcp_setsockopt_sol_socket_timestamping() iterate over subflows,\nacquire the subflow socket lock, but then erroneously pass the MPTCP\nmsk socket to sock_set_timestamp() / sock_set_timestamping() instead\nof the subflow ssk. As a result, the timestamp flags are set on the\nwrong socket and have no effect on the actual subflows.\n\nPass ssk instead of sk to both helpers.\n\nFixes: 9061f24bf82e (\"mptcp: sockopt: propagate timestamp request to subflows\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-1-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "21a7bb5cde5585aded53a47f21d6534d7da2ae48", "tree": "ae964878a6e357fd20a1ec407f94b79466f1f119", "parents": [ "403e7e34cc2ea75a2546c94176271591211b3334", "869cd6490fafe09c89a15d01610e8a03932d79f0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:14 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:15 2026 -0700" }, "message": "Merge branch \u0027netconsole-configfs-store-callback-fixes\u0027\n\nBreno Leitao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetconsole: configfs store callback fixes\n\nThere are still some changes I want to make, such as, having the dynamic\nlock when reading from configfs (_show() callbacks), wich will solve\nother issues, but I will keep it for later.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-0-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "869cd6490fafe09c89a15d01610e8a03932d79f0", "tree": "ae964878a6e357fd20a1ec407f94b79466f1f119", "parents": [ "92ceb7bff62c2606f664c204750eca0b85d44112" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:12 2026 -0700" }, "message": "netconsole: restore userdatum value on update_userdata() failure\n\nuserdatum_value_store() updates udm-\u003evalue first and only then calls\nupdate_userdata() to rebuild the on-the-wire payload. If\nupdate_userdata() fails (e.g. -ENOMEM from kmalloc), the function\nreturns the error to userspace, but udm-\u003evalue already holds the new\nstring while the live nt-\u003euserdata buffer still reflects the old one.\n\nThe next successful write to any sibling userdatum on the same target\nwill call update_userdata() again, which walks every entry and packs\nthe now-stale udm-\u003evalue into the payload. The failed write is thus\nsilently activated later, with no indication to userspace that the\nvalue it tried to set was rejected.\n\nSnapshot the previous value before overwriting udm-\u003evalue and restore\nit if update_userdata() fails so the visible state and the active\npayload stay consistent.\n\nFixes: eb83801af2dc (\"netconsole: Dynamic allocation of userdata buffer\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-4-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "92ceb7bff62c2606f664c204750eca0b85d44112", "tree": "aa3b04733e17dc9c7fe6f20afcdcf539e37f892a", "parents": [ "e6dd94252b0fa7b4fcc00577c6898432c5d97a08" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: propagate device name truncation in dev_name_store()\n\ndev_name_store() calls strscpy(nt-\u003enp.dev_name, buf, IFNAMSIZ) without\nchecking the return value. If userspace writes an interface name longer\nthan IFNAMSIZ - 1, strscpy() silently truncates and returns -E2BIG, but\nthe function ignores it and reports a fully successful write back to\nuserspace.\n\nIf a real interface happens to match the truncated name, netconsole will\nbind to the wrong device on the next enable, sending kernel logs and\npanic output to an unintended network segment with no indication to\nuserspace that anything was rewritten.\n\nReject writes whose length cannot fit in nt-\u003enp.dev_name up front:\n\n\tif (count \u003e\u003d IFNAMSIZ)\n\t\treturn -ENAMETOOLONG;\n\nThis is not a big deal of a problem, but, it is still the correct\napproach.\n\nFixes: 0bcc1816188e57 (\"[NET] netconsole: Support dynamic reconfiguration using configfs\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-3-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e6dd94252b0fa7b4fcc00577c6898432c5d97a08", "tree": "bdac07f9d060c38cde5b04ee96a91eea46962926", "parents": [ "d62c6f2df5c0e1390b9a1f45b1b52689e3f234f0" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: avoid clobbering userdatum value on truncated write\n\nuserdatum_value_store() bounds count by MAX_EXTRADATA_VALUE_LEN (200)\nand then copies straight into udm-\u003evalue, which is itself 200 bytes:\n\n\tif (count \u003e MAX_EXTRADATA_VALUE_LEN)\n\t\treturn -EMSGSIZE;\n\t...\n\tret \u003d strscpy(udm-\u003evalue, buf, sizeof(udm-\u003evalue));\n\tif (ret \u003c 0)\n\t\tgoto out_unlock;\n\nIf userspace writes exactly MAX_EXTRADATA_VALUE_LEN bytes with no NUL\nwithin them, strscpy() copies 199 bytes plus a NUL into udm-\u003evalue and\nreturns -E2BIG. The function jumps to out_unlock and reports the error\nto userspace, but udm-\u003evalue has already been overwritten with the\ntruncated string and update_userdata() is skipped, so the corruption\nis not yet visible on the wire.\n\nThe next successful write to any userdatum entry under the same target\ncalls update_userdata(), which packs udm-\u003evalue into the active\nnetconsole payload. From that point on, every netconsole message\ncarries the silently truncated value, and userspace has no indication\nthat a previous, error-returning write left state behind.\n\nTighten the entry check from \"count \u003e MAX_EXTRADATA_VALUE_LEN\" to\n\"count \u003e\u003d MAX_EXTRADATA_VALUE_LEN\". With count strictly less than\nsizeof(udm-\u003evalue), strscpy() can no longer return -E2BIG here, so\nthe corrupting truncation path is removed entirely.\n\nFixes: 8a6d5fec6c7f (\"net: netconsole: add a userdata config_group member to netconsole_target\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-2-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d62c6f2df5c0e1390b9a1f45b1b52689e3f234f0", "tree": "f73aee2bc768541b38a67fbd6400afbede7f3c66", "parents": [ "403e7e34cc2ea75a2546c94176271591211b3334" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: return count instead of strnlen(buf, count) from store callbacks\n\nSeveral configfs store callbacks in netconsole end with:\n\n\tret \u003d strnlen(buf, count);\n\nThis under-reports the number of bytes consumed when the input\ncontains an embedded NUL within count, telling the VFS that fewer\nbytes were written than userspace actually handed in. A conformant\npartial-write loop would then retry the trailing bytes against a\ncallback that has already accepted them.\n\nEvery other configfs driver in the tree returns count directly from\nits store callbacks once parsing has succeeded, including\ndrivers/nvme/target/configfs.c, drivers/gpio/gpio-sim.c,\ndrivers/most/configfs.c, drivers/block/null_blk/main.c,\ndrivers/pci/endpoint/pci-ep-cfs.c, and the rest of the configfs\nusers. netconsole was the outlier (along with\ndrivers/infiniband/core/cma_configfs.c, which has the same latent\nissue).\n\nAlign netconsole with the rest of the configfs ecosystem: return\ncount once the parser/validator has accepted the input. The numeric\nand boolean parsers (kstrtobool, kstrtou16, mac_pton,\nnetpoll_parse_ip_addr) have already validated the meaningful prefix;\nany trailing bytes are padding and should simply be reported as\nconsumed.\n\nFixes: 0bcc1816188e (\"[NET] netconsole: Support dynamic reconfiguration using configfs\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-1-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "403e7e34cc2ea75a2546c94176271591211b3334", "tree": "1a16997fcdd83c2e0e8430826d79f5e6a95c1855", "parents": [ "aa6c6d9ee064aabfede4402fd1283424e649ca19", "a6c95b833dc17e84d16a8ac0f40fd0931616a52d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:54 2026 -0700" }, "message": "Merge branch \u0027net-sched-sch_cake-annotate-data-races-in-cake_dump_stats-series\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: sch_cake: annotate data-races in cake_dump_stats() (series)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nThis mini series adds missing READ_ONCE()/WRITE_ONCE() annotations.\n\nOriginal patch was too big, splitting it eases code review.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427083606.459355-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a6c95b833dc17e84d16a8ac0f40fd0931616a52d", "tree": "1a16997fcdd83c2e0e8430826d79f5e6a95c1855", "parents": [ "8fab48d87745a6ab1cec594b8d5865d9ae2db879" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:06 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:51 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this final patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor cparams.target and cparams.interval.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-6-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8fab48d87745a6ab1cec594b8d5865d9ae2db879", "tree": "4d41f028e3661c9bc3ba04e7cf857e0e012321f4", "parents": [ "276a98a434964088fccd4745db5b34d6e831e358" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:05 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:51 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this fourth patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- avg_peak_bandwidth\n- buffer_limit\n- buffer_max_used\n- avg_netoff\n- max_netlen\n- max_adjlen\n- min_netlen\n- min_adjlen\n- active_queues\n- tin_rate_bps\n- bytes\n- tin_backlog\n\nOther annotations are added in following patch, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "276a98a434964088fccd4745db5b34d6e831e358", "tree": "3fba48454fc969d0e977c23abeba8a3fbae54201", "parents": [ "91a96427b93b9ba27413077b7e825d2fefbfa134" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:04 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this third patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- packets\n- tin_dropped\n- tin_ecn_mark\n- ack_drops\n- peak_delay\n- avge_delay\n- base_delay\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "91a96427b93b9ba27413077b7e825d2fefbfa134", "tree": "d9306d11e118b261c14bc14c2dd07acc6468b6ea", "parents": [ "44967ac3785ebef6442377708925181d4a0eb1c8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:03 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this second patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- bulk_flow_count\n- unresponsive_flow_count\n- max_skblen\n- flow_quantum\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "44967ac3785ebef6442377708925181d4a0eb1c8", "tree": "2dde8cb5dd3a428f613bcf31e371307b9323ee7f", "parents": [ "aa6c6d9ee064aabfede4402fd1283424e649ca19" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:02 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this first patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- way_hits\n- way_misses\n- way_collisions\n- sparse_flow_count\n- decaying_flow_count\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aa6c6d9ee064aabfede4402fd1283424e649ca19", "tree": "4f8990610b83b33e766f9fea6c14ec77e9aa017e", "parents": [ "dfb7e3b9a925262603867a4f1210717b347fb234" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sun Apr 26 09:53:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:16:53 2026 -0700" }, "message": "bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()\n\nbareudp_fill_metadata_dst() passes bareudp-\u003esock to\nudp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.\nThe socket is only created in bareudp_open() and NULLed in\nbareudp_stop(), so calling this function while the device is down\ntriggers a NULL dereference via sock-\u003esk.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)\n Call Trace:\n \u003cTASK\u003e\n bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)\n do_execute_actions (net/openvswitch/actions.c:901)\n ovs_execute_actions (net/openvswitch/actions.c:1589)\n ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)\n genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)\n genl_rcv_msg (net/netlink/genetlink.c:1209)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n \u003c/TASK\u003e\n\nAdd a NULL check returning -ESHUTDOWN, consistent with the xmit paths\nin the same driver.\n\nFixes: 571912c69f0e (\"net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dfb7e3b9a925262603867a4f1210717b347fb234", "tree": "0c28d88b3cdcf00c0a66b4ddb8cf0ce48893ad46", "parents": [ "b718342a7fbaa2dff5fefc31988c07af8c6cbc21", "8a92cb475ca90d84db769e4d4383e631ace0d6e5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:23 2026 -0700" }, "message": "Merge branch \u0027sctp-fix-a-vtag-verification-failure-caused-by-stale-inits\u0027\n\nXin Long says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsctp: fix a vtag verification failure caused by stale INITs\n\nSimilar to Scenario B in commit 8e56b063c865 ( netfilter: handle the\nconnecting collision properly in nf_conntrack_proto_sctp\"):\n\nScenario B: INIT_ACK is delayed until the peer completes its own handshake\n\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [COOKIE ECHO]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [COOKIE ACK]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *\n\nThere is another case:\n\nScenario F: INIT is delayed until the peer completes its own handshake\n\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n (OVS upcall)\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [COOKIE ECHO]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [COOKIE ACK]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n (delayed)\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *\n\nIn this case, the delayed INIT (e.g. due to OVS upcall) is recorded by\nconntrack, which prevents vtag verification from dropping the unexpected\nINIT-ACK in nf_conntrack_sctp_packet():\n\n vtag \u003d ct-\u003eproto.sctp.vtag[!dir];\n if (!ct-\u003eproto.sctp.init[!dir] \u0026\u0026 vtag \u0026\u0026 vtag !\u003d ih-\u003einit_tag)\n goto out_unlock;\n\nThis happens because ct-\u003eproto.sctp.init[!dir] is set by the delayed INIT,\neven though it is stale.\n\nFix this in two parts:\n\n- In netfilter: Do not record INITs whose init_tag matches the peer vtag,\n as they carry no new handshake state in the 1st patch.\n\n- In SCTP: Prevent endpoints from responding to such INITs with INIT-ACK,\n ensuring correctness even when middleboxes lack the netfilter fix in\n the 2nd patch.\n\nA follow-up selftest for this scenario will be posted in a separate patch\nby Yi Chen.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8a92cb475ca90d84db769e4d4383e631ace0d6e5", "tree": "0c28d88b3cdcf00c0a66b4ddb8cf0ce48893ad46", "parents": [ "576a5d2bad4814c881a829576b1261b9b8159d2b" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Sun Apr 26 10:46:41 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:19 2026 -0700" }, "message": "sctp: discard stale INIT after handshake completion\n\nAfter an association reaches ESTABLISHED, the peer’s init_tag is already\nknown from the handshake. Any subsequent INIT with the same init_tag is\nnot a valid restart, but a delayed or duplicate INIT.\n\nDrop such INIT chunks in sctp_sf_do_unexpected_init() instead of\nprocessing them as new association attempts.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nLink: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "576a5d2bad4814c881a829576b1261b9b8159d2b", "tree": "9ba438fc3ab1bd9c16f7f26d98fae9c909b39123", "parents": [ "b718342a7fbaa2dff5fefc31988c07af8c6cbc21" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Sun Apr 26 10:46:40 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:19 2026 -0700" }, "message": "netfilter: skip recording stale or retransmitted INIT\n\nAn INIT whose init_tag matches the peer\u0027s vtag does not provide new state\ninformation. It indicates either:\n\n- a stale INIT (after INIT-ACK has already been seen on the same side), or\n- a retransmitted INIT (after INIT has already been recorded on the same\n side).\n\nIn both cases, the INIT must not update ct-\u003eproto.sctp.init[] state, since\nit does not advance the handshake tracking and may otherwise corrupt\nINIT/INIT-ACK validation logic.\n\nAllow INIT processing only when the conntrack entry is newly created\n(SCTP_CONNTRACK_NONE), or when the init_tag differs from the stored peer\nvtag.\n\nNote it skips the check for the ct with old_state SCTP_CONNTRACK_NONE in\nnf_conntrack_sctp_packet(), as it is just created in sctp_new() where it\nset ct-\u003eproto.sctp.vtag[IP_CT_DIR_REPLY] \u003d ih-\u003einit_tag.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nLink: https://patch.msgid.link/ee56c3e416452b2a40589a2a85245ac2ad5e9f4b.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a201aef1a88b675e9eb8487e27d14e2eef3cef80", "tree": "3688865ea958637280540768d7e337c31f29d1be", "parents": [ "be102efb832ef7e30e4cd4c2edf22bbf64ddf35a" ], "author": { "name": "Christian A. Ehrhardt", "email": "christian.ehrhardt@codasip.com", "time": "Tue Apr 28 21:22:49 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 09:47:39 2026 +0900" }, "message": "ASoC: codecs: ab8500: Fix casting of private data\n\nab8500_filter_controls[i].private_value is initialized using\n\n\t.private_value \u003d (unsigned long)\u0026(struct filter_control)\n\t\t{.count \u003d xcount, .min \u003d xmin, .max \u003d xmax}\n\nthus it\u0027s a pointer to a struct filter_control casted to unsigned long.\n\nSo to get back that pointer .private_data must be cast back, not its\naddress.\n\nFixes: 679d7abdc754 (\"ASoC: codecs: Add AB8500 codec-driver\")\nSigned-off-by: Christian A. Ehrhardt \u003cchristian.ehrhardt@codasip.com\u003e\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\nLink: https://patch.msgid.link/20260428192255.2294705-2-u.kleine-koenig@baylibre.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "b718342a7fbaa2dff5fefc31988c07af8c6cbc21", "tree": "5a9912a82d45107ae363a3f9f603db8b3882865b", "parents": [ "b89769f936a8fa9e66de72ddc1b71a9745a488e6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 12:58:56 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:44:20 2026 -0700" }, "message": "net: psp: require admin permission for dev-set and key-rotate\n\nThe dev-set and key-rotate netlink operations modify shared device\nstate (PSP version configuration and cryptographic key material,\nrespectively) but do not require CAP_NET_ADMIN. The only access\ncontrol is psp_dev_check_access() which merely verifies netns\nmembership.\n\nFixes: 00c94ca2b99e (\"psp: base PSP device support\")\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260427195856.401223-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b89769f936a8fa9e66de72ddc1b71a9745a488e6", "tree": "490816c0380f1e23f37a44f4f08cc298335d9e2c", "parents": [ "67d7ae3340cae0a18ec1d53a2fce198c31a211b8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 12:06:06 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:43:32 2026 -0700" }, "message": "net: psp: check for device unregister when creating assoc\n\npsp_assoc_device_get_locked() obtains a psp_dev reference via\npsp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU);\nit then acquires psd-\u003elock and drops the reference. Before\nthe lock is taken, psp_dev_unregister() can run to completion:\ntake psd-\u003elock, clear out state, unlock, drop the registration\nreference.\n\nThe expectation is that the lock prevents device unregistration,\nbut much like with netdevs special care has to be taken when\n\"upgrading\" a reference to a locked device. Add the missing\ncheck if device is still alive. psp_dev_is_registered() exists\nalready but had no callers, which makes me wonder if I either\nforgot to add this or lost the check during refactoring...\n\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nFixes: 6b46ca260e22 (\"net: psp: add socket security association code\")\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260427190606.366101-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "67d7ae3340cae0a18ec1d53a2fce198c31a211b8", "tree": "aad3431cf21c685c4fd0ee9dd3cd01d60b791fbd", "parents": [ "46f74a3f7d57d9cc0110b09cbc8163fa0a01afa2", "8cf6809cddcbe301aedfc6b51bcd4944d45795f6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:41:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:41:06 2026 -0700" }, "message": "Merge tag \u0027nf-26-04-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) IEEE1394 ARP payload contains no target hardware address in the\n ARP packet. Apparently, arp_tables was never updated to deal with\n IEEE1394 ARP properly. To deal with this, return no match in case\n the target hardware address selector is used, either for inverse or\n normal match. Moreover, arpt_mangle disallows mangling of the target\n hardware and IP address because, it is not worth to adjust the\n offset calculation to fix this, we suspect no users of arp_tables\n for this family.\n\n2) Use list_del_rcu() to delete device hooks in nf_tables, this hook\n list is RCU protected, concurrent netlink dump readers can be\n walking on this list, fix it by adding a helper function and use it\n for consistency. From Florian Westphal.\n\n3) Add list_splice_rcu(), this is useful for joining the local list of\n new device hooks to the RCU protected hook list in chain and\n flowtable. Reviewed by Paul E. McKenney.\n\n4) Use list_splice_rcu() to publish the new device hooks in chain and\n flowtable to fix concurrent netlink dump traversal.\n\n5) Add a new hook transaction object to track device hook deletions.\n The current approach moves device hooks to be deleted around during\n the preparation phase, this breaks concurrent RCU reader via netlink\n dump. This new hook transaction is combined with NFT_HOOK_REMOVE\n flag to annotate hooks for removal in the preparation phase.\n\n6) xt_policy inbound policy check in strict mode can lead to\n out-of-bound access of the secpath array due to incorrect.\n The iteration over the secpath needs to be reversed in the inbound\n to check for the human readable policy, expecting inner in first\n position and outer in second position, the secpath from inbound\n actually stores outer in first position then in second position.\n From Jiexun Wang.\n\n7) Fix possible zero shift in nft_bitwise triggering UBSAN splat,\n reject zero shift from control plane, from Kai Ma.\n\n8) Replace simple_strtoul() in the conntrack SIP helper since it relies\n on nul-terminated strings. From Florian Westphal.\n\n* tag \u0027nf-26-04-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nf_conntrack_sip: don\u0027t use simple_strtoul\n netfilter: reject zero shift in nft_bitwise\n netfilter: xt_policy: fix strict mode inbound policy matching\n netfilter: nf_tables: add hook transactions for device deletions\n netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase\n rculist: add list_splice_rcu() for private lists\n netfilter: nf_tables: use list_del_rcu for netlink hooks\n netfilter: arp_tables: fix IEEE1394 ARP payload parsing\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260428095840.51961-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be102efb832ef7e30e4cd4c2edf22bbf64ddf35a", "tree": "d633a78e56579a4a6b84ad38e3544923fc4917d9", "parents": [ "13d30682e8dee191ac04e93642f0372a723e8b0c" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Tue Apr 28 12:52:28 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 08:41:14 2026 +0900" }, "message": "ASoC: cs35l56: Fix illegal writes to OTP_MEM registers\n\nMark the OTP_MEM registers as volatile so that regcache_sync() will not\nattempt to write to them.\n\nThese registers hold a constant, and originally they were marked as\nreadable non-volatile so that this value would be read into the regmap\ncache. The problem with this is regcache_sync() issues a write for any\ncached register that does not have a reg_default.\n\nThough these registers are constants and writing them in normal use\ncannot change OTP, it is illegal for the host to write to them.\n\nFixes: e1830f66f6c6 (\"ASoC: cs35l56: Add helper functions for amp calibration\")\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260428115228.158252-1-rf@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "tree": "7e2714963b58fa6732df54be5685588158ec2a51", "parents": [ "dca922e019dd758b4c1b4bec8f1d509efddeaab4", "d99f7a32f09dccbe396187370ec1a74a31b73d7e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n \"The merge window pulled in the cgroup sub-scheduler infrastructure,\n and new AI reviews are accelerating bug reporting and fixing - hence\n the larger than usual fixes batch:\n\n - Use-after-frees during scheduler load/unload:\n - The disable path could free the BPF scheduler while deferred\n irq_work / kthread work was still in flight\n - cgroup setter callbacks read the active scheduler outside the\n rwsem that synchronizes against teardown\n Fix both, and reuse the disable drain in the enable error paths so\n the BPF JIT page can\u0027t be freed under live callbacks.\n\n - Several BPF op invocations didn\u0027t tell the framework which runqueue\n was already locked, so helper kfuncs that re-acquire the runqueue\n by CPU could deadlock on the held lock\n\n Fix the affected callsites, including recursive parent-into-child\n dispatch.\n\n - The hardlockup notifier ran from NMI but eventually took a\n non-NMI-safe lock. Bounce it through irq_work.\n\n - A handful of bugs in the new sub-scheduler hierarchy:\n - helper kfuncs hard-coded the root instead of resolving the\n caller\u0027s scheduler\n - the enable error path tried to disable per-task state that had\n never been initialized, and leaked cpus_read_lock on the way\n out\n - a sysfs object was leaked on every load/unload\n - the dispatch fast-path used the root scheduler instead of the\n task\u0027s\n - a couple of CONFIG #ifdef guards were misclassified\n\n - Verifier-time hardening: BPF programs of unrelated struct_ops types\n (e.g. tcp_congestion_ops) could call sched_ext kfuncs - a semantic\n bug and, once sub-sched was enabled, a KASAN out-of-bounds read.\n Now rejected at load. Plus a few NULL and cross-task argument\n checks on sched_ext kfuncs, and a selftest covering the new deny.\n\n - rhashtable (Herbert): restore the insecure_elasticity toggle and\n bounce the deferred-resize kick through irq_work to break a\n lock-order cycle observable from raw-spinlock callers. sched_ext\u0027s\n scheduler-instance hash is the first user of both.\n\n - The bypass-mode load balancer used file-scope cpumasks; with\n multiple scheduler instances now possible, those raced. Move to\n per-instance cpumasks, plus a follow-up to skip tasks whose\n recorded CPU is stale relative to the new owning runqueue.\n\n - Smaller fixes:\n - a dispatch queue\u0027s first-task tracking misbehaved when a parked\n iterator cursor sat in the list\n - the runqueue\u0027s next-class wasn\u0027t promoted on local-queue\n enqueue, leaving an SCX task behind RT in edge cases\n - the reference qmap scheduler stopped erroring on legitimate\n cross-scheduler task-storage misses\"\n\n* tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (26 commits)\n sched_ext: Fix scx_flush_disable_work() UAF race\n sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable\n sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime\n sched_ext: Refuse cross-task select_cpu_from_kfunc calls\n sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED\n sched_ext: Make bypass LB cpumasks per-scheduler\n sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before\n sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task\n sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP\n sched_ext: Use dsq-\u003efirst_task instead of list_empty() in dispatch_enqueue() FIFO-tail\n sched_ext: Resolve caller\u0027s scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued()\n sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n sched_ext: Don\u0027t disable tasks in scx_sub_enable_workfn() abort path\n sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()\n sched_ext: Guard scx_dsq_move() against NULL kit-\u003edsq after failed iter_new\n sched_ext: Unregister sub_kset on scheduler disable\n sched_ext: Defer scx_hardlockup() out of NMI\n sched_ext: sync disable_irq_work in bpf_scx_unreg()\n sched_ext: Fix local_dsq_post_enq() to use task\u0027s scheduler in sub-sched\n ...\n" }, { "commit": "5ec07d5204b4544271f32f6261ee097fe53cb081", "tree": "aea41e260d471234fef4a09d02479ffe4439b1fe", "parents": [ "3b75dd76e64a04771861bb5647951c264919e563" ], "author": { "name": "Sheng Che Peng", "email": "synte4028@gmail.com", "time": "Wed Apr 22 10:18:19 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 14:28:29 2026 -0400" }, "message": "tracepoint: Fix typo in tracepoint.h comment\n\nChange \"my\" to \"may\" in the description of subsystem configurations.\n\nLink: https://patch.msgid.link/20260422021819.1788091-1-synte4028@gmail.com\nSigned-off-by: Sheng Che Peng \u003csynte4028@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "3b75dd76e64a04771861bb5647951c264919e563", "tree": "27e8045c5332240d71c921fcd22a44998b93df78", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 20 06:25:09 2026 -0700" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 14:28:29 2026 -0400" }, "message": "tracing: branch: Fix inverted check on stat tracer registration\n\ninit_annotated_branch_stats() and all_annotated_branch_stats() check the\nreturn value of register_stat_tracer() with \"if (!ret)\", but\nregister_stat_tracer() returns 0 on success and a negative errno on\nfailure. The inverted check causes the warning to be printed on every\nsuccessful registration, e.g.:\n\n Warning: could not register annotated branches stats\n\nwhile leaving real failures silent. The initcall also returned a\nhard-coded 1 instead of the actual error.\n\nInvert the check and propagate ret so that the warning fires on real\nerrors and the initcall reports the correct status.\n\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nLink: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org\nFixes: 002bb86d8d42 (\"tracing/ftrace: separate events tracing and stats tracing engine\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d99f7a32f09dccbe396187370ec1a74a31b73d7e", "tree": "54a5a52b58b3ce0f5cb550bb4a93da8681bb34c9", "parents": [ "163f8b7f9a84086c67c76aeadc04e6d43e32df6e" ], "author": { "name": "Cheng-Yang Chou", "email": "yphbchou0911@gmail.com", "time": "Wed Apr 29 01:36:12 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 07:40:03 2026 -1000" }, "message": "sched_ext: Fix scx_flush_disable_work() UAF race\n\nscx_flush_disable_work() calls irq_work_sync() followed by\nkthread_flush_work() to ensure that the disable kthread work has\nfully completed before bpf_scx_unreg() frees the SCX scheduler.\n\nHowever, a concurrent scx_vexit() (e.g., triggered by a watchdog stall)\ncreates a race window between scx_claim_exit() and irq_work_queue():\n\n CPU A (scx_vexit (watchdog)) CPU B (bpf_scx_unreg)\n ---- ----\n scx_claim_exit()\n atomic_try_cmpxchg(NONE-\u003ekind)\n stack_trace_save()\n vscnprintf()\n scx_disable()\n scx_claim_exit() -\u003e FAIL\n scx_flush_disable_work()\n irq_work_sync() // no-op: not queued yet\n kthread_flush_work() // no-op: not queued yet\n kobject_put(\u0026sch-\u003ekobj) -\u003e free %sch\n irq_work_queue() -\u003e UAF on %sch\n scx_disable_irq_workfn()\n kthread_queue_work() -\u003e UAF\n\nThe root cause is that CPU B\u0027s scx_flush_disable_work() returns after\nsyncing an irq_work that has not yet been queued, while CPU A is still\nexecuting the code between scx_claim_exit() and irq_work_queue().\n\nLoop until exit_kind reaches SCX_EXIT_DONE or SCX_EXIT_NONE, draining\ndisable_irq_work and disable_work in each pass. This ensures that any\nwork queued after the previous check is caught, while also correctly\nhandling cases where no disable was triggered (e.g., the\nscx_sub_enable_workfn() abort path).\n\nFixes: 510a27055446 (\"sched_ext: sync disable_irq_work in bpf_scx_unreg()\")\nReported-by: https://sashiko.dev/#/patchset/20260424100221.32407-1-icheng%40nvidia.com\nSuggested-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Cheng-Yang Chou \u003cyphbchou0911@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "163f8b7f9a84086c67c76aeadc04e6d43e32df6e", "tree": "571d82152fb8e08455663c68d3b6dae14e8dc875", "parents": [ "deb7b2f93d0129b79425f830a1e5e7e1bb2c4973" ], "author": { "name": "Kuba Piecuch", "email": "jpiecuch@google.com", "time": "Tue Apr 28 12:46:01 2026 +0000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 06:28:48 2026 -1000" }, "message": "sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n\nThere are several edge cases (see linked thread) where an IMMED task\ncan be left lingering on a local DSQ if an RT task swoops in at the\nwrong time. All of these edge cases are due to rq-\u003enext_class being idle\neven after dispatching a task to rq\u0027s local DSQ. We should bump\nrq-\u003enext_class to \u0026ext_sched_class as soon as we\u0027ve inserted a task into\nthe local DSQ.\n\nTo optimize the common case of rq-\u003enext_class \u003d\u003d \u0026ext_sched_class,\nonly call wakeup_preempt() if rq-\u003enext_class is below EXT. If next_class\nis EXT or above, wakeup_preempt() is a no-op anyway.\n\nThis lets us also simplify the preempt_curr() logic a bit since\nwakeup_preempt() will call preempt_curr() for us if next_class is\nbelow EXT.\n\nLink: https://lore.kernel.org/all/DHZPHUFXB4N3.2RY28MUEWBNYK@google.com/\nSigned-off-by: Kuba Piecuch \u003cjpiecuch@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "46f74a3f7d57d9cc0110b09cbc8163fa0a01afa2", "tree": "f59e7a83a1df420450d1af94affbcbab52bd6fe3", "parents": [ "4ca07b9239bd0478ae586632a2ed72be37ed8407" ], "author": { "name": "Heiko Schocher", "email": "hs@nabladev.com", "time": "Sat Apr 25 05:13:39 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 15:51:55 2026 +0200" }, "message": "net: phy: dp83869: fix setting CLK_O_SEL field.\n\nTable 7-121 in datasheet says we have to set register 0xc6\nto value 0x10 before CLK_O_SEL can be modified. No more infos\nabout this field found in datasheet. With this fix, setting\nof CLK_O_SEL field in IO_MUX_CFG register worked through dts\nproperty \"ti,clk-output-sel\" on a DP83869HMRGZR.\n\nSigned-off-by: Heiko Schocher \u003chs@nabladev.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nFixes: 01db923e8377 (\"net: phy: dp83869: Add TI dp83869 phy\")\nLink: https://patch.msgid.link/20260425031339.3318-1-hs@nabladev.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4ca07b9239bd0478ae586632a2ed72be37ed8407", "tree": "3c7827139d70c8e27aa954e2fbd697564cc522b0", "parents": [ "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8" ], "author": { "name": "William A. Kennington III", "email": "william@wkennington.com", "time": "Thu Apr 23 00:46:52 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 13:11:53 2026 +0200" }, "message": "net: mctp i2c: check length before marking flow active\n\nCurrently, mctp_i2c_get_tx_flow_state() is called before the packet length\nsanity check. This function marks a new flow as active in the MCTP core.\n\nIf the sanity check fails, mctp_i2c_xmit() returns early without calling\nmctp_i2c_lock_nest(). This results in a mismatched locking state: the\nflow is active, but the I2C bus lock was never acquired for it.\n\nWhen the flow is later released, mctp_i2c_release_flow() will see the\nactive state and queue an unlock marker. The TX thread will then\ndecrement midev-\u003ei2c_lock_count from 0, causing it to underflow to -1.\n\nThis underflow permanently breaks the driver\u0027s locking logic, allowing\nfuture transmissions to occur without holding the I2C bus lock, leading\nto bus collisions and potential hardware hangs.\n\nMove the mctp_i2c_get_tx_flow_state() call to after the length sanity\ncheck to ensure we only transition the flow state if we are actually\ngoing to proceed with the transmission and locking.\n\nFixes: f5b8abf9fc3d (\"mctp i2c: MCTP I2C binding driver\")\nSigned-off-by: William A. Kennington III \u003cwilliam@wkennington.com\u003e\nAcked-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20260423074741.201460-1-william@wkennington.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8", "tree": "f9acc5596db6383fe33e839bb85e718df3c19c85", "parents": [ "f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e" ], "author": { "name": "Sam Edwards", "email": "cfsworks@gmail.com", "time": "Tue Apr 21 21:45:03 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 12:26:20 2026 +0200" }, "message": "net: stmmac: Prevent NULL deref when RX memory exhausted\n\nThe CPU receives frames from the MAC through conventional DMA: the CPU\nallocates buffers for the MAC, then the MAC fills them and returns\nownership to the CPU. For each hardware RX queue, the CPU and MAC\ncoordinate through a shared ring array of DMA descriptors: one\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\nphysical address and a status flag (\"OWN\") indicating which side owns\nthe buffer: OWN\u003d0 for CPU, OWN\u003d1 for MAC. The CPU is only allowed to set\nthe flag and the MAC is only allowed to clear it, and both must move\nthrough the ring in sequence: thus the ring is used for both\n\"submissions\" and \"completions.\"\n\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\nwith the `cur_rx` index. The main receive loop in that function checks\nfor rx_descs[cur_rx].own\u003d0, gives the corresponding buffer to the\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\nposition with `dirty_rx`, allocates fresh buffers and rearms the\ndescriptors (setting OWN\u003d1). If it fails any allocation, it simply stops\nearly (leaving OWN\u003d0) and will retry where it left off when next called.\n\nThis means descriptors have a three-stage lifecycle (terms my own):\n- `empty` (OWN\u003d1, buffer valid)\n- `full` (OWN\u003d0, buffer valid and populated)\n- `dirty` (OWN\u003d0, buffer NULL)\n\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\nin a NULL dereference when mistaken for `full`. The aforementioned\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\n`dirty` descriptors that the loop might encounter without needing to\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\ncatch up to `dirty_rx`.\n\nFix this by explicitly checking, before advancing `cur_rx`, if the next\nentry is dirty; exit the loop if so. This prevents processing of the\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\nfully prevents the `cur_rx \u003d\u003d dirty_rx` ambiguity as the previous bugfix\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\nany fix to stmmac_rx() will also need a corresponding fix for\nstmmac_rx_zc(). Therefore, apply the same check there.\n\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\nMAC sets OWN\u003d0 on the final descriptor, it will be unable to send any\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\nsucceeds, risking an indefinite stall of the receive process if not. But\nthis is not a regression, so it can be addressed in a future change.\n\nFixes: b6cb4541853c7 (\"net: stmmac: avoid rx queue overrun\")\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221010\nCc: stable@vger.kernel.org\nSuggested-by: Russell King \u003clinux@armlinux.org.uk\u003e\nSigned-off-by: Sam Edwards \u003cCFSworks@gmail.com\u003e\nLink: https://patch.msgid.link/20260422044503.5349-1-CFSworks@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e", "tree": "0e81790227f6b8da16e5a23da87d3e65e1052c32", "parents": [ "3bc179bc7146c26c9dff75d2943d10528274e301" ], "author": { "name": "Andrea Mayer", "email": "andrea.mayer@uniroma2.it", "time": "Tue Apr 21 11:47:35 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 11:16:14 2026 +0200" }, "message": "net: ipv6: fix NOREF dst use in seg6 and rpl lwtunnels\n\nseg6_input_core() and rpl_input() call ip6_route_input() which sets a\nNOREF dst on the skb, then pass it to dst_cache_set_ip6() invoking\ndst_hold() unconditionally.\nOn PREEMPT_RT, ksoftirqd is preemptible and a higher-priority task can\nrelease the underlying pcpu_rt between the lookup and the caching\nthrough a concurrent FIB lookup on a shared nexthop.\nSimplified race sequence:\n\n ksoftirqd/X higher-prio task (same CPU X)\n ----------- --------------------------------\n seg6_input_core(,skb)/rpl_input(skb)\n dst_cache_get()\n -\u003e miss\n ip6_route_input(skb)\n -\u003e ip6_pol_route(,skb,flags)\n [RT6_LOOKUP_F_DST_NOREF in flags]\n -\u003e FIB lookup resolves fib6_nh\n [nhid\u003dN route]\n -\u003e rt6_make_pcpu_route()\n [creates pcpu_rt, refcount\u003d1]\n pcpu_rt-\u003esernum \u003d fib6_sernum\n [fib6_sernum\u003dW]\n -\u003e cmpxchg(fib6_nh.rt6i_pcpu,\n NULL, pcpu_rt)\n [slot was empty, store succeeds]\n -\u003e skb_dst_set_noref(skb, dst)\n [dst is pcpu_rt, refcount still 1]\n\n rt_genid_bump_ipv6()\n -\u003e bumps fib6_sernum\n [fib6_sernum from W to Z]\n ip6_route_output()\n -\u003e ip6_pol_route()\n -\u003e FIB lookup resolves fib6_nh\n [nhid\u003dN]\n -\u003e rt6_get_pcpu_route()\n pcpu_rt-\u003esernum !\u003d fib6_sernum\n [W \u003c\u003e Z, stale]\n -\u003e prev \u003d xchg(rt6i_pcpu, NULL)\n -\u003e dst_release(prev)\n [prev is pcpu_rt,\n refcount 1-\u003e0, dead]\n\n dst \u003d skb_dst(skb)\n [dst is the dead pcpu_rt]\n dst_cache_set_ip6(dst)\n -\u003e dst_hold() on dead dst\n -\u003e WARN / use-after-free\n\nFor the race to occur, ksoftirqd must be preemptible (PREEMPT_RT without\nPREEMPT_RT_NEEDS_BH_LOCK) and a concurrent task must be able to release\nthe pcpu_rt. Shared nexthop objects provide such a path, as two routes\npointing to the same nhid share the same fib6_nh and its rt6i_pcpu\nentry.\n\nFix seg6_input_core() and rpl_input() by calling skb_dst_force() after\nip6_route_input() to force the NOREF dst into a refcounted one before\ncaching.\nThe output path is not affected as ip6_route_output() already returns a\nrefcounted dst.\n\nFixes: af4a2209b134 (\"ipv6: sr: use dst_cache in seg6_input\")\nFixes: a7a29f9c361f (\"net: ipv6: add rpl sr tunnel\")\nCc: stable@vger.kernel.org\nSigned-off-by: Andrea Mayer \u003candrea.mayer@uniroma2.it\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Justin Iurman \u003cjustin.iurman@gmail.com\u003e\nLink: https://patch.msgid.link/20260421094735.20997-1-andrea.mayer@uniroma2.it\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "13d30682e8dee191ac04e93642f0372a723e8b0c", "tree": "d1fad87c3dfb6443120627cf883f248fbc1dff04", "parents": [ "241ee17ecb6be210f7b231b2a81bfb68871950d0" ], "author": { "name": "Cássio Gabriel", "email": "cassiogabrielcontato@gmail.com", "time": "Mon Apr 27 23:38:41 2026 -0300" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Apr 28 17:50:08 2026 +0900" }, "message": "ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error\n\nIf byt_wm5102_prepare_and_enable_pll1() fails in the\nSND_SOC_DAPM_EVENT_ON() path, platform_clock_control() returns after\nclk_prepare_enable(priv-\u003emclk) without disabling the clock again.\n\nThis leaks an MCLK enable reference on failed power-up attempts. Add the\nmissing clk_disable_unprepare() on the error path, matching the unwind\nused by the other Intel platform_clock_control() implementations.\n\nFixes: 9a87fc1e0619 (\"ASoC: Intel: bytcr_wm5102: Add machine driver for BYT/WM5102\")\nCc: stable@vger.kernel.org\nSigned-off-by: Cássio Gabriel \u003ccassiogabrielcontato@gmail.com\u003e\nReviewed-by: Cezary Rojewski \u003ccezary.rojewski@intel.com\u003e\nReviewed-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260427-bytcr-wm5102-mclk-leak-v1-1-02b96d08e99c@gmail.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "6e7247d8f5fefeceb0bb9cc80a5388a636b219cd", "tree": "5d60a51552ff47c95740e6dd988c3547f2121da0", "parents": [ "c39f0bc03f84ba64c9144c95714df1dc36150f6d" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Apr 27 17:22:15 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Apr 28 08:14:21 2026 +0200" }, "message": "ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()\n\nThe convert_chmap_v3() has a loop with its increment size of\ncs_desc-\u003ewLength, but we forgot to validate cs_desc-\u003ewLength itself,\nwhich may lead to potential endless loop by a malformed descriptor.\n\nAdd a proper size check to abort the loop for plugging the hole.\n\nFixes: ecfd41166b72 (\"ALSA: usb-audio: Validate UAC3 cluster segment descriptors\")\nCc: \u003cstable@vger.kernel.org\u003e\nLink: https://patch.msgid.link/20260427152224.15276-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "c39f0bc03f84ba64c9144c95714df1dc36150f6d", "tree": "238e5bb41a529fb01d77a5bf7193866bbc2d00f7", "parents": [ "b32ae47a2b0a1fb4bd4942242847966d9b178222" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Mon Apr 27 17:15:04 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Apr 28 08:13:50 2026 +0200" }, "message": "ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams\n\nAt parsing UAC3 streams, we allocate a PD object at each time, and\neither assign or free it. But there is a case where the PD object may\nbe leaked; namely, in __snd_usb_parse_audio_interface() loop, when an\naudioformat shares the same endpoint with others, it\u0027s put to a link\nand returns from snd_usb_add_audio_stream(), but the PD is forgotten\nafterwards. Overall, the treatment of PD object in the parser code is\na bit flaky, and we should be more careful about the object ownership.\n\nThis patch tries to fix the above case and improve the code a bit.\nThe pd object is now managed with the auto-cleanup in the loop, and\nthe ownership is updated when the pd object gets assigned to the\nstream, which guarantees the release of the leftover object.\n\nFixes: 7edf3b5e6a45 (\"ALSA: usb-audio: AudioStreaming Power Domain parsing\")\nLink: https://patch.msgid.link/20260427151508.12544-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" } ], "next": "b32ae47a2b0a1fb4bd4942242847966d9b178222" }