)]}'
{
  "log": [
    {
      "commit": "dc4b95b8fee95113587e93ca116356032d271371",
      "tree": "7334dcb3c1300d747fca63a600596389a6e05598",
      "parents": [
        "b95dbcdd718f38fd27eb13e63d8bfe4bf6e26ab3"
      ],
      "author": {
        "name": "Victor Nogueira",
        "email": "victor@mojatatu.com",
        "time": "Mon Aug 24 08:59:28 2026 -0300"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 15:24:35 2026 +0200"
      },
      "message": "net/sched: sch_teql: restore skb-\u003edev on the slave failure path\n\nteql_master_xmit() sets skb-\u003edev \u003d slave before calling the slave\u0027s\nndo_start_xmit(), but never restores it when that transmit fails. The\nskb then walks on to the next slave still pointing at the previous one.\n\nIf a later slave has no resolved neighbour, teql_resolve() hands the skb\nto neigh_event_send(), which queues it on that neighbour\u0027s arp_queue\nwith the stale skb-\u003edev. skb-\u003edev holds no reference, so deleting the\nprevious slave frees the net_device while the skb is still queued.\nWhatever runs next on that skb - arp_error_report() on timeout, or\nneigh_direct_output() -\u003e dev_queue_xmit() once the neighbour resolves -\ncauses a UAF like the one below:\n\nBUG: KASAN: slab-use-after-free in __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nRead of size 4 at addr ffff888106e100b0 by task flood_packet/527\nCPU: 0 UID: 0 PID: 527 Comm: flood_packet Not tainted 7.2.0-rc6-g594d90519502 #1 PREEMPT(lazy)\nHardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\nCall Trace:\n\u003cIRQ\u003e\ndump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\nprint_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n? __pfx__raw_spin_lock_irqsave (./include/asm-generic/qrwlock.h:122 (discriminator 4))\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\nkasan_report (mm/kasan/report.c:595)\n? __icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n__icmp_send (net/ipv4/icmp.c:914 (discriminator 2))\n[...]\nipv4_link_failure (net/ipv4/route.c:1251 net/ipv4/route.c:1258)\n? __pfx_ipv4_link_failure (./include/linux/skbuff.h:4327)\n? _raw_write_lock (./include/linux/instrumented.h:55 ./include/linux/atomic/atomic-instrumented.h:1301 ./include/asm-generic/qrwlock.h:98 ./include/linux/rwlock_api_smp.h:230 kernel/locking/spinlock.c:304)\n? __pfx__raw_write_lock (kernel/locking/spinlock.c:175)\narp_error_report (./include/net/dst.h:438 net/ipv4/arp.c:296)\nneigh_invalidate (net/core/neighbour.c:1077)\nneigh_timer_handler (net/core/neighbour.c:1169)\n[...]\nAllocated by task 505:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\n__kasan_kmalloc (mm/kasan/common.c:398 mm/kasan/common.c:415)\n__kvmalloc_node_noprof (./include/linux/kasan.h:263 mm/slub.c:5334 mm/slub.c:6905)\nalloc_netdev_mqs (net/core/dev.c:12055 (discriminator 2))\nrtnl_create_link (net/core/rtnetlink.c:3721)\nrtnl_newlink (net/core/rtnetlink.c:3903 net/core/rtnetlink.c:4044 net/core/rtnetlink.c:4159)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\nFreed by task 536:\nkasan_save_stack (mm/kasan/common.c:57)\nkasan_save_track (mm/kasan/common.c:78)\nkasan_save_free_info (mm/kasan/generic.c:584)\n__kasan_slab_free (mm/kasan/common.c:253 mm/kasan/common.c:285)\nkfree (./include/linux/kasan.h:235 mm/slub.c:2677 mm/slub.c:6377 mm/slub.c:6692)\ndevice_release (drivers/base/core.c:2636)\nkobject_put (lib/kobject.c:689 lib/kobject.c:720 ./include/linux/kref.h:65 lib/kobject.c:737)\nnetdev_run_todo (net/core/dev.c:11756)\nrtnl_dellink (net/core/rtnetlink.c:157 ./include/linux/rtnetlink.h:135 net/core/rtnetlink.c:3651)\nrtnetlink_rcv_msg (net/core/rtnetlink.c:7076)\n[...]\n\nFix this by restoring skb-\u003edev to the master at the end of each slave\u0027s\niteration.\n\nFixes: 0cc0c2e661af (\"net/sched: teql: fix NULL pointer dereference in iptunnel_xmit on TEQL slave xmit\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260824115928.4099988-1-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b95dbcdd718f38fd27eb13e63d8bfe4bf6e26ab3",
      "tree": "a3055f3068c99a9e142314351cf3bbf94d83a36c",
      "parents": [
        "a687f2ae995fc366a6f2ef180451e6db4c6b4530",
        "3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:33:10 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:33:10 2026 +0200"
      },
      "message": "Merge branch \u0027sctp-handle-wrapped-and-duplicate-reconf-responses\u0027\n\nJun Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsctp: handle wrapped and duplicate RECONF responses\n\nFix response sequence zero lookup first, then make RECONF response\nhandling idempotent with an outstanding-request bitmask.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260824081832.98717-1-juny24602@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "3faf13aff243ca9f78d08b1a2956ef5a6fc77b6e",
      "tree": "a3055f3068c99a9e142314351cf3bbf94d83a36c",
      "parents": [
        "63f44178f0a0f86060c9b576d6efab8a3ffa403e"
      ],
      "author": {
        "name": "Jun Yang",
        "email": "junvyyang@tencent.com",
        "time": "Mon Aug 24 16:18:20 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:33:08 2026 +0200"
      },
      "message": "sctp: fix stream-\u003eoutcnt underflow on duplicate RECONF responses\n\nA cached RECONF chunk may contain more than one request parameter.  A\nduplicate response can therefore find and process the same ADD_OUT request\nagain while another parameter is still outstanding, rolling back outcnt\ntwice and possibly underflowing it.\n\nTrack outstanding request types as bits and clear each bit after its first\nresponse.  Later responses for the same request are then ignored.\n\nFixes: 11ae76e67a17 (\"sctp: implement receiver-side procedures for the Reconf Response Parameter\")\nCc: stable@kernel.org\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nLink: https://lore.kernel.org/netdev/20260730110225.37371-1-juny24602@gmail.com/\nSuggested-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAssisted-by: tencentos-corvus-ai:kimi-k3\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nLink: https://patch.msgid.link/20260824081832.98717-3-juny24602@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "63f44178f0a0f86060c9b576d6efab8a3ffa403e",
      "tree": "a01f6c6119fc3817c46b451353c6bee8a7305fa1",
      "parents": [
        "a687f2ae995fc366a6f2ef180451e6db4c6b4530"
      ],
      "author": {
        "name": "Jun Yang",
        "email": "junvyyang@tencent.com",
        "time": "Mon Aug 24 16:18:19 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:33:08 2026 +0200"
      },
      "message": "sctp: distinguish sequence zero from wildcard in reconf lookup\n\nZero is a valid response sequence after strreset_outseq wraps, but\nsctp_chunk_lookup_strreset_param() currently treats it as a wildcard.\n\nAdd match_seq so response lookups match zero exactly while the one\ntype-only lookup can still ignore the sequence.\n\nFixes: 50a41591f110 (\"sctp: implement receiver-side procedures for the Add Outgoing Streams Request Parameter\")\nCc: stable@kernel.org\nSuggested-by: Simon Horman \u003chorms@kernel.org\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nLink: https://patch.msgid.link/20260824081832.98717-2-juny24602@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "a687f2ae995fc366a6f2ef180451e6db4c6b4530",
      "tree": "3a70ded8205fefedaa84d46087cb2c9da3c697f4",
      "parents": [
        "728836ebca239810f164262b10211ef59182f811",
        "816e90057ab1879562a5b7cc688e35bb9027ae97"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:34 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:35 2026 +0200"
      },
      "message": "Merge branch \u0027net-sched-fix-quantum-mtu-overflow-in-fq-fq_codel-sch_codel-fq_pie-hhf-sfq\u0027\n\nJamal Hadi Salim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: sched: fix quantum/mtu overflow in fq, fq_codel, sch_codel, fq_pie, hhf, sfq\n\nSeveral qdiscs derive their per-flow quantum or CoDel mtu from\npsched_mtu() without an overflow or zero clamp, which can drive the\ndequeue/credit-refill loop into a soft lockup or silently disable the\nAQM. vega@nebusec.ai provided reports and PoCs for the following qdiscs:\nsch_fq, sch_fq_codel, sch_fq_pie, sch_hhf, and sch_sfq.\n\nsch_codel was found by inspection for the same pattern. It\u0027s TheLinuxWay\n(i.e cutnpaste code from somewhere for your new feature) and the AIs\nare having a lot of fun finding patterns. We must overcome!\n\nClamp the quantum (and, for the codel family, the cparams/params mtu)\nto a sane range at init/change time so the dequeue loops terminate and\nthe AQM stays armed. The clamps live in the init/change paths, not the\nper-packet fast path, so no hot-path cost is added for a configuration\nissue.\n\nThis series depends on \"net/sched: bound qdisc_pkt_len to prevent qdisc\nsoft lockup\", which caps qdisc_pkt_len() at GSO_MAX_SIZE in\n__qdisc_calculate_pkt_len(). That cap closes the fq_codel TCA_STAB\nbacklog-wrap vector (qdisc_pkt_len inflated to ~1 GiB wrapping the u32\nper-flow backlog to 0 and NULL-derefing in fq_codel_drop()); with it\nupstream this series no longer needs the fq_codel_drop() hardening hunk\nthat the earlier respin carried. The five quantum/mtu fixes here are\npsched_mtu()-driven and orthogonal to the qdisc_pkt_len() cap.\n\nQ: Why not bound the MTU at the source instead? dummy\u0027s max_mtu \u003d\u003d 0 is\nintentional (dev_validate_mtu() treats 0 as unbounded), other drivers\ncan legitimately advertise large MTUs, and qdiscs must not trust\npsched_mtu() regardless.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps 2 * psched_mtu() or psched_mtu() into the sign\nbit (e.g. a dummy device with max_mtu \u003d\u003d 0 accepting a huge MTU).\nRequires CAP_NET_ADMIN in a user namespace.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260822195509.112717-1-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "816e90057ab1879562a5b7cc688e35bb9027ae97",
      "tree": "3a70ded8205fefedaa84d46087cb2c9da3c697f4",
      "parents": [
        "2164b512b97bb053e8ce4d6e95576f11bed6a005"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:09 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: sfq: clamp quantum to avoid signed overflow soft lockup\n\nsfq_init() sets q-\u003equantum \u003d psched_mtu(qdisc_dev(sch)) (unsigned). A\ndevice with a huge MTU (e.g. dummy with max_mtu \u003d\u003d 0 accepting MTU\n2147483634) makes psched_mtu() return 0x80000000, so slot-\u003eallot \u003d INT_MIN\nand INT_MIN + INT_MIN toggles between INT_MIN and 0 forever, spinning\nsfq_dequeue() under the qdisc lock.\n\nClamp the quantum to [256, 1 \u003c\u003c 20] so the refill loop terminates. The\nlower bound also covers q-\u003equantum \u003d\u003d 0 (psched_mtu() returning 0),\nwhich spins sfq_dequeue() identically. sfq_change() already rejects a\nnegative quantum, so only the init path was exposed.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy\ndevice with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-7-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2164b512b97bb053e8ce4d6e95576f11bed6a005",
      "tree": "c4a8ab9ef6754dd0b551a1cd7c603f1ec7a9a4b0",
      "parents": [
        "c86cd7ed0b0e44779a3d1683f03e4353baf4bdc9"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:08 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: hhf: clamp quantum before hhf_change() to avoid overflow\n\nhhf_init() sets q-\u003equantum \u003d psched_mtu(qdisc_dev(sch)) with no overflow\ncheck. A device with a huge MTU (e.g. dummy with max_mtu \u003d\u003d 0 accepting\nMTU 2147483634) makes weight * quantum overflow the signed deficit in\nhhf_dequeue(), spinning forever.\n\nClamp q-\u003equantum before hhf_change() so both the opt and !opt paths see\na sane quantum. Without this, bare \"tc qdisc add ... hhf\" succeeds with\na clamped quantum but \"tc qdisc add ... hhf limit 1000\" (any option\npresent) fails with -EINVAL because hhf_change() re-validates the\nunclamped default (sch_hhf.c:559). 256 matches fq_codel\u0027s floor and is\na sane minimum for a DRR quantum.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy\ndevice with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: 10239edf86f1 (\"net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-6-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c86cd7ed0b0e44779a3d1683f03e4353baf4bdc9",
      "tree": "bb56074adcd9080d3d4d8e28a68cdf34d971f41b",
      "parents": [
        "6439461f1618ae176c048673ad28bdb6c68efbfc"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:07 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: fq_pie: clamp default quantum to avoid signed overflow\n\nfq_pie_init() sets q-\u003equantum \u003d psched_mtu(qdisc_dev(sch)) without\nclamping. A device with a huge MTU (e.g. dummy with max_mtu \u003d\u003d 0\naccepting MTU 2147483634) makes psched_mtu() return 0x80000000, which\noverflows the signed flow-\u003edeficit to INT_MIN in fq_pie_qdisc_dequeue(),\ncausing an infinite loop and soft lockup. Emulate fq_pie_policy which\nis already bounded to [1, 1 \u003c\u003c 20]; clamp the default to [256, 1 \u003c\u003c 20].\n256 matches fq_codel\u0027s floor and is a sane minimum for a DRR quantum.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy\ndevice with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: ec97ecf1ebe4 (\"net: sched: add Flow Queue PIE packet scheduler\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-5-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "6439461f1618ae176c048673ad28bdb6c68efbfc",
      "tree": "8a0094ef290fc221ecb63ca032a62d93b5c948fa",
      "parents": [
        "d9ebd8f9aa8b2773235889cb903fafd61f2d8585"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:06 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: sch_codel: clamp default mtu to avoid disabling CoDel\n\ncodel_init() sets q-\u003eparams.mtu \u003d psched_mtu(qdisc_dev(sch)) without\nclamping. A device with a huge MTU (e.g. dummy with max_mtu \u003d\u003d 0\naccepting MTU 2147483634) makes psched_mtu() return 0x80000000. In\ncodel_should_drop() the test \"*backlog \u003c\u003d params-\u003emtu\" then compares\nthe backlog against ~2 GiB; with the default sch-\u003elimit of\nDEFAULT_CODEL_LIMIT (1000) packets the backlog can never reach it, so\nthe test is always true and CoDel is silently and completely disabled\ni.e no drops, no ECN marking, codel degrades to a tail-drop FIFO.\ncodel_change() never updates params.mtu, so the init path is the only\nplace to clamp it. Constrain to [256, 1 \u003c\u003c 20], matching the fq_codel\nbound; 256 is a sane floor that only makes CoDel slightly more willing\nto act on very small queues, which is the safe direction.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy\ndevice with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: 76e3cc126bb2 (\"codel: Controlled Delay AQM\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-4-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "d9ebd8f9aa8b2773235889cb903fafd61f2d8585",
      "tree": "f2bca57f686de1ec4dbf02e941b275f99c4ac766",
      "parents": [
        "709f34f7c28dc4dd6c40343d101850f11e172312"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:05 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: fq_codel: clamp default quantum and mtu\n\nfq_codel_init() sets q-\u003equantum \u003d psched_mtu(qdisc_dev(sch)) without\nclamping. A device with a huge MTU (e.g. dummy with max_mtu \u003d\u003d 0\naccepting MTU 2147483634) makes psched_mtu() return 0x80000000, which\noverflows the signed flow-\u003edeficit to INT_MIN in fq_codel_dequeue(),\ncausing an infinite loop and soft lockup. Emulate fq_codel_change()\nand constrain to [256, FQ_CODEL_QUANTUM_MAX].\n\nThe same unclamped psched_mtu() is assigned to q-\u003ecparams.mtu a bit\nbelow, and fq_codel_change() never updates it. codel_should_drop()\ntests \"*backlog \u003c\u003d params-\u003emtu\"; with mtu \u003d\u003d 0x80000000 (~2 GiB) and\nthe default 32 MiB memory_limit, the test is always true, so CoDel is\nsilently and completely disabled (no drops, no ECN). Declare a single\nclamped mtu and assign both q-\u003equantum and q-\u003ecparams.mtu from it,\nwhich also removes the double psched_mtu() call.\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) wraps psched_mtu() into the sign bit (e.g. a dummy\ndevice with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: 4b549a2ef4be (\"fq_codel: Fair Queue Codel AQM\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-3-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "709f34f7c28dc4dd6c40343d101850f11e172312",
      "tree": "cbc34446b875b8662f26328c40590a83b872af55",
      "parents": [
        "728836ebca239810f164262b10211ef59182f811"
      ],
      "author": {
        "name": "Jamal Hadi Salim",
        "email": "jhs@mojatatu.com",
        "time": "Sat Aug 22 15:55:04 2026 -0400"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 13:09:32 2026 +0200"
      },
      "message": "net/sched: fq: add overflow bounds to quantum and initial quantum\n\nfq_init() computes quantum \u003d 2 * psched_mtu() and initial_quantum \u003d 10 *\npsched_mtu() with no overflow check. A device with a huge MTU (e.g. dummy\nwith max_mtu \u003d\u003d 0 accepting MTU 2147483634) makes psched_mtu() return\n0x80000000; the 2 * and 10 * multiplications wrap to 0 in 32-bit\narithmetic, so q-\u003equantum \u003d\u003d 0. Then in fq_dequeue() the credit-refill\nloop adds 0 to f-\u003ecredit (which stays \u003c\u003d 0) and goto begin loops\nforever under the qdisc lock, creating a soft lockup.\n\nClamp psched_mtu() to [1, 1 \u003c\u003c 20] before multiplying so the product\ncannot wrap, then cap the result at 1 \u003c\u003c 20, matching the bound already\nenforced on TCA_FQ_QUANTUM in fq_change().\n\nConditions to recreate the bug: a device whose MTU (plus\nhard_header_len) is large enough that 2 * psched_mtu() wraps (e.g. a\ndummy device with max_mtu \u003d\u003d 0 accepting MTU 2147483634). Requires\nCAP_NET_ADMIN in a user namespace.\n\nFixes: afe4fd062416 (\"pkt_sched: fq: Fair Queue packet scheduler\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260822195509.112717-2-jhs@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "728836ebca239810f164262b10211ef59182f811",
      "tree": "c9e059452d7fa8d3e72fdedf993830e600f42e9f",
      "parents": [
        "3220b62fbb8a55feebd2a826d5ead0f49f09ed5a"
      ],
      "author": {
        "name": "Chengfeng Ye",
        "email": "nicoyip.dev@gmail.com",
        "time": "Sun Aug 23 00:45:56 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 12:35:51 2026 +0200"
      },
      "message": "vsock/virtio: flush works in dependency order\n\nvirtio_vsock_remove() stops the virtqueues and then flushes each work\nitem before freeing the enclosing virtio_vsock.  The current order does\nnot account for dependencies between those items: tx_work may queue\nsend_pkt_work, and send_pkt_work may queue rx_work.\n\nIn particular, send_pkt_work can set restart_rx and release tx_lock.\nThe remove path can then stop the queues and flush rx_work before\nsend_pkt_work queues it.  Although the later send_pkt_work flush waits\nfor that producer to finish, nothing waits for the newly queued rx_work,\nso kfree(vsock) can race with it.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in\n  virtio_transport_rx_work+0x487/0x4b0\n  Read of size 8 at addr ffff888114c2b008 by task kworker/1:1/47\n  Workqueue: virtio_vsock virtio_transport_rx_work\n  Call Trace:\n   virtio_transport_rx_work+0x487/0x4b0\n   process_one_work+0x688/0x1120\n   worker_thread+0x45b/0xd10\n  Allocated by task 1:\n   virtio_vsock_probe+0xef/0x6b0\n  Freed by task 84:\n   kfree+0x131/0x3c0\n   virtio_vsock_remove+0xd1/0x100\n\nFlush the works in producer-to-consumer order.  virtio_vsock_vqs_del()\nhas already disabled the queue callbacks and cleared the run flags, so\nafter tx_work and send_pkt_work are drained, no source remains that can\nqueue rx_work after its flush.\n\nFixes: 0ea9e1d3a9e3 (\"VSOCK: Introduce virtio_transport.ko\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260822164556.3750959-1-nicoyip.dev@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "3220b62fbb8a55feebd2a826d5ead0f49f09ed5a",
      "tree": "5e53516d721e0bf7314e4a8dba77199e69c0e3cb",
      "parents": [
        "97148bcb751105cd7cf86a21344887028f329890"
      ],
      "author": {
        "name": "Tetsuo Handa",
        "email": "penguin-kernel@I-love.SAKURA.ne.jp",
        "time": "Sat Aug 22 17:18:31 2026 +0900"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 12:30:55 2026 +0200"
      },
      "message": "net: fix a resource leak in copy_net_ns() error handling path\n\nCurrently, preinit_net() does two things:\n\n  (1) call ns_common_init() which might fail\n  (2) initialize resources which does not fail\n\nHowever, preinit_net() is returning early when (1) fails, and copy_net_ns()\nis jumping to the dec_ucounts: label. As a result, resources allocated by\nnet_alloc() are leaking. We need to call key_remove_domain() and\nnet_passive_dec() in order to release resources allocated by net_alloc().\n\nWe cannot simply jump to the put_userns: label when preinit_net() failed,\nfor (2) is not yet done. But we can reorder (1) and (2), for there is no\ndependency between (1) and (2). Therefore, this patch decouples (1) from\npreinit_net() and changes preinit_net() back to a void function, and calls\nns_common_init() after preinit_net() succeeded. Then, we can jump to\nimmediately after ns_common_free() of the put_userns: label.\n\nReported-by: sashiko (no mail address)\nCloses: https://sashiko.dev/#/patchset/af7dabf3-d0d7-46dc-a878-e1715b3c9ac6%40I-love.SAKURA.ne.jp\nFixes: 08027f6b790b (\"net: use ns_common_init()\")\nSigned-off-by: Tetsuo Handa \u003cpenguin-kernel@I-love.SAKURA.ne.jp\u003e\nLink: https://patch.msgid.link/c182cf90-1ed7-435b-88f7-9f00e88a0487@I-love.SAKURA.ne.jp\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "97148bcb751105cd7cf86a21344887028f329890",
      "tree": "5c9cd3413cbbd86d11e602d274a14cd992df7a13",
      "parents": [
        "00e11ee9831b3439264e0ae6762a0470126515af"
      ],
      "author": {
        "name": "Mina Almasry",
        "email": "almasrymina@google.com",
        "time": "Sun Aug 23 18:36:02 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 11:28:44 2026 +0200"
      },
      "message": "net: core: fix head-page leak in skb_zerocopy\n\nWhen skb_orphan_frags() throws -ENOMEM, skb_copy_ubufs() may have\nalready reallocated and replaced \u0027from-\u003ehead\u0027. Accessing from-\u003ehead to\ndrop the old refcount leaks the original head page, and erroneously\nputs an unrelated new buffer. Use the local \u0027page\u0027 tracker variable\ninstead to drop the reference properly.\n\nFixes: 36d5fe6a0007 (\"core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors\")\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20260823183602.1051453-2-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "00e11ee9831b3439264e0ae6762a0470126515af",
      "tree": "3e57e08e5d4d8d92d800f1c13983c74a75d6d88e",
      "parents": [
        "2db9bfa3e27bdea15e05ea70b56bad3d21e570ec"
      ],
      "author": {
        "name": "Mina Almasry",
        "email": "almasrymina@google.com",
        "time": "Sun Aug 23 18:36:01 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 11:28:40 2026 +0200"
      },
      "message": "net: core: check skb_frags_readable before uncloning in skb_copy_ubufs\n\nskb_copy_ubufs drops clones and modifies the SKB via pskb_expand_head()\nbefore checking for !skb_frags_readable(skb). This alters the SKB\ngeometry prior to throwing an -EFAULT on an invalid SKB. Check\nreadability first.\n\nFixes: 65249feb6b3d (\"net: add support for skbs with unreadable frags\")\nSigned-off-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/20260823183602.1051453-1-almasrymina@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "2db9bfa3e27bdea15e05ea70b56bad3d21e570ec",
      "tree": "0244c4b9e23ccd16e4763b1f49c2897b89584c30",
      "parents": [
        "81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Mon Aug 24 01:28:58 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 11:06:46 2026 +0200"
      },
      "message": "sctp: fix NULL deref on untransmitted RECONF completion\n\nsctp_process_strreset_outreq(), sctp_process_strreset_addstrm_out() and\nsctp_process_strreset_resp() complete a pending stream reconfiguration\nrequest by stopping the reconf timer on the transport it was sent on:\n\n\tt \u003d asoc-\u003estrreset_chunk-\u003etransport;\n\tif (timer_delete(\u0026t-\u003ereconf_timer))\n\t\tsctp_transport_put(t);\n\nchunk-\u003etransport is assigned by __sctp_packet_append_chunk() when the\nchunk is appended to an outbound packet, and sctp_outq_flush_ctrl() arms\nthe reconf timer at that same point. A request already published in\nasoc-\u003estrreset_chunk but not yet transmitted has neither, so completing\nit dereferences NULL.\n\nTwo ways to get there. sctp_send_asconf_del_ip() sets\nasoc-\u003esrc_out_of_asoc_ok without sending anything when the address being\nremoved is the association\u0027s last one, and sctp_outq_flush_ctrl() then\nleaves every non-ASCONF control chunk queued; as only\nsctp_process_asconf_ack() clears that flag, it persists. An unprivileged\nprocess that removes such an address and then asks for a stream reset\npanics the kernel from softirq. A peer needs neither ASCONF nor local\nhelp: sctp_cmd_interpreter() uncorks the outqueue only once the whole\npacket has been processed, so a reply built while walking a RECONF chunk\nstays untransmitted for the rest of that walk, and one RECONF chunk\ncarrying [Incoming SSN Reset Request, Outgoing SSN Reset Request,\nResponse] -- or two RECONF chunks in one packet -- reaches the same\ndereference.\n\n  KASAN: null-ptr-deref in range [0x00000000000001e8-0x00000000000001ef]\n  RIP: 0010:timer_delete+0x67/0x110\n  Call Trace:\n   \u003cIRQ\u003e\n   sctp_process_strreset_addstrm_out (net/sctp/stream.c:832)\n   sctp_sf_do_reconf (net/sctp/sm_statefuns.c:4212)\n   sctp_do_sm (net/sctp/sm_sideeffect.c:1172)\n   sctp_assoc_bh_rcv (net/sctp/associola.c:1044)\n   sctp_rcv (net/sctp/input.c:243)\n   ip_local_deliver (net/ipv4/ip_input.c:262)\n   process_backlog (net/core/dev.c:6680)\n   \u003c/IRQ\u003e\n\nA response can only acknowledge a request that was actually sent, so do\nnot match asoc-\u003estrreset_chunk while chunk-\u003etransport is NULL. Guarding\nthe lookup covers all three completion sites.\n\nFixes: 810544764536 (\"sctp: implement receiver-side procedures for the Outgoing SSN Reset Request Parameter\")\nCc: stable@vger.kernel.org\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSuggested-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/20260823172857.896146-2-bestswngs@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "81d0d1e64f30d9989c829c0953cd6e6c68d9c5fb",
      "tree": "caeda71c4951933f91bdecb081bb6a1196627bf9",
      "parents": [
        "b17cf742eaad70ae29ac558cefb3aa9bbeea03d4"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Sun Aug 23 18:22:41 2026 +0000"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 11:04:12 2026 +0200"
      },
      "message": "net/sched: act_skbmod: fix length calculations and avoid invalid header warnings\n\nsyzbot reported a warning in skb_network_header_len() triggered\nby tcf_skbmod_act():\n\n  !skb_transport_header_was_set(skb)\n  WARNING: CPU: 0 PID: 14949 at include/linux/skbuff.h:3243 skb_network_header_len include/linux/skbuff.h:3243 [inline]\n  WARNING: CPU: 0 PID: 14949 at net/sched/act_skbmod.c:55 tcf_skbmod_act+0xfe8/0x1810 net/sched/act_skbmod.c:55\n\nThere are a few issues in tcf_skbmod_act():\n\n1. Calling skb_network_header_len() assumes skb-\u003etransport_header is set,\n   which is not guaranteed when tcf_skbmod_act() runs at TC ingress.\n2. Unconditionally calling skb_mac_header_len() at the beginning of\n   tcf_skbmod_act() triggers a warning on L3 devices (e.g. TUN) where the\n   MAC header is unset, evaluating to an underflowed garbage length.\n3. On TC ingress, skb-\u003edata points to the network header. Adding the MAC\n   header length to the IP header length causes skb_ensure_writable() to\n   request more bytes than the actual IP packet length, dropping valid\n   short packets (e.g. 28-byte UDP/IPv4 packets).\n\nFix these by:\n- Using skb_network_offset(skb) + sizeof(struct iphdr/ipv6hdr) for\n  SKBMOD_F_ECN so that the required length is correctly calculated on\n  both ingress (offset \u003d\u003d 0) and egress (offset \u003d\u003d mac_len).\n- Setting max_edit_len to ETH_HLEN for Ethernet header modifications\n  after validating ARPHRD_ETHER.\n\nFixes: 56af5e749f20 (\"net/sched: act_skbmod: Add SKBMOD_F_ECN option support\")\nReported-by: syzbot+1d56f14f95c0480cfdc9@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6a8b39c0.dbb3a75c.13dd47.0051.GAE@google.com/T/#u\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260823182241.1958695-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b17cf742eaad70ae29ac558cefb3aa9bbeea03d4",
      "tree": "23ccc1296884d71b34d3eac31f9ca9287ba104b4",
      "parents": [
        "c5f2613e69ccdf04aeb0848a704ecf4f481961da"
      ],
      "author": {
        "name": "Jiayuan Chen",
        "email": "jiayuan.chen@linux.dev",
        "time": "Sun Aug 23 16:47:56 2026 +0800"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 10:04:02 2026 +0200"
      },
      "message": "tls: device: fix out-of-bounds write in tls_append_frag()\n\nFound with syzkaller and a local syzbot instance running on top of a\nnetdevsim TLS offload emulation; tls_device.c is otherwise only reachable\non a machine with a NIC that implements the offload.\n\ntls_push_data() only checks whether the open record still has room for\nanother frag at the bottom of its loop, and the MSG_MORE early break\nskips that check.  The record survives to the next syscall with the frag\ncount it already had, and tls_append_frag() does not check either, so\nwith TLS_TX_ZEROCOPY_RO every splice(SPLICE_F_MORE) of a byte or two adds\na non-coalescing pipe page and num_frags walks off the end of\ntls_record_info.frags[MAX_SKB_FRAGS].  Once the record is pushed,\ntls_push_record() runs the same index over sg_tx_data[MAX_SKB_FRAGS] and\nthe sg_set_page() writes land on the destruct_work that follows it, which\nthe workqueue then calls.\n\nThe byte limit is fine because copy drops to 0 and the loop falls through\nto the same check; the frag count has no such feedback.\n\nPush the record rather than keep a full one open, which is what a plain\nTCP socket does - tcp_sendmsg_locked() uses tcp_mark_push() and\nnew_segment in both the copy and the MSG_SPLICE_PAGES paths, and tls_sw\nalready sets full_record when the sk_msg ring fills up, MSG_MORE or not.\n\n  BUG: KASAN: slab-out-of-bounds in tls_append_frag ( net/tls/tls_device.c:269)\n  Write of size 8 at addr ffff8881104d1530 by task tls_oob/450\n\n  CPU: 2 UID: 0 PID: 450 Comm: tls_oob Not tainted 7.2.0-rc7+ #329 PREEMPT\n  Call Trace:\n   \u003cTASK\u003e\n   dump_stack_lvl (lib/dump_stack.c:94 lib/dump_stack.c:120)\n   print_report (mm/kasan/report.c:378 mm/kasan/report.c:482)\n   kasan_report (mm/kasan/report.c:595)\n   tls_append_frag (net/tls/tls_device.c:269)\n   tls_push_data (net/tls/tls_device.c:518)\n   tls_device_sendmsg (net/tls/tls_device.c:583)\n   inet_sendmsg (net/ipv4/af_inet.c:865)\n   sock_sendmsg (net/socket.c:775 net/socket.c:790 net/socket.c:813)\n   splice_to_socket (fs/splice.c:884)\n   do_splice (fs/splice.c:936 fs/splice.c:1349)\n   __do_splice (fs/splice.c:1431)\n   __x64_sys_splice (fs/splice.c:1634 fs/splice.c:1616)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:63 arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n   \u003c/TASK\u003e\n\nand, once the record is pushed:\n\n  UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:300:24\n  index 18 is out of range for type \u0027skb_frag_t [17]\u0027\n  UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:301:41\n  index 18 is out of range for type \u0027scatterlist [17]\u0027\n  UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:302:39\n  index 18 is out of range for type \u0027scatterlist [17]\u0027\n  UBSAN: array-index-out-of-bounds in net/tls/tls_device.c:307:38\n  index 26 is out of range for type \u0027scatterlist [17]\u0027\n\n  kernel tried to execute NX-protected page - exploit attempt? (uid: 0)\n  BUG: unable to handle page fault for address: ffffea000411a680\n  #PF: supervisor instruction fetch in kernel mode\n  #PF: error_code(0x0011) - permissions violation\n  Oops: Oops: 0011 [#1] SMP KASAN PTI\n  Workqueue: ktls_device_destruct 0xffffea000411a680\n  RIP: 0010:0xffffea000411a680\n  Call Trace:\n   \u003cTASK\u003e\n   worker_thread (kernel/workqueue.c:3405 kernel/workqueue.c:3486)\n   kthread (kernel/kthread.c:436)\n   ret_from_fork (arch/x86/kernel/process.c:158)\n   ret_from_fork_asm (arch/x86/entry/entry_64.S:245)\n   \u003c/TASK\u003e\n\nFixes: e8f69799810c (\"net/tls: Add generic NIC offload infrastructure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nLink: https://patch.msgid.link/20260823084758.20936-1-jiayuan.chen@linux.dev\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "c5f2613e69ccdf04aeb0848a704ecf4f481961da",
      "tree": "94b502dd3b5e9f9b0f6245449062da1ee8776964",
      "parents": [
        "b70b7b71561f2be1183b6046964d950c2b203bfc",
        "f66bdb1cc0fcd227a062378f8be0b5873aa5600a"
      ],
      "author": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 09:36:49 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 09:36:49 2026 +0200"
      },
      "message": "Merge branch \u0027net-don-t-strip-zerocopy-frag-markers-from-a-forwarded-skb\u0027\n\nNorbert Szetei says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: don\u0027t strip zerocopy frag markers from a forwarded skb\n\nqueue_userspace_packet() calls skb_tx_error() on the packet skb in its\nerror path, but it only borrows that skb: on the OVS_ACTION_ATTR_USERSPACE\naction path do_execute_actions() ignores output_userspace()\u0027s return value\nand keeps forwarding the same skb through the flow\u0027s remaining actions.\nskb_tx_error() completes the zerocopy uarg and clears SKBFL_ALL_ZEROCOPY,\nand with it SKBFL_SHARED_FRAG.\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() instead of taking the in-place AEAD\npath. Once it is stripped, a later local ESP delivery decrypts in place\nover pages the sender still shares with the page cache.\n\nPatch 1 moves the skb_tx_error() into the one path that does drop the\npacket, the \"default\" arm of ovs_dp_process_packet()\u0027s switch(error).\n\nPatch 2 removes a second such strip, in skb_zerocopy(), which calls\nskb_tx_error() on its source when skb_orphan_frags() fails. A copy helper\nshould not perform a destructive action on its source, and both callers\nalready report the error on their own drop path. MSG_ZEROCOPY skbs cannot\nreach that one -- SKBFL_DONT_ORPHAN makes skb_orphan_frags() return early\n-- but producers that do not set that flag, such as vhost-net, can.\nPatch 3 is new in v2. It stops skb_tx_error() from touching skb_shinfo()\nstate that is shared with clones, so patch 1\u0027s new call site cannot reach\na live skb either. For a non-last OVS_ACTION_ATTR_RECIRC action\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone() does\nnot privatise the frags for these skbs -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN -- so a flow miss on the clone strips\nSKBFL_SHARED_FRAG from the packet still in flight. Confirmed on a KASAN\nbuild with a flow matching recirc_id 0 and actions RECIRC(1),OUTPUT(0):\nwith patches 1 and 2 applied it still reproduces the page-cache write,\nwith patch 3 on top it no longer does (5/5 runs). A kprobe on\nskb_tx_error() shows the datapath drop path is still reached in both\ncases, so the difference is the guard and not the reproducer.\n\nAs Ilya noted, that makes patch 3 the general fix -- an skb can enter any\nskb_tx_error() caller already cloned elsewhere in the stack -- while\npatches 1 and 2 keep the callers from acting on an skb they do not own.\nRemoving skb_tx_error() altogether looks like the right long-term cleanup\nand is planned as a net-next follow-up.\n\nv3: https://lore.kernel.org/netdev/F3B9E5BA-0AC1-4AD1-A7D9-F38033304270@doyensec.com/\nv2: https://lore.kernel.org/netdev/AD1B7BEE-C04C-4A1B-982C-8385F1908911@doyensec.com/\nv1: https://lore.kernel.org/netdev/8063260C-05C9-4997-B9B6-2135063C4858@doyensec.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/4B5CCA6E-2C49-4F86-8C4E-E1BE15C16C0A@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "f66bdb1cc0fcd227a062378f8be0b5873aa5600a",
      "tree": "94b502dd3b5e9f9b0f6245449062da1ee8776964",
      "parents": [
        "8ece906150128d5ec2462aabcc978c568433eca4"
      ],
      "author": {
        "name": "Norbert Szetei",
        "email": "norbert@doyensec.com",
        "time": "Sat Aug 22 11:15:08 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 09:36:47 2026 +0200"
      },
      "message": "net: skbuff: don\u0027t touch shared zerocopy state in skb_tx_error()\n\nskb_tx_error() completes the zerocopy uarg and clears\nSKBFL_ALL_ZEROCOPY, and skb_zcopy_downgrade_managed() clears\nSKBFL_MANAGED_FRAG_REFS. Both live in skb_shinfo(), which every clone\nshares, while the caller only owns the reference it is about to drop.\nThrough a clone it tells the producer its pages are free and drops\nSKBFL_SHARED_FRAG for an skb that is still in flight.\n\nOpen vSwitch reaches this with a non-last OVS_ACTION_ATTR_RECIRC:\nclone_execute() sends a skb_clone() into ovs_dp_process_packet() while\ndo_execute_actions() keeps forwarding the original, and skb_clone()\ndoes not privatise the frags here -- skb_orphan_frags() returns early\non SKBFL_DONT_ORPHAN. A flow miss on the clone then strips the marker\nfrom the packet still being forwarded, and a later local ESP delivery\ndecrypts in place over frags it does not own privately.\n\nSkip it for a cloned skb. Nothing is lost: skb_release_data() clears\nthe zerocopy state once the last reference to the shared data goes.\n\nFixes: 25121173f7b1 (\"skb: api to report errors for zero copy skbs\")\nCc: stable@vger.kernel.org\nSuggested-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nTested-by: Jongmin Jang \u003cpayload.jang@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/CFAB292A-674B-4C14-BB2C-BB8830AD5659@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "8ece906150128d5ec2462aabcc978c568433eca4",
      "tree": "cc0b1822b1da37d338e5b164c60db87325801b12",
      "parents": [
        "0dbc2398fca3bb33eda963849f865ddb1b3aa05e"
      ],
      "author": {
        "name": "Norbert Szetei",
        "email": "norbert@doyensec.com",
        "time": "Sat Aug 22 11:13:47 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 09:36:47 2026 +0200"
      },
      "message": "net: skbuff: don\u0027t skb_tx_error() the source skb in skb_zerocopy()\n\nskb_zerocopy() copies frags from @from into @to. On an\nskb_orphan_frags() failure it calls skb_tx_error(@from), a destructive\noperation on the source skb the copy helper does not own. That completes\n@from\u0027s zerocopy uarg and clears SKBFL_ALL_ZEROCOPY, including the\nSKBFL_SHARED_FRAG page-ownership marker.\n\nBoth callers already report the failure on their own drop path.\nnfnetlink_queue does it at nla_put_failure, and Open vSwitch does it in\nthe flow-miss drop arm of ovs_dp_process_packet(), so nothing is lost by\ndropping it here.\n\nOn Open vSwitch\u0027s OVS_ACTION_ATTR_USERSPACE path the skb is not freed on\nthis error: do_execute_actions() ignores output_userspace()\u0027s return\nvalue and, unless the upcall was the last action, keeps forwarding the\nsame skb through the flow\u0027s remaining actions. The uarg is completed\nwhile that skb is still in flight, telling the producer its buffers are\nfree, and SKBFL_SHARED_FRAG is cleared on an skb the rest of the stack\nstill handles. That flag is what makes esp_input() call skb_cow_data()\ninstead of decrypting in place, so a later local ESP delivery can\ndecrypt over frags the skb does not own privately.\n\nLeave error reporting to the callers.\n\nFixes: 36d5fe6a0007 (\"core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors\")\nCc: stable@vger.kernel.org\nSuggested-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/6E3A780D-FB87-421F-9964-B1D457D7D106@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "0dbc2398fca3bb33eda963849f865ddb1b3aa05e",
      "tree": "18c0ec9b013182713841ec9678bd2c9910f22028",
      "parents": [
        "b70b7b71561f2be1183b6046964d950c2b203bfc"
      ],
      "author": {
        "name": "Norbert Szetei",
        "email": "norbert@doyensec.com",
        "time": "Sat Aug 22 11:12:11 2026 +0200"
      },
      "committer": {
        "name": "Paolo Abeni",
        "email": "pabeni@redhat.com",
        "time": "Tue Aug 25 09:36:47 2026 +0200"
      },
      "message": "openvswitch: only skb_tx_error() a packet we are about to drop\n\nqueue_userspace_packet() borrows the packet skb -- it only copies it into\na private netlink message (user_skb) and does not own it; on return\ndo_execute_actions() keeps forwarding it through the flow\u0027s remaining\nactions. Its error path nevertheless calls skb_tx_error(skb), which via\nskb_zcopy_clear() does skb_shinfo(skb)-\u003eflags \u0026\u003d ~SKBFL_ALL_ZEROCOPY,\nstripping SKBFL_SHARED_FRAG from that live skb (skb_tx_error()\u0027s kerneldoc\nsays \"skb must be freed afterwards\").\n\nFor a MSG_ZEROCOPY skb carrying page-cache frags, SKBFL_SHARED_FRAG is\nwhat makes esp_input() skb_cow_data() before in-place AEAD; once it is\nstripped a later local ESP-in-UDP delivery decrypts in place over pages\nthe sender does not own -- an unprivileged page-cache write (the\n\"Fragnesia\" primitive).\ndo_execute_actions() ignores output_userspace()\u0027s return value, so any\naction after a failed USERSPACE upcall inherits the stripped skb.\n\nMove the skb_tx_error() to the flow-miss drop path - the \"default\"\nbranch of ovs_dp_process_packet()\u0027s switch(error), before kfree_skb().\n\nThe call has been here since commit 36d5fe6a0007 (\"core, nfqueue,\nopenvswitch: Orphan frags in skb_zerocopy and handle errors\") but was\nharmless until esp_input() began relying on SKBFL_SHARED_FRAG to gate\nin-place decrypt; only then did stripping it on a still-forwarded skb\nbecome a page-cache write primitive.\n\nFixes: 36d5fe6a0007 (\"core, nfqueue, openvswitch: Orphan frags in skb_zerocopy and handle errors\")\nFixes: f4c50a4034e6 (\"xfrm: esp: avoid in-place decrypt on shared skb frags\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nTested-by: Jongmin Jang \u003cpayload.jang@gmail.com\u003e\nLink: https://patch.msgid.link/55A52703-7548-4A55-A9CE-2A37145BDCAD@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n"
    },
    {
      "commit": "b70b7b71561f2be1183b6046964d950c2b203bfc",
      "tree": "ff0aa5b55c8ed0b9c3e8ed639e0af6496e824020",
      "parents": [
        "3b11a77f69980932c3924054d66e565c9a135747",
        "ebe6674292fda9a58e6f3adffd6d277560857169"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 13:02:35 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 13:02:35 2026 -0700"
      },
      "message": "Merge tag \u0027for-net-2026-08-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\nCore:\n\n - hci_core: use skb_get() instead of skb_clone() for req_skb\n - hci_conn: re-enable advertising only for peripheral role\n - hci_event: clear HCI_LE_ADV only on a created connection\n - hci_sync: Clear HCI_CMD_PENDING when dropping the last request\n - hci_sync: add conditional locking annotations\n - hci_sync: do not leak an hci_conn when a second LE connect is rejected\n - eir: Fix OOB read in eir_get_service_data()\n - mgmt: fix \u0027hdev-\u003ediscovery.uuids\u0027 NULL dereference\n - L2CAP: access chan-\u003econn safely in get/setsockopt\n - L2CAP: reject accept queue add unless BT_LISTEN\n - L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n - RFCOMM: serialize security confirmation handling\n - RFCOMM: serialize session teardown\n - RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n - ISO: fix use-after-free of listener socket in iso_conn_ready\n\nDrivers:\n\n - btnxpuart: Validate the FW dump header length\n - btnxpuart: Check remote M.2 connector availability before pwrseq\n - btmtksdio: Take exclusive ownership of the SKB before TX\n - btmtksdio: Fix out-of-bounds DMA read in the TX path\n - hci_uart: Fix false success return in hci_uart_setup()\n - hci_bcm: fix usage_count leak when autosuspend_delay is negative\n - hci_h5: fix usage_count leak when autosuspend_delay is negative\n - hci_intel: fix usage_count leak when autosuspend_delay is negative\n - btmtk: Do not report success when subsys reset fails\n - btmtk: Do not discard the subsystem reset timeout\n - btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728\n - hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378\n\n* tag \u0027for-net-2026-08-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth: (27 commits)\n  Bluetooth: RFCOMM: serialize session teardown\n  Bluetooth: do not leak an hci_conn when a second LE connect is rejected\n  Bluetooth: RFCOMM: serialize security confirmation handling\n  Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728\n  Bluetooth: hci_uart: Fix false success return in hci_uart_setup()\n  Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n  Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n  Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb\n  Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection\n  Bluetooth: hci_conn: re-enable advertising only for peripheral role\n  Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378\n  Bluetooth: eir: Fix OOB read in eir_get_service_data()\n  Bluetooth: btnxpuart: Validate the FW dump header length\n  Bluetooth: hci_sync: add conditional locking annotations\n  Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq\n  Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path\n  Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX\n  Bluetooth: btmtk: Do not discard the subsystem reset timeout\n  Bluetooth: btmtk: Do not report success when subsys reset fails\n  Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n  ...\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260824180639.3570348-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "3b11a77f69980932c3924054d66e565c9a135747",
      "tree": "cbcbe1e278a3e64e3f984b7f515793f3db517c62",
      "parents": [
        "b09a0503c755b6609fad59a84cc7f05b6843a03c"
      ],
      "author": {
        "name": "Sai Krishna",
        "email": "saikrishnag@marvell.com",
        "time": "Fri Aug 21 15:53:37 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 12:07:13 2026 -0700"
      },
      "message": "octeontx2-af: fix cn20k mailbox lifetime on repeated rvu_mbox_init()\n\nrvu_mbox_init() is called separately for AF-PF mailboxes during probe\nand for AF-VF mailboxes when SR-IOV is enabled.  Each call used to\nallocate a new ng_rvu object, leaking the first allocation when the\npointer was overwritten on the second call.\n\nSharing one ng_rvu across both paths exposed several teardown bugs:\nthe error path freed all cn20k mailbox DMA and kfree()d ng_rvu even\nwhen only the failing init type should be unwound, leaving live AF-PF\nmailbox memory in use after an AF-VF init failure.  mutex_init() was\nalso re-run on the AF-VF path while AF-PF mailbox handlers could still\nhold rvu-\u003embox_lock.  Probe and SR-IOV failure paths did not release\ncn20k mailbox DMA either, since cleanup only happened in rvu_remove().\n\nAllocate ng_rvu once with devm_kzalloc(), initialize mbox_lock in the\nsame block, unwind only the mailbox memory for the failing init type,\nand free cn20k mailbox DMA from the probe and pci_enable_sriov()\nerror paths.\n\nFixes: e53ee4acb220 (\"octeontx2-af: CN20k basic mbox operations and structures\")\nSigned-off-by: Sai Krishna \u003csaikrishnag@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821102337.2989169-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b09a0503c755b6609fad59a84cc7f05b6843a03c",
      "tree": "cf5a4b153168c0626412328890b867a0cb314557",
      "parents": [
        "80230a18c164a4b5bbc048fe2768b219ac17bc5a"
      ],
      "author": {
        "name": "Suman Ghosh",
        "email": "sumang@marvell.com",
        "time": "Fri Aug 21 16:25:35 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 12:05:22 2026 -0700"
      },
      "message": "octeontx2-pf: fix NULL deref of af_xdp_zc_qidx on rep setup\n\naf_xdp_zc_qidx tracks receive queues using AF_XDP zero-copy and is\nallocated during PF/VF probe. Representors and other non-AF_XDP paths\nleave the pointer NULL, but several call sites used test_bit() on it\nunconditionally.\n\nSwitching to devlink eswitch mode creates representors and runs\notx2_init_hw_resources(), which reaches otx2_pool_aq_init() and oopses\nwhen dereferencing the NULL bitmap. Add NULL checks before every\naf_xdp_zc_qidx test_bit() use in the RSS, ethtool, XSK, and pool init\npaths.\n\nFixes: efabce290151 (\"octeontx2-pf: AF_XDP zero copy receive support\")\nSigned-off-by: Suman Ghosh \u003csumang@marvell.com\u003e\nSigned-off-by: Geetha sowjanya \u003cgakula@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260821105536.2998765-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "80230a18c164a4b5bbc048fe2768b219ac17bc5a",
      "tree": "ff5e2831161886cbe5538fad5a809f5480471a43",
      "parents": [
        "d4f484661961636eb90d287050959e613795f73a"
      ],
      "author": {
        "name": "Alexandra Winter",
        "email": "wintera@linux.ibm.com",
        "time": "Fri Aug 21 14:55:01 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 12:04:29 2026 -0700"
      },
      "message": "net/iucv: filter frames in afiucv_hs_rcv() by ingress device\n\nafiucv_hs_rcv() selects a socket from iucv_sk_list by matching four 8-byte\nname fields in the transport header alone. No check is made against the\nnet_device the frame arrived on.\n\nThis can cause a frame arriving on any netdev to be delivered to an AF_IUCV\nsocket. Three problems follow.\n\nFirst, a frame arriving over HiperSockets can be delivered to a socket\nbound to the classic z/VM IUCV transport, which has iucv-\u003ehs_dev \u003d\u003d NULL.\niucv_sock_bind() takes the classic path whenever the requested userid\nmatches iucv_userid, even on a guest that also has a HiperSockets device\ncarrying the same identifier. The child socket created by\nafiucv_hs_callback_syn() for such a match inherits hs_dev \u003d NULL and\ntransport \u003d AF_IUCV_TRANS_HIPER, so the first send() on it returns -ENODEV.\nThe socket delivered to accept() is unusable.\n\nSecond, a frame arriving on one netdev can be delivered to a socket bound\nto a different IQD device. Which can lead to\n- Accept-queue exhaustion (DoS)\n- Attacker-controlled peer identity in the child socket\n- Data injection into existing sockets\n- Fabric noise on the IQD fabric, where bogus replies are sent\n- killing established connections\n\nThird, all AF_IUCV sockets live in init_net, as iucv_sock_alloc() calls\nsk_alloc(\u0026init_net, ...). But even frames arriving on netdev devices in a\nnamespace can be delivered to an IUCV socket. So a process in an\nunprivileged user and network namespace holding only the CAP_NET_RAW\ncapability valid within that namespace can send a raw ETH_P_AF_IUCV frame\non its own lo device and have it matched against init_net sockets.\n\nFix all three by skipping any socket whose hs_dev does not match the\ningress device. A classic z/VM IUCV socket has hs_dev \u003d\u003d NULL; the ingress\ndev is never NULL, so classic sockets are skipped automatically. An unbound\nHIPER socket also has hs_dev \u003d\u003d NULL and is skipped. A bound HIPER socket\nis only reachable from the exact IQD device it was bound to. Because hs_dev\nis always a device in init_net (iucv_sock_bind() scans\nfor_each_netdev_rcu(\u0026init_net, ...) exclusively), a frame whose ingress\ndevice belongs to another namespace never matches any socket.\n\nNote that AF_IUCV over HiperSockets provides no per-connection\nauthentication: no sequence numbers, no TLS, no nonce. The four name fields\nidentifying a connection are exchanged in plaintext on the shared\nHiperSockets segment (VCHID). Any host on the same HiperSockets segment\ncould spoof any frame type against an existing connection. That is a\nprotocol-level property unchanged by this patch. The fix reduces the attack\nsurface to peers present on the same HiperSockets segment.\n\nFixes: 3881ac441f64 (\"af_iucv: add HiperSockets transport\")\nCc: stable@vger.kernel.org\nCo-developed-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nSigned-off-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260821125501.3718748-1-wintera@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d4f484661961636eb90d287050959e613795f73a",
      "tree": "e6f8281960787dc81aea85cfe3875e75cad9d02a",
      "parents": [
        "2c7493f980140a5c40eb4f98f97c557193a2c330"
      ],
      "author": {
        "name": "Allison Henderson",
        "email": "achender@kernel.org",
        "time": "Fri Aug 21 22:26:47 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 12:03:25 2026 -0700"
      },
      "message": "net/rds: use wq_has_sleeper() in rds_cong_map_updated()\n\nrds_cong_map_updated() runs after a peer\u0027s congestion map has been\nrewritten (by rds_tcp_cong_recv() and rds_ib_cong_recv(), or the\nclear-all in the loopback and IB send-completion paths).  It bumps\nrds_cong_generation and then checks waitqueue_active() on\nmap-\u003em_waitq and on rds_poll_waitq to decide whether anyone needs\nwaking.  atomic_inc() carries no ordering and waitqueue_active() is a\nplain load, so nothing orders the map and generation stores before\nthe wait queue reads.  The waiters do the mirror image: rds_cong_wait()\nadds itself to m_waitq and then tests the port bit, and rds_poll()\nregisters on rds_poll_waitq and then reads the generation.  That is\nthe store-buffering pattern described above waitqueue_active() in\ninclude/linux/wait.h - the updater can observe an empty wait queue\nwhile the waiter still observes the port as congested, and no wake-up\nis issued.\n\nrds_cong_wait() is an interruptible sleep with no timeout, so a\nsender blocked on a congested port stays blocked until the next\ncongestion update from that peer arrives or a signal is delivered.\nA poll() waiter misses the map-updated notification the same way.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier, as rds_tcp_state_change() already does for\nthe same pattern.\n\nFixes: 922cb17a5c81 (\"RDS: Congestion-handling code\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260822052647.88318-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "2c7493f980140a5c40eb4f98f97c557193a2c330",
      "tree": "46e6a4e6cb5dbdf4b6ec91bf84353bcd18715e92",
      "parents": [
        "5b483f7791b079bb97d411f1066652ff659207ff"
      ],
      "author": {
        "name": "Long Li",
        "email": "longli@microsoft.com",
        "time": "Fri Aug 21 11:37:36 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 12:00:31 2026 -0700"
      },
      "message": "net: mana: Cap MSI-X vectors to the device MSI-X table size\n\nmana_gd_query_max_resources() sizes gc-\u003enum_msix_usable from resp.max_msix\nand the CPU count, but never from the device MSI-X table. On a 1792 vCPU\nM-series VM that yields 1793 while the table has 1024 entries, and\nmana_gd_setup_remaining_irqs() then walks indices 1..1792, running off the\nend of the region mapped by msix_map_region():\n\n  BUG: unable to handle page fault for address: ff8e347f8b99800c\n  RIP: 0010:msix_prepare_msi_desc+0x7a/0x90\n  RAX: 0000000000004000 RBX: ff4330cb164ea780 RCX: ff8e347f8b998000\n  Call Trace:\n   \u003cTASK\u003e\n   __msi_domain_alloc_irqs+0x13a/0x440\n   msi_domain_alloc_irq_at+0x149/0x1b0\n   mana_gd_setup+0x351/0x890\n   mana_gd_probe+0x274/0x390\n   \u003c/TASK\u003e\n\nRAX is index 1024 * PCI_MSIX_ENTRY_SIZE, one entry past the table.\n\nmsi_insert_desc() does range check the index, but only against the MSI\ndomain hwsize, which matches the table only for devices on an MSI parent\ndomain. With a global PCI/MSI domain hwsize is MSI_XA_DOMAIN_SIZE, so\nnothing bounds the request.\n\nCap num_msix_usable with pci_msix_vec_count().\n\nFixes: 755391121038 (\"net: mana: Allocate MSI-X vectors dynamically\")\nSigned-off-by: Long Li \u003clongli@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821183736.733296-1-longli@microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "5b483f7791b079bb97d411f1066652ff659207ff",
      "tree": "bbdf4afaba2cc6482de052610a542f505031da8d",
      "parents": [
        "5c07193ebe4718f71752c11d30cf389fa7b4c870"
      ],
      "author": {
        "name": "Victor Nogueira",
        "email": "victor@mojatatu.com",
        "time": "Fri Aug 21 13:40:31 2026 -0300"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:59:59 2026 -0700"
      },
      "message": "net/sched: act_ife: Only operate on Ethernet frames\n\nact_ife encapsulates/decapsulates the original Ethernet header and uses\nskb-\u003edev-\u003ehard_header_len as the length of that header. That is only\ncorrect for Ethernet devices: on a device where hard_header_len does not\nmatch the L2 header that was actually pulled (PPP reports PPP_HDRLEN\nwhile nothing is stripped on ingress), the ingress skb_push()/skb_pull()\nuse the wrong length and can hit skb_under_panic when headroom is tight.\n\nIFE is Ethernet-only by design - it builds an outer ethhdr, rewrites\nh_source/h_dest/h_proto, and calls eth_type_trans() on decode - so\ninstead of trying to make the offsets work for arbitrary link types,\nsimply drop packets that do not carry an Ethernet header.\n\nChecking skb-\u003edev-\u003etype alone is not enough. We have to cater for a\ncorner case where mirred can redirect an skb from a non-Ethernet device\nto an Ethernet one, and skb-\u003edev then says nothing about the framing the\nskb actually has: an skb redirected from ppp0 reaches the target\u0027s ingress\nhook with mac_len 0 and no Ethernet header at all. So at ingress also\nrequire mac_len to be ETH_HLEN. On egress mac_len is not maintained, so\nthe device type is all we have; a bogus redirect there yields a malformed\nframe rather than an out-of-bounds push, and it would be malformed with or\nwithout IFE.\n\nThat corner case is not theoretical - redirecting from ppp0 into a veth\nthat has an ife encode action on its ingress hook panics without this\npatch:\n\n  skbuff: skb_under_panic: len:98 put:14 head:ffff88800e410000\n          data:ffff88800e40fff5 tail:0x57 end:0x640 dev:veth3\n  kernel BUG at net/core/skbuff.c:214!\n  Call Trace:\n   skb_push (net/core/skbuff.c:224 net/core/skbuff.c:2657)\n   tcf_ife_act (net/sched/act_ife.c:829 net/sched/act_ife.c:874)\n   tc_run (net/core/dev.c:4463)\n   netif_receive_skb (net/core/dev.c:6463 net/core/dev.c:6522)\n   tcf_mirred_to_dev (net/sched/act_mirred.c:248 net/sched/act_mirred.c:328)\n   tcf_mirred_act (net/sched/act_mirred.c:489)\n   tc_run (net/core/dev.c:4463)\n   process_backlog (net/core/dev.c:6728)\n\nWith Ethernet framing guaranteed, use ETH_HLEN instead of\nhard_header_len.\n\nFixes: 295a6e06d21e (\"net/sched: act_ife: Change to use ife module\")\nReported-by: vega@nebusec.ai\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260821164031.32824-1-victor@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "5c07193ebe4718f71752c11d30cf389fa7b4c870",
      "tree": "a18767ce8238482db7f3e3f7c77a0cf2059318c8",
      "parents": [
        "01ba856c3604ec01c83619a05c2d405f7532a7b0"
      ],
      "author": {
        "name": "Manush Prajwal",
        "email": "manushprajwal555@gmail.com",
        "time": "Fri Aug 21 15:37:14 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:58:22 2026 -0700"
      },
      "message": "net: ethernet: renesas: rswitch: fix device_node refcount leak in rswitch_get_port_node()\n\nOn an of_property_read_u32() failure, rswitch_get_port_node() set port\nto NULL and jumped to the out label before releasing the reference the\nfor_each_available_child_of_node() iterator was holding on it. Once\nport was overwritten with NULL, that reference could never be\nreleased since out: only put \"ports\", the parent node.\n\nRework the function around for_each_available_child_of_node_scoped()\ninstead of adding a manual of_node_put(), so the iterator\u0027s reference\nis dropped automatically on every exit path. Since port is the\nfunction\u0027s return value, take an explicit reference with of_node_get()\non the match before breaking out of the loop.\n\nSigned-off-by: Manush Prajwal \u003cmanushprajwal555@gmail.com\u003e\nLink: https://patch.msgid.link/6a882352.ee10049a.267d65.7a31@mx.google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "01ba856c3604ec01c83619a05c2d405f7532a7b0",
      "tree": "7338419f2617b098c7139aba10d2dcc98a8ba3ab",
      "parents": [
        "9edf8d4876e8a2471e66f54d36208eaff2858392",
        "fa1a8457b8581725ae237efefb2358eddd7e05c9"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:56:39 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:56:40 2026 -0700"
      },
      "message": "Merge branch \u0027net-enetc-restore-rx-ring-congestion-mode-after-ring-reconfiguration\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: restore RX ring congestion mode after ring reconfiguration\n\nThe RX BD ring congestion mode (CM) enables the ENETC MAC to generate\nPAUSE frames when ingress congestion occurs. It is configured only in\nthe phylink .mac_link_up() callback, which is invoked when the link\nstatus changes.\n\nHowever, enetc_reconfigure() tears down and re-creates the RX BD rings\nat runtime without any link status change, for example when enabling or\ndisabling PTP RX hardware timestamping. enetc_setup_rxbdr() rebuilds the\nRBMR register from zero, which clears the CM bit, and since the link\nstatus does not change, .mac_link_up() is not called again to restore\nit. As a result, flow control silently stops working after such a\nreconfiguration.\n\nTo solve this issue, track the desired CM state in a software flag\nENETC_RXBDR_CM, which is maintained by the .mac_link_up() /\n.mac_link_down() callbacks and consulted by enetc_setup_rxbdr() when the\nRX BD rings are (re)configured. Both ENETC v1 and ENETC v4 are affected\nand are fixed in the same way.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260821064140.1315611-1-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "fa1a8457b8581725ae237efefb2358eddd7e05c9",
      "tree": "7338419f2617b098c7139aba10d2dcc98a8ba3ab",
      "parents": [
        "9e94d8e14ae45e3fda8c0919f745db3ed3715433"
      ],
      "author": {
        "name": "Wei Fang",
        "email": "wei.fang@nxp.com",
        "time": "Fri Aug 21 14:41:40 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:56:38 2026 -0700"
      },
      "message": "net: enetc: restore RX ring congestion mode for ENETC v4\n\nENETC v4 has the same problem as ENETC v1: the RX BD ring congestion\nmode (CM) is only configured in the phylink .mac_link_up() callback, so\nit is cleared when enetc_reconfigure() rebuilds the RX BD rings at\nruntime (for example when enabling or disabling PTP RX hardware\ntimestamping) without a link status change, and it is never restored.\nAs a result, the MAC can no longer generate PAUSE frames on ingress\ncongestion and flow control stops working.\n\nFix it in the same way as ENETC v1. Track the desired CM state in the\nsoftware flag ENETC_RXBDR_CM. Route enetc4_set_tx_pause() through the\nshared helper enetc_set_congestion_mode(), which sets or clears the flag\naccording to tx_pause and updates the ENETC_RBMR_CM bit under si-\u003egen_lock.\nWhen the RX BD rings are (re)enabled, enetc_enable_rxbdr() consults this\nflag and restores the CM bit accordingly, so flow control survives ring\nreconfiguration even when the link status does not change.\n\nFixes: f5b9a1cde0a2 (\"net: enetc: add PTP synchronization support for ENETC v4\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821064140.1315611-3-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "9e94d8e14ae45e3fda8c0919f745db3ed3715433",
      "tree": "ffdc35528b0c4503f1ec1cedfde556ed413851f4",
      "parents": [
        "9edf8d4876e8a2471e66f54d36208eaff2858392"
      ],
      "author": {
        "name": "Wei Fang",
        "email": "wei.fang@nxp.com",
        "time": "Fri Aug 21 14:41:39 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:56:37 2026 -0700"
      },
      "message": "net: enetc: restore RX ring congestion mode after ring reconfiguration\n\nThe RX ring congestion mode (CM) is only configured in the phylink\n.mac_link_up() callback enetc_pl_mac_link_up(), which sets the\nENETC_RBMR_CM bit when tx_pause is enabled. This callback runs only when\nthe link status changes.\n\nHowever, enetc_reconfigure() tears down and re-creates the RX BD rings at\nruntime without any link status change, for example when attaching or\ndetaching an XDP program, or when enabling/disabling PTP RX hardware\ntimestamping. The rings are rebuilt from a cleared RBMR, so the CM bit is\nlost. Since the link status does not change, enetc_pl_mac_link_up() is\nnot called again and the CM bit is never restored.\n\nAs a result, the ENETC MAC can no longer generate PAUSE frames on ingress\ncongestion, and flow control stops working after such a reconfiguration.\n\nTrack the desired CM state in a software flag ENETC_RXBDR_CM. Set or clear\nthis flag in enetc_pl_mac_link_up() according to tx_pause. When the RX BD\nrings are (re)enabled, enetc_enable_rxbdr() consults this flag and restores\nthe ENETC_RBMR_CM bit accordingly, so flow control survives ring\nreconfiguration even when the link status does not change.\n\nRBMR is now written as a whole word from enetc_enable_rxbdr() rather than\nby read-modify-write from several call sites. Serialize the remaining RBMR\nread-modify-write paths, the congestion mode update and the RX VLAN offload\nupdate, with the new si-\u003egen_lock so they cannot race each other.\n\nFixes: 5093406c784f (\"net: enetc: implement ring reconfiguration procedure for PTP RX timestamping\")\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821064140.1315611-2-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "9edf8d4876e8a2471e66f54d36208eaff2858392",
      "tree": "02e83a5c870d39a54bc0470e62839159341d0dec",
      "parents": [
        "c745d091fc6fe59bc4c4024d6cee8b8bd120f298"
      ],
      "author": {
        "name": "Naveen Mamindlapalli",
        "email": "naveenm@marvell.com",
        "time": "Fri Aug 21 11:24:45 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:54:43 2026 -0700"
      },
      "message": "octeontx2-af: Fix TL3/TL2 link config ENA clearing\n\nClear and restore the ENA bit for each TL3/TL2 link entry during\nSMQ flush instead of repeatedly using the same link index.\n\nFixes: 019aba04f08c (\"octeontx2-af: Modify SMQ flush sequence to drop packets\")\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nSigned-off-by: Naveen Mamindlapalli \u003cnaveenm@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821055445.2517568-1-nshettyj@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "c745d091fc6fe59bc4c4024d6cee8b8bd120f298",
      "tree": "a2668b5a28f2fabec6e194067d334dc4050e01c7",
      "parents": [
        "719296c4aa8213d4ac8002e77d5956d436bc98d0",
        "c924884743e948e25625b7fbf3ee2a9325a204a7"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:52:02 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:52:02 2026 -0700"
      },
      "message": "Merge branch \u0027net-smc-fix-use-after-free-in-smc_rx_pipe_buf_release\u0027\n\nHidayath Khan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/smc: fix use-after-free in smc_rx_pipe_buf_release()\n\nsmc_rx_pipe_buf_release() tests sk_state before taking the socket lock\nand then dereferences conn-\u003ermb_desc and conn-\u003elgr. A concurrent close\nruns smc_conn_free() in between, which releases those structures. On the\nis_reg_err path smcr_buf_unuse() frees the descriptor outright, so this\nis a use-after-free.\n\nPatch 2/2 fixes this by taking the socket lock first and testing\nconn-\u003efreed instead. smc_conn_free() sets that flag before releasing\nanything, under the same lock, so the two paths exclude each other.\n\nPatch 1/2 is a prerequisite. conn-\u003efreed shares a byte with killed and\nout_of_sync as single-bit bitfields. out_of_sync is written from the\nreceive tasklet without the socket lock, so a concurrent store to freed\nfrom process context can be lost in the read-modify-write. Patch 1/2\ngives each flag its own byte so stores do not interfere.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260820074642.966856-1-hidayath@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "c924884743e948e25625b7fbf3ee2a9325a204a7",
      "tree": "a2668b5a28f2fabec6e194067d334dc4050e01c7",
      "parents": [
        "db51a8658c11a82432b64999519a269c3aabb447"
      ],
      "author": {
        "name": "Hidayath Khan",
        "email": "hidayath@linux.ibm.com",
        "time": "Thu Aug 20 09:46:42 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:52:00 2026 -0700"
      },
      "message": "net/smc: fix use-after-free in smc_rx_pipe_buf_release()\n\nsmc_rx_splice() hands RMB pages to a pipe and takes a socket reference\nper entry so the smc_sock stays alive until the reader finishes. The\nconnection does not: a concurrent close runs smc_conn_free(), which\nreleases the receive buffer back to the link group pool.\n\nsmc_rx_pipe_buf_release() tests sk_state before taking the socket lock.\nThe state can change between the test and the lock, and\nsmc_rx_update_cons() then dereferences conn-\u003ermb_desc and walks\nconn-\u003elgr, which smc_conn_free() has already released. On the\nis_reg_err path smcr_buf_unuse() frees the descriptor outright, so\nthis is a use-after-free.\n\nTake the socket lock first and test conn-\u003efreed instead.\nsmc_conn_free() sets that flag before releasing anything, and every\ncaller holds the socket lock. The two paths exclude each other: either\nthe pipe release runs first with everything valid, or it sees the flag\nand skips the update.\n\nFixes: 9014db202cb7 (\"smc: add support for splice()\")\nCc: stable@vger.kernel.org\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nSigned-off-by: Hidayath Khan \u003chidayath@linux.ibm.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260820074642.966856-3-hidayath@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "db51a8658c11a82432b64999519a269c3aabb447",
      "tree": "ac8e5d01f2118c78d9b286677c4c2b0ea27b5907",
      "parents": [
        "719296c4aa8213d4ac8002e77d5956d436bc98d0"
      ],
      "author": {
        "name": "Hidayath Khan",
        "email": "hidayath@linux.ibm.com",
        "time": "Thu Aug 20 09:46:41 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:52:00 2026 -0700"
      },
      "message": "net/smc: stop killed, freed and out_of_sync sharing a byte\n\nThe three connection state flags are single-bit bitfields, so they occupy\none byte of struct smc_connection and every store to one is a\nread-modify-write of the other two:\n\n    u8  killed : 1;\n    u8  freed : 1;\n    u8  out_of_sync : 1;\n\nThey are not written under a common lock. smc_cdc_msg_validate() sets\nout_of_sync from the receive tasklet, while smc_conn_kill() sets killed\nfrom process context under lock_sock(), and the receive path does not defer\nto the backlog when the socket is owned -- smc_cdc_msg_recv() takes only\nbh_lock_sock().\n\nGive each flag its own byte so a store no longer touches its neighbours.\nAll readers test them as booleans and are unchanged. struct smc_connection\ngrows by two bytes.\n\nFixes: b286a0651e44 (\"net/smc: handle incoming CDC validation message\")\nCc: stable@vger.kernel.org\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nSigned-off-by: Hidayath Khan \u003chidayath@linux.ibm.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260820074642.966856-2-hidayath@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "719296c4aa8213d4ac8002e77d5956d436bc98d0",
      "tree": "20290aeb05a46555b6de113c8f841a298590a4f7",
      "parents": [
        "317fe168f4c0fc30e5c375c22d9c8911940aea9b"
      ],
      "author": {
        "name": "Hidayath Khan",
        "email": "hidayath@linux.ibm.com",
        "time": "Thu Aug 20 16:47:29 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:51:21 2026 -0700"
      },
      "message": "net/smc: fix socket refcount leak in smc_switch_conns()\n\nsmc_switch_conns() takes a reference on the SMC socket before dropping\nlgr-\u003econns_lock, so the connection stays alive while the CDC slot is\nfetched:\n\n        sock_hold(\u0026smc-\u003esk);\n        read_unlock_bh(\u0026lgr-\u003econns_lock);\n        /* pre-fetch buffer outside of send_lock, might sleep */\n        rc \u003d smc_cdc_get_free_slot(conn, to_lnk, \u0026wr_buf, NULL, \u0026pend);\n        if (rc)\n                goto err_out;\n\nThe err_out label only drops the wr_tx link reference, so this early exit\nreturns without the matching sock_put(). The second error exit is not\naffected, because sock_put() has already run by then.\n\nA leaked sk_refcnt means the smc_sock is never destroyed. Its send and\nreceive buffers stay allocated, and for a user socket the reference held\non the network namespace is never released, so the netns can no longer be\ntorn down.\n\nsmc_cdc_get_free_slot() fails when the target link goes down or when the\nconnection has been killed while the switch is in progress. Both are\nreachable during the link failover this function implements, so the leak\nis triggered by the same hardware events that make smc_switch_conns() run\nin the first place.\n\nRestructure so there is a single sock_put() covering both outcomes,\ninstead of adding a second one to the error path.\n\nFixes: 95f7f3e7dc6b (\"net/smc: improved fix wait on already cleared link\")\nCc: stable@vger.kernel.org\nReviewed-by: Mahanta Jambigi \u003cmjambigi@linux.ibm.com\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Hidayath Khan \u003chidayath@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260820144729.1019399-1-hidayath@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "317fe168f4c0fc30e5c375c22d9c8911940aea9b",
      "tree": "4f06e531c27c2059f43dbe26cff05e5ed0f2d7b6",
      "parents": [
        "af20e269f7459d2ce69887fdf2fad7caf986c865"
      ],
      "author": {
        "name": "Md Rabbani",
        "email": "rabbanyhmm@gmail.com",
        "time": "Fri Aug 21 11:57:18 2026 +0600"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:44:46 2026 -0700"
      },
      "message": "net: stmmac: fix device node reference leaks in stmmac_mtl_setup()\n\nIn stmmac_mtl_setup(), q_node is shared across the RX and TX queue\nparsing loops. When the RX queue loop breaks early because the number\nof parsed queues reaches plat-\u003erx_queues_to_use, q_node retains an\nacquired reference count. If the error check passes\n(queue \u003d\u003d plat-\u003erx_queues_to_use), execution proceeds directly to the\nTX queue loop, where of_get_next_child() immediately overwrites q_node\nwith the first TX child, permanently leaking the retained RX child\ndevice node reference.\n\nSwitch both loops to for_each_child_of_node_scoped() so child node\nreferences are automatically dropped upon loop exit or early break,\nand remove the now-unnecessary function-scoped q_node variable and\nits manual of_node_put() at the exit label.\n\nSigned-off-by: Md Rabbani \u003crabbanyhmm@gmail.com\u003e\nLink: https://patch.msgid.link/20260821055718.57-1-rabbanyhmm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "af20e269f7459d2ce69887fdf2fad7caf986c865",
      "tree": "b68ca1f5382cd62ea29395b46f0a3f59d498a12b",
      "parents": [
        "a66734a1c5e36525ea07e9f4547fddc51e916de3"
      ],
      "author": {
        "name": "Zihan Xi",
        "email": "zihanx@nebusec.ai",
        "time": "Thu Aug 20 18:40:28 2026 +0000"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:43:28 2026 -0700"
      },
      "message": "net: l2tp: do not propagate multicast notification errors\n\nThe tunnel create, tunnel modify, session create, and session modify\nnetlink handlers send multicast notifications through helpers that can fail\nwhile allocating or encoding a message, or while multicasting it.\n\nFor tunnel and session create/modify, a notification is sent after the live\noperation has completed. Returning a best-effort notification error as the\ncommand result can therefore report failure for an operation that already\ncommitted and can cause callers to retry and accumulate live objects.\n\nKeep sending notifications for listener visibility, but do not propagate\ntheir best-effort status as the command result. This also keeps the tunnel\nmodify command consistent with the other notification-only paths.\n\nFixes: 33f72e6f0c67 (\"l2tp : multicast notification to the registered listeners\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/54f48e812ca0424c47ffdb9a8182180921f7e6b2.1787247008.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "a66734a1c5e36525ea07e9f4547fddc51e916de3",
      "tree": "df89e8fac4c23c929d0fe7c4432e40afe57fd2a1",
      "parents": [
        "0a90e8f4e268e7cabe6a355e76f0e199be3ee185"
      ],
      "author": {
        "name": "Xiang Mei",
        "email": "xmei5@asu.edu",
        "time": "Thu Aug 20 12:52:40 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:42:16 2026 -0700"
      },
      "message": "net: qualcomm: rmnet: restore skb-\u003edev on deaggregated frames\n\nrmnet_map_deaggregate() allocates each sub-frame with alloc_skb() and\nleaves skb-\u003edev NULL. __rmnet_map_ingress_handler() assigns\nskb-\u003edev \u003d ep-\u003eegress_dev only on the data path, but a MAP command frame\nis dispatched to rmnet_map_command() before that, so rmnet_map_send_ack()\nruns netif_tx_lock(skb-\u003edev) on a NULL device. An unprivileged user\nreaches this by unsharing a user+net namespace, creating an rmnet link\nover a tap device with INGRESS_DEAGGREGATION and INGRESS_MAP_COMMANDS,\nand writing an aggregated frame carrying a flow-control command to the\ntap fd.\n\nRestore the assignment dropped by 378e25357ac7, so every skb leaving\nrmnet_map_deaggregate() has a valid device.\n\n  BUG: KASAN: null-ptr-deref in _raw_spin_lock (kernel/locking/spinlock.c:158)\n  Write of size 4 at addr 00000000000004b4 by task exploit/144\n  Call Trace:\n   _raw_spin_lock (kernel/locking/spinlock.c:158)\n   netif_tx_lock (net/sched/sch_generic.c:497)\n   rmnet_map_command (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_command.c:67)\n   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:125)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6103)\n   ...\n   __netif_receive_skb_one_core (net/core/dev.c:6214)\n   netif_receive_skb (net/core/dev.c:6474)\n   tun_get_user (drivers/net/tun.c:1966)\n   tun_chr_write_iter (drivers/net/tun.c:2012)\n   vfs_write (fs/read_write.c:687)\n   ksys_write (fs/read_write.c:739)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nFixes: 378e25357ac7 (\"net: qualcomm: rmnet: Remove unnecessary device assignment\")\nReported-by: co+4638111fe2a12980@bugs.sh\nCloses: https://lore.kernel.org/netdev/ijg79FFMfIvKJbivdJEKvTO90Q9dTvyBkJck@bugs.sh/T/#u\nSigned-off-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nReviewed-by: Subash Abhinov Kasiviswanathan \u003csubash.a.kasiviswanathan@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260820195240.1631458-1-xmei5@asu.edu\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "0a90e8f4e268e7cabe6a355e76f0e199be3ee185",
      "tree": "2ad37d06a62a2db9de5aeb56bec312346579c342",
      "parents": [
        "403f96c32c9e24600093d7d0c61c17daeedca957",
        "11e41444a3f6d854937672343a040607c219db0f"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:40:32 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:40:33 2026 -0700"
      },
      "message": "Merge branch \u0027selftests-net-fixes-for-fin_ack_lat\u0027\n\nQingshuang Fu says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests/net: fixes for fin_ack_lat\n\nThis series fixes two bugs in the fin_ack_lat self-test.\n\nPatch 1 fixes the swapped kill() arguments in sig_handler(), so the\nserver actually forwards SIGTERM to the client.  It also makes the\nwrapper script\u0027s cleanup tolerant of ESRCH, since the client may now\nexit before the kill command reaches its PID.\n\nPatch 2 adds a missing fork() error check: on failure the code falls\ninto server()\u0027s infinite accept loop, producing empty output that the\nwrapper script treats as a passing test.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260821030922.1123754-1-fffsqian@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "11e41444a3f6d854937672343a040607c219db0f",
      "tree": "2ad37d06a62a2db9de5aeb56bec312346579c342",
      "parents": [
        "2d83aa65dc983368ce14f1a1daa05ca56d38ab5c"
      ],
      "author": {
        "name": "Qingshuang Fu",
        "email": "fuqingshuang@kylinos.cn",
        "time": "Fri Aug 21 11:14:42 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:40:29 2026 -0700"
      },
      "message": "selftests/net: check fork() return value in fin_ack_lat\n\nmain() never checks fork() for failure.  When fork() returns -1\n(EAGAIN/ENOMEM/RLIMIT_NPROC), the !child_pid test is false and the\nprocess falls into server()\u0027s infinite accept() loop with no client ever\nconnecting, producing empty output.  The wrapper script treats an\nempty log as a passing test, producing a false positive.\n\nCheck fork() for failure with error(), as is done for every other\nsyscall in this file.\n\nSigned-off-by: Qingshuang Fu \u003cfuqingshuang@kylinos.cn\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821031442.1124777-2-fffsqian@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "2d83aa65dc983368ce14f1a1daa05ca56d38ab5c",
      "tree": "5a69f5b6ddbaf673209e7fb9e35fea4b707901ce",
      "parents": [
        "403f96c32c9e24600093d7d0c61c17daeedca957"
      ],
      "author": {
        "name": "Qingshuang Fu",
        "email": "fuqingshuang@kylinos.cn",
        "time": "Fri Aug 21 11:14:41 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:40:25 2026 -0700"
      },
      "message": "selftests/net: fix kill() argument order and wrapper cleanup in fin_ack_lat\n\nsig_handler() passes its arguments to kill() in the wrong order: it sends\nsignal number child_pid to PID SIGTERM (15) instead of sending SIGTERM\nto the client process.  The call therefore always fails and the signal\nis never forwarded: when only the server process receives SIGTERM, the\nclient keeps running its infinite connect loop as an orphan process.\n\nSwap the arguments so that the server forwards SIGTERM to the client.\nGuard the call with child_pid \u003e 0: the client inherits the handler and\nsees child_pid \u003d\u003d 0, and a plain argument swap would make it call\nkill(0, SIGTERM), signaling the whole process group instead of exiting\nquietly.\n\nNow that the server actually terminates the client before the wrapper\nscript\u0027s cleanup runs, kill() may fail with ESRCH for the already-exited\nclient.  The script uses set -e, so make the kill tolerant to avoid\naborting the EXIT trap and leaking temporary files.\n\nSigned-off-by: Qingshuang Fu \u003cfuqingshuang@kylinos.cn\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260821031442.1124777-1-fffsqian@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "403f96c32c9e24600093d7d0c61c17daeedca957",
      "tree": "0240272fcf8daf37234268c86436292a43ca3bbb",
      "parents": [
        "3ba97ff4f873481d370bee7f7dfb87f8296af9be"
      ],
      "author": {
        "name": "Yuqi Xu",
        "email": "xuyuqiabc@gmail.com",
        "time": "Fri Aug 21 11:19:38 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:38:09 2026 -0700"
      },
      "message": "openvswitch: Fix CT limit teardown use-after-free\n\nPacket processing uses CT limit state under RCU, while netns teardown\nfrees that state under ovs_mutex. The CT limit pointer was neither removed\nfrom readers nor protected by a grace period, allowing packet processing to\ndereference the freed state.\n\nAn unprivileged user can trigger this bug from a user and network\nnamespace, causing a slab-use-after-free in ovs_ct_execute() when the\nnetns is torn down.\n\nPublish the CT limit pointer through RCU, remove it before teardown, and\nwait for readers before freeing its contents. Keep ovs_mutex around\nindividual CT limit updates, and use the RCU read-side lock while GET\ntraverses the RCU-protected limit lists.\n\nNetns teardown detaches the RCU-protected CT limit state in the pernet\n.pre_exit callback while holding ovs_mutex.  The pernet core guarantees an\nRCU grace period between the .pre_exit and .exit callbacks, so the .exit\ncallback completes the teardown without adding any extra synchronization.\n\nThe netlink command handlers do not need NULL checks because the userspace\nnetlink socket holds an active reference to its network namespace while a\nrequest is processed. The per-netns exit path therefore cannot run\nconcurrently with SET, DEL, or GET for that socket\u0027s namespace.\n\nFixes: 11efd5cb04a1 (\"openvswitch: Support conntrack zone limit\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nLink: https://lore.kernel.org/all/cover.1784711445.git.xuyuqiabc@gmail.com\nCo-developed-by: Nan Li \u003ctonanli66@gmail.com\u003e\nSigned-off-by: Nan Li \u003ctonanli66@gmail.com\u003e\nSigned-off-by: Yuqi Xu \u003cxuyuqiabc@gmail.com\u003e\nReviewed-by: Ren Wei \u003cenjou1224z@gmail.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/288fbd5459d92b9dd0dcc6faf625f04819161ff3.1787280296.git.xuyuqiabc@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "3ba97ff4f873481d370bee7f7dfb87f8296af9be",
      "tree": "9c77aa32d1a42468503b6e7cf45e860cdc0f83c4",
      "parents": [
        "4d5df98369c5f45710b786499f8bd7ffc3196433"
      ],
      "author": {
        "name": "Anshumali Gaur",
        "email": "agaur@marvell.com",
        "time": "Thu Aug 20 14:06:34 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:34:16 2026 -0700"
      },
      "message": "octeontx2-vf: fix workqueue and netdev race in probe/remove\n\nInitialize the VF workqueue before register_netdev() so ndo_set_rx_mode\ndoes not queue work on a NULL workqueue. Unregister the netdev before\ndestroying the workqueue, and add proper probe error cleanup.\n\nFixes: cbc100aa2205 (\"octeontx2-nicvf: add ndo_set_rx_mode support for multicast \u0026 promisc\")\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nSigned-off-by: Anshumali Gaur \u003cagaur@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260820083634.1641740-1-nshettyj@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "4d5df98369c5f45710b786499f8bd7ffc3196433",
      "tree": "8462976c98c4dd7a4f972247be58bf4d570af63e",
      "parents": [
        "ec65631bd5ec251cdf67a4919fac7a3149a6e235"
      ],
      "author": {
        "name": "Anshumali Gaur",
        "email": "agaur@marvell.com",
        "time": "Thu Aug 20 11:24:51 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:30:47 2026 -0700"
      },
      "message": "octeontx2-af: fix out-of-bounds read setting MSI-X irq affinity\n\nrvu_register_interrupts() walks every MSI-X vector and uses strstr()\nto match \"Mbox\" or \"FLR\" in irq_name before pinning those interrupts\nto CPU 0. irq_name is a per-vector NAME_SIZE buffer, but not every\nslot is populated before this loop runs. strstr() keeps scanning until\nit finds a NUL terminator, so an uninitialized slot can trigger a KASAN\nslab-out-of-bounds read at boot when debug options are enabled.\n\nUse strnstr() with NAME_SIZE to bound the search within each vector\u0027s\nname buffer.\n\nFixes: 4e527f1e5c15 (\"octeontx2-af: npc: cn20k: Add new mailboxes for CN20K silicon\")\nSigned-off-by: Anshumali Gaur \u003cagaur@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260820055451.2642358-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "ec65631bd5ec251cdf67a4919fac7a3149a6e235",
      "tree": "f6d8971daf4f9482ae007ed4b6819cff1d1e6050",
      "parents": [
        "d989e22ae9802c52c56ad4284d0caf26696cf6ae"
      ],
      "author": {
        "name": "Anshumali Gaur",
        "email": "agaur@marvell.com",
        "time": "Thu Aug 20 10:33:33 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:30:43 2026 -0700"
      },
      "message": "octeontx2-af: fix NULL deref in NIX TM tree debugfs read path\n\nrvu_dbg_nix_tm_tree_display() dereferences pfvf-\u003esq_ctx without\nchecking whether the SQ context has been allocated. Reading\n/sys/kernel/debug/octeontx2/nix/tm_tree for a NIX LF whose transmit\nqueues are not set up triggers a kernel oops.\n\nGuard the read path the same way rvu_dbg_nix_tm_tree_write() already\ndoes and return -EINVAL with a seq_file message when sq_ctx is NULL.\n\nFixes: b907194a5d5b (\"octeontx2-af: Add debugfs support to dump NIX TM topology\")\nSigned-off-by: Anshumali Gaur \u003cagaur@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260820050333.2606095-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "d989e22ae9802c52c56ad4284d0caf26696cf6ae",
      "tree": "3081811c04b0f01eccec594df7768d1b5d649228",
      "parents": [
        "3e995a30b9e3812e61e50669d4ea4642d3362ef6"
      ],
      "author": {
        "name": "Cen Zhang (Microsoft)",
        "email": "blbllhy@gmail.com",
        "time": "Wed Aug 19 22:07:35 2026 -0400"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:30:39 2026 -0700"
      },
      "message": "gtp: add synchronize_net() in gtp_newlink() error path to prevent use-after-free\n\ngtp_newlink()\u0027s error path frees tid_hash and addr_hash without\nwaiting for an RCU grace period after clearing sk_user_data. A\nconcurrent gtp_encap_recv() in softirq may still hold the gtp_dev\npointer obtained via rcu_dereference_sk_user_data() and access the\nfreed memory.\n\n  BUG: KASAN: slab-use-after-free in gtp0_pdp_find+0x1f6/0x200 (gtp.c:152)\n  Call Trace:\n   \u003cIRQ\u003e\n   gtp0_pdp_find+0x1f6/0x200\n   gtp_encap_recv+0x527/0x24b0\n   udp_queue_rcv_one_skb+0x75f/0xc10\n\nAdd synchronize_net() before the kfree calls in out_hashtable, which\ncovers all error paths from both gtp_encap_enable() and\ngtp_create_sockets().\n\nFixes: 459aa660eb1d8ce6 (\"gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nReported-by: Xiang Mei (Microsoft) \u003cxmei5@asu.edu\u003e\nReported-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nLink: https://patch.msgid.link/20260820020735.59474-1-blbllhy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "3e995a30b9e3812e61e50669d4ea4642d3362ef6",
      "tree": "c5c8781fc76eb3e06668bd2b57eb1321b0a8db67",
      "parents": [
        "c0ef04232f9fac083c3d8a77ce58ba32243e6734",
        "a6e4b9a6deb9362ef7a0706c70d674e92fe1411a"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:12:03 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:12:03 2026 -0700"
      },
      "message": "Merge branch \u0027xsk-pre-existing-af_xdp-tx-metadata-fixes-from-sashiko\u0027\n\nStanislav Fomichev says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nxsk: pre-existing AF_XDP TX metadata fixes from Sashiko\n\nA few fixes to address pre-existing issues from Sashiko review.\n\nNotes on the feedback from net-next v1 posting [0]:\n- It correctly complains about ABI breakage for 32 bit systems, added\n  an explanation why I think we unlikely to have any 32 bit users with\n  launch time\n- mlx5 batching (pre existing) - I think my point in the comment still\n  stays (that we do not make it worse)\n\n0: from https://netdev-ai.bots.linux.dev/sashiko/#/message/20260810184753.135756-1-sdf%40fomichev.me\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260819160535.1472459-1-sdf@fomichev.me\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "a6e4b9a6deb9362ef7a0706c70d674e92fe1411a",
      "tree": "c5c8781fc76eb3e06668bd2b57eb1321b0a8db67",
      "parents": [
        "bd7d30bd1d3856d8354b5acef947d68ad1faf886"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Wed Aug 19 09:05:34 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:12:00 2026 -0700"
      },
      "message": "xsk: honor XDP_TX_METADATA in zero-copy path\n\nThe zero-copy path reads TX metadata whenever the UMEM has metadata space,\neven if the descriptor does not set XDP_TX_METADATA. Pass descriptor\noptions through the metadata helpers and ignore metadata unless the option\nis set.\n\nThis does not fix the existing per-WQE metadata handling for mlx5 MPWQEs.\nOnly the descriptor that starts a session passes through\nxsk_tx_metadata_request() and configures offload state shared by the batch.\nMetadata on descriptors joining an open session is therefore not validated\nand does not configure its requested offloads. In addition, a non-NULL\nmetadata pointer from such a descriptor is treated as a timestamp\ncompletion request even when XDP_TXMD_FLAGS_TIMESTAMP is not set, so its\nmetadata union can be overwritten with an unrequested timestamp. Fixing\nmixed metadata states within one MPWQE requires a separate change.\n\nFixes: 48eb03dd2630 (\"xsk: Add TX timestamp and TX checksum offload support\")\nReviewed-by: Alexander Lobakin \u003caleksander.lobakin@intel.com\u003e\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nReviewed-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20260819160535.1472459-3-sdf@fomichev.me\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "bd7d30bd1d3856d8354b5acef947d68ad1faf886",
      "tree": "27d3863d7d77747fb8dc9706a29924790fc24dd1",
      "parents": [
        "c0ef04232f9fac083c3d8a77ce58ba32243e6734"
      ],
      "author": {
        "name": "Stanislav Fomichev",
        "email": "sdf.kernel@gmail.com",
        "time": "Wed Aug 19 09:05:33 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:11:59 2026 -0700"
      },
      "message": "xsk: align TX metadata layout across ABIs\n\nAdd explicit padding before launch_time so xsk_tx_metadata has the same\nlayout on 32-bit and 64-bit systems.\n\nOn several architectures (csky, i386, nios2, m65k, openrisc, sh), the old\nnative 32-bit layout put launch_time at offset 12 and had a natural size of\n20 bytes. Using sizeof(struct xsk_tx_metadata) as tx_metadata_len was already\nrejected because the length must be a multiple of eight, so the\nstraightforward use of the interface was broken on those ABIs. Userspace\ncould still register a padded length of 24 bytes, though; mixing the old and\nnew layouts then silently reads launch_time from the wrong offset and\nmisprograms packet launch times. This intentionally replaces that\nincompatible layout because the affected architectures are unlikely to\nhave any notable users. (x86_64 and arm64 have the most users and are _not_\naffected)\n\nFixes: ca4419f15abd (\"xsk: Add launch time hardware offload support to XDP Tx metadata\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20260819160535.1472459-2-sdf@fomichev.me\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "c0ef04232f9fac083c3d8a77ce58ba32243e6734",
      "tree": "50407791ccd36b3df8bb15fbac62cd29219d5489",
      "parents": [
        "7cbfb180945ce529608e4d4e24a6d483699fab1e"
      ],
      "author": {
        "name": "Shiji Yang",
        "email": "yangshiji66@outlook.com",
        "time": "Wed Aug 19 21:07:07 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Mon Aug 24 11:10:54 2026 -0700"
      },
      "message": "net: ethernet: mtk_wed: increase WED v2 WDMA RESV_BUFF to 0x80\n\nChange WDMA RESV_BUFF from 0x40 to 0x80 to avoid CDM TX FIFO overflow.\nWithout this patch mt7986 and mt7981 may have WDMA TX hang issue. This\npatch was pulled from mtk-openwrt-feeds GPL open source project.\n\nLink: https://github.com/mediatek/mtk-openwrt-feeds/commit/07c87502e854b68b48544d101b6fe17ec059b97b\nSigned-off-by: Shiji Yang \u003cyangshiji66@outlook.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/OSZPR01MB779537889255E2F606E47EABBCA52@OSZPR01MB7795.jpnprd01.prod.outlook.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "ebe6674292fda9a58e6f3adffd6d277560857169",
      "tree": "122688a387b1067df2e7e741565a4b2098b6485d",
      "parents": [
        "7e1e4047200fd7519f9bdfe8a001437715e618b4"
      ],
      "author": {
        "name": "Chengfeng Ye",
        "email": "nicoyip.dev@gmail.com",
        "time": "Sat Aug 22 23:06:19 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:14:43 2026 -0400"
      },
      "message": "Bluetooth: RFCOMM: serialize session teardown\n\nrfcomm_kill_listener() walks session_list and deletes every session\nwithout holding rfcomm_mutex, unlike the normal session processing and\nconnect error paths.\n\nUnder normal operation, an open RFCOMM socket pins rfcomm.ko, so\nrfcomm_kill_listener() does not run concurrently with rfcomm_dlc_open().\nHowever, forced module unload via delete_module(O_TRUNC) can stop\nkrfcommd while a failed connect is still unwinding.\n\n  connect task                    forced unload / krfcommd\n  ------------                    ------------------------\n  rfcomm_lock()\n  rfcomm_session_add()\n                                  delete_module(\"rfcomm\", O_TRUNC)\n                                  rfcomm_kill_listener()\n                                    fetch session from session_list\n  kernel_connect() fails\n  rfcomm_session_del()\n    remove and free session\n                                  rfcomm_session_del(session)\n\nThe final call then reads the freed session and may corrupt the list.\n\nKASAN reported with mdelay() to enlarge critical window:\n\n  BUG: KASAN: slab-use-after-free in rfcomm_run+0x3802/0x3f00 [rfcomm]\n  Read of size 8 at addr ffff888111058d40 by task krfcommd/79\n  Tainted: [R]\u003dFORCED_RMMOD\n  Allocated by task 86:\n   rfcomm_session_add+0xa1/0x300 [rfcomm]\n   rfcomm_dlc_open+0x8b2/0xf30 [rfcomm]\n   rfcomm_sock_connect+0x34c/0x530 [rfcomm]\n  Freed by task 86:\n   kfree+0x121/0x3c0\n   rfcomm_dlc_open+0xab7/0xf30 [rfcomm]\n   rfcomm_sock_connect+0x34c/0x530 [rfcomm]\n\nHold rfcomm_mutex across the teardown traversal so every reachable\nsession_list walk uses the same serialization.\n\nReviewed-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nTested-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nReviewed-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "7e1e4047200fd7519f9bdfe8a001437715e618b4",
      "tree": "96a850a713525e68ee49a374eaed08db1098e6db",
      "parents": [
        "759c185d0bbdb131357408f50b8735e04ed3caff"
      ],
      "author": {
        "name": "Radek Podgorny",
        "email": "radek@podgorny.cz",
        "time": "Mon Aug 24 13:00:20 2026 +0200"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:14:35 2026 -0400"
      },
      "message": "Bluetooth: do not leak an hci_conn when a second LE connect is rejected\n\ncreate_le_conn_complete() decides whether the failed connection is\nstill pending by comparing it against hci_lookup_le_connect(), which\nreturns the first LE connection in BT_CONNECT. That is the same\nconnection only while at most one is pending.\n\nTwo can be pending. Connections created on the passive scan path sit\nin BT_CONNECT with HCI_CONN_SCANNING set and are invisible to\nhci_lookup_le_connect() until hci_le_create_conn_sync() clears the\nflag when their command is issued, so the -EBUSY guard in\nhci_connect_le() does not prevent a second connection from being\nqueued while the first is still on the scan path. Whenever two\nconnections are in BT_CONNECT at once, the lookup may return one\nconnection while create_le_conn_complete() is reporting the failure\nof the other; the early exit then drops the error and hci_conn_failed()\nnever runs on the connection that failed.\n\nThe controller also rejects a second HCI_OP_LE_CREATE_CONN issued\nwhile another connection creation is still outstanding, per Core Spec\nVol 4, Part E. The spec calls for Command Disallowed there; the\nbcm43438 observed here answers with an LMP/LL error code instead,\nwhich bt_to_errno() maps to the -EPROTO (-71) in the log below.\n\nThe leaked connection stays in BT_CONNECT forever, and because\nhci_connect_le() refuses to dial while hci_lookup_le_connect() finds\nanything, every subsequent attempt to reach any peer fails with\n-EBUSY and no command reaches the controller at all.\n\nSeen on a bcm43438 with two BLE peers polled on the same interval\n(state 5 is BT_CONNECT; both handles are UNSET ones, allocated from\nthe ida above HCI_CONN_HANDLE_MAX):\n\n  Bluetooth: hci1: Opcode 0x2013 failed: -71\n\n  # hcitool con\n          \u003c LE 14:9C:EF:03:68:81 handle 3840 state 5 lm CENTRAL\n          \u003c LE C4:D3:6A:8C:B5:38 handle 3841 state 5 lm CENTRAL\n\nA btmon capture across the next ten minutes of connect attempts\ncontains no HCI_OP_LE_CREATE_CONN at all; outgoing LE connections\ndo not recover until the adapter is reset. With this change the same\nscenario fails the rejected connection cleanly and further connects\nto both peers go through.\n\nAsk about the connection itself instead of about the device.\n\nFixes: c9f73a2178c1 (\"Bluetooth: hci_conn: Fix hci_connect_le_sync\")\nSigned-off-by: Radek Podgorny \u003cradek@podgorny.cz\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "759c185d0bbdb131357408f50b8735e04ed3caff",
      "tree": "7d0954b8bc84ff980e771eb28cacae896d28b2f1",
      "parents": [
        "ca0583c24661749508a0979189c254388a685559"
      ],
      "author": {
        "name": "Chengfeng Ye",
        "email": "nicoyip.dev@gmail.com",
        "time": "Sun Aug 23 00:43:41 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:13:36 2026 -0400"
      },
      "message": "Bluetooth: RFCOMM: serialize security confirmation handling\n\nrfcomm_security_cfm() looks up a session on session_list and then walks\nits DLC list without holding rfcomm_mutex. Since RFCOMM session teardown\nuses rfcomm_mutex, krfcommd can close and free the same session and DLCs\nconcurrently:\n\n  hci_rx_work                    krfcommd\n  -----------                    ---------\n  rfcomm_session_get()\n                                 rfcomm_lock()\n                                 rfcomm_session_close()\n                                   rfcomm_dlc_unlink()\n                                   rfcomm_session_del()\n                                     kfree(s)\n                                 rfcomm_unlock()\n  walk s-\u003edlcs\n\nThe callback can then read a freed session list head and touch freed DLCs\nwhile updating their flags or timers.\n\nSerialize the session lookup and DLC traversal in rfcomm_security_cfm()\nwith rfcomm_mutex. This matches the existing RFCOMM session lifetime\nrules and prevents concurrent rfcomm_session_del() / rfcomm_dlc_unlink()\nfrom tearing the objects down while the callback is using them.\n\nKASAN reported:\n\n  BUG: KASAN: slab-use-after-free in rfcomm_security_cfm+0x41c/0x440\n  Read of size 8 at addr ffff888111fb3960 by task kworker/u17:1/89\n  Workqueue: hci0 hci_rx_work\n  Call Trace:\n   rfcomm_security_cfm+0x41c/0x440\n   hci_encrypt_cfm+0x139/0x590\n   hci_encrypt_change_evt+0x37b/0xc40\n   hci_event_packet+0x71b/0xb20\n   hci_rx_work+0x293/0x730\n  Allocated by task 69:\n   rfcomm_session_add+0x9e/0x2f0\n   rfcomm_run+0x44b/0x41e0\n  Freed by task 69:\n   kfree+0x131/0x3c0\n   rfcomm_session_del+0x188/0x220\n   rfcomm_run+0x1985/0x41e0\n\nFixes: 08c30aca9e698faddebd34f81e1196295f9dc063 (\"Bluetooth: Remove RFCOMM session refcnt\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chengfeng Ye \u003cnicoyip.dev@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "ca0583c24661749508a0979189c254388a685559",
      "tree": "bd966f1c5b805850e1f715340147af5f4518ceb5",
      "parents": [
        "a9355799343e10014f2acfd4b6844d2335ecafea"
      ],
      "author": {
        "name": "Junjie Cao",
        "email": "junjie.cao@intel.com",
        "time": "Mon Aug 24 13:32:27 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:13:28 2026 -0400"
      },
      "message": "Bluetooth: btusb: limit RTL8761B BROKEN_EXT_SCAN quirk to 0bda:a728\n\nCommit 5ead2063611a (\"Bluetooth: btrtl: fix RTL8761B/BU broken LE\nextended scan\") set HCI_QUIRK_BROKEN_EXT_SCAN for every CHIP_ID_8761B\ndevice to cure repeated 0x2042 failures on an 0bda:a728 dongle. The\nbrokenness is per-dongle, not per-chip: on a TP-Link UB500 (2357:0604,\nRTL8761BU, fw 0xdfc6d922) extended scan works, and the legacy scan\npath the quirk forces is what is broken -- LE Set Scan Enable (0x200c)\ntimes out with -110 about 30 s after firmware load, btusb resets the\ndevice, and the adapter re-enumerates in an endless loop (382 firmware\nreloads in one boot). 7.1.8, which predates the stable backport, runs\nclean on this unit; 7.1.9 loops.\n\nMove the quirk from btrtl\u0027s chip-wide switch to a btusb device-table\nflag on the USB id the original fix was verified against. Other 8761B\ndongles return to their earlier long-standing behaviour.\n\nLink: https://bugzilla.redhat.com/show_bug.cgi?id\u003d2521504\nFixes: 5ead2063611a (\"Bluetooth: btrtl: fix RTL8761B/BU broken LE extended scan\")\nCc: stable@vger.kernel.org\nSigned-off-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "a9355799343e10014f2acfd4b6844d2335ecafea",
      "tree": "b83da36eb4d6666ecd40eef38e3ac4490d9860eb",
      "parents": [
        "44c98fd082eafd49d55a8a4077ff488175b2fe24"
      ],
      "author": {
        "name": "Gongwei Li",
        "email": "ligongwei@kylinos.cn",
        "time": "Fri Aug 21 10:45:55 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:13:20 2026 -0400"
      },
      "message": "Bluetooth: hci_uart: Fix false success return in hci_uart_setup()\n\nWhen reading the local version information for vendor detection\nfails, the error is only printed and 0 is returned, which masks the\nsetup failure from the HCI core.\n\nReturn PTR_ERR(skb) instead.\n\nFixes: fb2ce8d11f039 (\"Bluetooth: hci_uart: Add support for vendor detection flag\")\nFixes: 82f5169bf3d3b (\"Bluetooth: hci_uart: add serdev driver support library\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gongwei Li \u003cligongwei@kylinos.cn\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "44c98fd082eafd49d55a8a4077ff488175b2fe24",
      "tree": "46360294b5c3a10efc57fd338b08f67155ca710d",
      "parents": [
        "560bef609fa5992745929e8d7d458b9d88dd2830"
      ],
      "author": {
        "name": "Hyunwoo Kim",
        "email": "imv4bel@gmail.com",
        "time": "Fri Mar 20 00:14:58 2026 +0900"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:13:13 2026 -0400"
      },
      "message": "Bluetooth: RFCOMM: Validate MTU in rfcomm_apply_pn() to prevent infinite loop\n\nrfcomm_apply_pn() accepts the MTU value from a remote PN (Parameter\nNegotiation) frame without checking for zero. When the remote peer\nsends an MTU of zero, d-\u003emtu is set to 0. This causes the sendmsg\npath to enter an infinite loop when fragmenting data, as each fragment\nhas size \u003d\u003d min_t(size_t, len, 0) \u003d\u003d 0, so the remaining length never\ndecreases. The infinite allocation of zero-length skbs exhausts all\nsystem memory.\n\nFix by clamping d-\u003emtu to RFCOMM_DEFAULT_MTU when the negotiated\nvalue is zero, consistent with the initial value assigned in\nrfcomm_dlc_alloc().\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Hyunwoo Kim \u003cimv4bel@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "560bef609fa5992745929e8d7d458b9d88dd2830",
      "tree": "d2bf237aef40bfbefd940b495bf6f7468f7bbf54",
      "parents": [
        "f5afdff569a09d1cb8cf19826199d024725576cb"
      ],
      "author": {
        "name": "Hang Nan",
        "email": "2122295973@qq.com",
        "time": "Wed Aug 19 08:57:58 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:13:06 2026 -0400"
      },
      "message": "Bluetooth: ISO: fix use-after-free of listener socket in iso_conn_ready\n\niso_conn_ready() looks up the BIS listener socket with iso_get_sock(),\nwhich takes a reference, and then, without re-checking its state,\ncreates a child socket from it:\n\n    parent \u003d iso_get_sock(hdev, ...);\n    if (!parent)\n        return;\n\n    lock_sock(parent);\n    sk \u003d iso_sock_alloc(sock_net(parent), NULL, BTPROTO_ISO, ...);\n    ...\n    iso_chan_add(conn, sk, parent);\n    ...\n    release_sock(parent);\n    sock_put(parent);\n\nIf the listener socket is closed concurrently, between iso_get_sock()\nand lock_sock(), the reference taken by iso_get_sock() may be the last\none: the close path drops the link-list reference, and once\niso_conn_ready() drops its own reference at the end of the function the\nsocket is freed.  The child socket, however, is already linked to the\nfreed parent, and a later disconnect of the child runs iso_chan_del()\n-\u003e bt_accept_unlink(), which dereferences the dangling parent pointer\ninto the freed accept queue (a use-after-free).  The same dangling\npointer is also dereferenced through parent-\u003e***() in\niso_chan_del().\n\nFix it the same way the connected (non-BIS) path was fixed in commit\n0d255e63fcf3 (\"Bluetooth: ISO: hold sk properly in iso_conn_ready\"):\nafter taking the socket lock, re-check that the parent is still a\nlistening, alive socket, and bail out otherwise.\n\nFixes: ccf74f2390d60 (\"Bluetooth: Add BTPROTO_ISO socket type\")\nCc: stable@vger.kernel.org\nSigned-off-by: Hang Nan \u003c2122295973@qq.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "f5afdff569a09d1cb8cf19826199d024725576cb",
      "tree": "ffba1e97e9d38087a5dcb98e678896b2c43cac5e",
      "parents": [
        "941929abe5feaed672b9a52e330e547d333240c6"
      ],
      "author": {
        "name": "Xin Chen",
        "email": "xin.chen2@oss.qualcomm.com",
        "time": "Wed Aug 19 21:53:21 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:11:55 2026 -0400"
      },
      "message": "Bluetooth: hci_core: use skb_get() instead of skb_clone() for req_skb\n\nBT enable fails intermittently with -ETIMEDOUT (-110).  The kernel log\nshows the HCI Read Local Version command was sent and the firmware\nreplied with status 0x00 (logged by hci_req_cmd_complete() BT_DBG),\nbut the waiter in __hci_cmd_sync_sk() never woke up and timed out\nafter 10 s:\n\n  bluetooth hci0: Opcode 0xfc00              // __hci_cmd_sync_sk\n  bluetooth hci0: opcode 0xfc00 plen 1       // hci_cmd_sync_add\n  bluetooth hci0: skb len 4                  // hci_cmd_sync_alloc\n  bluetooth hci0: length 1                   // hci_req_sync_run\n  Bluetooth: hci0 cmd_cnt 1 cmd queued 1     // hci_cmd_work\n  Bluetooth: hci0 type 1 len 4               // hci_send_frame\n  Bluetooth: opcode 0xfc00 status 0x00       // hci_req_cmd_complete\n  \u003c-- req_skb NULL: req_complete_skb not set,\n      hci_cmd_sync_complete() never called,\n      req_status stays HCI_REQ_PEND            --\u003e\n  \u003c-- 10 s later: wait_event_interruptible_timeout expires --\u003e\n  bluetooth hci0: end: err -110              // __hci_cmd_sync_sk\n\nThe root cause is that hci_send_cmd_sync() clones the sent command\ninto hdev-\u003ereq_skb so that hci_req_cmd_complete() can locate the\nregistered completion callback.  Under memory pressure this\nskb_clone() fails, leaving hdev-\u003ereq_skb NULL.  The firmware reply\nis received and processed, but hci_req_cmd_complete() finds NULL\nreq_skb, so hci_cmd_sync_complete() is never called, req_status\nstays HCI_REQ_PEND, and the waiter times out with -ETIMEDOUT.\n\nreq_skb is only used to read bt_cb(skb)-\u003ehci callbacks and opcode --\nit is never modified.  Replace skb_clone() with skb_get(), which\nsimply increments the reference count of hdev-\u003esent_cmd without\nallocating new memory and therefore cannot fail.\n\nThis issue was first observed as a use-after-free in ttyport_close()\nwhen ttyport_open() failed, which was investigated in an earlier\npatch series [1].  That investigation led to the discovery of the\ntrue root cause described above.\n\n[1] https://lore.kernel.org/all/20250430111617.1151390-1-quic_cxin@quicinc.com/\n\nFixes: 2615fd9a7c25 (\"Bluetooth: hci_sync: Fix overwriting request callback\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xin Chen \u003cxin.chen2@oss.qualcomm.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "941929abe5feaed672b9a52e330e547d333240c6",
      "tree": "7bb0615ed3ca1809dee33b5b3fad12c1901d6bc8",
      "parents": [
        "ed5fb41d3b6b6e665e7f97fd54bd1f9531c7477f"
      ],
      "author": {
        "name": "Valentin Kindschi",
        "email": "valentin.kindschi@fiveco.ch",
        "time": "Tue Aug 18 15:29:35 2026 +0200"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:11:42 2026 -0400"
      },
      "message": "Bluetooth: hci_event: clear HCI_LE_ADV only on a created connection\n\nle_conn_complete_evt() clears HCI_LE_ADV before looking at the event\nstatus, on the premise stated in its comment that all controllers stop\nadvertising when a connection is created.\n\nThat premise only holds when a connection was actually created. On a\nnon-zero status none was, and the controller is still advertising: after\nthe host issues LE Create Connection Cancel the event arrives with\nUnknown Connection Identifier (0x02), and a connection timeout behaves\nthe same way. Clearing the flag there leaves the host believing\nadvertising is off while the controller has it on.\n\nIt is also wrong for extended advertising, where several sets can be\nadvertising at once. hci_cc_le_set_ext_adv_enable() is careful about\nthis - on disabling one set it walks hdev-\u003eadv_instances and only clears\nHCI_LE_ADV once no instance is still enabled. The unconditional clear\nhere discards that bookkeeping, so one set connecting drops the flag\nwhile the others keep advertising.\n\nThe direction of the error matters. A flag left set is self-correcting:\nhci_disable_advertising_sync() sends LE Set Advertising Enable(0) and\nthe command complete puts the state back. A flag left clear is not,\nbecause that same function returns early without sending anything while\nthe flag is clear:\n\n  - LE Set Advertising Parameters is then sent to a controller that is\n    still advertising, and is correctly rejected with Command Disallowed\n    (0x0c);\n  - hci_enable_advertising_sync() returns at that point, before the\n    LE Set Advertising Enable that would set HCI_LE_ADV again.\n\nOn a controller without LE Extended Advertising that is reachable from\nhere: hci_schedule_adv_instance_sync() re-arms adv_instance_expire every\nHCI_DEFAULT_ADV_DURATION (2 s) and its \"already advertising\" shortcut\ntests HCI_LE_ADV, which can no longer become true, so the parameter\nwrite is retried for as long as advertising is configured:\n\n  Bluetooth: hci0: Opcode 0x2006 failed: -16\n\nOnly clear the flag when a connection was established.\n\nNote this is not on its own sufficient to stop that retry loop - the\nredundant enable queued by hci_le_conn_failed() clears HCI_LE_ADV itself\nand recreates the same mismatch, which patch 1 addresses. This patch\nfixes the event handler reporting a state the controller is not in.\n\nVerified on the affected device (BCM43455, legacy advertising only) with\nthis patch and patch 1 applied. A 221 s btmon capture with an out-of-range\npeer at -90 dBm contains two outgoing connection attempts that the host\ncancelled, each producing exactly the event this patch changes:\n\n  \u003c LE Set Advertising Parameters  0x2006   Success\n  \u003c LE Set Advertising Enable      0x200a   Success\n  \u003c LE Create Connection Cancel    0x200e   Success\n  \u003e LE Connection Complete   Unknown Connection Identifier (0x02), central\n\nNothing follows either one; the next command is an unrelated scan restart\n70 ms later. Over the whole capture: 7 LE Set Advertising Parameters sent,\nall Success; 10 LE Set Advertising Enable, all Success; no Command\nDisallowed of any opcode, and no 2 s cadence anywhere. Two central\nconnections to other peers completed normally afterwards, with feature\nexchange and a connection parameter update, so advertising was still live\nacross the cancelled attempts.\n\nThe extended advertising case above is a code argument, not a measurement:\nthis controller has no LE Extended Advertising, so that path is not\nexercised by the capture.\n\nFixes: fbd96c151cdc (\"Bluetooth: Fix clearing HCI_LE_ADV for LE connections\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5 btmon\nSigned-off-by: Valentin Kindschi \u003cvalentin.kindschi@fiveco.ch\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "ed5fb41d3b6b6e665e7f97fd54bd1f9531c7477f",
      "tree": "0d13329b6ac5160f79c95046d2814d7071eaedfe",
      "parents": [
        "aec6a8d80e3da0ab5c9303a0281fd06d077f8716"
      ],
      "author": {
        "name": "Valentin Kindschi",
        "email": "valentin.kindschi@fiveco.ch",
        "time": "Tue Aug 18 15:29:34 2026 +0200"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:11:33 2026 -0400"
      },
      "message": "Bluetooth: hci_conn: re-enable advertising only for peripheral role\n\nhci_le_conn_failed() unconditionally calls hci_enable_advertising(),\nalthough its own comment states advertising should be re-enabled only\nwhen the failed attempt was made as a peripheral.\n\nhci_le_conn_failed() is reached from hci_conn_failed() for every failed\nLE connection, including outgoing central connections. For a central\nattempt this enable is redundant: hci_le_create_conn_sync() already\nrestores advertising via hci_resume_advertising_sync() in its done:\nblock. Because hci_enable_advertising() only queues the work on\ncmd_sync_work, it runs *after* that resume has already succeeded and\nset HCI_LE_ADV.\n\nThe resulting HCI sequence, captured on a BCM43455 (no LE Extended\nAdvertising, so legacy advertising is used):\n\n  LE Create Connection                     Status Success\n  ... 13.8 s, peer never answers ...\n  LE Set Advertising Parameters (0x2006)   Success   \u003c- done: resume,\n  LE Set Advertising Enable     (0x200a)   Success      HCI_LE_ADV set\n  LE Create Connection Cancel   (0x200e)   Success\n  LE Connection Complete                   Unknown Conn Id\n  LE Set Advertising Parameters (0x2006)   Command Disallowed (0x0c)\n\nThe last command is the queued enable from hci_le_conn_failed() running\nas a second hci_enable_advertising_sync() pass. It clears HCI_LE_ADV\n(hci_sync.c, \"Clear the HCI_LE_ADV bit temporarily\"), then sends\nLE Set Advertising Parameters while the controller is still advertising,\nwhich the controller correctly rejects with Command Disallowed.\n\nThe disable-first call at the top of hci_enable_advertising_sync()\ncannot prevent this: hci_disable_advertising_sync() returns early\nwithout sending anything when HCI_LE_ADV is clear, so it is a no-op\nexactly when the flag is wrong.\n\nhci_enable_advertising_sync() then returns without sending LE Set\nAdvertising Enable, so HCI_LE_ADV is never set again. The legacy\nsoftware rotation loop re-arms hci_schedule_adv_instance_sync() every\nHCI_DEFAULT_ADV_DURATION (2 s), and its \"already advertising\" shortcut\ntests HCI_LE_ADV, which can no longer become true. The command is\ntherefore retried every 2 s indefinitely:\n\n  Bluetooth: hci0: Opcode 0x2006 failed: -16\n\nObserved on a gateway as 5326 occurrences over 3 hours, ending only when\nbluetoothd was restarted. Connection attempts that succeed do not call\nhci_le_conn_failed() and never trigger this.\n\nAdd the role test the comment already describes. Both other\nhci_enable_advertising() call sites reached from a failed/closed LE\nconnection (hci_cs_disconnect() and hci_disconn_complete_evt()) already\nguard on conn-\u003erole \u003d\u003d HCI_ROLE_SLAVE; this one was missed.\n\nReproducing needs legacy advertising (ext_adv_capable() false, so the\nsoftware rotation loop is used), simultaneous peripheral advertising and\noutgoing central connects, and a central connect that times out rather\nthan failing fast.\n\nThe Fixes tag points at the commit that introduced the advertising\nrestart into this path for the directed-advertising (peripheral) case;\nthe role test that the later commit 0b1db38ca26b (\"Bluetooth: Fix check\nfor direct advertising\") added to the sibling paths was never applied\nhere.\n\nFixes: 3c857757ef6e (\"Bluetooth: Add directed advertising support through connect()\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5 btmon\nSigned-off-by: Valentin Kindschi \u003cvalentin.kindschi@fiveco.ch\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "aec6a8d80e3da0ab5c9303a0281fd06d077f8716",
      "tree": "48f1a3f3267c4e1b25b607b59424a7a7511353a9",
      "parents": [
        "4beb198bc59b242404a47c21990bc84165052c8a"
      ],
      "author": {
        "name": "Lorenzo Stoakes (ARM)",
        "email": "ljs@kernel.org",
        "time": "Tue Aug 18 10:49:34 2026 +0100"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:10:49 2026 -0400"
      },
      "message": "Bluetooth: hci_bcm4377: Ignore reserved PHY in ext adv reports on BCM4378\n\nCommit ed2a2ef16a6b (\"Bluetooth: Add quirk to ignore reserved PHY bits in\nLE Extended Adv Report\") added a quirk to handle creative use of the\nreserved bits in the PHY fields for 4388 controllers in Apple silicon.\n\nI observed the same issue with the BCM4378 Bluetooth controller (14e4:5f69,\nrev 05) on an Apple MacBook Pro (13-inch, M2, 2022):\n\n\u003e HCI Event: LE Meta Event (0x3e) plen 51\n      LE Extended Advertising Report (0x0d)\n        Num reports: 1\n        Entry 0\n          Event type: 0x2513\n            Props: 0x0013\n              Connectable\n              Scannable\n              Use legacy advertising PDUs\n            Data status: Complete\n            Reserved (0x2500)\n          Legacy PDU Type: Reserved (0x2513)\n          Address type: Random (0x01)\n          Address: EA:C1:82:F0:24:C6 (Static)\n          Primary PHY: Reserved\n          Secondary PHY: No packets\n          SID: no ADI field (0xff)\n          TX power: 127 dBm\n          RSSI: -57 dBm (0xc7)\n          Periodic advertising interval: 0.00 msec (0x0000)\n          Direct address type: Public (0x00)\n          Direct address: 00:00:00:00:00:00 (OUI 00-00-00)\n          Data length: 25\n\nThis results in the firmware rejecting connection attempts with\n\"Unsupported Feature or Parameter Value\" (0x11).\n\nFix the issue by using the same quirk for BCM4378 devices too.\n\nI tested this locally and confirmed that the issue is resolved.\n\nThis was observed when attempting to connect a Kinesis Advantage 360\nkeyboard to the MacBook.\n\nAssisted-by: Claude:claude-fable-5\nFixes: 2e7ed5f5e69b (\"Bluetooth: hci_sync: Use advertised PHYs on hci_le_ext_create_conn_sync\")\nCc: stable@vger.kernel.org\nSigned-off-by: Lorenzo Stoakes (ARM) \u003cljs@kernel.org\u003e\nReviewed-by: Sven Peter \u003csven@kernel.org\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "4beb198bc59b242404a47c21990bc84165052c8a",
      "tree": "5b7c44fc4e3f3561c49fe182e20eaca9eae4c810",
      "parents": [
        "060fa7592bdc043a93b6b7870f5b8551206d315d"
      ],
      "author": {
        "name": "HyeongJun An",
        "email": "sammiee5311@gmail.com",
        "time": "Sat Aug 15 15:24:19 2026 +0900"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:10:27 2026 -0400"
      },
      "message": "Bluetooth: eir: Fix OOB read in eir_get_service_data()\n\neir_get_service_data() walks the advertising data for a Service Data\nfield with a matching UUID.  On a mismatch it advances:\n\n    eir +\u003d dlen;\n    eir_len -\u003d dlen;\n\neir_get_data() reports dlen as the field\u0027s data length, but the field\nspans dlen + 2 bytes once its length and type bytes count, and more\nwhen non-Service-Data fields were skipped to reach it.  The pointer\nlands correctly on the next field.  eir_len does not, and the shortfall\ncompounds across fields until eir_get_data() reads the length and type\nbytes of a \"field\" past the end of the buffer.\n\nFor an ISO broadcast sink that buffer is hcon-\u003ele_per_adv_data[], filled\nfrom the periodic advertising reports of a remote broadcaster.  A PA\npayload packed with mismatching Service Data fields walks off the array\ninto the rest of struct hci_conn.  A drifted field that matches the BAA\nUUID puts those bytes in iso_pi(sk)-\u003ebase, where user space reads them\nback with getsockopt(BT_ISO_BASE).\n\nRecompute eir_len from the end of the buffer each iteration.\n\nFixes: 8f9ae5b3ae80 (\"Bluetooth: eir: Add helpers for managing service data\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: HyeongJun An \u003csammiee5311@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "060fa7592bdc043a93b6b7870f5b8551206d315d",
      "tree": "0ab66cf0af4bf6ee54fd26cfb0fd0ca57154598e",
      "parents": [
        "5b9b68abb5fa548478e20ee38a0ef5c18e9cf4b7"
      ],
      "author": {
        "name": "Ali Ahmet Memis",
        "email": "ali@iusegentoo.com",
        "time": "Fri Aug 14 18:28:48 2026 +0000"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:10:20 2026 -0400"
      },
      "message": "Bluetooth: btnxpuart: Validate the FW dump header length\n\nnxp_process_fw_dump() pulls the ACL header off the frame and then reads\nseq_num and buf_len from a struct nxp_fw_dump_hdr placed at skb-\u003edata,\nwithout checking that the ACL payload is long enough to contain it.\n\nh4_recv_buf() collects HCI_ACL_HDR_SIZE bytes of header followed by the\nnumber of payload bytes named in that header, so skb-\u003elen is 4 + dlen\nwith dlen supplied by the controller and possibly smaller than the 8\nbyte dump header, or zero. A short frame with connection handle 0xfff\ntherefore reads both fields from beyond the received data.\n\nBeyond the read itself, buf_len is what terminates a dump: a value of\nzero makes the driver call hci_devcd_complete() and reset the\ncontroller, so a truncated frame can end a dump early.\n\nUse skb_pull_data() to validate and pull the FW dump header before\naccessing its fields. Warn and reject the chunk if the header is\ntruncated.\n\nFixes: 998e447f443f (\"Bluetooth: btnxpuart: Add support for HCI coredump feature\")\nSigned-off-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "5b9b68abb5fa548478e20ee38a0ef5c18e9cf4b7",
      "tree": "87e7c3d3d26a0d14493e378b89b7564141e83720",
      "parents": [
        "3b8f8d632381fdeb4c4f54fd516d49d4f513b9aa"
      ],
      "author": {
        "name": "Pauli Virtanen",
        "email": "pav@iki.fi",
        "time": "Sun Aug 16 11:59:01 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:08:00 2026 -0400"
      },
      "message": "Bluetooth: hci_sync: add conditional locking annotations\n\nAdd context analysis annotations to functions doing conditional locking,\nto suppress analysis warnings.\n\nFixes: cdc36db204ff (\"Bluetooth: hci_sync: Fix advertising data UAFs\")\nTested-by: Nathan Chancellor \u003cnathan@kernel.org\u003e # build\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "3b8f8d632381fdeb4c4f54fd516d49d4f513b9aa",
      "tree": "128b803bfad830b9b7c1d15656248a0220fb30fb",
      "parents": [
        "fa0ad2d277c7adead61d1c22411c55cea6990c2a"
      ],
      "author": {
        "name": "Sherry Sun",
        "email": "sherry.sun@nxp.com",
        "time": "Mon Aug 17 10:27:39 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:07:23 2026 -0400"
      },
      "message": "Bluetooth: btnxpuart: Check remote M.2 connector availability before pwrseq\n\nThe current code uses of_graph_is_present() to decide whether to enter\nthe pwrseq path. However, of_graph_is_present() only checks for the\nstructural presence of a port/ports sub-node and does not check the\nstatus property. This causes problems when a DT overlay disables the\nremote M.2 connector node (e.g., switching from PCIe WiFi to SDIO WiFi):\nthe port node still exists, so of_graph_is_present() returns true, but\nthe pwrseq provider never registers because the connector is disabled,\nleading to an infinite -EPROBE_DEFER loop.\n\nReplace of_graph_is_present() with a new helper that traverses the OF\ngraph to the remote port parent (the M.2 connector node) and checks\nof_device_is_available(). When the remote connector is disabled, the\npwrseq path is skipped, allowing the BT driver to fall through to the\ndirect bluetooth child node path.\n\nFixes: e48e332d84d8 (\"Bluetooth: btnxpuart: Add M.2 Bluetooth device support using pwrseq\")\nSigned-off-by: Sherry Sun \u003csherry.sun@nxp.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "fa0ad2d277c7adead61d1c22411c55cea6990c2a",
      "tree": "07b2c72e4dd4327be4336877a78efce2a1a70233",
      "parents": [
        "155e3003d1e614f85566b636973df7118e1b4851"
      ],
      "author": {
        "name": "Chris Lu",
        "email": "chris.lu@mediatek.com",
        "time": "Mon Aug 17 17:53:32 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:07:14 2026 -0400"
      },
      "message": "Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path\n\nbtmtksdio_tx_packet() rounds the transfer size up to the SDIO block size\nof 256 bytes, but hands the host controller the SKB buffer as is:\n\n\terr \u003d sdio_writesb(bdev-\u003efunc, MTK_REG_CTDR, skb-\u003edata,\n\t\t\t   round_up(skb-\u003elen, MTK_SDIO_BLOCK_SIZE));\n\nOnly skb-\u003elen bytes hold packet data, so the controller reads up to 255\nbytes of uninitialised memory and sends it to the device over the SDIO\nbus. Depending on how much tailroom slack the SKB allocation happens to\ncarry, that read can also extend past the end of the buffer.\n\nCompute the padded length up front, ensure the SKB has tailroom for it,\nand zero-fill the padding with skb_put_zero(). skb-\u003elen then covers the\npadding, so sdio_writesb() no longer needs to round up. byte_tx keeps\ncounting the header and the payload only, and the error path restores the\nSKB so that the caller can requeue it.\n\nWriting behind skb-\u003etail is only safe because the driver owns the buffer,\nwhich \"Bluetooth: btmtksdio: Take exclusive ownership of the SKB before\nTX\" ensures.\n\nFixes: 9aebfd4a2200 (\"Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices\")\nSigned-off-by: Chris Lu \u003cchris.lu@mediatek.com\u003e\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "155e3003d1e614f85566b636973df7118e1b4851",
      "tree": "07fdcd9be0267574a98f93f35c0dbb3f5ce530b1",
      "parents": [
        "21b50c24843b51f88ac4316dd470d2803da0c42f"
      ],
      "author": {
        "name": "Chris Lu",
        "email": "chris.lu@mediatek.com",
        "time": "Mon Aug 17 17:53:31 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:07:08 2026 -0400"
      },
      "message": "Bluetooth: btmtksdio: Take exclusive ownership of the SKB before TX\n\nbtmtksdio_tx_packet() prepends the MediaTek SDIO header with skb_push()\nand writes into that space after only checking the headroom size. On a\ncloned SKB that headroom belongs to a buffer shared with the other owner,\nwhich the driver has no right to write to.\n\nCloned SKBs do reach this path: hci_send_cmd_sync() keeps a clone of every\nHCI command in hdev-\u003esent_cmd before handing the SKB to the driver, and\nl2cap_ertm_send() clones SKBs for retransmission.\n\nReplace the open-coded headroom check with skb_cow_head(), which both\nguarantees the headroom and reallocates a private buffer when the SKB is\ncloned. The cost is one reallocation and copy per cloned packet, the usual\nprice of this pattern in network drivers.\n\nThis has no observable effect on its own, as the driver only writes in\nfront of skb-\u003edata where no other owner looks. It is a prerequisite for\n\"Bluetooth: btmtksdio: Fix out-of-bounds DMA read in the TX path\", which\nwrites padding behind skb-\u003etail, and carries the same Fixes: tag so that\nboth are backported together.\n\nFixes: 9aebfd4a2200 (\"Bluetooth: mediatek: add support for MediaTek MT7663S and MT7668S SDIO devices\")\nSigned-off-by: Chris Lu \u003cchris.lu@mediatek.com\u003e\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "21b50c24843b51f88ac4316dd470d2803da0c42f",
      "tree": "267d0657c0ffe6e81bf991e94dc4ff916baedcd7",
      "parents": [
        "59c3ee19ca88210bfc0e22ce59218091cb1a3c48"
      ],
      "author": {
        "name": "Ismail Tarim",
        "email": "ismailtarim7@gmail.com",
        "time": "Sat Aug 15 14:56:24 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:07:02 2026 -0400"
      },
      "message": "Bluetooth: btmtk: Do not discard the subsystem reset timeout\n\nWhen the MTK_BT_RST_DONE poll times out, btmtk_usb_subsys_reset() logs\n\"Reset timeout\" and keeps the error in err, but err is then overwritten\nby the return value of the following btmtk_usb_id_get() call, so the\ntimeout is never reported to the caller.\n\nCommit 25b6d7593a3a (\"Bluetooth: btmtk: introduce btmtk reset work\")\ndiscarded the return value of the chip id read, so the function returned\nthe timeout error as intended. Commit 3dcb122b3064 (\"Bluetooth: btusb:\nmediatek: return error for failed reg access\") started assigning err at\nthat call and silently dropped it.\n\nKeep the timeout in a separate variable and return it, restoring the\noriginal behaviour without changing the control flow.\n\nFixes: 3dcb122b3064 (\"Bluetooth: btusb: mediatek: return error for failed reg access\")\nSigned-off-by: Ismail Tarim \u003cismailtarim7@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "59c3ee19ca88210bfc0e22ce59218091cb1a3c48",
      "tree": "77c7c5c5b1b807f5401464a35ab718aaa5f30a83",
      "parents": [
        "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea"
      ],
      "author": {
        "name": "Ismail Tarim",
        "email": "ismailtarim7@gmail.com",
        "time": "Sat Aug 15 14:56:23 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:06:56 2026 -0400"
      },
      "message": "Bluetooth: btmtk: Do not report success when subsys reset fails\n\nbtmtk_usb_subsys_reset() validates the subsystem reset by reading the\nchip id back. When that read succeeds at the bus level but yields an id\nof zero, the reset has demonstrably not taken effect: the function logs\n\"Can\u0027t get device id, subsys reset fail.\" and then returns the return\nvalue of btmtk_usb_id_get(), which in that case is zero, i.e. success.\n\nbtusb_mtk_reset() returns that value unchanged, so its caller cannot\ntell a completed reset from a failed one.\n\nReturn -ENODEV when the chip id reads back as zero, leaving the existing\nMT6639 exemption intact.\n\nObserved on an MT7902 [13d3:3579]. The path can be reached on demand by\nasking the controller for a coredump, since btmtk requests a reset once\nthe dump completes:\n\n  # echo 1 \u003e /sys/class/bluetooth/hci0/device/coredump\n\n  Bluetooth: hci0: Mediatek coredump end\n  Bluetooth: hci0: Can\u0027t get device id, subsys reset fail.\n  usb 3-10: reset high-speed USB device number 5 using xhci_hcd\n  usb 3-10: device descriptor read/64, error -110\n  usb usb3-port10: attempt power cycle\n  usb usb3-port10: unable to enumerate USB device\n\nThe same sequence occurs unprompted when the controller firmware asserts\non its own.\n\nNote that this corrects the error reporting only; it does not by itself\nmake the controller recoverable in the case above.\n\nFixes: 25b6d7593a3a (\"Bluetooth: btmtk: introduce btmtk reset work\")\nSigned-off-by: Ismail Tarim \u003cismailtarim7@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "66d6ef18548ae6d7dd452b84115fc82c0a73a4ea",
      "tree": "552cb6caa5cb2f47f966419c47eca52299288597",
      "parents": [
        "59eecbe2f2f38d8f3e1104bd11da97f9a2c58998"
      ],
      "author": {
        "name": "Pauli Virtanen",
        "email": "pav@iki.fi",
        "time": "Sat Aug 08 12:08:45 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:06:49 2026 -0400"
      },
      "message": "Bluetooth: L2CAP: fix race l2cap_sock_cleanup_listen() vs. put_chan\n\nFor L2CAP sockets without owning sk-\u003esk_socket, reading\nl2cap_pi(sk)-\u003echan may race against concurrent l2cap_sock_kill() -\u003e\nl2cap_sock_put_chan().  This excludes simultaneous proto_ops callbacks,\nbut access in l2cap_sock_cleanup_listen() has unsafe lockless read.\n\n [Task 1]                         [Task 2 (hdev-\u003eworkqueue)]\n l2cap_sock_release(parent)       l2cap_disconn_cfm\n   l2cap_sock_cleanup_listen        l2cap_conn_del\n     bt_accept_dequeue                l2cap_chan_del\n       lock_sock(sk)                    l2cap_sock_teardown_cb\n       bt_accept_unlink\n         bt_sk(sk)-\u003eparent \u003d NULL\n       release_sock(sk) ----------------\u003e lock_sock(sk)\n                                          parent \u003d /* NULL */\n     lock_sock(sk) \u003c--------------------- release_sock(sk)\n                                          sock_set_flag(sk, SOCK_ZAPPED)\n                                      l2cap_sock_close_cb\n                                        l2cap_sock_kill(sk)\n                                          l2cap_sock_put_chan\n     chan \u003d READ l2cap_pi(sk)-\u003echan         l2cap_pi(sk)-\u003echan \u003d NULL\n     l2cap_chan_hold_unless_zero            l2cap_put_chan(chan)\n       kref_get_unless_zero(\u0026chan-\u003eref)\n\nTask 1 may observe NULL which causes null-ptr-deref.\n\nFix the race by taking lock_sock() in l2cap_sock_kill() to\nsynchronize with l2cap_sock_cleanup_listen().  hold_unless_zero() is not\nneeded here, l2cap_pi(sk)-\u003echan owns reference if it is non-NULL.\n\nClarify code comments vs. locking.\n\nFixes: 6fef032af009 (\"Bluetooth: L2CAP: Fix use-after-free in l2cap_sock_new_connection_cb()\")\nReported-by: syzbot+e6382a2f53f5fc7453ac@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003de6382a2f53f5fc7453ac\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "59eecbe2f2f38d8f3e1104bd11da97f9a2c58998",
      "tree": "a66e65a5e79f1f0e617e4843dbb5fbb4db2f7bcd",
      "parents": [
        "d4bfa78fd67929b62b02013c107973e0c5b7aa9a"
      ],
      "author": {
        "name": "Pavel Shpakovskiy",
        "email": "pashpakovskii@salutedevices.com",
        "time": "Sat Aug 08 19:31:11 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:06:39 2026 -0400"
      },
      "message": "Bluetooth: mgmt: fix \u0027hdev-\u003ediscovery.uuids\u0027 NULL dereference\n\n\u0027uuid_count\u0027 member of struct \u0027discovery_state\u0027 is assigned and read\nwithout any locks, so there is a chance of situation when\nuuid_count !\u003d 0, but uuids is NULL and there will be NULL pointer\ndereference.\n\nPossible race:\n\u0027hci_update_passive_scan_sync\u0027\n  \u0027hci_discovery_filter_clear\u0027\n    hdev-\u003ediscovery.uuid_count \u003d 0;\n      \u003c----------------------preempted-----------------------------\u003e\n                        \u0027start_service_discovery\u0027\n                          // Set uuid_count to value !\u003d 0\n                          hdev-\u003ediscovery.uuid_count \u003d uuid_count;\n                          hdev-\u003ediscovery.uuids \u003d kmemdup(...);\n      \u003c----------------------preempted-----------------------------\u003e\n    spin_lock(\u0026hdev-\u003ediscovery.lock);\n    kfree(hdev-\u003ediscovery.uuids);\n    hdev-\u003ediscovery.uuids \u003d NULL;\n    spin_unlock(\u0026hdev-\u003ediscovery.lock);\n\nNow uuids \u003d\u003d NULL and uuid_count !\u003d 0.\nSo \u0027mgmt_device_found\u0027 -\u003e \u0027is_filter_match\u0027 -\u003e \u0027eir_has_uuids\u0027 receives\nnon consistent discovery state, where NULL dereference of uuids happens.\n\nTo fix it let\u0027s add discovery.lock around every read/write of uuid_count,\nuuids pair of struct members. It is also important to assign uuid_count\nvalue only after success kmemdup() allocation in\nstart_service_discovery(), otherwise uuids is NULL, because kmemdup failed,\nbut uuid_count is already assigned to non zero value.\n\nThe following panic happens:\n\n[ ] ------------[ cut here ]------------\n[ ] Unable to handle kernel NULL pointer dereference at virtual\naddress 0000000000000000\n[ ] Internal error: Oops: 0000000096000006 [#1] PREEMPT SMP\n[ ] CPU: 0 PID: 15056 Comm: kworker/u9:2\n[ ] Workqueue: hci0 hci_rx_work\n[ ] pstate: 10400009 (nzcV daif +PAN -UAO -TCO -DIT -SSBS BTYPE\u003d--)\n[ ] pc : eir_has_uuids+0x2d8/0x590\n[ ] lr : is_filter_match+0x258/0x320\n...\n[ ] Call trace:\n[ ]  eir_has_uuids+0x2d8/0x590\n[ ]  is_filter_match+0x258/0x320\n[ ]  mgmt_device_found+0x5b0/0xafc\n[ ]  process_adv_report.part.0+0x8c8/0xf14\n[ ]  hci_le_adv_report_evt+0x338/0x3f0\n[ ]  hci_le_meta_evt+0x1f0/0x4c8\n[ ]  hci_event_packet+0x440/0xc9c\n[ ]  hci_rx_work+0x44c/0xaf8\n[ ]  process_one_work+0x54c/0x103c\n[ ]  worker_thread+0x6c4/0x10c4\n[ ]  kthread+0x274/0x2ec\n[ ]  ret_from_fork+0x10/0x20\n[ ] Code: 14000004 91004021 eb14003f 54000180 (f9400024)\n[ ] ---[ end trace 0000000000000000 ]---\n\nFixes: 2935e556850e (\"Bluetooth: hci_sync: fix double free in \u0027hci_discovery_filter_clear()\u0027\")\nSigned-off-by: Pavel Shpakovskiy \u003cpashpakovskii@salutedevices.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "d4bfa78fd67929b62b02013c107973e0c5b7aa9a",
      "tree": "19454593d6b10bc1f80c03f11cb85b1192f17e7e",
      "parents": [
        "ca2c4c26498643f421d35ffe258fafbd3ed461c3"
      ],
      "author": {
        "name": "Pauli Virtanen",
        "email": "pav@iki.fi",
        "time": "Sun Aug 09 01:06:05 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:04:37 2026 -0400"
      },
      "message": "Bluetooth: L2CAP: reject accept queue add unless BT_LISTEN\n\nNew sk should not be added to parent socket accept queue after last\nl2cap_sock_cleanup_listen() has run in l2cap_sock_teardown_cb() and\nstate set to BT_CLOSED, as that can result to UAF on dereferencing the\ndangling parent reference.\n\nl2cap_sock_new_connection_cb() may race with parent l2cap_chan teardown,\ndue to chan-\u003estate accessed without consistent locking:\n\n  [Task 1]                           [Task 2]\n  l2cap_sock_release(parent)         l2cap_connect\n    l2cap_sock_shutdown                pchan \u003d l2cap_global_chan_by_psm\n      l2cap_chan_lock(pchan)\n      l2cap_chan_close\n        l2cap_sock_teardown_cb\n          pchan-\u003estate \u003d BT_CLOSED\n      l2cap_chan_unlock(pchan) ------\u003e l2cap_chan_lock(pchan)\n                                       l2cap_new_connection\n                                         l2cap_sock_new_connection_cb\n      l2cap_chan_lock(pchan) \u003c-------- l2cap_chan_unlock(pchan)\n      l2cap_sock_kill(parent)          /* bt_sk(sk)-\u003eparent dangling */\n\nFix by adding check for sk_state \u003d\u003d BT_LISTEN after acquiring sk lock in\nl2cap_sock_new_connection_cb().  Add lock_sock() around sk_state writes\nwhere missing, to avoid data races.\n\nAlthough the data races on pchan-\u003estate should be fixed too, this\ndefensive sk_state check probably makes sense in any case.\n\nFixes: 2ff1a41a912d (\"Bluetooth: L2CAP: Fix null-ptr-deref in l2cap_sock_state_change_cb()\")\nReported-by: syzbot+9265e754091c2d27ea29@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d9265e754091c2d27ea29\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nReported-by: syzbot+9265e754091c2d27ea29@syzkaller.appspotmail.com\nTested-by: syzbot+9265e754091c2d27ea29@syzkaller.appspotmail.com\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "ca2c4c26498643f421d35ffe258fafbd3ed461c3",
      "tree": "ee7da11cc13f2bb16e627b5675dc8ce344092d61",
      "parents": [
        "c7e9a8cb6918656884a0757c92465075c7555ffa"
      ],
      "author": {
        "name": "Pauli Virtanen",
        "email": "pav@iki.fi",
        "time": "Sun Aug 09 20:42:41 2026 +0300"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:04:27 2026 -0400"
      },
      "message": "Bluetooth: L2CAP: access chan-\u003econn safely in get/setsockopt\n\nSince commit b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nl2cap_chan::conn has held reference and remains non-NULL also after the\ncorresponding hci_conn is deleted.  In this state accessing various\nfields eg. hci_conn::hdev is invalid, which leads to KASAN crash in\nl2cap_sock_setsockopt() access of conn-\u003ehcon-\u003ehdev.\n\nCheck l2cap_chan::conn.hcon corresponds to an alive hci_conn before\ntrying to use it in l2cap_sock.c.  Hold l2cap_chan_lock() in\ngetsockopt/setsockopt to ensure it stays alive, and to avoid data races\nin l2cap_chan fields.\n\nFixes: b66774b48dd9 (\"Bluetooth: L2CAP: Fix UAF in channel timeout by holding conn ref\")\nReported-by: syzbot+b106284c2a0b7bc80cf9@syzkaller.appspotmail.com\nLink: https://syzkaller.appspot.com/bug?extid\u003db106284c2a0b7bc80cf9\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "c7e9a8cb6918656884a0757c92465075c7555ffa",
      "tree": "a39498f8aa32769047495ea32c3f745554a0d887",
      "parents": [
        "853a92b97ca547a7ddd9790ff90651b2fd943498"
      ],
      "author": {
        "name": "Guangshuo Li",
        "email": "lgs201920130244@gmail.com",
        "time": "Sat Aug 08 13:30:57 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:04:18 2026 -0400"
      },
      "message": "Bluetooth: hci_intel: fix usage_count leak when autosuspend_delay is negative\n\nintel_set_power() calls pm_runtime_use_autosuspend() when powering on\nthe device, but the power-off path does not call the matching\npm_runtime_dont_use_autosuspend() before disabling runtime PM.\n\nIf the autosuspend delay is set to a negative value while autosuspend\nis enabled, the runtime PM core increments usage_count to prevent\nruntime suspend. Without calling pm_runtime_dont_use_autosuspend()\nduring teardown, this reference is not dropped and usage_count remains\nunbalanced.\n\nAdd the missing pm_runtime_dont_use_autosuspend() call before disabling\nruntime PM.\n\nThis issue was found by manual code inspection.\n\nFixes: 74cdad37cd24 (\"Bluetooth: hci_intel: Add runtime PM support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "853a92b97ca547a7ddd9790ff90651b2fd943498",
      "tree": "98bbb0c275909eb5e3efe24bedf3609f34d687f7",
      "parents": [
        "dc6b7c771a963e20aedf4a21ffa22543b9837ba8"
      ],
      "author": {
        "name": "Guangshuo Li",
        "email": "lgs201920130244@gmail.com",
        "time": "Sat Aug 08 13:26:54 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:04:11 2026 -0400"
      },
      "message": "Bluetooth: hci_h5: fix usage_count leak when autosuspend_delay is negative\n\nh5_btrtl_open() calls pm_runtime_use_autosuspend(), but\nh5_btrtl_close() does not call the matching\npm_runtime_dont_use_autosuspend() when tearing down runtime PM.\n\nIf the autosuspend delay is set to a negative value while autosuspend\nis enabled, the runtime PM core increments usage_count to prevent\nruntime suspend. Without calling pm_runtime_dont_use_autosuspend()\nduring driver teardown, this reference is not dropped and usage_count\nremains unbalanced.\n\nAdd the missing pm_runtime_dont_use_autosuspend() call before disabling\nruntime PM.\n\nThis issue was found by manual code inspection.\n\nFixes: d9dd833cf6d2 (\"Bluetooth: hci_h5: Add runtime suspend\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "dc6b7c771a963e20aedf4a21ffa22543b9837ba8",
      "tree": "91d902c50c0d3dbd9ea2c46f7e1925c6f69e7693",
      "parents": [
        "cb19774faa57c51efa189d8b8606aeabccebc53b"
      ],
      "author": {
        "name": "Guangshuo Li",
        "email": "lgs201920130244@gmail.com",
        "time": "Sat Aug 08 13:15:32 2026 +0800"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 13:04:03 2026 -0400"
      },
      "message": "Bluetooth: hci_bcm: fix usage_count leak when autosuspend_delay is negative\n\nbcm_request_irq() calls pm_runtime_use_autosuspend(), but bcm_close()\ndoes not call the matching pm_runtime_dont_use_autosuspend() when\ntearing down runtime PM.\n\nIf the autosuspend delay is set to a negative value while autosuspend\nis enabled, the runtime PM core increments usage_count to prevent\nruntime suspend. Without calling pm_runtime_dont_use_autosuspend()\nduring driver teardown, this reference is not dropped and usage_count\nremains unbalanced.\n\nAdd the missing pm_runtime_dont_use_autosuspend() call before disabling\nruntime PM.\n\nThis issue was found by manual code inspection.\n\nFixes: e88ab30d3669 (\"Bluetooth: hci_bcm: Add suspend/resume runtime PM functions\")\nCc: stable@vger.kernel.org\nSigned-off-by: Guangshuo Li \u003clgs201920130244@gmail.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "cb19774faa57c51efa189d8b8606aeabccebc53b",
      "tree": "f252e3fafec1783ecc9d7e0ca2adff265406b2ce",
      "parents": [
        "7cbfb180945ce529608e4d4e24a6d483699fab1e"
      ],
      "author": {
        "name": "Ibrahim Abdelkader",
        "email": "iabdelka@qti.qualcomm.com",
        "time": "Tue Aug 11 10:37:29 2026 +0200"
      },
      "committer": {
        "name": "Luiz Augusto von Dentz",
        "email": "luiz.von.dentz@intel.com",
        "time": "Mon Aug 24 12:48:58 2026 -0400"
      },
      "message": "Bluetooth: hci_sync: Clear HCI_CMD_PENDING when dropping the last request\n\nA synchronous HCI command that never receives a response leaves\nHCI_CMD_PENDING set: hci_req_cmd_complete() is the only place that clears\nit, and it only runs when a response matching the last command sent\narrives.\n\nhci_send_cmd_sync() populates hdev-\u003ereq_skb only when the flag transitions\nfrom clear to set, while hci_dev_open_sync() and hci_dev_close_sync() drop\nreq_skb without clearing the flag. After a timeout followed by either, the\ntwo disagree: the flag claims a request is outstanding while req_skb is\nNULL. Subsequent synchronous commands are then sent with no req_skb, so\nhci_event_packet() has nothing to match an arriving event against, and the\ncaller times out even though the controller answered.\n\nCommands answered by Command Complete recover on their own, since\nhci_req_cmd_complete() clears the flag as a side effect. Drivers using\n__hci_cmd_sync_ev() with a custom event do not, because a vendor event\nnever reaches that path. On a WCN3988 (hci_qca over UART) this makes a\ncontroller firmware hang unrecoverable: the driver injects a hardware\nerror and re-runs qca_setup(), qca_read_soc_version() waits for\nHCI_EV_VENDOR, the reply arrives within 4 ms and is discarded, and every\nretry fails the same way. The adapter is left down until the driver is\nunbound and rebound, or power is removed.\n\nClear the flag wherever the last request is dropped, restoring the\ninvariant that req_skb is non-NULL exactly when HCI_CMD_PENDING is set.\nVerified on hardware by forcing a command timeout: without this change\nsetup fails on every attempt, with it setup succeeds on the first.\n\nFixes: 2615fd9a7c25 (\"Bluetooth: hci_sync: Fix overwriting request callback\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ibrahim Abdelkader \u003ciabdelka@qti.qualcomm.com\u003e\nSigned-off-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n"
    },
    {
      "commit": "7cbfb180945ce529608e4d4e24a6d483699fab1e",
      "tree": "28d0c58fb834ce640b01ebaa6ab8f1107a9a9098",
      "parents": [
        "11efd7963dac9b036a7c9a435ab0e621188910e8"
      ],
      "author": {
        "name": "Giuseppe Piscitelli",
        "email": "ooonea@gmail.com",
        "time": "Thu Aug 20 17:45:03 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:51:40 2026 -0700"
      },
      "message": "net/sched: sch_cake: fix autorate reconfiguration throttling\n\nCAKE\u0027s autorate-ingress path intends to limit shaper reconfiguration to\nonce per 250 ms, but last_reconfig_time is only checked and never updated.\nSince the field stays zero, every qualifying capacity-estimate window can\ncall cake_reconfigure(), causing avoidable rate churn and scheduler work\nunder bursty traffic.\n\nStore the current timestamp when autorate actually reconfigures the qdisc\nso the guard enforces the intended interval.\n\nFixes: 7298de9cd725 (\"sch_cake: Add ingress mode\")\nSigned-off-by: Giuseppe Piscitelli \u003cooonea@gmail.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260820154503.892214-1-ooonea@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "11efd7963dac9b036a7c9a435ab0e621188910e8",
      "tree": "a3ac03352931e9c46c3a95dedaad680c239418cc",
      "parents": [
        "137b8ae233cabe7fc77cce86f5ba33bf1b369e26"
      ],
      "author": {
        "name": "Jian Shen",
        "email": "shenjian15@huawei.com",
        "time": "Thu Aug 20 20:43:46 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:49:13 2026 -0700"
      },
      "message": "net: hibmcge: fix page_pool DMA direction mismatch\n\nThe driver memsets the RX buffer page head to zero before\nsubmitting it to hardware, then calls dma_sync_single_for_device()\nwith DMA_TO_DEVICE.  This sync direction does not match the pool\ndma_dir which is DMA_FROM_DEVICE, violating the DMA API contract\nthat the sync direction must match the mapping direction.\n\nOn swiotlb platforms the mismatch can cause incorrect bounce-buffer\nbehaviour, and CONFIG_DMA_API_DEBUG emits a warning.\n\nSwitch the page_pool dma_dir to DMA_BIDIRECTIONAL so that the\nCPU-to-device memset sync becomes legal.\n\nFixes: c30595917585 (\"net: hibmcge: add support for pagepool on rx\")\nSigned-off-by: Jian Shen \u003cshenjian15@huawei.com\u003e\nSigned-off-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nLink: https://patch.msgid.link/20260820124346.4097115-1-shaojijie@huawei.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "137b8ae233cabe7fc77cce86f5ba33bf1b369e26",
      "tree": "78b6e2d5a6c5fe6ea3fd1e4a927bbf6da58126b1",
      "parents": [
        "039f248a6cc1f4dec895c001de2c600842022e58"
      ],
      "author": {
        "name": "Eric Dumazet",
        "email": "edumazet@google.com",
        "time": "Thu Aug 20 08:06:25 2026 -0400"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:47:53 2026 -0700"
      },
      "message": "net_sched: sch_fq: fix pacing delay underflow with pacing offload\n\nWhen pacing offload is enabled (q-\u003eoffload_horizon \u003e 0),\nFQ can dequeue packets early (now \u003c f-\u003etime_next_packet).\n\nIn this case, the drift calculation (now - f-\u003etime_next_packet)\nunderflows to a large unsigned value.\n\nmin(len/2, now - f-\u003etime_next_packet) then evaluates to len/2,\nincorrectly halving the pacing delay for the next packet.\n\nFix this by only applying drift compensation if now \u003e f-\u003etime_next_packet.\n\nThis bug was triggered when flow_max_rate was set on the qdisc\nor for non EDT packets (packets with a zero skb-\u003etstamp).\n\nFixes: f26080d47007 (\"net_sched: sch_fq: add the ability to offload pacing\")\nReported-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nCloses: https://lore.kernel.org/netdev/CANn89iK6O7ujR9zCJzd04MNLQoDi3mA+HWsR-hgQWYzLS3gZfw@mail.gmail.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260820120706.1995449-1-willemdebruijn.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "039f248a6cc1f4dec895c001de2c600842022e58",
      "tree": "d67428d2d0898693260bf489cb6f16a655d5b8e2",
      "parents": [
        "e16d750a906b05fa5cf475749668a96928aa0cbc"
      ],
      "author": {
        "name": "Rong Zhang",
        "email": "i@rong.moe",
        "time": "Fri Aug 21 01:41:25 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:28:14 2026 -0700"
      },
      "message": "net: page_pool: Remove zone/policy GFP flags when allocating XArray entries\n\nNet drivers request GFP flags according to both the current context and\nthe device constraints, but the XArray entry itself is by no mean used\nby the device. Passing though device constraints to XArray allocation is\na bug and will be warned and fixed up by slab, e.g.:\n\n    Unexpected gfp: 0x4 (GFP_DMA32). Fixing up to gfp: 0x82820 (GFP_ATOMIC|__GFP_NOWARN|__GFP_NOMEMALLOC). Fix your code!\n    CPU: 2 UID: 0 PID: 1071629 Comm: kworker/u80:1 Not tainted 7.2.0-rc7+ #1 PREEMPT(lazy)\n    Hardware name: LENOVO 21Q4/LNVNB161216, BIOS PXCN27WW 10/20/2025\n    Workqueue: mt76 mt792x_pm_wake_work [mt792x_lib]\n    Call Trace:\n     \u003cTASK\u003e\n     dump_stack_lvl+0x6e/0x90\n     kmalloc_fix_flags+0x4d/0x6a\n     refill_objects+0x10a/0x330\n     __pcs_replace_empty_main+0x292/0x5c0\n     kmem_cache_alloc_lru_noprof+0x4c2/0x680\n     ? __xas_nomem+0x3a/0x120\n     __xas_nomem+0x3a/0x120\n     __xa_alloc+0xd4/0x190\n     page_pool_dma_map+0xef/0x400\n     __page_pool_alloc_netmems_slow+0xed/0x480\n     ? lock_release+0x280/0x490\n     page_pool_alloc_frag_netmem+0xe0/0x3a0\n     page_pool_alloc_frag+0xe/0x20\n     mt76_dma_rx_fill_buf+0x1f6/0x580 [mt76]\n     mt76_dma_rx_reset+0x1cf/0x230 [mt76]\n     mt792x_wpdma_reset+0x183/0x1b0 [mt792x_lib]\n     mt792x_wpdma_reinit_cond+0x5e/0xa0 [mt792x_lib]\n     mt792xe_mcu_drv_pmctrl+0x28/0x60 [mt792x_lib]\n     mt792x_mcu_drv_pmctrl+0x3e/0x90 [mt792x_lib]\n     mt792x_pm_wake_work+0x2d/0x1d0 [mt792x_lib]\n     ? process_one_work+0x20e/0x600\n     process_one_work+0x230/0x600\n     ? process_one_work+0x256/0x600\n     worker_thread+0x1ec/0x3c0\n     ? rescuer_thread+0x610/0x610\n     kthread+0xf2/0x130\n     ? kthread_affine_node+0x140/0x140\n     ret_from_fork+0x2a5/0x380\n     ? kthread_affine_node+0x140/0x140\n     ret_from_fork_asm+0x11/0x20\n     \u003c/TASK\u003e\n\nCurrently mt76 and stmmac may allocate page pool pages with GFP_DMA32.\n\nFix it by removing zone/policy GFP flags when allocating XArray entries.\nThis is inspired by commit 96d578088085 (\"iommu/dma: Use the gfp\nparameter in __iommu_dma_alloc_noncontiguous()\").\n\nFixes: ee62ce7a1d90 (\"page_pool: Track DMA-mapped pages and unmap them when destroying the pool\")\nSigned-off-by: Rong Zhang \u003ci@rong.moe\u003e\nReviewed-by: Toke Høiland-Jørgensen \u003ctoke@redhat.com\u003e\nLink: https://patch.msgid.link/20260821-page-pool-xa-drop-dma32-v1-1-6eab295c3478@rong.moe\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "e16d750a906b05fa5cf475749668a96928aa0cbc",
      "tree": "1d2fd7febed1f1baf047da3368070a3f27afc15e",
      "parents": [
        "f05516dd7b865666ea7d67e90d0edb588ae9ad18",
        "8d3c1ab82c11d4fadebf817a825fd221b3e197ea"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:25:54 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:25:55 2026 -0700"
      },
      "message": "Merge branch \u0027net-smc-fix-out-of-bounds-and-use-after-free-in-smc-rv2-llc-processing\u0027\n\nYehyeong Lee says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/smc: fix out-of-bounds and use-after-free in SMC-Rv2 LLC processing\n\nPatch 1 fixes a use-after-free of the LLC queue entry in\nsmc_llc_srv_add_link(), patch 2 bounds the peer\u0027s rkey counts, and patch 3\ncarries the tail of an oversized v2 message in the queue entry so that both\nreaders are bounded by what arrived. All three are tagged for stable: a\ntree that takes 1 and 2 without 3 still deletes rkeys read from whatever an\nearlier message left in the shared receive buffer.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260819023306.644849-1-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "8d3c1ab82c11d4fadebf817a825fd221b3e197ea",
      "tree": "1d2fd7febed1f1baf047da3368070a3f27afc15e",
      "parents": [
        "2d1e7c5aaa3326e95e2058457f172ca99a9a4577"
      ],
      "author": {
        "name": "Yehyeong Lee",
        "email": "yhlee@isslab.korea.ac.kr",
        "time": "Wed Aug 19 11:33:06 2026 +0900"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:25:52 2026 -0700"
      },
      "message": "net/smc: carry oversized SMC-Rv2 LLC messages in the queue entry\n\nsmc_llc_rmt_delete_rkey() and smc_llc_save_add_link_rkeys() read the part\nof a v2 message that does not fit into the 44-byte union smc_llc_msg, and\nboth bound themselves by the size of the buffer it landed in, not by what\narrived. On a link with a shared v2 receive buffer a 44-byte\nDELETE_RKEY_V2 declaring 255 rkeys reaches rkey[9..254] in whatever an\nearlier message left in lgr-\u003ewr_rx_buf_v2, and passes each of them to\nsmc_rtoken_delete(). One of those 255 matched a registered rtoken and\ndeleted it. An ADD_LINK on such a link installs up to 255 rtokens from\nthe same bytes.\n\nCopy the tail into the queue entry, so its length is the length of the\nmessage that arrived, and declare the rkeys that fit inline as a member of\nthe union instead of reaching them through a cast. The same\nDELETE_RKEY_V2 now processes the 9 rkeys it carries. The copy is limited\nto the longest tail the two functions can read, so the peer does not pick\nthe size of the entry.\n\nThe bound the previous patch placed on links without a shared v2 receive\nbuffer is no longer needed.\n\nFixes: 27ef6a9981fe (\"net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1\")\nCc: stable@vger.kernel.org\nSuggested-by: D. Wythe \u003calibuda@linux.alibaba.com\u003e\nReviewed-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nSigned-off-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260819023306.644849-4-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "2d1e7c5aaa3326e95e2058457f172ca99a9a4577",
      "tree": "6f00399441535fac78bb7512bd8c32845a4a996d",
      "parents": [
        "a42a459ef0e54cb0c4b3e43e21cb0e658e664f64"
      ],
      "author": {
        "name": "Yehyeong Lee",
        "email": "yhlee@isslab.korea.ac.kr",
        "time": "Wed Aug 19 11:33:05 2026 +0900"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:25:51 2026 -0700"
      },
      "message": "net/smc: bound the peer rkey counts in SMC-Rv2 LLC messages\n\nOn a link whose device has max_recv_sge \u003d\u003d 1 there is no shared v2 receive\nbuffer, and smc_llc_save_add_link_rkeys() takes the v2 extension from 44\nbytes past the start of the queue entry\u0027s inline message:\n\n  ext \u003d (struct smc_llc_msg_add_link_v2_ext *)(llc_msg + SMC_WR_TX_SIZE);\n\nThe entry is a 72-byte allocation and the extension starts at offset 68, so\next-\u003enum_rkeys at offset 94 is already past it. This happens on every\nSMC-Rv2 link addition, whatever the peer sends:\n\n  [    2.490065] BUG: KASAN: slab-out-of-bounds in smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490431] Read of size 2 at addr ffff8880056406de by task smctest/106\n  [    2.490709]\n  [    2.490792] CPU: 0 UID: 0 PID: 106 Comm: smctest Not tainted 7.2.0-rc5-p1-g77a5d9d9c99f #32 PREEMPT(lazy)\n  [    2.490795] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  [    2.490798] Call Trace:\n  [    2.490803]  \u003cTASK\u003e\n  [    2.490805]  dump_stack_lvl+0x53/0x70\n  [    2.490810]  print_report+0xd0/0x630\n  [    2.490828]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [    2.490832]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490834]  kasan_report+0xce/0x100\n  [    2.490836]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490837]  smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.490839]  ? smcr_buf_map_lgr+0x1bf/0x2b0\n  [    2.490844]  smc_llc_cli_add_link+0xca7/0x1e80\n  [    2.490848]  ? smc_llc_wait+0x355/0x810\n  [    2.490850]  ? __pfx_smc_llc_wait+0x10/0x10\n  [    2.490851]  ? __pfx_smc_llc_cli_add_link+0x10/0x10\n  [    2.490853]  ? __pfx_autoremove_wake_function+0x10/0x10\n  [    2.490863]  __smc_connect+0x3f5c/0x4980\n  [    2.490873]  ? __pfx_kernel_connect+0x10/0x10\n  [    2.490888]  ? __pfx___smc_connect+0x10/0x10\n  [    2.490891]  ? release_sock+0x148/0x1d0\n  [    2.490894]  smc_connect+0x42c/0x580\n  [    2.490896]  __sys_connect+0xfc/0x130\n  [    2.490898]  ? __pfx___sys_connect+0x10/0x10\n  [    2.490900]  ? handle_mm_fault+0x1a1/0x430\n  [    2.490908]  __x64_sys_connect+0x6d/0xb0\n  [    2.490909]  ? fpregs_assert_state_consistent+0x56/0xe0\n  [    2.490917]  do_syscall_64+0xf9/0x540\n  [    2.490921]  entry_SYSCALL_64_after_hwframe+0x77/0x7f\n  [    2.490924] RIP: 0033:0x421bb4\n  [    2.490927] Code: ff f7 d8 64 89 01 48 83 c8 ff c3 66 2e 0f 1f 84 00 00 00 00 00 90 f3 0f 1e fa 80 3d ad 34 09 00 00 74 13 b8 2a 00 00 00 0f 05 \u003c48\u003e 3d 00 f0 ff ff 77 4c c3 0f 1f 00 55 48 89 e5 48 83 ec 10 89 55\n  [    2.490929] RSP: 002b:00007ffd473b01a8 EFLAGS: 00000202 ORIG_RAX: 000000000000002a\n  [    2.490935] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000000421bb4\n  [    2.490936] RDX: 0000000000000010 RSI: 00007ffd473b01d0 RDI: 0000000000000003\n  [    2.490937] RBP: 0000000000003930 R08: 0000000000000004 R09: 0000000000000000\n  [    2.490938] R10: 00007ffd473b0f98 R11: 0000000000000202 R12: 0000000000000006\n  [    2.490939] R13: 00007ffd473b0f87 R14: 0000000000000003 R15: 00007ffd473b0f90\n  [    2.490940]  \u003c/TASK\u003e\n  [    2.490941]\n  [    2.499545] Allocated by task 44:\n  [    2.499693]  kasan_save_stack+0x33/0x60\n  [    2.499860]  kasan_save_track+0x14/0x30\n  [    2.500026]  __kasan_kmalloc+0x8f/0xa0\n  [    2.500190]  __kmalloc_cache_noprof+0x158/0x370\n  [    2.500393]  smc_llc_enqueue+0x72/0x560\n  [    2.500559]  smc_wr_rx_tasklet_fn+0x474/0xa80\n  [    2.500747]  tasklet_action_common+0x20f/0x8a0\n  [    2.500945]  handle_softirqs+0x18e/0x590\n  [    2.501115]  do_softirq+0x3b/0x60\n  [    2.501266]  __local_bh_enable_ip+0x61/0x70\n  [    2.501446]  __alloc_skb+0x732/0x890\n  [    2.501604]  rxe_init_packet+0x16b/0x4f0\n  [    2.501783]  prepare_ack_packet+0xb8/0x830\n  [    2.501962]  rxe_receiver+0x495/0x96e0\n  [    2.502125]  do_work+0x144/0x470\n  [    2.502269]  process_one_work+0x633/0x1030\n  [    2.502450]  worker_thread+0x45b/0xd10\n  [    2.502617]  kthread+0x2c6/0x3b0\n  [    2.502762]  ret_from_fork+0x36e/0x5a0\n  [    2.502925]  ret_from_fork_asm+0x1a/0x30\n  [    2.503103]\n  [    2.503177] The buggy address belongs to the object at ffff888005640680\n  [    2.503177]  which belongs to the cache kmalloc-96 of size 96\n  [    2.503692] The buggy address is located 22 bytes to the right of\n  [    2.503692]  allocated 72-byte region [ffff888005640680, ffff8880056406c8)\n  [    2.504227]\n  [    2.504300] The buggy address belongs to the physical page:\n  [    2.504535] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5640\n  [    2.504865] flags: 0x100000000000000(node\u003d0|zone\u003d1)\n  [    2.505076] page_type: f5(slab)\n  [    2.505221] raw: 0100000000000000 ffff888001041280 dead000000000122 0000000000000000\n  [    2.505544] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000\n  [    2.505867] page dumped because: kasan: bad access detected\n  [    2.506102]\n  [    2.506176] Memory state around the buggy address:\n  [    2.506380]  ffff888005640580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n  [    2.506683]  ffff888005640600: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n  [    2.506987] \u003effff888005640680: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n  [    2.507291]                                                     ^\n  [    2.507548]  ffff888005640700: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n  [    2.507850]  ffff888005640780: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n\nWhatever that read finds then bounds the ext-\u003ert[] loop, so a peer that\ndeclares 255 rkeys reads much further. smc_llc_rmt_delete_rkey() has the\nsame shape for llcv2-\u003erkey[].\n\nBound both loops by the buffer they read from, and skip the extension\naltogether when there is no shared v2 receive buffer. The extension\ndoes arrive on the link, but smc_llc_enqueue() copies only\nsizeof(union smc_llc_msg) into the queue entry, so what that code read\npast the 44 inline bytes was heap and not peer data.\n\nFixes: 27ef6a9981fe (\"net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1\")\nCc: stable@vger.kernel.org\nReviewed-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nSigned-off-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260819023306.644849-3-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "a42a459ef0e54cb0c4b3e43e21cb0e658e664f64",
      "tree": "f2ec16eb0a9f2e183c474c58358e3797e4be0e20",
      "parents": [
        "f05516dd7b865666ea7d67e90d0edb588ae9ad18"
      ],
      "author": {
        "name": "Yehyeong Lee",
        "email": "yhlee@isslab.korea.ac.kr",
        "time": "Wed Aug 19 11:33:04 2026 +0900"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:25:51 2026 -0700"
      },
      "message": "net/smc: fix use-after-free of the LLC qentry in smc_llc_srv_add_link()\n\nsmc_llc_srv_add_link() keeps add_llc pointing into the queue entry:\n\n  add_llc \u003d \u0026qentry-\u003emsg.add_link;\t\t\tsmc_llc.c:1482\n  ...\n  smc_llc_save_add_link_info(link_new, add_llc);\tsmc_llc.c:1494\n  smc_llc_flow_qentry_del(\u0026lgr-\u003ellc_flow_lcl);\t\tsmc_llc.c:1495\n  ...\n  u8 *llc_msg \u003d smc_link_shared_v2_rxbuf(link) ?\n\t(u8 *)lgr-\u003ewr_rx_buf_v2 : (u8 *)add_llc;\tsmc_llc.c:1504\n  smc_llc_save_add_link_rkeys(link, link_new, llc_msg);\tsmc_llc.c:1506\n\nsmc_llc_flow_qentry_del() kfree()s the entry, so on a link without a shared\nv2 receive buffer the pointer handed to smc_llc_save_add_link_rkeys() is\nalready freed. Before the Fixes: commit that branch always used\nlgr-\u003ewr_rx_buf_v2 and add_llc was not used after the free.\n\nReproduced on an unpatched tree over rxe, with KASAN, kasan_multi_shot\nand a link forced to max_recv_sge \u003d\u003d 1: the entry is freed and read by\nthe same call, and the freeing frame is smc_llc_srv_add_link() itself.\n\n  [    2.523161] BUG: KASAN: slab-use-after-free in smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523499] Read of size 2 at addr ffff8880052194de by task kworker/0:1/11\n  [    2.523789]\n  [    2.523862] CPU: 0 UID: 0 PID: 11 Comm: kworker/0:1 Not tainted 7.2.0-rc5-p0-g2c9dd296545d #35 PREEMPT(lazy)\n  [    2.523865] Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix, 1996), BIOS 1.16.3-debian-1.16.3-2 04/01/2014\n  [    2.523866] Workqueue: smc_hs_wq smc_listen_work\n  [    2.523869] Call Trace:\n  [    2.523870]  \u003cTASK\u003e\n  [    2.523871]  dump_stack_lvl+0x53/0x70\n  [    2.523872]  print_report+0xd0/0x630\n  [    2.523874]  ? __pfx__raw_spin_lock_irqsave+0x10/0x10\n  [    2.523876]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523878]  kasan_report+0xce/0x100\n  [    2.523879]  ? smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523881]  smc_llc_save_add_link_rkeys+0x333/0x350\n  [    2.523883]  ? smcr_buf_reg_lgr+0x2a4/0x660\n  [    2.523885]  smc_llc_srv_add_link+0xaa2/0x1e50\n  [    2.523888]  ? _printk+0xba/0xf0\n  [    2.523897]  ? __pfx_smc_llc_srv_add_link+0x10/0x10\n  [    2.523899]  ? down_write+0xb0/0x130\n  [    2.523903]  ? __pfx_down_write+0x10/0x10\n  [    2.523905]  smc_listen_work+0x489e/0x4d00\n  [    2.523907]  ? kmem_cache_free+0x1c6/0x3a0\n  [    2.523911]  ? __pfx_smc_listen_work+0x10/0x10\n  [    2.523913]  ? release_sock+0x148/0x1d0\n  [    2.523915]  ? smc_tcp_listen_work+0xb4f/0xfc0\n  [    2.523917]  ? _raw_spin_lock_irq+0x80/0xe0\n  [    2.523918]  ? __pfx__raw_spin_lock_irq+0x10/0x10\n  [    2.523920]  process_one_work+0x633/0x1030\n  [    2.523922]  ? assign_work+0x11d/0x370\n  [    2.523924]  worker_thread+0x45b/0xd10\n  [    2.523926]  ? __pfx_worker_thread+0x10/0x10\n  [    2.523928]  ? __pfx_worker_thread+0x10/0x10\n  [    2.523929]  kthread+0x2c6/0x3b0\n  [    2.523931]  ? recalc_sigpending+0x15c/0x1e0\n  [    2.523934]  ? __pfx_kthread+0x10/0x10\n  [    2.523935]  ret_from_fork+0x36e/0x5a0\n  [    2.523937]  ? __pfx_ret_from_fork+0x10/0x10\n  [    2.523938]  ? __switch_to+0x572/0xdd0\n  [    2.523943]  ? __pfx_kthread+0x10/0x10\n  [    2.523944]  ret_from_fork_asm+0x1a/0x30\n  [    2.523947]  \u003c/TASK\u003e\n  [    2.523948]\n  [    2.531253] Allocated by task 48:\n  [    2.531399]  kasan_save_stack+0x33/0x60\n  [    2.531570]  kasan_save_track+0x14/0x30\n  [    2.531737]  __kasan_kmalloc+0x8f/0xa0\n  [    2.531905]  __kmalloc_cache_noprof+0x158/0x370\n  [    2.532100]  smc_llc_enqueue+0x72/0x560\n  [    2.532268]  smc_wr_rx_tasklet_fn+0x474/0xa80\n  [    2.532491]  tasklet_action_common+0x20f/0x8a0\n  [    2.532714]  handle_softirqs+0x18e/0x590\n  [    2.532886]  do_softirq+0x3b/0x60\n  [    2.533036]  __local_bh_enable_ip+0x61/0x70\n  [    2.533221]  __alloc_skb+0x732/0x890\n  [    2.533384]  rxe_init_packet+0x16b/0x4f0\n  [    2.533567]  prepare_ack_packet+0xb8/0x830\n  [    2.533760]  rxe_receiver+0x495/0x96e0\n  [    2.533933]  do_work+0x144/0x470\n  [    2.534078]  process_one_work+0x633/0x1030\n  [    2.534257]  worker_thread+0x45b/0xd10\n  [    2.534424]  kthread+0x2c6/0x3b0\n  [    2.534569]  ret_from_fork+0x36e/0x5a0\n  [    2.534737]  ret_from_fork_asm+0x1a/0x30\n  [    2.534907]\n  [    2.534980] Freed by task 11:\n  [    2.535112]  kasan_save_stack+0x33/0x60\n  [    2.535279]  kasan_save_track+0x14/0x30\n  [    2.535444]  kasan_save_free_info+0x3b/0x60\n  [    2.535625]  __kasan_slab_free+0x43/0x70\n  [    2.535798]  kfree+0x121/0x380\n  [    2.535935]  smc_llc_srv_add_link+0x9a8/0x1e50\n  [    2.536128]  smc_listen_work+0x489e/0x4d00\n  [    2.536305]  process_one_work+0x633/0x1030\n  [    2.536482]  worker_thread+0x45b/0xd10\n  [    2.536652]  kthread+0x2c6/0x3b0\n  [    2.536794]  ret_from_fork+0x36e/0x5a0\n  [    2.536958]  ret_from_fork_asm+0x1a/0x30\n  [    2.537133]\n  [    2.537205] The buggy address belongs to the object at ffff888005219480\n  [    2.537205]  which belongs to the cache kmalloc-96 of size 96\n  [    2.537719] The buggy address is located 94 bytes inside of\n  [    2.537719]  freed 96-byte region [ffff888005219480, ffff8880052194e0)\n  [    2.538216]\n  [    2.538289] The buggy address belongs to the physical page:\n  [    2.538524] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x5219\n  [    2.538857] flags: 0x100000000000000(node\u003d0|zone\u003d1)\n  [    2.539066] page_type: f5(slab)\n  [    2.539210] raw: 0100000000000000 ffff888001041280 dead000000000122 0000000000000000\n  [    2.539534] raw: 0000000000000000 0000000000200020 00000000f5000000 0000000000000000\n  [    2.539863] page dumped because: kasan: bad access detected\n  [    2.540098]\n  [    2.540170] Memory state around the buggy address:\n  [    2.540379]  ffff888005219380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  [    2.540684]  ffff888005219400: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n  [    2.540988] \u003effff888005219480: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc\n  [    2.541291]                                                     ^\n  [    2.541548]  ffff888005219500: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n  [    2.541857]  ffff888005219580: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc\n\nThe offset is past the 72-byte queue entry because the out-of-bounds read\nfixed by the next patch is on the same line; what this patch removes is the\nfree at smc_llc_srv_add_link+0x9a8 happening before the read at +0xaa2.\n\nDetach the entry instead of freeing it there, and free it at the single\nexit label. The reject path has to detach as well, otherwise it would be\nfreed twice.\n\nThis changes only the lifetime of the entry. The same read still runs past\nits end until the next two patches bound it, so a backport wants all three.\n\nFixes: 27ef6a9981fe (\"net/smc: support SMC-R V2 for rdma devices with max_recv_sge equals to 1\")\nCc: stable@vger.kernel.org\nReviewed-by: Sidraya Jayagond \u003csidraya@linux.ibm.com\u003e\nSigned-off-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260819023306.644849-2-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "f05516dd7b865666ea7d67e90d0edb588ae9ad18",
      "tree": "849e9bbc1f32ca98e2609c4f575a832353f8e4d9",
      "parents": [
        "06aa3d26327f24edd039ff249672fdf6f2ba5695"
      ],
      "author": {
        "name": "Jiawen Wu",
        "email": "jiawenwu@trustnetic.com",
        "time": "Tue Aug 18 15:47:21 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:24:18 2026 -0700"
      },
      "message": "net: libwx: fix concurrent bitmap overwrite in PTP setup\n\nIn wx_ptp_set_timestamp_mode(), the driver copies the global `wx-\u003eflags`\nbitmap to a local variable, modifies the PTP-related bits, and then writes\nthe entire bitmap back using memcpy().\n\nThis Read-Copy-Update pattern is unsafe and introduces a critical race\ncondition. Other asynchronous contexts (such as Tx timeout routines or\nGPIO IRQ handlers) update individual bits in `wx-\u003eflags` concurrently\nusing atomic bitops like set_bit() or clear_bit(). The memcpy() write-back\ncan silently overwrite and drop these concurrent changes, potentially\ncausing the driver to miss critical module reset or PCIe recovery requests.\n\nFix this by removing the local bitmap copy. Instead, evaluate the intended\nPTP flag states locally and apply them directly to `wx-\u003eflags` using\natomic set_bit() and clear_bit() operations only after the hardware is\nsuccessfully configured.\n\nFixes: 06e75161b9d4 (\"net: wangxun: Add support for PTP clock\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/6C7EC12D69217315+20260818074721.45536-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "06aa3d26327f24edd039ff249672fdf6f2ba5695",
      "tree": "853ffa179eae6766b465543d362d671fed9ce995",
      "parents": [
        "7bf29145d7a9564162c6b18f8d23760e141e2d15"
      ],
      "author": {
        "name": "Vaibhav Nagare",
        "email": "nagarevaibhav@gmail.com",
        "time": "Tue Aug 18 13:03:09 2026 +0530"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:23:02 2026 -0700"
      },
      "message": "qede: Fix NULL pointer dereference in TPA fragment processing\n\nUnder memory pressure, the qede driver encounters NULL pointer\ndereferences when processing TPA continuation fragments.\n\nCommit 8a8633978b84 (\"qede: Add build_skb() support.\") accidentally\ndropped the assignment of tpa_info-\u003ebuffer.data in qede_tpa_start().\n\nWhen memory pressure causes an SKB allocation failure in qede_tpa_start(),\nthe driver sets tpa_start_fail \u003d true and attempts to recycle the physical\npage later in qede_tpa_end() via qede_reuse_page(). However, because\nbuffer.data was left uninitialized (NULL), qede_reuse_page() pushes a\n\"ghost\" BD (valid DMA mapping but NULL data pointer) back into the\nactive Rx ring.\n\nThe next time the hardware uses this ring slot, it passes a NULL page\nto qede_fill_frag_skb(), causing a kernel panic.\n\nExample crash from production system:\n BUG: unable to handle kernel NULL pointer dereference at 0x8\n RIP: qede_fill_frag_skb+0x96/0x430 [qede]\n Call Trace:\n   qede_rx_int+0xb06/0x1de0\n   qede_poll+0x2f4/0x6c0\n   __napi_poll+0x2d/0x130\n\nFix the root cause by restoring the tpa_info-\u003ebuffer.data assignment\nin qede_tpa_start(), ensuring valid pages are correctly tracked and\nrecycled. Additionally, update the stale comment for\nstruct qede_agg_info::buffer to reflect its current usage.\n\nFixes: 8a8633978b84 (\"qede: Add build_skb() support.\")\nCc: stable@vger.kernel.org\nSigned-off-by: Vaibhav Nagare \u003cvnagare@redhat.com\u003e\nLink: https://patch.msgid.link/20260818073309.2266072-1-vnagare@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "7bf29145d7a9564162c6b18f8d23760e141e2d15",
      "tree": "5770daa5d076b646c264ecd55bf3bbe29108e09a",
      "parents": [
        "dac0c3fa97cb2d554ed17688722020ac68632cbe"
      ],
      "author": {
        "name": "Jiawen Wu",
        "email": "jiawenwu@trustnetic.com",
        "time": "Tue Aug 18 10:30:26 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:22:15 2026 -0700"
      },
      "message": "net: txgbe: fix MISC interrupt unmasking in non-MSI-X mode and device shutdown\n\nIn txgbe_misc_irq_thread_fn(), the driver unmasks the miscellaneous\ninterrupt at the end of the handler using TXGBE_INTR_MISC(wx) (which\nresolves to BIT(wx-\u003enum_q_vectors)). While this is correct for MSI-X\nmode, it is incorrect for legacy INTx or single MSI modes.\n\nDue to hardware behavior, the WX_PX_MISC_IVAR register is completely\nignored by the hardware when MSI-X is disabled. In non-MSI-X mode, the\nhardware forcibly merges all interrupt causes (both Queue and MISC) into\na single bit: BIT(0) of the interrupt register.\n\nUnconditionally unmasking TXGBE_INTR_MISC(wx) (e.g., BIT(1)) in non-MSI-X\nmode means the actual MISC interrupt bit (BIT(0)) is not unmasked\npromptly at the end of the MISC thread. Instead, it remains masked until\nNAPI completes its polling and unmasks the shared BIT(0). This delays the\nassertion of subsequent MISC interrupts, preventing timely handling of\nevents like link state changes.\n\nFix this by explicitly checking `pdev-\u003emsix_enabled` and falling back\nto BIT(0) as the interrupt mask for the MISC cause when MSI-X is disabled.\n\nAdditionally, unconditionally unmasking the interrupt at the end of the\nthread introduces a race condition during device teardown. Guarding the\nwx_intr_enable() call with a check for the WX_STATE_DOWN bit, to prevent\nre-arming the interrupt during device shutdown.\n\nFixes: e37546ad1f9b (\"net: wangxun: revert the adjustment of the IRQ vector sequence\")\nSigned-off-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/56A53978B83EEDE9+20260818023026.6631-1-jiawenwu@trustnetic.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "dac0c3fa97cb2d554ed17688722020ac68632cbe",
      "tree": "a83e40ed9fc59b2df8cb2aeeb0e2a5bdd7e9699d",
      "parents": [
        "498386b6d402737db1e2eeed4c385acbf0ef9e34",
        "b62793a7baeea9cf20209c9fd2e333311aaf3b8d"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:21:29 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:21:29 2026 -0700"
      },
      "message": "Merge branch \u0027net-sparx5-misc-fixes-for-sparx5-and-lan969x\u0027\n\nDaniel Machon says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: sparx5: misc fixes for sparx5 and lan969x\n\nThis series fixes various issues in the sparx5 driver, which also\nserves lan969x.\n\nDetails are in the individual commit descriptions.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-0-c7c7fef723a8@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b62793a7baeea9cf20209c9fd2e333311aaf3b8d",
      "tree": "a83e40ed9fc59b2df8cb2aeeb0e2a5bdd7e9699d",
      "parents": [
        "b7adcc56fd3db4f5ddaf8c01069d26136d61e5c8"
      ],
      "author": {
        "name": "Daniel Machon",
        "email": "daniel.machon@microchip.com",
        "time": "Mon Aug 17 17:41:59 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:21:26 2026 -0700"
      },
      "message": "net: sparx5: fix sleep in atomic context in MAC table access\n\nsparx5_set_rx_mode() runs with netif_addr_lock_bh held and iterates\ndev-\u003emc via __dev_mc_sync(), which per address calls sparx5_mc_sync() /\nsparx5_mc_unsync() -\u003e sparx5_mact_learn() / sparx5_mact_forget().  These\ntake sparx5-\u003elock, a mutex, and then poll the MAC access command\nregister with readx_poll_timeout(). A mutex may block, which is not\nallowed from atomic context.\n\nConvert the driver to the new .ndo_set_rx_mode_async callback introduced\nin commit 3554b4345d85 (\"net: introduce ndo_set_rx_mode_async and\nnetdev_rx_mode_work\"). The async callback is invoked from process\ncontext, so the mutex and sleeping completion poll can remain.\n\nObserved with CONFIG_PROVE_LOCKING, CONFIG_DEBUG_SPINLOCK,\nCONFIG_DEBUG_MUTEXES and CONFIG_DEBUG_ATOMIC_SLEEP enabled:\n\n  BUG: sleeping function called from invalid context at kernel/locking/mutex.c:591\n  in_atomic(): 1, irqs_disabled(): 0, non_block: 0, pid: 217, name: ip\n  preempt_count: 201, expected: 0\n  Call trace:\n   __might_resched+0x144/0x248\n   __might_sleep+0x48/0x7c\n   __mutex_lock+0x74/0x850\n   mutex_lock_nested+0x24/0x30\n   sparx5_mact_learn+0x78/0x100\n   sparx5_mc_sync+0x40/0x54\n   __hw_addr_sync_dev+0xc4/0x170\n   sparx5_set_rx_mode+0x4c/0x58\n   __dev_set_rx_mode+0x64/0xa4\n   __dev_open+0x1ec/0x26c\n\nFixes: d6fce5141929 (\"net: sparx5: add switching support\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-2-c7c7fef723a8@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "b7adcc56fd3db4f5ddaf8c01069d26136d61e5c8",
      "tree": "2701257a2e6c25bec0dc840e22be862bbe422424",
      "parents": [
        "498386b6d402737db1e2eeed4c385acbf0ef9e34"
      ],
      "author": {
        "name": "Daniel Machon",
        "email": "daniel.machon@microchip.com",
        "time": "Mon Aug 17 17:41:58 2026 +0200"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:21:26 2026 -0700"
      },
      "message": "net: microchip: vcap: use port number instead of netdev name for debugfs\n\nsparx5_vcap_init() runs before sparx5_register_netdevs() in probe, and\nits debugfs setup calls vcap_port_debugfs() for every port using\nnetdev_name(ndev) as the debugfs file name. At that point the netdevs\nhave only been allocated, not registered, so dev-\u003ename still holds the\n\"eth%d\" template and netdev_name() returns \"(unnamed net_device)\".\nEvery port tries to create the same file under vcaps/, producing a\nflood of warnings at boot:\n\n  debugfs: \u0027(unnamed net_device)\u0027 already exists in \u0027vcaps\u0027\n  debugfs: \u0027(unnamed net_device)\u0027 already exists in \u0027vcaps\u0027\n  ...\n\nAdd vcap_port_debugfs_portno(), a variant of vcap_port_debugfs() that\ntakes the port\u0027s stable hardware port number and uses \"p%u\" as the\ndebugfs file name instead of netdev_name(ndev). This makes the file\nname independent of registration order; the file still stores and\nlater dereferences the netdev itself, same as before. sparx5 already\nreports the same \"p%d\" string via ndo_get_phys_port_name(), so the\ndebugfs name now matches that.\n\nOnly sparx5 (and lan969x, which shares this code) is switched to the\nnew function. lan966x keeps calling vcap_port_debugfs() unchanged, so\nthis fix does not rename any of its existing debugfs files.\n\nFixes: b8909aad5b8d (\"net: sparx5: move netdev and notifier block registration to probe\")\nSigned-off-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20260817-misc-fixes-sparx5-lan969x-v3-1-c7c7fef723a8@microchip.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "498386b6d402737db1e2eeed4c385acbf0ef9e34",
      "tree": "8b30267a5e7a58bfb83a7a75e07ac0a3c4a20781",
      "parents": [
        "71283aaa6c65b3cec84caf1dc78560985737641f"
      ],
      "author": {
        "name": "Qing Ming",
        "email": "a0yami@mailbox.org",
        "time": "Tue Aug 18 23:00:00 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:17:12 2026 -0700"
      },
      "message": "gtp: serialize PDP context updates\n\nPDP contexts can be deleted through GTP_CMD_DELPDP or while the GTP\nnetwork device is being unregistered. The latter is serialized by RTNL,\nbut the generic-netlink delete path only holds RCU.\n\nRunning both paths concurrently can therefore make both paths delete the\nsame PDP context. The issue was found through static analysis and\nreproduced on a KASAN-enabled kernel by a simple two-thread program\nracing GTP_CMD_DELPDP against RTM_DELLINK:\n\n  Oops: general protection fault, probably for non-canonical address\n  KASAN: maybe wild-memory-access in range\n         [0xdead000000000120-0xdead000000000127]\n  RIP: gtp_genl_del_pdp+0x1c1/0x420 [gtp]\n  RBP: dead000000000122\n\nThe second deletion dereferenced the poisoned hlist pprev pointer.\n\nSerialize gtp_pdp_add(), gtp_genl_del_pdp(), and gtp_dellink() with a\nshared mutex. Keep the mutex held until the final use of a PDP context in\nthe NEWPDP path, and keep the RCU read-side section around the complete\nPDP context use in the DELPDP path.\n\nFixes: 459aa660eb1d (\"gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qing Ming \u003ca0yami@mailbox.org\u003e\nLink: https://patch.msgid.link/20260818150000.7670-1-a0yami@mailbox.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "71283aaa6c65b3cec84caf1dc78560985737641f",
      "tree": "23e19a663952ac51fb5835852df484ddcd3d516b",
      "parents": [
        "7c3a1a34810d9570d65701200f23d6a9e7e6c874"
      ],
      "author": {
        "name": "Weiming Shi",
        "email": "bestswngs@gmail.com",
        "time": "Tue Aug 18 23:45:15 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:10:48 2026 -0700"
      },
      "message": "xdp: fix zero-copy frame layout\n\nxdp_convert_zc_to_xdp_frame() clones an XSK packet into an order-0 page\nand advertises PAGE_SIZE as its frame size.  It allows the copied frame\nto occupy the page tail needed by skb_shared_info and records zero\nheadroom even when metadata separates the frame header from packet data.\nAn AF_XDP zero-copy packet redirected through cpumap can therefore make\nthe skb overlap skb_shared_info or place it beyond the allocated page.\n\nLimit the copied layout to SKB_WITH_OVERHEAD(PAGE_SIZE) and include the\nmetadata length in frame headroom.  Redirect callers already handle a\nNULL conversion result.\n\nBUG: KASAN: slab-out-of-bounds in skb_gro_receive\nWrite of size 4 at addr ffff88800cf37004 by task cpumap/1/map:1/146\nCall Trace:\n skb_gro_receive (net/core/gro.c:174)\n udp_gro_receive (net/ipv4/udp_offload.c:812)\n inet_gro_receive (net/ipv4/af_inet.c:1539)\n dev_gro_receive (net/core/gro.c:515)\n gro_receive_skb (net/core/gro.c:633)\n cpu_map_kthread_run (kernel/bpf/cpumap.c:395)\n kthread (kernel/kthread.c:436)\n ret_from_fork (arch/x86/kernel/process.c:164)\n ret_from_fork_asm (arch/x86/entry/entry_64.S:255)\nKernel panic - not syncing: KASAN: panic_on_warn set ...\n\nFixes: b0d1beeff2a9 (\"xdp: implement convert_to_xdp_frame for MEM_TYPE_ZERO_COPY\")\nCc: stable@vger.kernel.org\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nLink: https://patch.msgid.link/20260818154516.793517-1-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "7c3a1a34810d9570d65701200f23d6a9e7e6c874",
      "tree": "1eacdf318cd000f5e05668299ea98ba6dc7772b2",
      "parents": [
        "870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1",
        "31ded341c375bb2faac1d77ab0012a732ba3e2a6"
      ],
      "author": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:06:10 2026 -0700"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:06:10 2026 -0700"
      },
      "message": "Merge branch \u0027net-ntb_netdev-fix-rx-statistics-accounting\u0027\n\nKoichiro Den says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ntb_netdev: Fix RX statistics accounting\n\nThis series addresses Jakub\u0027s comment on ntb_netdev RX statistics\naccounting:\nhttps://lore.kernel.org/r/20260818092938.4121c220@kernel.org/\n\nIt fixes the double counting and also the related packet/byte accounting\non RX refill failure.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260819172539.1450821-1-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "31ded341c375bb2faac1d77ab0012a732ba3e2a6",
      "tree": "1eacdf318cd000f5e05668299ea98ba6dc7772b2",
      "parents": [
        "82e15be2d8b9efa6fb1750528d9b6f40e6a8eea7"
      ],
      "author": {
        "name": "Koichiro Den",
        "email": "den@valinux.co.jp",
        "time": "Thu Aug 20 02:25:39 2026 +0900"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:06:08 2026 -0700"
      },
      "message": "net: ntb_netdev: Count packets dropped on RX refill failure\n\nWhen replacement skb allocation fails, ntb_netdev drops a packet that\nwas received successfully and requeues the original buffer. The drop is\ncounted, but rx_packets and rx_bytes are not.\n\nCount every good packet before allocating its replacement.\n\nFixes: d2121faf133a (\"NTB: ntb_netdev: Preserve RX queue depth on allocation failure\")\nCc: stable@vger.kernel.org\nSigned-off-by: Koichiro Den \u003cden@valinux.co.jp\u003e\nLink: https://patch.msgid.link/20260819172539.1450821-3-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "82e15be2d8b9efa6fb1750528d9b6f40e6a8eea7",
      "tree": "fe528d89aa7019c9e8f72ef5f838cf680ea4c471",
      "parents": [
        "870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1"
      ],
      "author": {
        "name": "Koichiro Den",
        "email": "den@valinux.co.jp",
        "time": "Thu Aug 20 02:25:38 2026 +0900"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:06:08 2026 -0700"
      },
      "message": "net: ntb_netdev: Avoid double-accounting netif_rx() drops\n\nnetif_rx() already accounts packets it drops in the core rx_dropped\ncounter. ntb_netdev counts them again as both errors and drops.\n\nLeave netif_rx() drops to the core. Count the packet and bytes\nunconditionally since it was received successfully by the driver.\n\nFixes: 548c237c0a99 (\"net: Add support for NTB virtual ethernet device\")\nCc: stable@vger.kernel.org\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Koichiro Den \u003cden@valinux.co.jp\u003e\nLink: https://patch.msgid.link/20260819172539.1450821-2-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    },
    {
      "commit": "870a9e42ecc6fe1b8c25d87af043cb0d9c178fe1",
      "tree": "cc0daa712b05785bd25f0e1907020577e1071bbc",
      "parents": [
        "6776efe4a52f289a3fc18f8adf19b035a7d8e1bb"
      ],
      "author": {
        "name": "Yong Wang",
        "email": "edragain@163.com",
        "time": "Wed Aug 19 23:22:04 2026 +0800"
      },
      "committer": {
        "name": "Jakub Kicinski",
        "email": "kuba@kernel.org",
        "time": "Sat Aug 22 13:05:19 2026 -0700"
      },
      "message": "tcp: clamp route advmss to TCP_MIN_MSS\n\ntcp_select_initial_window() assumes that callers never pass an MSS\nsmaller than 1, but route-derived advmss values can violate that\nassumption.\n\nA too-small explicit RTAX_ADVMSS is one way to get there, but it is not\nthe only one. The same divide-by-zero can also be reached through the\n\"default advmss\" path when RTAX_ADVMSS is left at 0 and the effective\nadvmss is later driven down by route MTU and min_adv_mss.\n\nIntroduce a tcp_dst_advmss() helper that clamps route advmss to\nTCP_MIN_MSS before TCP consumes it, and use it in the TCP paths that\nderive advmss from dst metrics. This keeps the effective MSS from\ndropping to zero before tcp_select_initial_window() rounds the receive\nwindow.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Yong Wang \u003cedragain@163.com\u003e\nSigned-off-by: Ren Wei \u003cweir@nebusec.ai\u003e\nLink: https://patch.msgid.link/251eaf8277fa7c66364c9815c5da01662d269181.1787074852.git.edragain@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n"
    }
  ],
  "next": "6776efe4a52f289a3fc18f8adf19b035a7d8e1bb"
}