)]}' { "log": [ { "commit": "879e280b8486d4612ad1aa050d6fada2dd80cf1c", "tree": "084706e01fdb3bc8ec9ba5517b2011bf55d83ad0", "parents": [ "c0aca269ec07b0f2c106d5c11ebc7611f6cf90c5" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@kylinos.cn", "time": "Thu Sep 10 16:06:58 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:10:22 2026 -0700" }, "message": "selftests: netdevsim: add TEST_INCLUDES to Makefile\n\nSome netdevsim selftests source forwarding/lib.sh and other files, but\nthe Makefile doesn\u0027t have TEST_INCLUDES targets, which makes\n\n make INSTALL_PATH\u003d/tmp/kself TARGETS\u003ddrivers/net/netdevsim \\\n -C tools/testing/selftests install\n\nfailed to install related lib files. Add TEST_INCLUDES to the Makefile\nto install the dependencies.\n\nSigned-off-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260910-nsim_lib-v1-1-0be0d49eaa42@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c0aca269ec07b0f2c106d5c11ebc7611f6cf90c5", "tree": "b3c665522e79aa037eaf8e1c0226f9bac9ea4a62", "parents": [ "57ca800cd3f7d21561d802645dc03df55d2281db" ], "author": { "name": "Mohsin Bashir", "email": "hmohsin@meta.com", "time": "Wed Sep 09 14:11:11 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:55:47 2026 -0700" }, "message": "eth: fbnic: Make Rx completion coalescing configurable\n\nThe Rx completion queue writeback coalescing window controls how long\nthe queue manager may defer writing completions to host memory.\n\nExpose this window through the standard rx-cqe-nsecs ethtool\nparameter. Preserve the existing 2000 ns default and accept values\nfrom 1000 ns through the device maximum (~109 us).\n\nHardware expresses COAL_WAIT in 600 MHz core clock cycles, or 1.667 ns\nper cycle. Programming rounds the configured value to the nearest clock\ncycle, resulting in an error of less than 1 ns. Retain the requested\nvalue for get_coalesce() because this error is below the one-nanosecond\nresolution of the ethtool interface.\n\nSigned-off-by: Mohsin Bashir \u003chmohsin@meta.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260909211111.1795726-1-mohsin.bashr@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57ca800cd3f7d21561d802645dc03df55d2281db", "tree": "82d795103a8c0d935ef7c9aefa68969f5678b550", "parents": [ "cde77d69ea50f3a10da0ed749495a7c77fbc04b0" ], "author": { "name": "Ethan Nelson-Moore", "email": "enelsonmoore@gmail.com", "time": "Thu Sep 10 07:35:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:54:32 2026 -0700" }, "message": "drivers: net: smsc: Remove unused smc9194.h header\n\nThe smc9194 driver was removed in commit 9fdf9f61fa6d (\"drivers: net:\nsmsc: smc9194: Remove this driver\"), but smc9194.h was left behind.\nRemove it.\n\nSigned-off-by: Ethan Nelson-Moore \u003cenelsonmoore@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260910143516.87304-1-enelsonmoore@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cde77d69ea50f3a10da0ed749495a7c77fbc04b0", "tree": "d958cc6236333f86fa340b48e370d0880fb3725f", "parents": [ "219c6b768ec7bd69682923e9bb59f1558f1f5b64", "55edd9e55711e7e47060fb998a96e968a895fc20" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:52 2026 -0700" }, "message": "Merge branch \u0027netlink-specs-conntrack-minor-spec-fixes\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetlink: specs: conntrack: minor spec fixes\n\nClashiko raised a bunch of pre-existing issues on a recent series\nfrom Ilya. Let\u0027s fix those and whatever else pops out in AI review\nand looks relatively legitimate.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260910003852.2184031-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "55edd9e55711e7e47060fb998a96e968a895fc20", "tree": "d958cc6236333f86fa340b48e370d0880fb3725f", "parents": [ "f869aa4ceaa2daeb4320a0d83fa212dad3709785" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:49 2026 -0700" }, "message": "netlink: specs: conntrack: tweak definition of obsolete attrs\n\nCTA_SECMARK, CTA_COUNTERS32_{PACKETS,BYTES} are all obsolete\nbe32 attrs. Since they are obsolete we don\u0027t bother with\nthe byte-order annotation, but let\u0027s be consistent about\nmarking them as u32 with doc: obsolete.\n\nThe attrs were obsoleted by:\ncommit 584015727a3b (\"netfilter: accounting rework: ct_extend + 64bit counters (v4)\")\ncommit 1cc63249adfa (\"conntrack: export lsm context rather than internal secid via netlink\")\n\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-8-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f869aa4ceaa2daeb4320a0d83fa212dad3709785", "tree": "1d8517173a5a865fa13f7590d4b731160c0a4eb5", "parents": [ "6c98fd455ed507f82047816e07d5856db987cacd" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:49 2026 -0700" }, "message": "netlink: specs: conntrack: fix the per-CPU stats reply\n\nctnetlink_ct_stat_cpu_fill_info() emits CTA_STATS_INVALID but\ndoes not emit CTA_STATS_SEARCHED. Update the attr list, and\nremove the false annotation of invalid as obsolete.\n\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-7-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c98fd455ed507f82047816e07d5856db987cacd", "tree": "31ce09f6f4fa3b74a38630e60a0d77f142b2e788", "parents": [ "58c7df883ada6d97107cffc07e3b3bb965a761a8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:48 2026 -0700" }, "message": "netlink: specs: conntrack: describe CTA_HELP_INFO\n\nnfnl_cthelper_to_nlattr() seems to output CTA_HELP_INFO but the spec\ndoesn\u0027t have a definition for it, add one.\n\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-6-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "58c7df883ada6d97107cffc07e3b3bb965a761a8", "tree": "889ff1d36d5baf797a1db053d5c58a35e9c92131", "parents": [ "924c8a610d3acb186248dd7256e8787cf6a0e422" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:48 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:48 2026 -0700" }, "message": "netlink: specs: conntrack: fix the nat-attrs attribute IDs\n\nThe enum for attr IDs says:\n\n CTA_NAT_V4_MINIP,\n #define CTA_NAT_MINIP CTA_NAT_V4_MINIP\n CTA_NAT_V4_MAXIP,\n #define CTA_NAT_MAXIP CTA_NAT_V4_MAXIP\n CTA_NAT_PROTO,\n CTA_NAT_V6_MINIP,\n CTA_NAT_V6_MAXIP,\n\nMove nat-proto to the right place in the YAML spec to make sure\nthe attr IDs match.\n\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-5-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "924c8a610d3acb186248dd7256e8787cf6a0e422", "tree": "7f99cd0df8f311a69bd993a0e82fa71358afe0d0", "parents": [ "19be13c9c1e940c041c52ddeeb93d3f9150865f6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:47 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:48 2026 -0700" }, "message": "netlink: specs: conntrack: fix SCTP conntrack state names\n\nCorrect the names of constants:\n\nValue 1 is SCTP_CONNTRACK_CLOSED, not \"cloned\".\nValue 6 is SCTP_CONNTRACK_SHUTDOWN_RECD, not \"shutdown-received\".\nValue 8 is SCTP_CONNTRACK_HEARTBEAT_SENT, there is no \"shutdown-heartbeat\"\nstate.\n\nNote that there\u0027s also a value of 9 (HEARTBEAT_ACKED) but sctp_nla_policy\ncaps the attribute at HEARTBEAT_SENT and HEARTBEAT_ACKED is marked no\nlonger used in the header.\n\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19be13c9c1e940c041c52ddeeb93d3f9150865f6", "tree": "34fb74a106c637f0d51cc730d7d332c360a030a9", "parents": [ "68fd293d99e469159bb131e1a965f076adbc160d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:46 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:47 2026 -0700" }, "message": "netlink: specs: conntrack: fix the get reply attribute lists\n\nCTA_NAT_SRC and CTA_NAT_DST are input-only. The only references to either\nare cda[] reads in ctnetlink_setup_nat() and the rejection in\nctnetlink_change_conntrack(); no path ever puts them into a message, so\nneither belongs in a reply. nat-dst was listed twice on top of that.\n\nCTA_TIMESTAMP is the opposite case - both the do and the dump reach\nctnetlink_fill_info() with extinfo set, so ctnetlink_dump_extinfo() -\u003e\nctnetlink_dump_timestamp() emits it, but the lists never named it.\n\nReported-by: Sashiko \u003cnetdev-bot+sashiko@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "68fd293d99e469159bb131e1a965f076adbc160d", "tree": "38acb16d8edb5e4f418603690f52f7ae68450fb4", "parents": [ "219c6b768ec7bd69682923e9bb59f1558f1f5b64" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:38:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:42:47 2026 -0700" }, "message": "netlink: specs: conntrack: timestamp is a nest, not a be64\n\nctnetlink_dump_timestamp() wraps CTA_TIMESTAMP_START\nand CTA_TIMESTAMP_STOP in a nest, but the spec declares CTA_TIMESTAMP\nas a flat be64. ynl picks reply attributes out of the attribute set rather\nthan the operation\u0027s attribute list, so the mistyped attribute stops\nthe whole dump:\n\n Error decoding \u0027timestamp\u0027 from \u0027conntrack-attrs\u0027\n Traceback (most recent call last):\n File \"tools/net/ynl/pyynl/cli.py\", line 314, in main\n reply \u003d ynl.dump(args.dump, attrs)\n File \"tools/net/ynl/pyynl/lib/ynl.py\", line 1082, in _decode\n decoded \u003d attr.as_scalar(attr_spec[\u0027type\u0027], attr_spec.byte_order)\n File \"tools/net/ynl/pyynl/lib/ynl.py\", line 291, in as_scalar\n return format_.unpack(self.raw)[0]\n struct.error: unpack requires a buffer of 8 bytes\n\nThe tstamp extension is only attached when CONFIG_NF_CONNTRACK_TIMESTAMP\nis enabled and nf_conntrack_timestamp is turned on, which is off by default\nand is why every dump does not hit this.\n\nstop is omitted for live entries, so it stays optional like every other\nmember here. The pad member mirrors counter-attrs, which covers the same\nnla_put_be64() padding.\n\nReported-by: Sashiko \u003cnetdev-bot+sashiko@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260826220444.4054714-1-i.maximets@ovn.org\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910003852.2184031-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "219c6b768ec7bd69682923e9bb59f1558f1f5b64", "tree": "a11a583aeb3ab8d221bae4306d419815ea258856", "parents": [ "b81c7a91ce15b97390747b34ca511e984bcc4286" ], "author": { "name": "Junjie Cao", "email": "junjie.cao@intel.com", "time": "Thu Sep 10 17:49:37 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:38:36 2026 -0700" }, "message": "net: dropreason: add SKB_DROP_REASON_IP_TTL_EXCEEDED\n\nThe forwarding paths report an expired TTL or hop limit as\nSKB_DROP_REASON_IP_INHDR, the reason otherwise used for a header that is\nmalformed (ip_input.c, exthdrs.c, br_netfilter). Nothing else in the drop\npath separates the two: IPSTATS_MIB_INHDRERRORS covers both, and the TTL\ncheck runs before NF_INET_FORWARD, so netfilter tracing stops at\nPREROUTING and never sees the drop.\n\nThe Fedora bug linked below shows how that reads in practice. The\nreporter took kfree_skb(reason\u003dIP_INHDR, loc\u003dip_forward) to mean the\nsoftware header checksum check had failed, and worked through RX checksum\noffload, tc csum actions and both libvirt firewall backends before the\ndrops turned out to be replies arriving with TTL 1. ip_forward() never\nverifies the header checksum; that runs earlier, in ip_rcv_core(), and\nreports IP_CSUM.\n\nTTL expiry is not a corner case -- every traceroute through a Linux\nrouter goes through too_many_hops.\n\nThe three loopback hop limit checks in exthdrs.c drop with no reason at\nall; give them the new one.\n\nIPSTATS_MIB_INHDRERRORS stays as it is: RFC 1213 counts time-to-live\nexceeded under ipInHdrErrors. The drop reason has no such constraint.\n\nLink: https://bugzilla.redhat.com/show_bug.cgi?id\u003d2517131\nSigned-off-by: Junjie Cao \u003cjunjie.cao@intel.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260910094937.536150-1-junjie.cao@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b81c7a91ce15b97390747b34ca511e984bcc4286", "tree": "7ad4961e1ae2c3f190d484ad489504e99e5b13e4", "parents": [ "17d3afadf539c93def8106bbb83c88274bdc7ab1", "bb2b71024976a39ed57d66bad8f9ca7e93bc3f33" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:36:04 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:36:39 2026 -0700" }, "message": "Merge branch \u0027net-xilinx-axienet-fix-irq-error-handling\u0027\n\nbui duc phuc says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: xilinx: axienet: Fix IRQ error handling\n\nThis series fixes IRQ error handling in the Xilinx AXI Ethernet driver\n\nHandle errors from optional IRQ lookup and preserve the original error\ncodes instead of returning -ENOMEM.\n\nThe changes were found by manual code inspection and compile-tested\nonly.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909045450.16176-1-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bb2b71024976a39ed57d66bad8f9ca7e93bc3f33", "tree": "7ad4961e1ae2c3f190d484ad489504e99e5b13e4", "parents": [ "2d2f18d49221846a5a3271ce93e08e4f9f784991" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Wed Sep 09 11:54:50 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:36:35 2026 -0700" }, "message": "net: xilinx: axienet: Fix IRQ error handling\n\nirq_of_parse_and_map() returns 0 when parsing or mapping an IRQ fails,\nwhile platform_get_irq() returns a negative error code on failure.\n\nHandle both failure cases appropriately: return -EINVAL when\nirq_of_parse_and_map() fails, and propagate the original error code\nreturned by platform_get_irq() instead of returning -ENOMEM.\n\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nReviewed-by: Suraj Gupta \u003csuraj.gupta2@amd.com\u003e\nLink: https://patch.msgid.link/20260909045450.16176-4-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2d2f18d49221846a5a3271ce93e08e4f9f784991", "tree": "46550fbbcbfbd97b41277089b50c05d4742b8075", "parents": [ "90ab44517ee1f9e5018b6c274b95219cf229e617" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Wed Sep 09 11:54:49 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:36:02 2026 -0700" }, "message": "net: xilinx: axienet: Handle optional IRQ return value correctly\n\nlp-\u003eeth_irq is assigned from platform_get_irq_optional(), which returns\na non-zero interrupt number on success or a negative error number on\nfailure. Errors other than -ENXIO are handled before this check,\nso -ENXIO is the only error value that can reach this point.\n\nCheck for a negative value instead of treating 0 as an undefined IRQ.\n\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Radhey Shyam Pandey \u003cradhey.shyam.pandey@amd.com\u003e\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260909045450.16176-3-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "90ab44517ee1f9e5018b6c274b95219cf229e617", "tree": "9cbd4edf482a9e5f99cd89730785554965a6e65c", "parents": [ "17d3afadf539c93def8106bbb83c88274bdc7ab1" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Wed Sep 09 11:54:48 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 16:36:02 2026 -0700" }, "message": "net: xilinx: axienet: Propagate errors from optional IRQ lookup\n\nplatform_get_irq_optional() returns a positive IRQ number on success or\na negative error code on failure. For an optional IRQ, -ENXIO indicates\nthat no optional IRQ is available, while other errors should be propagated.\n\nPropagate all error codes returned by platform_get_irq_optional() other\nthan -ENXIO.\n\nAnother call to platform_get_irq_optional() in the same function already\nhandles the return value this way. Apply the same error handling to this\ncall site for consistency.\n\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Radhey Shyam Pandey \u003cradhey.shyam.pandey@amd.com\u003e\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nLink: https://patch.msgid.link/20260909045450.16176-2-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17d3afadf539c93def8106bbb83c88274bdc7ab1", "tree": "e6753ad3812b98bb79b314421393ed52eba866fa", "parents": [ "348ea4642f56ab3dc93621c8e3ab0ccd0e5f1782" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Tue Sep 08 11:41:13 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Fri Sep 11 09:32:26 2026 +0100" }, "message": "octeontx2: collapse consecutive blank lines in source files\n\nRemove extra blank lines across the octeontx2 driver source.\n\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "348ea4642f56ab3dc93621c8e3ab0ccd0e5f1782", "tree": "3ff8de185e8c9edb79cfe412892e808654339d77", "parents": [ "c48f4d49b43aa923112a3c0a1c45bd3a76370ab2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 11:00:09 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:46:40 2026 -0700" }, "message": "selftests: net: add ctl_file_write() helper\n\nSetting a sysctl or a sysfs attribute for the duration of a test and\nputting the old value back has been open coded multiple times.\n\nWe generally avoid creating library helpers but this one is very\ncommon, and the defer is a little tricky as using the same function\nfor defer as the initial write leads to an infinite loop (not that\nI would ever make such mistake!)\n\nSome of the conversions are not identical, but arguably ctl_file_write()\nsemantics are more correct.\n\nReviewed-by: Nimrod Oren \u003cnoren@nvidia.com\u003e\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260909180009.1894019-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c48f4d49b43aa923112a3c0a1c45bd3a76370ab2", "tree": "7512430b44e2cd7cdd363ab8b65ff9d5dcb593ea", "parents": [ "75a73afd0b32d19512f50db197e8794456e4f738", "f712bf6f17d881763547d6c33ccdcf3e62d4ae84" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:36 2026 -0700" }, "message": "Merge branch \u0027sit-convert-configuration-to-rcu-and-lockless-fill_info\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsit: convert configuration to RCU and lockless fill_info\n\nSIT (IPv6-in-IPv4) tunnel configuration and status reporting have\nhistorically relied on the RTNL lock for synchronization. Consequently,\nnetlink dumps via ipip6_fill_info() had to run with RTNL held, adding\ncontention during network device dumps.\n\nAt the same time, the transmit path (dev-\u003elltx \u003d\u003d true), tunnel lookups,\nand error handling run locklessly and can race with configuration\nupdates. This can result in torn reads of multi-word fields (such as the\n128-bit 6RD IPv6 prefix) or transiently zeroed encapsulation parameters.\nFurthermore, ipip6_tunnel_update() currently unhashes, re-hashes, and\ncalls synchronize_net() unconditionally, even when the tunnel endpoint\naddresses (saddr and daddr) have not changed.\n\nThis patch series addresses PRL issues, modernizes SIT parameter\nmanagement to use RCU protection, optimizes tunnel updates, and removes\nthe RTNL requirement from ipip6_fill_info():\n\n- Patch 1 fixes a pre-existing UAF in PRL (Potential Router List)\n deletion where call_rcu() was invoked before unlinking t-\u003eprl.\n- Patch 2 adds GFP_KERNEL_ACCOUNT to struct ip_tunnel_prl_entry\n allocations in ipip6_tunnel_add_prl().\n- Patch 3 removes the unsafe in-place memset() in ip_tunnel_encap_setup()\n and uses WRITE_ONCE() to prevent lockless readers from observing\n transiently zeroed or torn fields.\n- Patch 4 annotates data races on tunnel-\u003efwmark with READ_ONCE() and\n WRITE_ONCE().\n- Patch 5 converts 6RD configuration (tunnel-\u003eip6rd) to an RCU-protected\n pointer, preventing torn reads on the 128-bit IPv6 prefix.\n- Patch 6 implements a dedicated ipip6_get_iflink() callback to decouple\n SIT parameter handling from generic ip_tunnel.\n- Patch 7 dynamically allocates struct ip_tunnel_parm_kern (sit_parms)\n as a preparatory step.\n- Patch 8 converts tunnel-\u003esit_parms to full RCU protection. Updates\n publish new parameters via rcu_assign_pointer() and free the old ones\n via kfree_rcu(). When saddr and daddr do not change, unhashing,\n re-hashing, and synchronize_net() are completely bypassed.\n- Patch 9 wraps attribute serialization in ipip6_fill_info() under\n rcu_read_lock(), eliminating the reliance on the RTNL lock.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260907075846.2913645-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f712bf6f17d881763547d6c33ccdcf3e62d4ae84", "tree": "7512430b44e2cd7cdd363ab8b65ff9d5dcb593ea", "parents": [ "0301127e4d984d06300b539127f5922d97482bd9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:46 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:34 2026 -0700" }, "message": "sit: no longer rely on RTNL in ipip6_fill_info()\n\nNow that SIT parameters and 6RD parameters are RCU-protected,\nand fwmark/encap are annotated with READ_ONCE()/WRITE_ONCE(),\nipip6_fill_info() no longer requires RTNL to be held.\n\nWrap the attribute serialization in rcu_read_lock() and rcu_read_unlock().\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-10-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0301127e4d984d06300b539127f5922d97482bd9", "tree": "23b2d3546abd453e4d0eb38ebe9ba2ae5185c05a", "parents": [ "3cd52b7c0bbfbcd90f5a0fb9284e722852e04899" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:45 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:34 2026 -0700" }, "message": "sit: convert configuration to RCU protection\n\nNow that SIT parameters are dynamically allocated, convert\ntunnel-\u003esit_parms to an RCU-protected pointer.\n\nUpdates in ipip6_tunnel_update() allocate a new parameter block,\npublish it using rcu_assign_pointer(), and free the old one\nvia kfree_rcu().\n\nWe only need to unlink and re-link the tunnel in the hash table\nif either saddr or daddr changed. When neither address changes,\nthe unhash/re-hash and synchronize_net() can be completely skipped.\n\nReaders in ipip6_tunnel_lookup(), ipip6_tunnel_xmit(), ipip6_err(),\nand ipip6_rcv() now safely dereference tunnel-\u003esit_parms under RCU.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-9-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3cd52b7c0bbfbcd90f5a0fb9284e722852e04899", "tree": "4a880678e1acae87f81f5eec07e8c7d45c786fe7", "parents": [ "e3434672b7ad38cfd58006d4361966e61b508f5e" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:44 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:34 2026 -0700" }, "message": "sit: dynamically allocate struct ip_tunnel_parm_kern\n\nIn preparation for converting SIT configuration parameters to RCU,\ndynamically allocate struct ip_tunnel_parm_kern as sit_parms in\nstruct ip_tunnel.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-8-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3434672b7ad38cfd58006d4361966e61b508f5e", "tree": "c5519330dfd09f597b8ba74483ebcaaf644d3ff7", "parents": [ "eaa2098a94cdd726c8c96764de19ecbc95719d37" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:43 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "sit: implement ipip6_get_iflink()\n\nSIT currently uses ip_tunnel_get_iflink() which reads tunnel-\u003eparms.link.\nIn order to decouple SIT parameter handling from ip_tunnel, implement\nits own ndo_get_iflink callback.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-7-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eaa2098a94cdd726c8c96764de19ecbc95719d37", "tree": "dfa290bb1c8962f9fb2fc131229513c564cd4962", "parents": [ "b5e8eadb1c8a800b1fe7bec42b5e0c696f69e1aa" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "sit: convert 6RD configuration to RCU protection\n\nIn order to allow lockless readers in future patches, convert\n\u0027tunnel-\u003eip6rd\u0027 to an RCU protected pointer.\n\nUpdating 6RD configuration via ipip6_tunnel_update_6rd() or\nipip6_tunnel_clone_6rd() now allocates a struct ip_tunnel_6rd_parm and\nuses rcu_assign_pointer() to publish it, freeing the previous\nparameters with kfree_rcu().\n\nReaders in check_6rd() and only_dnatted() use rcu_dereference() under\nexisting RCU read lock, preventing torn reads on the 128-bit IPv6\nprefix.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-6-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b5e8eadb1c8a800b1fe7bec42b5e0c696f69e1aa", "tree": "6539c4ae11097a5a4fd88bb1c51c8a6e2f938528", "parents": [ "88b84cae6b94087d3a9679845fe28ad19c7bef8b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:41 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "sit: annotate data-races around tunnel-\u003efwmark\n\nipip6_tunnel_xmit() runs locklessly (dev-\u003elltx \u003d\u003d true) and reads\ntunnel-\u003efwmark.\n\nIn preparation for converting ipip6_fill_info() to run without RTNL,\nadd READ_ONCE() and WRITE_ONCE() annotations around tunnel-\u003efwmark.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "88b84cae6b94087d3a9679845fe28ad19c7bef8b", "tree": "86f97ec3e0d716c65a7731880e2abdbf78de182f", "parents": [ "40a2b90f5190fcc7b083809fa93f2799abefeeb1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "ip_tunnel: use WRITE_ONCE in ip_tunnel_encap_setup\n\nUpdate ip_tunnel_encap_setup() to use WRITE_ONCE() when writing\nto encap fields (type, sport, dport, flags) and hlen fields.\nThis ensures that concurrent lockless readers (like fill_info)\ndo not see torn writes.\n\nAlso remove the unsafe memset() on t-\u003eencap which could cause\nconcurrent readers to transiently see zeroed fields.\nRemoving it also fixes a bug where t-\u003eencap was left cleared\neven if ip_encap_hlen() failed, resulting in partial configuration.\n\nFixes: 56328486539d (\"net: Changes to ip_tunnel to support foo-over-udp encapsulation\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "40a2b90f5190fcc7b083809fa93f2799abefeeb1", "tree": "f3e1091ac395e37d1dbac1c0328e7ad301240284", "parents": [ "5145bb6a2c2683d541828f86d5321e0565f2e30c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "sit: charge ip_tunnel_prl_entry allocations to memcg\n\nipip6_tunnel_add_prl() allocates struct ip_tunnel_prl_entry for each\npotential router entry added via SIOCADDPRL.\nAn unprivileged user with CAP_NET_ADMIN in a user namespace can add\nan unbounded number of entries, consuming uncharged kernel memory.\n\nCommit 1b51d8271973 (\"memcg: ipv6/sit: account and don\u0027t WARN on\nip_tunnel_prl structs allocation\") added accounting to the temporary\nbuffer in ipip6_tunnel_get_prl(), but missed the entry allocations\nin ipip6_tunnel_add_prl().\n\nUse GFP_KERNEL_ACCOUNT when allocating struct ip_tunnel_prl_entry.\n\nFixes: 1b51d8271973 (\"memcg: ipv6/sit: account and don\u0027t WARN on ip_tunnel_prl structs allocation\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5145bb6a2c2683d541828f86d5321e0565f2e30c", "tree": "f68ed85e34397b87d20ef85813b7948025ffbb8e", "parents": [ "75a73afd0b32d19512f50db197e8794456e4f738" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Sep 07 07:58:38 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:35:33 2026 -0700" }, "message": "sit: fix UAF in ipip6_tunnel_del_prl()\n\nWhen flushing all potential router list (PRL) entries,\nipip6_tunnel_del_prl() called call_rcu(\u0026x-\u003ercu_head, prl_list_destroy_rcu)\nbefore clearing t-\u003eprl.\n\nA concurrent reader in isatap_chksrc() could enter an RCU read-side\ncritical section after call_rcu() but before t-\u003eprl is set to NULL,\nallowing prl_list_destroy_rcu() to free nodes while the reader traverses\nthem.\n\nClear t-\u003eprl using RCU_INIT_POINTER() before invoking call_rcu().\nAlso use rcu_assign_pointer() when unlinking individual entries.\n\nFixes: ef9a9d1183b3 (\"ipv6 sit: RCU conversion phase I\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260907075846.2913645-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75a73afd0b32d19512f50db197e8794456e4f738", "tree": "875bd5b91ed6cc611a440a980aba800a8ffa1ed2", "parents": [ "318e5ae0fe40f4cf73735e5016c4a2aa60a31294" ], "author": { "name": "bui duc phuc", "email": "phucduc.bui@gmail.com", "time": "Wed Sep 09 11:57:37 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 18:06:08 2026 -0700" }, "message": "net: davicom: Propagate wakeup IRQ errors\n\nThe wakeup IRQ is optional, but errors from platform_get_irq_optional()\nare currently ignored. Propagate errors from the IRQ lookup, except\n-ENXIO which indicates that the optional IRQ is not available.\n\nFound by manual code inspection.\n\nCc: stable+noautosel@kernel.org # untested fix to unlikely driver error path\nSigned-off-by: bui duc phuc \u003cphucduc.bui@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260909045738.16705-1-phucduc.bui@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "318e5ae0fe40f4cf73735e5016c4a2aa60a31294", "tree": "ba8bb3e2e0d261cc2e3075a579f4531742ad4be5", "parents": [ "f5f0fcfcb30c677c1069c131f8e00e728e0a4fc5", "6d7f71ae4cdcbb22f541638057299fe26c451e65" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 17:58:49 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 17:58:50 2026 -0700" }, "message": "Merge tag \u0027batadv-next-pullrequest-20260907\u0027 of https://git.open-mesh.org/batadv\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nThis cleanup patchset includes the following patches, all by Sven Eckelmann:\n\n - translation table cleanups (12 patches)\n\n - kerneldoc fixes noted by sashiko (3 patches)\n\n* tag \u0027batadv-next-pullrequest-20260907\u0027 of https://git.open-mesh.org/batadv:\n batman-adv: correct batadv_hash_remove kdoc return type\n batman-adv: bat_iv: fix ogm_neigh_is_sob parameters references\n batman-adv: tt: clarify kernel doc for batadv_tt_local_set_pending_event()\n batman-adv: tt: drop the cleanup label from batadv_tt_local_remove()\n batman-adv: tt: extract immediate purge of a local entry\n batman-adv: tt: extract marking of a removed local entry\n batman-adv: tt: extract removal of the superseded local entry\n batman-adv: tt: replace add_orig_entry goto in batadv_tt_global_add()\n batman-adv: tt: extract merging of flags into existing global entries\n batman-adv: tt: extract allocation of new global entries\n batman-adv: tt: extract update of dynamic client flags\n batman-adv: tt: extract refresh of existing local entries\n batman-adv: tt: replace forward gotos in batadv_tt_local_add()\n batman-adv: tt: extract allocation of new local entries\n batman-adv: tt: look up wifi state of incoming interface in helper\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260907081824.2474040-1-sw@simonwunderlich.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f5f0fcfcb30c677c1069c131f8e00e728e0a4fc5", "tree": "315d54175b43e1184404dda4bbb5a955fd1465ba", "parents": [ "99d76b4da88f21edd14b169f65de33e8df1b7804" ], "author": { "name": "Ivy Lopez", "email": "skunkolee@gmail.com", "time": "Tue Sep 08 18:28:29 2026 -0600" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 17:31:35 2026 -0700" }, "message": "net: starfire: fix ioaddr sign-extension causing ioremap() failure\n\nioaddr is declared as a signed long, but is assigned the result of\npci_resource_start(), which returns an unsigned resource_size_t.\nOn configurations where the BAR address has its high bit set, the\nvalue sign-extends when passed to ioremap(), producing a bogus\n64-bit address and causing device probe to fail:\n\n ioremap: invalid physical address fffffffffe480000\n starfire 0000:08:04.0: cannot Remap 0x80000 @ 0xfe480000, aborting\n\nChange ioaddr to resource_size_t, matching both the return type of\npci_resource_start() and the type ioremap() expects for its physical\naddress argument, rather than unsigned long, which is not guaranteed\nto be wide enough on all configurations. Switch the associated error\nprint to %pa accordingly.\n\nLink: https://bugzilla.kernel.org/show_bug.cgi?id\u003d198035\nSigned-off-by: Ivy Lopez \u003cskunkolee@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260909002829.224639-1-skunkolee@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99d76b4da88f21edd14b169f65de33e8df1b7804", "tree": "7c8166373d1ef29fee7792b956ba5d2f14201329", "parents": [ "0abe8777490ebc008635ecb20297761d1b317697", "78445023439506ebd83b86d40b1e428a3b309d4a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Aug 06 11:51:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 15:14:05 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.3-rc3).\n\nConflicts:\n\ndrivers/net/dsa/mt7530.c\n 3c18e3c9a54e (\"net: dsa: mt7530: populate lpi_interfaces to fix EEE support\")\n 10d9d8328e8a (\"net: dsa: mt7530: replace mt7530_read with regmap_read\")\n\nAdjacent changes:\n\ndrivers/net/bonding/bond_alb.c\n 1746ef2e2df2 (\"bonding: use skb_cow_head() in bond_do_alb_xmit() and rlb_arp_xmit()\")\n 4cef95f72bbd (\"bonding: fix u32 overflow in compute_gap()\")\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "78445023439506ebd83b86d40b1e428a3b309d4a", "tree": "4be5947a504ab54bc7ec43697ea87cace94a962f", "parents": [ "0a96d0d726cd380423ac38e2c28f538db2940a1d", "5096947508b750bd4a65a8e61bd2083a44d61bfd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Nothing too exciting, usual stream of fixes. Including fixes from\n Netfilter, Bluetooth and WPAN.\n\n Current release - new code bugs:\n\n - Bluetooth: hci_sync: fix not setting CE length properly\n\n - eth: enic: match mailbox replies to request numbers\n\n Previous releases - regressions:\n\n - tunnels: drop stale dst when building an ICMP error for PMTUD\n\n - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n (bug in the rtnl_lock -\u003e RCU conversion)\n\n - eth: bnxt_en:\n - fix crashes on Thor2 due to OOB coalescing buffer accesses\n - prevent queue stop with deferred completions\n\n Previous releases - always broken:\n\n - eth:\n - ice: don\u0027t dereference pointers from TP_printk()\n - fix OOB writes on ethtool flow rule dump in 3 drivers\n - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD\n\n - dsa: tag_brcm: legacy FCS: request needed tailroom\n\n Misc:\n\n - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc\n\n - ipv6: flowlabel: cap duplicate leases per socket\"\n\n* tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)\n selftests: tc-testing: test action batch failure cleanup\n net/sched: act_api: release all action references on NEWACTION failure\n openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n ipmr: account multicast table and route memory\n net: phy: dp83td510: handle the active-high LED polarity mode\n net: macb: initialize PTP state before registering clock\n net: hsr: enable promiscuous mode on interlink port with fwd offload\n ipv6: fix fib6 walker UAF on seq stop\n net: stmmac: fix TX descriptor availability check for TSO traffic\n net/rds: fix tcp stream corruption with large pages\n net: mana: restore the XDP program pointer when pre-allocation fails\n net: phy: dp83867: handle the active-high LED polarity mode\n octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n tcp: reject non zerocopy devmem tx\n net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support\n net: dsa: mt7530: populate lpi_interfaces to fix EEE support\n net: hinic: fix mailbox segment buffer overflow\n net: sun4i-emac: fix missing of_node_put() for phy_node\n ...\n" }, { "commit": "0a96d0d726cd380423ac38e2c28f538db2940a1d", "tree": "5ca577a2941565211f3d9980bc05811b9a9f955a", "parents": [ "ad724d319c81475488794eccc11eb5e27242e1eb", "cb26524ef4ac28fcfa554c0656e8dc412c38a8ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - File type corruption fixes in reparse point handling: setting S_IFMT\n bits without clearing the existing type first corrupted the file mode\n (e.g. S_IFREG | S_IFCHR \u003d\u003d S_IFLNK). Fixed in the WSL, POSIX and\n native symlink reparse parsers. Also fixes an uninitialized SID\n structure in the POSIX readdir path when parsing fails.\n\n - Ownership mapping fixes: forceuid/forcegid mount options were\n ignored in several code paths (SID-to-id mapping, WSL extended\n attributes, POSIX extensions getattr), allowing an untrusted server\n to dictate local file ownership despite explicit mount overrides.\n\n - Heap overflow and overflow fixes in DACL rewriting: replacing short\n SIDs with long ones could overflow the DACL buffer, and the u16\n accumulator for DACL size could wrap around with enough ACEs.\n\n - Reference count leak fixes in oplock break and deferred close:\n duplicate oplock breaks on a queued work item leaked a\n cifsFileInfo reference, and deferred close had a similar leak when\n requeueing a running work item. Both cause busy-inode oopses on\n unmount.\n\n - DFS superblock use-after-free fix: the iterator callback stored a\n raw superblock pointer without pinning it, racing with automount\n expiry.\n\n - One-byte slab OOB read in the native symlink parser when handling\n share-root relative paths.\n\n - Hardening of legacy SMB1 input: reject userspace-crafted\n cifs.idmap key descriptions that bypass kernel origin checks, and\n validate DataOffset in CIFSSMBRead() to prevent heap info\n disclosure from a malicious server.\n\n - DFS cache fix: defer metadata updates until target copying\n succeeds to prevent partial-state cache entries on allocation\n failure.\n\n* tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux:\n smb: client: fix one-byte OOB read in smb2_parse_native_symlink()\n smb: client: fail DACL rewrite when the new DACL exceeds 64K\n smb: client: fix heap overflow in DACL owner/group rewrite\n smb: client: fix file type corruption in cifs_reparse_point_to_fattr()\n smb: client: fix file type corruption in posix_reparse_to_fattr()\n smb: client: fix file type corruption in wsl_to_fattr()\n smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n smb: client: fix WSL reparse point uid/gid override\n smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n smb: client: fix uid/gid override in getattr with posix extensions\n smb: client: fix cifsFileInfo reference leak in deferred close\n smb: client: avoid leaking refcount when cifs_sb_tlink() fails\n smb: client: avoid leaking refcount in cifs_queue_oplock_break()\n smb: client: fill cache fields after populating cache in copy_ref_data()\n smb: client: pin DFS superblock in iterator callback\n smb: client: reject userspace cifs.idmap descriptions\n smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()\n smb: client: reject short READ responses in CIFSSMBRead()\n" }, { "commit": "ad724d319c81475488794eccc11eb5e27242e1eb", "tree": "89a34a871f422f2e320eee99820218bc134cee34", "parents": [ "c9a8c0e393d6043fc29b0b527e654110ba523c36", "353a95f1cd8da8a5436a3f070be07d2f484486cd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fix from Joel Granados:\n \"This fell through the cracks during the latest merge window. There are\n no more CONFIG_PROC_SYSCTL uses after this fix:\n\n - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL\n\n CONFIG_SYSCTL is the config string that controls sysctl subsys\"\n\n* tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard\n" }, { "commit": "c9a8c0e393d6043fc29b0b527e654110ba523c36", "tree": "e01cbcc26ddef4915060d28cd77d4f0abcc6a789", "parents": [ "50d05c7c76c96b90462f24debacca971d2e86713", "01504d14e47b34779911250dd308a03f6ef681c2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "message": "Merge tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog fixes from Guenter Roeck:\n\n - core: Do not start hrtimer when pretimeout is zero\n\n - msc313e: Various fixes for issues reported by Sashiko\n\n - MAINTAINERS: Update URI for watchdog tree\n\n - sunxi_wdt: preserve boot-enabled watchdog\n\n* tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n watchdog: msc313e: Sync timeout value if WDT was running at boot\n watchdog: msc313e: Fix undefined behavior\n watchdog: msc313e: Fix spurious reset on suspend\n watchdog: msc313e: Enable clock before accessing hardware registers\n watchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n watchdog: msc313e: Avoid division by zero\n watchdog: fix hrtimer start when pretimeout is zero\n MAINTAINERS: Update URI for watchdog tree\n watchdog: msc313e: Fix NULL pointer dereference in PM callbacks\n watchdog: sunxi_wdt: preserve boot-enabled watchdog\n" }, { "commit": "5096947508b750bd4a65a8e61bd2083a44d61bfd", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae", "2a86bbed9f60702e97a8194e40f90f4db22d7795" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:08 2026 -0700" }, "message": "Merge branch \u0027net-sched-fix-action-batch-failure-cleanup\u0027\n\nXuanqiang Luo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: fix action batch failure cleanup\n\nFailed batched RTM_NEWACTION requests can leak action references and\nreserved IDR indices when cleanup encounters a filter-bound action.\n\nPatch 1 fixes the failure cleanup.\n\nPatch 2 adds tc-testing regression coverage.\n\nFailure reproduction (key output excerpts):\n\n python3 tdc.py -f tc-tests/actions/gact-rollback.json\n\nnot ok 1 e3b1 - Failed action batch releases a bound action reference\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 3 bind 1\n\nnot ok 2 e3b2 - Failed action batch releases entries after a bound action\n\tCommand exited with 255, expected 0\nRTNETLINK answers: Resource temporarily unavailable\nWe have an error talking to the kernel\n\nnot ok 3 e3b3 - Failed action batch releases repeated references to a bound action\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 4 bind 1\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909070336.32979-1-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2a86bbed9f60702e97a8194e40f90f4db22d7795", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "478eb5abb51931a152abab068f8a717b7ff480fd" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "selftests: tc-testing: test action batch failure cleanup\n\nAdd tests for cleanup after a batched RTM_NEWACTION request fails.\nReplace an existing gact action bound to a filter, then fail a later\nentry by requesting goto chain without a classifier context.\n\nCheck that the bound action\u0027s reference count returns to its original\nvalue. Also cover a successfully initialized new action between the\nbound action and the failing entry, verifying that its reserved index\ncan be reused. Repeat the bound action in another batch to check that\neach temporary reference to the same action is released.\n\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-3-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "478eb5abb51931a152abab068f8a717b7ff480fd", "tree": "00d7d67e4c0fb1ab2af4484bc8f6ab3c90eb1f03", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "net/sched: act_api: release all action references on NEWACTION failure\n\nWhen a batched RTM_NEWACTION request replaces an existing action,\ntcf_idr_check_alloc() takes a temporary reference on it. If a later\naction fails to initialize, tcf_action_destroy() uses strict release\nsemantics to clean up the actions initialized so far. For an action\nbound to a filter, the strict check returns -EPERM without dropping\nthe temporary reference.\n\nThis error also makes tcf_action_destroy() return before releasing\nsubsequent entries. Any new action initialized between the bound\naction and the failing entry is leaked together with its reserved\nIDR slot, preventing reuse of its index.\n\nUse tcf_idr_release() to drop each reference held by the batch without\nrejecting bound actions. This allows cleanup to continue through all\ninitialized entries and preserves the module reference release when\nan action is destroyed. Explicit action deletion and flushing retain\ntheir separate bind-count checks.\n\nFixes: 55334a5db5cd (\"net_sched: act: refuse to remove bound action outside\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-2-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fc266a5dd99c4584c985b8b687c750598500a7ae", "tree": "74cf39e5c4d1eaac74ae943720e2ec264c383555", "parents": [ "e184a4a6f423550a25adce867036cdb1ff471745", "b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:13 2026 -0700" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-09-08 (idpf, ice)\n\nFor idpf:\nMyeonghun Pak adds calls to disable DIM work and PTM to allow for proper\ncleanup.\n\nJosh adds check, and adjustment, for VLAN headers when processing RSC\npackets.\n\nFor ice:\nJake adds call to xa_destroy for xarray sched_node_ids; also moving it\nfrom port_info struct to ice_hw to simplify its lifecycle management.\n\nJakub Kicinski stores trace event data as scalars instead of\ndereferencing pointers in TP_printk(), preventing use-after-free issues\nduring event printing and eliminating double-dereference warnings.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n eth: ice: don\u0027t dereference pointers from TP_printk()\n ice: add missing xa_destroy for sched_node_ids\n idpf: account for VLAN header when parsing RSC packet header\n idpf: disable PTM on probe failure and on remove\n idpf: disable DIM work before freeing q_vectors\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908214502.528440-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e184a4a6f423550a25adce867036cdb1ff471745", "tree": "81a226f509ca1643d3e04ee8dd923f342f75ac90", "parents": [ "b7ee18725f2292ab554aa96a101ae42d45f008bd" ], "author": { "name": "Eelco Chaudron", "email": "echaudro@redhat.com", "time": "Tue Sep 08 16:15:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:51:30 2026 -0700" }, "message": "openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n\nThe ESP and AH cases in get_ipv6_ext_hdrs() used IPPROTO_FRAGMENT instead\nof OFPIEH12_FRAG when checking for out-of-order extension headers, causing\nthe fragment header to not be recognised as a valid predecessor.\n\nThe original code used IPPROTO_FRAGMENT (44) as a bitmask constant where\nOFPIEH12_FRAG (1 \u003c\u003c 4 \u003d 16) was intended. IPPROTO_FRAGMENT encodes bits\n2, 3 and 5 (OFPIEH12_AUTH | OFPIEH12_DEST | OFPIEH12_ROUTER), but not\nbit 4 (OFPIEH12_FRAG). This caused incorrect OFPIEH12_UNSEQ verdicts in\nboth the ESP and AH arms: the ESP arm failed to whitelist OFPIEH12_FRAG,\nwhile the AH arm accidentally whitelisted OFPIEH12_AUTH.\n\nWith the fix, a packet with two AH headers now also gets OFPIEH12_UNSEQ\nin addition to OFPIEH12_UNREP, matching the ESP arm which already sets\nUNSEQ on a repeat, which is the intended behavior.\n\nFixes: 28a3f0601727 (\"net: openvswitch: IPv6: Add IPv6 extension header support\")\nReported-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: Eelco Chaudron \u003cechaudro@redhat.com\u003e\nLink: https://patch.msgid.link/1b1582eb07550d71f3cbe210e5cb31eeb8d0ad86.1788876917.git.echaudro@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7ee18725f2292ab554aa96a101ae42d45f008bd", "tree": "e9f27a905de4f01c5c44bf17c355c2bcc72477ce", "parents": [ "6ca81bbc31cdc964e4b74d17b86215d4a810a56f" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 11:58:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:48:44 2026 -0700" }, "message": "ipmr: account multicast table and route memory\n\nA netadmin in a user+net namespace can create many IPv4 and IPv6\nmulticast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen\nid allocates an mr_table via the shared mr_table_alloc(), links it\ninto the per-net list, and leaves it until netns teardown. Those\nobjects were not charged to memcg, so the host unreclaimable slab\ngrows with the table count.\n\nAccount mr_table allocations with GFP_KERNEL_ACCOUNT and mark the\nIPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established\nhandling of IP addresses, routes and alternate interface names.\n\nUnresolved MFC entries are still allocated from softIRQ with\nGFP_ATOMIC and are not charged. They expire after 10 seconds and are\nbounded by the socket receive queue; see commit 0079ad8e8dc3\n(\"ipmr: remove hard code cache_resolve_queue_len limit\").\n\nFixes: f0ad0860d01e (\"ipv4: ipmr: support multiple tables\")\nFixes: d1db275dd3f6 (\"ipv6: ip6mr: support multiple tables\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/050b58f7fc6b45da0fb12768ebb62d18fa46133d.1788784801.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ca81bbc31cdc964e4b74d17b86215d4a810a56f", "tree": "0179c0ec9b498bdde3b83f0db783e424b5891b69", "parents": [ "e1406330d70e56dd44fa6fbafc86e77e5c80c122" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 08 19:59:58 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:47:22 2026 -0700" }, "message": "net: phy: dp83td510: handle the active-high LED polarity mode\n\ndp83td510_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() returns it. A device tree marking\na DP83TD510 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus leaves the mdio device\nunbound, so phy_attach_direct() falls back to the genphy driver, which\ncannot drive this 10BASE-T1L single-mode PHY, so the interface has no\nusable link.\n\nThe callback initializes polarity to DP83TD510E_LED_POLARITY(index), which\nis the active-high setting, so the request is already satisfied and only\nthe case label is missing.\n\nCc: stable@vger.kernel.org\nFixes: 5b281fe7e396 (\"net: phy: dp83td510: introduce LED framework support\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908105959.70453-3-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e1406330d70e56dd44fa6fbafc86e77e5c80c122", "tree": "2291415b8da9eb8dcf3cdc335e1ad07c0b9c785e", "parents": [ "a2dc179481d18f6df7274522571b64dd50f31e81" ], "author": { "name": "Runyu Xiao", "email": "runyu.xiao@seu.edu.cn", "time": "Tue Sep 08 18:39:24 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:46:19 2026 -0700" }, "message": "net: macb: initialize PTP state before registering clock\n\ngem_ptp_init() registers the PTP clock before initializing\nbp-\u003etsu_clk_lock and the TSU hardware. Since ptp_clock_register()\npublishes the PTP character device, userspace may invoke PTP callbacks\nbefore the lock and hardware are ready.\n\nIn addition, gem_ptp_init() is called from both the interface open and\nresume paths. Reinitializing tsu_clk_lock there can reset the lock while\ntimestamp processing is using it.\n\nThis race is theoretical and has not been observed in practice.\n\nInitialize tsu_clk_lock once during probe and initialize the TSU before\nregistering the PTP clock.\n\nFixes: ab91f0a9b5f4 (\"net: macb: Add hardware PTP support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260904030439.3994047-1-runyu.xiao@seu.edu.cn/\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260908103924.607033-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a2dc179481d18f6df7274522571b64dd50f31e81", "tree": "627196c8b7c7dcdcde85e1ec1a31e74664f0a196", "parents": [ "19b4ed644d68098cc62ab612727f40d30f43476c" ], "author": { "name": "MD Danish Anwar", "email": "danishanwar@ti.com", "time": "Tue Sep 08 14:38:56 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:45:00 2026 -0700" }, "message": "net: hsr: enable promiscuous mode on interlink port with fwd offload\n\nhsr_portdev_setup() skips promiscuous mode on non-master ports when\nhsr-\u003efwd_offloaded is set. fwd_offloaded is derived only from the ring\nslaves\u0027 NETIF_F_HW_HSR_FWD bit, so this also skips it for the interlink\nport, which never gets forwarding offload. Without promiscuous mode,\nthe interlink NIC drops unicast frames addressed to hsr_dev\u0027s MAC\n(e.g. SAN traffic to the RedBox), breaking RedBox whenever the ring is\nHW-offloaded.\n\nFixes: 5055cccfc2d1 (\"net: hsr: Provide RedBox support (HSR-SAN)\")\nSigned-off-by: MD Danish Anwar \u003cdanishanwar@ti.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260908090856.2876114-1-danishanwar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19b4ed644d68098cc62ab612727f40d30f43476c", "tree": "40c1c6cb900b27e01b6bed9adfdc66ca2c36d60b", "parents": [ "5e38d732ec67a5b1f9a56e6c73add480c4b6030a" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 07:42:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:39:06 2026 -0700" }, "message": "ipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet-\u003eipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w-\u003enode check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race.\n\nFixes: 8d2ca1d7b5c3 (\"ipv6: avoid high order memory allocations for /proc/net/ipv6_route\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nCo-developed-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/89699735763f6c297584d7c2ff106239cc1e8ce0.1788837093.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0abe8777490ebc008635ecb20297761d1b317697", "tree": "33a67b2a89bdfb8875bb8dff206b17db43668ba5", "parents": [ "10ca508878b6c0342639b85534ee914edfd0b2a0", "f36cb539fd9718d48f88d6e8c6afe25e2178c4c6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:35:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:35:06 2026 -0700" }, "message": "Merge branch \u0027net-fix-typos-and-repeated-words-in-comments\u0027\n\nHemanth Selam says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: fix typos and repeated words in comments\n\nFix misspellings and repeated words in comments across the networking\ncode, found with scripts/checkpatch.pl using the misspelling list in\nscripts/spelling.txt. Comments only, no code changes.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908052602.27497-1-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f36cb539fd9718d48f88d6e8c6afe25e2178c4c6", "tree": "33a67b2a89bdfb8875bb8dff206b17db43668ba5", "parents": [ "eeea715379b27a27350b2f77ed36213177229671" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:56:02 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:39 2026 -0700" }, "message": "net: dec: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-11-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eeea715379b27a27350b2f77ed36213177229671", "tree": "f4ca6b721318371e0ed24f73726e9dd8376e357c", "parents": [ "1b4109e4a024eb51b5b81fcaed511256e0ce502e" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:56:01 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:38 2026 -0700" }, "message": "net: atheros: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-10-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1b4109e4a024eb51b5b81fcaed511256e0ce502e", "tree": "fb4a164776834972dbdc84d4c74bb30aadfda31e", "parents": [ "36ca708b7cc7dd224c2e2ef257f68e06fbc15837" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:56:00 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:38 2026 -0700" }, "message": "net: hisilicon: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-9-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "36ca708b7cc7dd224c2e2ef257f68e06fbc15837", "tree": "227066427b3ca226a53ba282d7d74d9145cfa9b0", "parents": [ "ef7ed063b48ff3de9df36098d78b9f23e6876a26" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:59 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:38 2026 -0700" }, "message": "net: marvell: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908052602.27497-8-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ef7ed063b48ff3de9df36098d78b9f23e6876a26", "tree": "5af5b9f27a292ff891fa1a6ae760f25e59fcaadb", "parents": [ "12ae2a2b298a124874492d48a4052ffd75ccb5e9" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:58 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:38 2026 -0700" }, "message": "net: fddi: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-7-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "12ae2a2b298a124874492d48a4052ffd75ccb5e9", "tree": "b3276cdf8ec9f61fd25ca30c3fc58b40841c76c2", "parents": [ "405829119fdc8df5fe894ba21834a0968110d0f0" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:57 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:38 2026 -0700" }, "message": "net: qlogic: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-6-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "405829119fdc8df5fe894ba21834a0968110d0f0", "tree": "e775066eb8e74cf8061c86bac62e907fac22d212", "parents": [ "a08b0a9e5e5fb0b05796dcbbc022bd7a16e24e4c" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:56 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:37 2026 -0700" }, "message": "net: cavium: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-5-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a08b0a9e5e5fb0b05796dcbbc022bd7a16e24e4c", "tree": "d012501fd4ba5a14a7a493c89f3cb0b182d37a70", "parents": [ "a2c9decb21b25f9d667fbeb72117be5a312aaf7d" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:55 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:37 2026 -0700" }, "message": "net: broadcom: fix typos in comments\n\nFix misspellings in comments, found with scripts/checkpatch.pl using\nthe misspelling list in scripts/spelling.txt. Comments only, no code\nchanges.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260908052602.27497-4-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a2c9decb21b25f9d667fbeb72117be5a312aaf7d", "tree": "640945338cfb3070d0da54921dc721acef3ea305", "parents": [ "2d2c2ea6650e423b83f89f919900124a625fd452" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:54 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:37 2026 -0700" }, "message": "selftests: net: fix repeated word \u0027use\u0027 in comment\n\nDrop the second \u0027use\u0027, reported by checkpatch.pl as a possible repeated\nword. Only touches a comment, no code changes.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908052602.27497-3-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2d2c2ea6650e423b83f89f919900124a625fd452", "tree": "f17b50ef74083b180e7dd77e90239b811f5f45bd", "parents": [ "10ca508878b6c0342639b85534ee914edfd0b2a0" ], "author": { "name": "Hemanth Selam", "email": "hemanth.selam@gmail.com", "time": "Tue Sep 08 10:55:53 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:37 2026 -0700" }, "message": "net: llc: fix repeated word \u0027all\u0027 in comment\n\nDrop the second \u0027all\u0027, reported by checkpatch.pl as a possible repeated\nword. Only touches a comment, no code changes.\n\nSigned-off-by: Hemanth Selam \u003chemanth.selam@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908052602.27497-2-hemanth.selam@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a", "tree": "2bbcab25587be47331ea1a16c89d915de1c4da7f", "parents": [ "2ac09b5353fe6858411fdc8c6efa60d832e20f13" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Sep 07 23:46:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:07 2026 -0700" }, "message": "net: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb-\u003elen - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check.\n\nFixes: f748be531d70 (\"stmmac: support new GMAC4\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907-stmmac-fix-tso-nfrags-check-v1-1-328459906cdb@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ac09b5353fe6858411fdc8c6efa60d832e20f13", "tree": "59b37dc616b531c0fd1fae4800544096428c90b7", "parents": [ "4c46beb807efcc93f5899ebe1f5958248eb296c6" ], "author": { "name": "Greg Marsden", "email": "greg.marsden@oracle.com", "time": "Sat Sep 05 10:00:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:19:17 2026 -0700" }, "message": "net/rds: fix tcp stream corruption with large pages\n\nrds_message_map_pages() assigns PAGE_SIZE bytes to every\nscatterlist entry, even when total_len ends in a partial page. The RDS\ncongestion map is defined as 8192 bytes, so on systems with PAGE_SIZE\ngreater than 8192 the scatterlist maps bytes beyond the end of the\ncongestion map. RDS-TCP transmits the SG contents according to those\nlengths, so the extra bytes become part of the TCP RDS stream and are\ninterpreted as subsequent RDS message headers, corrupting the stream.\n\nLimit the final scatterlist mapping to the number of bytes remaining.\nThis has no effect on systems with a 4K page size and allows RDS-TCP to\nbe used on systems with 16K and larger page sizes.\n\nThe RDS selftest, which previously hung on 16K pages, now passes.\n\nFixes: 7875e18e0996 (\"RDS: Message parsing\")\nSigned-off-by: Greg Marsden \u003cgreg.marsden@oracle.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/apxJjxvStibPI0AS@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c46beb807efcc93f5899ebe1f5958248eb296c6", "tree": "1fb7e99e6821c49b9479a254786d54217fb0d027", "parents": [ "36a45facedd5c8e73bfb2403f8b0dbff05124c9c" ], "author": { "name": "Long Li", "email": "longli@microsoft.com", "time": "Fri Sep 04 13:26:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:06:07 2026 -0700" }, "message": "net: mana: restore the XDP program pointer when pre-allocation fails\n\nmana_xdp_set() publishes the new program into apc-\u003ebpf_prog before it\nallocates anything, because mana_pre_alloc_rxbufs() sizes the buffers\nfrom it via mana_get_rxbuf_cfg(). When that allocation fails the\nfunction returns the error directly, skipping the err_dealloc_rxbuffs\nlabel which is the only place that restores the previous pointer.\n\nThe attach is reported as failed, so the BPF core drops the reference it\nheld for the caller and the program can be freed, while apc-\u003ebpf_prog\nstill points at it. The next consumer of mana_xdp_get() - typically\nmana_chn_setxdp() from mana_alloc_queues() on the following ifup, or\nafter a TX timeout reset - then calls bpf_prog_add() on freed memory.\n\nThis is reachable from an ordinary \"ip link set dev ethX xdp obj ...\"\nwhenever the per-queue RX buffer pre-allocation cannot be satisfied.\n\nRestore the previous program on that error path.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nSigned-off-by: Long Li \u003clongli@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904202640.3900685-1-longli@microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "36a45facedd5c8e73bfb2403f8b0dbff05124c9c", "tree": "6d2ebc24e56c1531ba8573ae117681007a6ba286", "parents": [ "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 03 11:28:38 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "net: phy: dp83867: handle the active-high LED polarity mode\n\nCommit a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY\nLEDs\") added PHY_LED_ACTIVE_HIGH and made of_phy_led() set the matching\nbit in the modes mask when a LED node carries the \u0027active-high\u0027\nproperty. dp83867 was not part of that series.\n\ndp83867_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() fails. A device tree marking a\nDP83867 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus stops the PHY from\nprobing.\n\nActive high is what the function programs when no polarity mode is\nrequested at all, so the initial value of polarity already satisfies the\nrequest and only the case label is missing.\n\nThe same series updated mxl-gpy in commit eb89c79c1b8f (\"net: phy:\nmxl-gpy: correctly describe LED polarity\") and aquantia in\ncommit 9d55e68b19f2 (\"net: phy: aquantia: correctly describe LED\npolarity override\").\n\nFixes: a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY LEDs\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nLink: https://patch.msgid.link/20260903022839.4006614-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437", "tree": "7234cccade054ae2d9331ff8f8d2adeef5b05526", "parents": [ "985a663bf00799c1daf1c5789efa6406958780c8" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Fri Sep 04 14:21:13 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n\nrvu_dbg_rvu_pf_cgx_map_display() locates each RVU PF PCI device via\npci_get_domain_bus_and_slot() when printing the PF-to-CGX map. It\nassumed PF0 always sits on PCI bus 1 and derived other PF bus numbers\nas pf + 1, but the AF device can be enumerated on a different bus.\n\nUse rvu-\u003epdev-\u003ebus-\u003enumber as the base bus instead, so each PF lookup\nuses pf + start on systems where RVU functions are on contiguous buses\nbut do not start at bus 1.\n\nFixes: e2fb373038654 (\"octeontx2-af: Display CGX, NIX and PF map in debugfs.\")\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904085114.3385530-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "985a663bf00799c1daf1c5789efa6406958780c8", "tree": "82415db2760ff82b11dc69dd6e978fb5d92e4747", "parents": [ "ccbe7540e4aad0d1c3acc249697350b93ccb8025" ], "author": { "name": "Faicker Mo", "email": "faicker.mo@gmail.com", "time": "Tue Sep 08 12:06:29 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 15:19:06 2026 +0200" }, "message": "net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n\nThis is a sibling fix of commit\nb84c5632c7b3 (\"net: net_failover: Fix the deadlock in slave register\").\nThere is netdev_lock_ops() in the upper callers, so using netif_open()\ninstead of dev_open().\n\nCall Trace:\n __schedule+0x2bb/0x650\n schedule+0x27/0xb0\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x550/0xaf0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n dev_open+0x3b/0xe0\n net_failover_slave_name_change+0x22/0x40\n failover_event+0xd4/0x1e0\n notifier_call_chain+0x62/0xf0\n raw_notifier_call_chain+0x16/0x30\n call_netdevice_notifiers_info+0x50/0x80\n netif_change_name+0x200/0x330\n do_setlink.isra.0+0xb12/0xdf0\n ? security_capable+0x9a/0x1e0\n ? ns_capable+0x31/0x60\n rtnl_setlink+0x302/0x670\n ? netlink_recvmsg+0x296/0x340\n ? security_capable+0x9a/0x1e0\n ? __pfx_rtnl_setlink+0x10/0x10\n rtnetlink_rcv_msg+0x384/0x460\n ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x61/0x120\n rtnetlink_rcv+0x15/0x30\n netlink_unicast+0x28f/0x3c0\n netlink_sendmsg+0x216/0x450\n __sys_sendto+0x222/0x230\n __x64_sys_sendto+0x24/0x40\n x64_sys_call+0x1d5d/0x2390\n do_syscall_64+0x105/0x5a0\n ? do_syscall_64+0x140/0x5a0\n ? exc_page_fault+0x94/0x1e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFixes: 7e4d784f5810 (\"net: hold netdev instance lock during rtnetlink operations\")\nSigned-off-by: Faicker Mo \u003cfaicker.mo@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260908040708.3972058-1-faicker.mo@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "10ca508878b6c0342639b85534ee914edfd0b2a0", "tree": "499d16dcef853a5b70d92d8c4c45ed7c2a6973ce", "parents": [ "ae768e41c03e865ec55a70ff1020a18a83976955" ], "author": { "name": "Weiting Lee", "email": "weiting.lee@airoha.com", "time": "Mon Sep 07 09:56:37 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 15:16:25 2026 +0200" }, "message": "net: phy: air_en8811h: select LED GPIO pins based on AN8811HB package variant\n\nThe AN8811HB comes in two package variants, AN8811HBCN and AN8811HBN,\nwhich use different GPIO pins to drive LED outputs. AN8811HBCN uses\nGPIOs 0, 1, and 15, while AN8811HBN uses GPIOs 3, 4, and 5. Using a\nfixed GPIO assignment causes incorrect LED behavior on one of the\nvariants.\n\nRead the package variant from the read-only silicon identification bits\nin AN8811HB_HWTRAP2 at probe time and store it in priv-\u003eis_an8811hbcn.\nAdd an8811hb_led_gpio_setup() to configure the correct GPIO output pins\nand select lines based on the detected variant, and call it from\nconfig_init.\n\nSigned-off-by: Weiting Lee \u003cweiting.lee@airoha.com\u003e\nLink: https://patch.msgid.link/20260907015638.2875763-1-weiting.lee@airoha.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ae768e41c03e865ec55a70ff1020a18a83976955", "tree": "2454f029561fe4e4b5d434470f3167c292ca8a9e", "parents": [ "211f2a875f6f447745d80d5762d6d614503ac84a" ], "author": { "name": "Marco Crivellari", "email": "marco.crivellari@suse.com", "time": "Mon Sep 07 11:48:22 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 15:04:33 2026 +0200" }, "message": "Octeontx2-af: Add WQ_PERCPU to alloc_workqueue users\n\nThis continues the effort to refactor workqueue APIs, which began with\nthe introduction of new workqueues and a new alloc_workqueue flag in:\n\n commit 128ea9f6ccfb (\"workqueue: Add system_percpu_wq and system_dfl_wq\")\n commit 930c2ea566af (\"workqueue: Add new WQ_PERCPU flag\")\n\nThe refactoring is going to alter the default behavior of\nalloc_workqueue() to be unbound by default.\n\nWith the introduction of the WQ_PERCPU flag (equivalent to !WQ_UNBOUND),\nany alloc_workqueue() caller that doesn’t explicitly specify WQ_UNBOUND\nmust now use WQ_PERCPU. For more details see the Link tag below.\n\nThis is also enforced by:\n\n commit 21c05ca88a548 (\"workqueue: Add warnings and ensure one among WQ_PERCPU or WQ_UNBOUND is present\")\n\nIn order to keep alloc_workqueue() behavior identical, explicitly request\nWQ_PERCPU.\n\nLink: https://lore.kernel.org/all/20250221112003.1dSuoGyc@linutronix.de/\nSuggested-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Marco Crivellari \u003cmarco.crivellari@suse.com\u003e\nLink: https://patch.msgid.link/20260907094822.121457-1-marco.crivellari@suse.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ccbe7540e4aad0d1c3acc249697350b93ccb8025", "tree": "cc0ebd4dc7a32b9c8edf139baec73560be3df695", "parents": [ "125755776bc6d4dd53eaf551c87e3d460625d638" ], "author": { "name": "Vladislav Karmanov", "email": "vladislav.karmanov.dev@gmail.com", "time": "Tue Sep 08 17:52:13 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 14:48:21 2026 +0200" }, "message": "net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n\nThe MT7530 internal GE PHY advertises EEE by hardware default, but its\nEEE support is defective: with EEE advertised, some link partners fail\nto establish a stable link. On a 2-pair (4-wire) cable where both ends\nadvertise gigabit, 1000BASE-T training cannot succeed, and instead of\nfalling back to 100 Mbps the port loops, so no link or DHCP lease is\never obtained. MediaTek confirms the hardware is the root cause (Landen\nChao, 2021): \"EEE of the 10-year-old MT7530 internal gephy has many IOT\nproblems, so it is recommended to disable its EEE.\"\n\nmtk_gephy_config_init() used to clear the EEE advertisement early, but\ncommit af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE\nadvertisement\") removed that on the rationale that the DSA subdriver\nalready performs an early disable. That holds for MT7531, whose\nmt7531_setup() clears MDIO_AN_EEE_ADV on each switch PHY, but not for\nthe MT7530 PHY: neither the MT7621 integrated switch nor the dedicated\nMT7530 IC ever had such a loop, so removing it left those boards\nwithout any working early EEE disable and the link flapping came back.\n\nSince the broken hardware is the PHY, fix it in the PHY driver so it\ncovers all users of this PHY, integrated in a switch or standalone:\n\n - clear MDIO_AN_EEE_ADV in probe(), as early as possible, before\n anything can negotiate EEE with the link partner;\n - clear it again in config_init() and call phy_disable_eee() there.\n config_init() is what phy_init_hw() replays after a PHY reset, when\n the register is back at its EEE-advertising hardware default, and\n it runs after of_set_phy_eee_broken() in phy_probe(), so the\n eee_disabled_modes mask survives and neither phylib nor userspace\n can re-enable EEE. dp83867 disables broken EEE from config_init()\n the same way.\n\nAuto-negotiation then falls back to a stable 100 Mbps link instead of\nlooping at gigabit. Tested on ASUS RT-AX53U (MT7621): with a 2-pair\ncable on the WAN port, a single clean 100 Mbps link comes up and a\nDHCP lease is obtained, where the unpatched driver loops.\n\nFixes: af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE advertisement\")\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Vladislav Karmanov \u003cvladislav.karmanov.dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260908145213.3976508-1-vladislav.karmanov.dev@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "125755776bc6d4dd53eaf551c87e3d460625d638", "tree": "2849f24849762901d55b340b73e9f442211eeffb", "parents": [ "7addb4e5ef1702704914b47bca3f706ef96c1589" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Fri Sep 04 14:43:07 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 14:45:57 2026 +0200" }, "message": "tcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation.\n\nFixes: bd61848900bff (\"net: devmem: Implement TX path\")\nFixes: d9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/fdc2478d8f21268d7078556409887d8e6ba0ad32.1788529053.git.asml.silence@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7addb4e5ef1702704914b47bca3f706ef96c1589", "tree": "4130ff1bd37ce68000eeef42084d6aa7f632f977", "parents": [ "5d4d985957434867bbe85e4fa5e638f3e48ad522", "d876c9cb2d16ed259449fe9da08c37a5cb81d724" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:31 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:31 2026 +0200" }, "message": "Merge branch \u0027net-restore-eee-on-mediatek-switches-and-soc-macs\u0027\n\nAleksei Sviridkin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: restore EEE on MediaTek switches and SoC MACs\n\nBoth drivers fill in phylink_config.lpi_capabilities and\nlpi_timer_default but never lpi_interfaces. phylink treats a MAC as\nsupporting managed EEE only when the tx_lpi methods are implemented and\nBOTH bitmaps are non-empty, which phylink_create() decides once and for\nall, so EEE has been off on every mt753x port and on every mtk_eth_soc\nMAC that uses mtk_phylink_ops since the two commits named in the\nFixes: tags. Because the tx_lpi methods ARE implemented, phylink takes\nthe other branch and calls phy_disable_eee(), which fills\neee_disabled_modes - so userspace cannot enable EEE either.\n\nOn an MT7981B board with an MT7531 switch, before these patches:\n\n \u003d\u003d lan1\n Cannot get EEE settings: Not supported\n \u003d\u003d lan2\n Cannot get EEE settings: Not supported\n \u003d\u003d lan3\n Cannot get EEE settings: Not supported\n \u003d\u003d lan4\n Cannot get EEE settings: Not supported\n \u003d\u003d wan\n Cannot get EEE settings: Not supported\n\nlan1-3 are the MT7531 internal PHYs, lan4 is an EN8811H on switch port\n5 whose MAC side runs 2500BASE-X rate matched to a 1 Gbps media link,\nand wan is the mtk_eth_soc MAC with its directly attached 1 Gbps PHY -\nso both drivers are covered.\n\nEach patch fills lpi_interfaces from supported_interfaces and leaves\n2.5 Gbps out of both bitmaps for now. LPI above 1 Gbps is unvalidated\nrather than unsupported: both MACs fold 2.5 Gbps onto their 1 Gbps\nspeed encoding, so the 1 Gbps EEE force bit is what would govern it.\nMediaTek\u0027s SDK driver sets the force bits for 100 Mbps and 1 Gbps only,\nEEE signalling on 2500BASE-X is outside 802.3, and the 1 us unit of the\nwakeup timers is undocumented at 2.5 times the port clock.\n\nThe SoC MAC patch fills lpi_interfaces only on SoCs carrying a new\nMTK_GMAC_EEE capability. mtk_mac_enable_tx_lpi() programs wake-up times\ntaken from MT7531\u0027s reset values, and the capability marks the SoCs\nwhere those have been measured to work: MT7981 for now. The others keep\ntoday\u0027s behaviour, EEE unreachable from userspace, until someone with\nthe hardware confirms them.\n\nNeither driver sets eee_enabled_default, so LPI stays off until\nuserspace asks for it with ethtool --set-eee. The EEE advertisement is\na different matter: phylink stops force-clearing it, so a PHY that\nadvertises EEE out of reset advertises it again and the link may\nnegotiate EEE, without this MAC asserting LPI. MT7531\u0027s internal PHYs\nand EN7528 are the exceptions, for the reasons in patch 1. Devicetree\neee-broken-* marks act at the PHY level and keep working, so a board\nthat already distrusts its PHYs stays protected: OpenWrt marks all\nmodes broken on MT7621\u0027s internal PHYs.\n\nThe two patches are independent and touch different subsystems; they\nare sent together because they are the same bug.\n\nTargeted at net as a regression fix with an active userspace lockout;\ncan be retargeted at net-next if maintainers prefer.\n\nBased on net-next at 91ec20351349. All three files touched are byte\nidentical in net/main and the series applies there unchanged.\n\nAfter the series, all five ports report:\n\n EEE status: disabled\n Tx LPI: disabled\n Supported EEE link modes: 100baseT/Full\n 1000baseT/Full\n Advertised EEE link modes: Not reported\n\nNo 2.5G mode is offered, which is the narrowed lpi_capabilities, and\nnothing is advertised until userspace asks. On this board no PHY came\nout of reset advertising EEE, so the case where the advertisement\nreturns once phylink stops clearing it is not exercised here.\n\nEnabling it on lan1, whose partner advertises EEE at both speeds:\n\n # ethtool --set-eee lan1 eee on\n EEE status: enabled - active\n Advertised EEE link modes: 100baseT/Full 1000baseT/Full\n Link partner advertised EEE link modes: 100baseT/Full 1000baseT/Full\n\n # ethtool --set-eee lan1 eee on tx-lpi on\n EEE status: enabled - active\n Tx LPI: 30 (us)\n\nWith LPI armed, 30 parallel ICMPv6 streams of 1400-byte payload, 300\npackets each one second apart - so every gap crosses the LPI threshold\nand the link enters and leaves LPI thousands of times over 300 s - lost\nnothing: 300/300 on every stream, tx and rx error counters unchanged,\ncarrier_changes unchanged, and no mac_enable_tx_lpi errors in dmesg.\n\nOn wan, cabled for this round to a partner that advertises EEE (a\nBCM5720), the MT7981 GMAC\u0027s own LPI was exercised. With tx-lpi armed\nthe wan PHY\u0027s MMD 3.1 reads 0x0f44, Tx LPI indication set, so the MAC\nis asserting LPI; it drops to 0x0044 with tx-lpi off and comes back\nwith it on. The same 30-stream test at 1 Gbps lost nothing over 9000\npackets with the link cycling through LPI at every 1 s gap. At\n100 Mbps the only losses were the first packet or two of some\nstreams, and those reproduce with EEE disabled on both ends:\nneighbour discovery for 30 streams starting at once. The 17 and 36 that\nmtk_mac_enable_tx_lpi() programs therefore hold on MT7981 against this\npartner at both speeds. Its Tx LPI reads 1000 (us) against lan1\u0027s 30;\nsee the note below the scissors of patch 1.\n\nlan4 keeps EEE disabled and never arms LPI, which is what dropping\n2500BASE-X from lpi_interfaces is for. Forwarding through it was\nlossless with no carrier change.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260903123644.23800-1-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d876c9cb2d16ed259449fe9da08c37a5cb81d724", "tree": "4130ff1bd37ce68000eeef42084d6aa7f632f977", "parents": [ "3c18e3c9a54e1239b72849502ca4737604bfbb46" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Thu Sep 03 12:36:44 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:28 2026 +0200" }, "message": "net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support\n\nphylink_create() decides once and for all that a MAC supports managed\nEEE, and it requires the tx_lpi ops plus non-empty lpi_capabilities and\nlpi_interfaces. mtk_add_mac() leaves lpi_interfaces empty.\n\nSo ever since EEE support was added, ethtool has answered \"Not\nsupported\" on every MAC that uses mtk_phylink_ops, and\nphy_disable_eee() has locked userspace out of turning EEE on. MT7628\nis unaffected, as rt5350_phylink_ops has no tx_lpi methods.\n\nLeave 2.5 Gbps out of both bitmaps, and the xGMII modes that\nmtk_mac_enable_tx_lpi() already refuses. MAC_MCR folds SPEED_2500 onto\nMAC_MCR_SPEED_1000, so MAC_MCR_EEE1G would govern LPI on such a link,\nand that is unvalidated rather than known unsupported: MediaTek\u0027s SDK\ndriver sets the EEE force bits for 100 Mbps and 1 Gbps only, and the\nunit of the wakeup timers is undocumented with the port clock at\n2.5 times the rate.\n\nmtk_mac_enable_tx_lpi() programs wake-up times taken from MT7531\u0027s\nreset values, and the SoC\u0027s own field has no reset value to fall\nback on. Only MT7981 has been seen to exit LPI cleanly with them, so\nthe LPI interfaces sit behind a new MTK_GMAC_EEE capability that only\nMT7981 sets; every other SoC keeps the current behaviour until it has\nbeen confirmed.\n\nLPI stays off until userspace enables it, but the EEE advertisement of\na PHY that advertises it out of reset comes back, since phylink stops\nforce-clearing it.\n\nFixes: 952d7325362f (\"net: ethernet: mediatek: add EEE support\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260903123644.23800-3-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3c18e3c9a54e1239b72849502ca4737604bfbb46", "tree": "606cf2e622bea14b78e4bc14ca88e43399f31698", "parents": [ "5d4d985957434867bbe85e4fa5e638f3e48ad522" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Thu Sep 03 12:36:43 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:28 2026 +0200" }, "message": "net: dsa: mt7530: populate lpi_interfaces to fix EEE support\n\nphylink_create() decides once and for all that a MAC supports managed\nEEE, and it requires the tx_lpi ops plus non-empty lpi_capabilities and\nlpi_interfaces. mt753x_phylink_get_caps() leaves lpi_interfaces empty.\n\nSo ever since the conversion to phylink managed EEE, ethtool has\nanswered \"Not supported\" on every mt753x port, and phy_disable_eee()\nhas locked userspace out of turning EEE on. That undoes what\ncommit 06dfcd4098cf (\"net: dsa: mt7530: fix enabling EEE on MT7531\nswitch on all boards\") arranged: EEE off by default, but reachable\nwith ethtool.\n\nLeave the speeds above 1 Gbps out of both bitmaps. PMCR folds\nSPEED_2500 and SPEED_10000 onto PMCR_FORCE_SPEED_1000, so\nPMCR_FORCE_EEE1G would govern LPI on such a link, and that is\nunvalidated rather than known unsupported: MediaTek\u0027s SDK driver sets\nthe EEE force bits for 100 Mbps and 1 Gbps only, and the unit of the\nwakeup timers is undocumented with the port clock at 2.5 times the\nrate.\n\nLPI stays off until userspace enables it, but the EEE advertisement of\na PHY that advertises it out of reset comes back, since phylink stops\nforce-clearing it.\n\nFixes: 9cf21773f535 (\"net: dsa: mt7530: convert to phylink managed EEE\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260903123644.23800-2-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "tree": "bcddb5736265d2d16cd1d1341b0b01571dddbbff", "parents": [ "af406abfecad2f48d8f1fc646d3994f0982bac62" ], "author": { "name": "Aamir Ahmed", "email": "elb12345@hotmail.co.uk", "time": "Mon Sep 07 02:42:34 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:37:09 2026 +0200" }, "message": "net: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id\u003d42) to carry a full 48-byte payload, writing to offset\n42*48\u003d2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver.\n\nFixes: a425b6e1c69b (\"hinic: add mailbox function support\")\nSigned-off-by: Aamir Ahmed \u003celb12345@hotmail.co.uk\u003e\nLink: https://patch.msgid.link/AS8P251MB0001AE870B09020B46B5D7DBC8B22@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "af406abfecad2f48d8f1fc646d3994f0982bac62", "tree": "fc76a70989b71f1f556ca5cf084a0afe034e09fc", "parents": [ "dff39930ad5e53d202bfdfb14687d1d2fd753b4d" ], "author": { "name": "Li Youhong", "email": "liyouhong@kylinos.cn", "time": "Fri Sep 04 16:07:58 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:22:01 2026 +0200" }, "message": "net: sun4i-emac: fix missing of_node_put() for phy_node\n\nof_parse_phandle() returns a node pointer with an elevated refcount.\nAdd the missing of_node_put() on the probe error path after\nregister_netdev() fails and in emac_remove().\n\nFixes: 492205050d77 (\"net: Add EMAC ethernet driver found on Allwinner A10 SoC\u0027s\")\nSigned-off-by: Li Youhong \u003cliyouhong@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904080758.2432748-1-dayou5941@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "dff39930ad5e53d202bfdfb14687d1d2fd753b4d", "tree": "df6e8159f8cf47f7f318aa4e0ee501f71cfc3235", "parents": [ "4770e9f851b782c0047d617a62897f957e441eca" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Sep 08 20:55:25 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:06:23 2026 +0200" }, "message": "net/sched: cls_api: Don\u0027t replay RTM_GETCHAIN in tc_ctl_chain().\n\nIf a netlink socket sends RTM_GETCHAIN requests repeatedly\nwithout recv()ing the responses, tc_ctl_chain() hogs CPU and\ntriggers Hung Task splat. [0]\n\nAs caught in the stack trace, netlink_attachskb() could confuse\ntc_ctl_chain() by returning -EAGAIN when the userspace netlink\nsocket\u0027s receive buffer is full.\n\nThe replay: label exists since commit 32a4f5ecd738 (\"net: sched:\nintroduce chain object to uapi\") but was not used initially.\n\nSince commit 9f407f1768d3 (\"net: sched: introduce chain templates\"),\nthe label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()\nmay release RTNL to call request_module().\n\nHowever, the replay logic is unnecessary for RTM_GETCHAIN.\n\nLet\u0027s apply the replay logic only for RTM_NEWCHAIN.\n\n[0]:\nINFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.\ntask:repro state:R running task stack:14096 pid:1022 tgid:1014 ppid:961 task_flags:0x400040 flags:0x00080000\nCall Trace:\n \u003cTASK\u003e\n ? clockevents_program_event (kernel/time/clockevents.c:372)\n ? pskb_expand_head (net/core/skbuff.c:615)\n ? skb_release_data (net/core/skbuff.c:1122)\n ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232)\n ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499)\n ? tc_chain_notify (net/sched/cls_api.c:3045)\n ? tc_chain_notify (./include/linux/skbuff.h:1384 net/sched/cls_api.c:3041)\n ? netlink_unicast (net/netlink/af_netlink.c:1335)\n ? rtnl_unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985)\n ? tc_ctl_chain (net/sched/cls_api.c:3242)\n ? rtnetlink_rcv_msg (net/core/rtnetlink.c:7146)\n ? netlink_unicast (net/netlink/af_netlink.c:1354)\n ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:7177)\n ? netlink_rcv_skb (net/netlink/af_netlink.c:2556)\n ? netlink_unicast (net/netlink/af_netlink.c:1319)\n ? netlink_sendmsg (net/netlink/af_netlink.c:1900)\n ? __sock_sendmsg (net/socket.c:800)\n ? __sys_sendto (net/socket.c:2281)\n ? __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)\n ? do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n\nFixes: 2ed9db3074fc (\"net: sched: cls_api: fix dead code in switch\")\nReported-by: Taras Madan \u003ctarasmadan@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: hybris@mojatatu.ai\nLink: https://patch.msgid.link/20260908205537.863484-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4770e9f851b782c0047d617a62897f957e441eca", "tree": "c433561f4864a5ad1f4c16b690ad20a14a93070f", "parents": [ "00f9fbc12320253bfc576fb7539d860029c82d0f", "e190a7aabbea4fbfec0e74de134144cb4d040738" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:53 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:54 2026 +0200" }, "message": "Merge branch \u0027net-sched-cls_route-fix-bucket-retention-and-handle-recomputation\u0027\n\nVictor Nogueira says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: cls_route: fix bucket retention and handle recomputation\n\nPatch 1 is the v1 patch, unchanged. route4_change() can move an existing\nfilter to a different top-level bucket, since route4_set_parms()\nrecomputes the handle from TCA_ROUTE4_TO/FROM/IIF. The filter is\nunlinked from the old bucket, but the bucket itself is never freed once\nit goes empty, so route4_delete() keeps reporting *last\u003dfalse after the\nlast live filter is gone. That pins the empty tcf_proto and leaks it.\nThe filters linked to a bucket are refcounted now, and the bucket is\ndropped from head-\u003etable[] as soon as the count reaches zero.\n\nReviewing v1, Sashiko pointed out that the duplicate scan in\nroute4_set_parms() compares against the wrong handle [1]. Patches 2 and\n3 fix the two symptoms of that.\n\nPatch 2 makes the scan compare against nhandle. f-\u003ehandle is the handle\nthe filter has before the update, not the one it is about to be linked\nunder, so a change that moves a filter into a chain already holding\nnhandle misses the collision and links a second filter under the same\nhandle. The newcomer is then unreachable: route4_get() returns the\nincumbent, and route4_classify() stops at the first filter whose f-\u003eid\nmatches.\n\nPatch 3 handles the mirror case. An in-place replace computes an nhandle\nthat the filter being replaced already carries, so the scan finds that\nfilter and rejects the request with -EEXIST. The older filter is passed\nto route4_set_parms() and skipped in the scan. Skipping it alone would\nrename the filter it replaces: the 0x7F00 order bits are carried in no\nattribute and were folded into nhandle on the create path alone, so an\norder 1 filter came back as order 0, and a sibling sharing its key could\nthen no longer be replaced at all. They are carried over now whenever\nthe request builds the key the filter already has, which leaves a\nrequest that does change the key renaming the filter as before.\n\nPatch 4 adds tdc coverage for all three, including the cross-bucket move\ncase Sashiko noted route.json had no test for.\n\n[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260907192133.2639067-1-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e190a7aabbea4fbfec0e74de134144cb4d040738", "tree": "c433561f4864a5ad1f4c16b690ad20a14a93070f", "parents": [ "41e85e54e5649a1617698438b0ce64c6f9d83d69" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:33 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "selftests/tc-testing: Add cls_route bucket move and change tests\n\nAdd 4 tdc tests for the cls_route bugs fixed earlier in this series:\n\n- Delete a route filter that was moved to another bucket (a7d2):\n Validates that deleting a filter, and making a bucket empty, does not\n leave a dangling empty bucket\n- Try to change a route filter onto an already used handle (c05a):\n Validates that attempting to change an existing filter\u0027s handle to an\n already taken one fails\n- Replace a route filter that shares its key with another filter (3f21):\n Validates that an in-place replace keeps the handle userspace named\n the filter by, rather than dropping the 0x7F00 bits from it\n- Replace both route filters sharing a key (9d0e):\n Validates that replacing one of the two does not make the other one\n unreplaceable\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-5-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "41e85e54e5649a1617698438b0ce64c6f9d83d69", "tree": "349e0e4927ccd8d2aae049a48c70cab413a73176", "parents": [ "b74a8455a2f271f54695b6a8ec1f113824a46c0e" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:32 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "net/sched: cls_route: Fix in-place replace\n\nBuilding on the previous patch, route4_set_parms rejects a duplicate by\nscanning the destination chain for nhandle, but the scan doesn\u0027t exclude\nthe older version it is replacing, so an in-place replace will match\nthe older version\u0027s handle and fail.\n\nFix this by passing the older filter as a parameter to route4_set_parms\n(replacing \"new\") and skipping it in the scan.\n\nExcluding the older version is not enough on its own. nhandle is built\nout of TCA_ROUTE4_TO, TCA_ROUTE4_FROM and TCA_ROUTE4_IIF alone, while the\n0x7F00 bits, which only tell apart filters sharing one key, are folded in\non the create path. Letting the replace through would therefore rename\nthe filter it replaces: replacing handle 0x10101 stored it back as\n0x10001, and a sibling at 0x10201 could then no longer be replaced at\nall, since its own nhandle collided with the renamed filter.\n\n\ttc filter add ... handle 0x10101 route from 1 to 1 classid 1:1\n\ttc filter add ... handle 0x10201 route from 1 to 1 classid 1:2\n\ttc filter replace ... handle 0x10101 route from 1 to 1 classid 1:9\n\t... fh 0x00010001 flowid 1:9 to 1 from 1\n\t... fh 0x00010201 flowid 1:2 to 1 from 1\n\ttc filter replace ... handle 0x10201 route from 1 to 1 classid 1:8\n\tError: Handle 10001 is already in use.\n\nSo carry those bits over when the key the request builds is the key the\nolder filter already has. An in-place replace then keeps the handle\nuserspace named the filter by, while a request that does change the key\nstill renames it, as it did before.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-4-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b74a8455a2f271f54695b6a8ec1f113824a46c0e", "tree": "6a929c033c381f6823ff93be2a33f3f20f04aba2", "parents": [ "1853f30cf5c84971f99788a76207c6f745380896" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:31 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "net/sched: cls_route: Reject handle aliasing\n\nroute4_set_parms() rejects a duplicate by scanning the destination chain\nfor f-\u003ehandle, but f-\u003ehandle is the handle the filter has before the\nupdate, not the one it is about to be linked under. The comparison and\nthe insertion therefore use different handles, which causes breakage.\n\nWhen a change moves the filter to a chain that already holds nhandle,\nthe scan looks for the old handle instead, misses the collision and\nlinks a second filter with the same handle:\n\n tc filter add dev lo ingress protocol ip pref 100 \\\n route from 1 to 1 classid 1:1 action ok\n tc filter add dev lo ingress protocol ip pref 100 \\\n route from 2 to 2 classid 1:2 action drop\n tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n route from 2 to 2 classid 1:1 action ok\n tc filter show dev lo ingress\n ... fh 0x00020002 flowid 1:2 to 2 from 2\n ... fh 0x00020002 flowid 1:1 to 2 from 2\n\nThe newcomer is appended after the incumbent, and both end up with the\nsame f-\u003eid. route4_get() returns the first match, so the second filter\ncan no longer be addressed by handle, and route4_classify() stops at the\nfirst filter whose f-\u003eid matches. The second filter is dumped but is\neffectively dead.\n\nFix this by comparing against nhandle.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-3-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1853f30cf5c84971f99788a76207c6f745380896", "tree": "aae6b91e43d866e5b2472d889257b436a974acf9", "parents": [ "00f9fbc12320253bfc576fb7539d860029c82d0f" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:30 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:51 2026 +0200" }, "message": "net/sched: cls_route: free emptied bucket on filter move\n\nroute4_change can move an existing filter to a different top-level\nbucket: route4_set_parms recomputes the handle from TCA_ROUTE4_TO/\nFROM/IIF, and the handle-mismatch check is gated on the \u0027new\u0027 flag, so\nfor an existing filter the new handle may differ from the old one and\nland in a different bucket. When this happens, the filter is unlinked\nfrom the old bucket, but the bucket itself is never freed once it goes\nempty. The stale empty bucket remains in head-\u003etable[], causing\nroute4_delete to report *last\u003dfalse even after the last live filter is\ngone. That pins the empty tcf_proto and causes a leak.\n\nFix this by refcounting the filters linked to a bucket and freeing the\nbucket when the count drops to zero. The existing scan in route4_delete\ngoes away with it.\n\nThe count is updated at all sites that link or unlink a filter during add,\nchange and delete, and the bucket is dropped from head-\u003etable[] as soon as\nit reaches zero.\n\nConditions to recreate the bug:\n CONFIG_NET_CLS_ROUTE4\u003dy, CONFIG_NET_SCH_INGRESS\u003dy, CONFIG_NET_CLS_ACT\u003dy.\n\n tc qdisc replace dev lo clsact\n tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1\n tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n route from 1 to 2\n tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 \\\n route from 1 to 2\n tc filter show dev lo ingress | grep -c \u0027pref 100 route chain 0 \u0027\n\nFixes: 1e052be69d04 (\"net_sched: destroy proto tp when all filters are gone\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-2-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "00f9fbc12320253bfc576fb7539d860029c82d0f", "tree": "55e716d39ed306da2d8d31804654b5ae8ea2982b", "parents": [ "7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Mon Sep 07 08:52:35 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:09:50 2026 +0200" }, "message": "net: hso: fix TIOCMIWAIT race\n\nThe task state must be updated before checking the wakeup condition to\navoid missing a racing modem status update.\n\nFixes: 542f54823614 (\"tty: Modem functions for the HSO driver\")\nCc: stable@vger.kernel.org\t# 2.6.29\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20260907065235.100848-1-johan@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "211f2a875f6f447745d80d5762d6d614503ac84a", "tree": "cb28ecfe28434d449c6290619484cbddd0013a9a", "parents": [ "5a81c72ef9ad6477e03d9d9b0abd794e9e4e639c", "c6ff098cb63a5d2ac491be0a307d6058876292f5" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:04 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:04 2026 +0200" }, "message": "Merge branch \u0027net-stmmac-add-common-rgmii-delay-handling-and-dp1000-support\u0027\n\nJia Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: Add common RGMII delay handling and DP1000 support\n\nThe UltraRISC DP1000 integrates a Synopsys DesignWare GMAC from the 5.20\nseries with fixed internal delays on both TX and RX RGMII clock paths.\n\nFor boards without PCB delays, \"rgmii-id\" describes the link. Passing this\nmode unchanged to the PHY would enable another pair of delays and break\nRGMII timing.\n\nAdd TX and RX internal-delay capability flags to the common stmmac platform\ndata and adjust the PHY interface mode in stmmac_pltfr_probe(). Convert the\nSophgo and EIC7700 glue drivers to this common handling, then add the DP1000\nbinding and glue driver. The DP1000 glue driver only declares both delay\ncapabilities.\n\nTested with:\n\n1. dt_binding_check and dtbs_check.\n2. RISC-V build with CONFIG_DWMAC_ULTRARISC\u003dm.\n3. Runtime validation on Shenzhen Rongda M0 with a YT8531S PHY and\n Milk-V Titan with an RTL8211F PHY: ultrarisc-dwmac binds and\n establishes a 1000 Mb/s full-duplex link on both boards.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-0-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c6ff098cb63a5d2ac491be0a307d6058876292f5", "tree": "cb28ecfe28434d449c6290619484cbddd0013a9a", "parents": [ "8dbfb46c233abe2a3482cca0ff58ade39a95f8c6" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Mon Sep 07 15:46:54 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:02 2026 +0200" }, "message": "net: stmmac: Add UltraRISC DP1000 GMAC support\n\nThe UltraRISC DP1000 GMAC provides fixed internal delays on both TX and RX\nRGMII clock paths.\n\nAdd a platform glue driver and describe both delay capabilities through\nthe common stmmac platform data. This lets the common RGMII delay handling\nadjust the interface mode passed to the PHY and reject incompatible RGMII\nmodes.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-5-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8dbfb46c233abe2a3482cca0ff58ade39a95f8c6", "tree": "8c8f4311b84f0911e90a6972f7c2ff810370ca8d", "parents": [ "345d78e3098044b792d7d130c7f5e72ca86f5491" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Mon Sep 07 15:46:53 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:02 2026 +0200" }, "message": "dt-bindings: net: Add UltraRISC DP1000 GMAC\n\nThe DP1000 integrates a Synopsys DesignWare GMAC from the 5.20 series with\none MMIO register range, one clock and one interrupt.\n\nIt also provides fixed TX and RX RGMII clock delays that cannot be\ndisabled. Board connections must therefore not add either delay in PCB\ntraces, making \"rgmii-id\" the only supported phy-mode.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nReviewed-by: Conor Dooley \u003cconor.dooley@microchip.com\u003e\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-4-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "345d78e3098044b792d7d130c7f5e72ca86f5491", "tree": "30c4783ff4a5355cfd38aa9550f1d18c77a83577", "parents": [ "7d1cbb9ba9336780639554581207e8ee147dd7b3" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Mon Sep 07 15:46:52 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:02 2026 +0200" }, "message": "net: stmmac: eic7700: Use common RGMII delay handling\n\nDescribe the EIC7700 inherent TX delay through the common stmmac\nplatform data and let stmmac_pltfr_probe() adjust the PHY interface\nmode.\n\nKeep the existing programmable TX and RX delay configuration in the\nEIC7700 glue driver.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-3-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7d1cbb9ba9336780639554581207e8ee147dd7b3", "tree": "fcc2c160f292e554fc2afd16a33aa071e56e2fe2", "parents": [ "cc54f9667188904b3a20ebee1f1eac56b947b358" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Mon Sep 07 15:46:51 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:02 2026 +0200" }, "message": "net: stmmac: sophgo: Use common RGMII delay handling\n\nDescribe the SG2042 internal RX delay through the common stmmac\nplatform data and let stmmac_pltfr_probe() adjust the PHY interface\nmode.\n\nThis removes the duplicated mode conversion without changing the\nhardware behavior.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-2-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "cc54f9667188904b3a20ebee1f1eac56b947b358", "tree": "2702aeeb5ad30ab01fecd786c1f582c71403cb75", "parents": [ "5a81c72ef9ad6477e03d9d9b0abd794e9e4e639c" ], "author": { "name": "Jia Wang", "email": "wangjia@ultrarisc.com", "time": "Mon Sep 07 15:46:50 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 10:38:02 2026 +0200" }, "message": "net: stmmac: Add common internal RGMII delay handling\n\nSome DWMAC integrations add fixed RGMII clock delays internally.\nGlue drivers need to account for these delays before passing the\ninterface mode to the PHY.\n\nAdd TX and RX delay capability flags to the common platform data.\nApply phy_fix_phy_mode_for_mac_delays() in stmmac_pltfr_probe() when\neither capability is present.\n\nThis lets glue drivers describe the MAC capabilities without\nduplicating the interface-mode validation and conversion.\n\nSigned-off-by: Jia Wang \u003cwangjia@ultrarisc.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260907-dwmac-ultrarisc-v2-1-9a39bf8db313@ultrarisc.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5a81c72ef9ad6477e03d9d9b0abd794e9e4e639c", "tree": "83f0b1f00358127bb419852bb8969d5e8d661af3", "parents": [ "f217004a40c49e787372e798785aecb983828d35" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 04 11:00:58 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 09:47:50 2026 +0200" }, "message": "net: run netdev work under the ops-compat lock\n\nnetdev_work_proc() took rtnl_lock() for the whole batch, forcing\neven ops-locked drivers onto rtnl just to run their rx_mode / ndo_work\ncallbacks. Take the per-device ops-compat lock instead: the instance\nlock for ops-locked drivers, rtnl_lock for the rest. That\u0027s what the\ncallbacks already assert (e.g. netif_rx_mode_run() asserts\nnetdev_assert_locked_ops_compat()), and non-ops-locked work\nsuch as vlan ndo_work keeps rtnl, since its compat lock resolves\nto rtnl anyway.\n\nWithout this adding more uses of ndo_work, for cases which don\u0027t\nneed rtnl_lock feels like a step back.\n\nWe can drop the comment about the extra ref now, with the relocking\nit\u0027s a necessity.\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20260904180058.3803849-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937", "tree": "89ad779f5d6e25ba4b91cf2a2fdf4cf7bb7f2a20", "parents": [ "0338c68e22abd2ee509ec2e32508a50896618c32" ], "author": { "name": "Carolina Jubran", "email": "cjubran@nvidia.com", "time": "Sun Sep 06 12:07:00 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 19:24:15 2026 -0700" }, "message": "net/mlx5e: Move representor vnic reporter to eswitch devlink port\n\nThe representor vnic devlink health reporter is created and destroyed\nalong the representor netdev (un)load path, which is not serialized by\nthe devlink instance lock. Destroying the reporter from there triggers\na devl_assert_locked() splat on driver unbind:\n WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758\n Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ...\n CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT\n Tainted: [W]\u003dWARN\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ...\n RIP: 0010:devl_assert_locked+0x54/0x70\n Call Trace:\n \u003cTASK\u003e\n devl_health_reporter_destroy+0x3a/0x1b0\n mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core]\n ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core]\n ? kernfs_remove_by_name_ns+0xc3/0xf0\n device_release_driver_internal+0x3b2/0x560\n unbind_store+0xce/0xf0\n\nMove the reporter\u0027s lifecycle to the eswitch devlink port (un)register\npaths, which are already serialized by the devlink instance lock, and\nstore the handle on mlx5_devlink_port. Use the port\u0027s mlx5_vport as the\nreporter priv since the diagnose callback only needs a device handle and\na vport number, and mlx5_vport carries both and is initialized before\nany representor driver probes.\n\nFixes: cf14af140a5a (\"net/mlx5e: Add vnic devlink health reporter to representors\")\nSigned-off-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260906090700.3761260-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0338c68e22abd2ee509ec2e32508a50896618c32", "tree": "55f5434749a08b072480429b4750435a060341be", "parents": [ "113998aa372f4869bf62cfc75c28a2849e8487be" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Fri Sep 04 12:32:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 19:07:36 2026 -0700" }, "message": "net: stmmac: initialize ptp_lock at probe time\n\npriv-\u003eptp_lock is only initialized in stmmac_ptp_register(), which runs\nduring __stmmac_open(). However, the lock is also used while the\ninterface is down and has never been opened: tc_taprio_configure()\ninvokes the PTP gettime64() callback to compute the EST base time when\noffloading a TAPRIO schedule, and stmmac_get_time() takes\npriv-\u003eptp_lock. Using an uninitialized rwlock is undefined behaviour.\nMove the rwlock_init() to __stmmac_dvr_probe(), together with the other\nprivate locks, so that ptp_lock is always valid regardless of the\ninterface state.\n\nFixes: b60189e0392f (\"net: stmmac: Integrate EST with TAPRIO scheduler API\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260904-stmmac-fix-ptp-clock-init-v1-1-df70eb1eb04d@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f217004a40c49e787372e798785aecb983828d35", "tree": "3016de1220431e961390f7a884d545a737cacfe6", "parents": [ "3bfa48d011fbf41b50480a12efa0e26990c43b36" ], "author": { "name": "Sergey Shtylyov", "email": "s.shtylyov@auroraos.dev", "time": "Mon Sep 07 22:46:32 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:51:35 2026 -0700" }, "message": "r8152: simplify loops in generic_ocp_{read,write}()\n\nIn generic_ocp_{read,write}(), the *while* loops look very strange:\nthe last iteration is implemented differently to the previous ones\n(doing some useless assignments before *break*) for no good reason.\nMerge the different iterations into one, using the local variables\nin the loop bodies...\n\nFound by a static analysis tool.\n\nSuggested-by: Michal Pecio \u003cmichal.pecio@gmail.com\u003e\nSigned-off-by: Sergey Shtylyov \u003cs.shtylyov@auroraos.dev\u003e\nLink: https://patch.msgid.link/863dac62-89ef-42d7-9108-d4a0600913a4@auroraos.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "113998aa372f4869bf62cfc75c28a2849e8487be", "tree": "2d1b2a3d4acc932bf7f3e20f5d6fbb6b41f306e6", "parents": [ "8aaeb56aff2a557a88f83ae866da2c91ad247e59" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 04 18:55:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:47:16 2026 -0700" }, "message": "net: phylink: initialise link_state before a forced major config\n\nphylink_resolve() leaves link_state on the stack unpopulated on its\ndisable and link-failed branches, which set only link_state.link.\nphylink_apply_manual_flow() then reads the struct\u0027s advertising on\nevery mode but MLO_AN_FIXED, and has done so since long before\nforce_major_config existed.\n\nforce_major_config turns that into a write to the hardware. It is the\nonly trigger for the major-config block that does not require\nmac_config, so phylink_major_config() programs the MAC for whatever\nthe stack held, a zeroed interface is PHY_INTERFACE_MODE_NA, and the\nwrite-back stores it in pl-\u003elink_config.interface.\n\nphylink_replay_link_end() is the only in-tree setter, and\nsja1105_static_config_reload() calls it for every port that has a\nphylink instance, regardless of admin state. On a stopped port\nphylink_run_resolve() no-ops, so the flag outlives the call. The next\nresolve consumes it whatever branch it takes; an unpopulated branch is\nwhere that does damage.\n\nFound while developing a series that attaches a late PHY from a\ndelayed work item and sets this flag there, so the PHY attached after\nits port was already up. The link stayed down until the port was\ncycled 29 minutes later. With this patch on the same board the same\nattach programs the MAC for 2500base-x rather than unknown, and the\nPHY\u0027s interrupt fires without a port bounce where it had stayed at\nzero throughout the failure.\n\nFixes: 96969b132bf1 (\"net: phylink: introduce helpers for replaying link callbacks\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260904185540.2844261-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3bfa48d011fbf41b50480a12efa0e26990c43b36", "tree": "ab11c7412587ca8c70b28fa64cd9b6a3f2591007", "parents": [ "b5a252adbe4a7c611c8a131383f278852a2773d2" ], "author": { "name": "Ian Lin", "email": "ian.lin@jetone.com.tw", "time": "Fri Sep 04 15:57:41 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:44:51 2026 -0700" }, "message": "net: usb: qmi_wwan: add Compal EXC-T1 support\n\nThe Compal EXC-T1 is a Qualcomm MDM9207-based LTE modem which reports\n\"EXC-x1\" as its USB product string. It exposes its QMI function on\ninterface 5.\n\nAdd a fixed-interface match for the QMI function.\n\nTested on a Compal EXC-T1 modem using an Ubuntu kernel build. Interface\n5 bound to qmi_wwan and exposed cdc-wdm2 and wwan1.\n\nSigned-off-by: Ian Lin \u003cian.lin@jetone.com.tw\u003e\nLink: https://patch.msgid.link/20260904075741.55778-1-ian.lin@jetone.com.tw\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b5a252adbe4a7c611c8a131383f278852a2773d2", "tree": "3be4720033468a2af5544bab037b7a7abc45094a", "parents": [ "3037c2f6a9de3af9775427059546e705237f6723" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Sep 08 09:13:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:43:49 2026 -0700" }, "message": "selftests: icmp_redirect: remove xfail support\n\nCommit 0a36a75c6818 (\"selftests: icmp_redirect: support expected failures\")\nadded xfail support to icmp_redirect.sh because the test \"IPv6: mtu\nexception plus redirect\" was failing at the time due to a perceived\nkernel bug described in commit 99513cfa16c6 (\"selftest: Fixes for\nicmp_redirect test\").\n\nHowever, commit 0e02bf5de46a (\"selftests: icmp_redirect: IPv6 PMTU info\nshould be cleared after redirect\") subsequently fixed the test logic:\nafter redirecting to a new path, the old PMTU information should indeed\nbe cleared, so the test was adjusted to verify the redirect without the\nold PMTU.\n\nSince that fix, the test has been passing and is no longer expected to\nfail.\n\nLeaving xfail\u003d1 in log_test() for all IPv6 tests was not only obsolete,\nbut had the undesirable side effect of masking any future IPv6 failure\nas XFAIL instead of FAIL. Furthermore, commit 3748939bce3f (\"selftests:\nicmp_redirect: pass xfail\u003d0 to log_test()\") had to work around a bash\nsyntax error caused by the empty xfail argument on IPv4 tests.\n\nRemove the obsolete xfail support from log_test() and restore standard\npass/fail reporting across all tests.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260908091327.349091-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8aaeb56aff2a557a88f83ae866da2c91ad247e59", "tree": "9b47cc4ca7782909de720259a209dd529625f48d", "parents": [ "be83178bfc44588f6e3adb827ed874c683193466" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Tue Sep 08 15:21:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:41:57 2026 -0700" }, "message": "ppp_synctty: ensure a writeable skb header\n\nppp_sync_txmunge() checks headroom before prepending the address and\ncontrol bytes, but does not ensure that the skb header is writable.\nA received skb can reach this function through PPP channel bridging\nwithout passing through ppp_start_xmit(), which calls skb_cow_head().\n\nFor example, a PPPoE frame may share its buffer with a clone queued to\nan AF_PACKET socket. If it is bridged to a synchronous tty channel, the\naddress/control bytes can overwrite data still visible to that socket.\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader.\n\nFixes: 4cf476ced45d (\"ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls\")\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260908072135.877364-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3037c2f6a9de3af9775427059546e705237f6723", "tree": "6ee56773b1fd4bb9355ee94c9176fad31b7562e6", "parents": [ "bcf03907c5ec714f7b4fa0662b01be81f2919a17" ], "author": { "name": "Tapio Reijonen", "email": "tapio.reijonen@vaisala.com", "time": "Fri Sep 04 06:03:00 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:41:06 2026 -0700" }, "message": "net: dsa: microchip: enable the SGMII port of the KSZ9897S\n\nThe KSZ9897 has an SGMII/1000BASE-X capable port 7, but its chip_info\nentry never set .sgmii_port. ksz_has_sgmii_port() is therefore false,\nksz9477_pcs_create() is never called and ksz9477_phylink_mac_select_pcs()\nreturns NULL for port 7, so a phy-mode \u003d \"sgmii\" or \"1000base-x\" link on\nthat port cannot come up.\n\nOnly the KSZ9897S has that port; the KSZ9897R has a second RGMII port\ninstead. Both report chip ID 0x00989700, so the port cannot be enabled\nfrom the chip ID alone, and enabling it unconditionally breaks the\nKSZ9897R badly: ksz9477_setup() propagates the failure of\nxpcs_create_pcs_mdiodev() on a part without an XPCS, so the switch as a\nwhole stops probing.\n\nThe variants do differ in the read-only bit 7 of the port 7 XMII control\n0 register, which reads one on the KSZ9897S and zero on the KSZ9897R.\nCompare the KSZ9897S data sheet DS00002394C section 5.2.4.1 with the\nKSZ9897R data sheet DS00002330D section 5.2.3.1.\n\nRead that bit in ksz_switch_register() and use it to select a KSZ9897S\nchip_data entry, which is the KSZ9897 one plus .sgmii_port \u003d 7, with\nport 7 no longer marked as supporting MII, RMII and RGMII. On the\nKSZ9897S that port is permanently an SGMII port and only its\ndifferential pairs are brought out, so advertising the xMII modes on it\nwould let phylink accept a mode the driver never programs:\nksz_phylink_need_config() skips the XMII control registers for the SGMII\nport. The KSZ9477, which also has SGMII on port 7, is described the same\nway. See DS00002394C section 4.11.\n\nKSZ9897S_CHIP_ID selects that chip_data entry and nothing else.\ndev-\u003echip_id keeps the KSZ9897 chip ID that both parts report, so no\nother chip ID comparison has to know about the variant,\nksz_check_device_id() is unchanged, and a device tree naming the KSZ9897\nkeeps matching whichever part is fitted. No binding change is needed and\nexisting device trees keep working.\n\nTested on a KSZ9897S with a 1000BASE-LX fibre SFP on port 7: bit 7 of\nthe port 7 XMII control 0 register reads one, the switch is identified\nas a KSZ9897S and the PCS is created. The port advertises\n1000baseX/Full, clause 37 in-band autonegotiation completes against the\nlink partner, and the link comes up at 1Gbps/full duplex and passes\ntraffic.\n\nSuggested-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nSuggested-by: Jerry Ray \u003cJerry.Ray@microchip.com\u003e\nSuggested-by: Tristram Ha \u003cTristram.Ha@microchip.com\u003e\nSigned-off-by: Tapio Reijonen \u003ctapio.reijonen@vaisala.com\u003e\nReviewed-by: Linus Walleij \u003clinusw@kernel.org\u003e\nLink: https://patch.msgid.link/20260904-ksz9897-sgmii-port-v5-1-9bd4a0381aa8@vaisala.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be83178bfc44588f6e3adb827ed874c683193466", "tree": "a5d741ab567653b9bdf6733ac607ea52921d7f0a", "parents": [ "ef39fca8508597fa565cf2be72a884a712fb98af" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Sep 06 18:01:04 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:33:02 2026 -0700" }, "message": "vxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info-\u003ekey.tun_flags)) {\n if (info-\u003eoptions_len \u003c sizeof(*md))\n goto drop;\n md \u003d ip_tunnel_info_opts(info);\n }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n if (vxflags \u0026 VXLAN_F_GBP)\n vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md-\u003egbp is read:\n\n if (!md-\u003egbp)\n return;\n gbp \u003d (struct vxlanhdr_gbp *)vxh;\n ...\n if (md-\u003egbp \u0026 VXLAN_GBP_DONT_LEARN)\n gbp-\u003edont_learn \u003d 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp-\u003edont_learn and gbp-\u003epolicy_applied to be set from stack bits.\n3) gbp-\u003epolicy_id to receive 16 bits of uninitialized kernel stack data,\n leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md-\u003egbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header.\n\nFixes: ee122c79d422 (\"vxlan: Flow based tunneling\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260906180111.1973188-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bcf03907c5ec714f7b4fa0662b01be81f2919a17", "tree": "8cf0998f9976d67d0c02264e926509dd1b43a644", "parents": [ "07260479e33b89f71d51b9d1608be05d2262e559" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Sat Sep 05 10:47:11 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:23:17 2026 -0700" }, "message": "docs: networking: page_pool: Use page_pool_put_netmem_bulk() in the kernel-doc directive\n\npage_pool.rst asks net/core/page_pool.c for page_pool_put_page_bulk().\nCommit 024bfd2e9d80 (\"page_pool: make page_pool_put_page_bulk() handle\narray of netmems\") renamed the function to page_pool_put_netmem_bulk().\nSince then the directive finds nothing and the bulk release helper is\nmissing from the rendered page.\n\nUse the current name.\n\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nAcked-by: Randy Dunlap \u003crdunlap@infradead.org\u003e\nLink: https://patch.msgid.link/20260905084711.40105-1-kmehltretter@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ef39fca8508597fa565cf2be72a884a712fb98af", "tree": "d8a161c570facfc257b8090ddad6e19d1ad7cd76", "parents": [ "66ef5adb75446627f8b6c26cd04f2adc86d4de56" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Thu Sep 03 07:35:33 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:17:19 2026 -0700" }, "message": "octeontx2-pf: reset HTB scheduler topology before freeing queues\n\nHTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler\nqueues via otx2_qos_txschq_set_parent_topology(), but teardown freed\nthose queues without clearing TOPOLOGY. The AF only restores PARENT and\nSCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the\nshared scheduler pool and affect later allocations.\n\nAdd otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero\nTL4 through TL2 TOPOLOGY before each schq is returned to the AF during\nhierarchy teardown and cfg rollback. Skip the aggregation level (TL1):\nit is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,\nand is not freed back to the AF by nix_txschq_free_one().\n\nFixes: 5e6808b4c68d (\"octeontx2-pf: Add support for HTB offload\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260903020533.3068041-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "07260479e33b89f71d51b9d1608be05d2262e559", "tree": "6075549306c9be26818acc5ea7467137c1d8a080", "parents": [ "0b799884350f722208206bdecb3f405138e54d92", "a4b9392ef046bd8a165fb5091adebc2c6ea46890" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:09:54 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:09:54 2026 -0700" }, "message": "Merge branch \u0027netconsole-validate-a-target-s-ip-address-configuration\u0027\n\nGustavo Luiz Duarte says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetconsole: validate a target\u0027s IP address configuration\n\nThis series adds two validations to the target configuration when the\nuser tries to enable it: first whether remote_ip was set, and second\nwhether local_ip and remote_ip address families match. Refuse to enable\nthe target if any of those validations fail.\n\nThese validations are already done for the target passed on the\ncommand-line, so this aligns dynamic targets with the command-line\nbehavior.\n\nThe first two patches replace the per-target \u0027ipv6\u0027 flag with a\nper-address \u0027family\u0027 field, which makes it easier to detect these error\nconditions. Patches 3 and 4 implement the actual validations.\n\nPatches 5-7 are follow-ups from previous reviews: move inet_addr from\nnetpoll.h into netconsole.c, show an unset address as an empty string\nrather than \"0.0.0.0\", document local_ip auto-selection.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260903-netcons_ipv6-v4-0-bdd183c844d3@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a4b9392ef046bd8a165fb5091adebc2c6ea46890", "tree": "6075549306c9be26818acc5ea7467137c1d8a080", "parents": [ "7be9bfb7689e875fc94b711dcafe27c86413c966" ], "author": { "name": "Gustavo Luiz Duarte", "email": "gustavold@gmail.com", "time": "Thu Sep 03 17:26:06 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:09:53 2026 -0700" }, "message": "docs: netconsole: document local_ip auto-selection\n\nAn unset local_ip is auto-populated from the egress interface at enable\ntime, but any value the user writes, including 0.0.0.0, is used as-is.\nThis deviates from the behavior prior to \"netconsole: use the address\nfamily instead of the ipv6 flag\", which interpreted 0.0.0.0 as unset.\n\nDocument this so the distinction between \"unset\" and \"set to 0.0.0.0\" is\nclear.\n\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Gustavo Luiz Duarte \u003cgustavold@gmail.com\u003e\nLink: https://patch.msgid.link/20260903-netcons_ipv6-v4-7-bdd183c844d3@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7be9bfb7689e875fc94b711dcafe27c86413c966", "tree": "b50f078aecaaf37b6369a10d41db82a0ab012149", "parents": [ "56ddc8d48e75f48df938f5df80e2f99a0c3548d3" ], "author": { "name": "Gustavo Luiz Duarte", "email": "gustavold@gmail.com", "time": "Thu Sep 03 17:26:05 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:09:52 2026 -0700" }, "message": "netconsole: move struct inet_addr into netconsole.c\n\nThe struct inet_addr lives in netpoll.h, but since commit a1116396476f\n(\"netconsole: move local_ip/remote_ip/ipv6 to netconsole_target\") the\nonly user is netconsole. Move the definition into netconsole.c\n\nSuggested-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nSigned-off-by: Gustavo Luiz Duarte \u003cgustavold@gmail.com\u003e\nLink: https://patch.msgid.link/20260903-netcons_ipv6-v4-6-bdd183c844d3@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "56ddc8d48e75f48df938f5df80e2f99a0c3548d3" }