)]}' { "log": [ { "commit": "83a945a529d6e002dd7339c532288a931f463dba", "tree": "86828766c2f2cd8a9b9e2e74a2537160011cf6f0", "parents": [ "8e759cd1f6444a946bd1fd2b2b29eea582eea1d5" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sat Sep 12 14:48:48 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 15:21:17 2026 +0200" }, "message": "tcp: do not let tcp_rmem be set below 4096\n\nWe can hit a division by zero crash in tcp_rcvbuf_grow()\nand tcp_rcv_space_adjust():\n\ndivide error: 0000 [#1] PREEMPT SMP\nRIP: 0010:tcp_rcvbuf_grow+0x187/0x450 net/ipv4/tcp_input.c:939\n...\ngrow \u003d div_u64(((u64)rcvwin \u003c\u003c 1) * (newval - oldval), oldval);\n\nThe division uses oldval \u003d tp-\u003ercvq_space.space as divisor.\nWhen tp-\u003ercvq_space.space is zero, this leads to a divide-by-zero\nexception.\n\ntp-\u003ercvq_space.space is initialized in tcp_init_buffer_space():\n tp-\u003ercvq_space.space \u003d min3(tp-\u003ercv_ssthresh, tp-\u003ercv_wnd,\n (u32)TCP_INIT_CWND * tp-\u003eadvmss);\n\nIf tcp_rmem[1] is configured to very small values (such as 1),\nsk-\u003esk_rcvbuf is initialized to 1. Then tcp_full_space(sk), which\ncomputes (sk-\u003esk_rcvbuf * scaling_ratio) \u003e\u003e 8, truncates to 0.\nThis sets tp-\u003ewindow_clamp \u003d 0, tp-\u003ercv_ssthresh \u003d 0, and\ntp-\u003ercvq_space.space \u003d 0. Later, when data arrives and DRS is invoked,\ntcp_rcvbuf_grow() divides by oldval \u003d\u003d 0.\n\nBack in 2015, commit b1cb59cf2efe (\"net: sysctl_net_core: check SNDBUF\nand RCVBUF for min length\") ensured that net.core.rmem_default and\nnet.core.rmem_max cannot be set below SOCK_MIN_RCVBUF. Similarly,\nSO_RCVBUF setsockopt enforces max_t(int, val * 2, SOCK_MIN_RCVBUF).\n\nHowever, net.ipv4.tcp_rmem still had .extra1 \u003d SYSCTL_ONE, allowing\narbitrarily small values.\n\nBecause SOCK_MIN_RCVBUF depends on sizeof(struct sk_buff) and cacheline\nalignment, its value varies across architectures and configuration options.\nUsing a fixed constant of 4096 ensures a predictable, architecture-\nindependent lower bound that is safely above SOCK_MIN_RCVBUF everywhere\nand matches the documented 4K default.\n\nFix this by setting tcp_rmem.extra1 to 4096 and updating the documentation.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260912144848.3448026-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8e759cd1f6444a946bd1fd2b2b29eea582eea1d5", "tree": "6b5c9ca4b112aaec71080297328ca7548cfbb06d", "parents": [ "0654f4dba1fbc697f2653aba30cd68587fcbf10e" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Mon Sep 14 01:14:01 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 15:13:22 2026 +0200" }, "message": "tcp: Don\u0027t call skb_clone_and_charge_r() for close()d listener in tcp_v6_do_rcv().\n\ntcp_v6_do_rcv() no longer calls skb_clone_and_charge_r() for\nTCP_LISTEN since commit 073d89808c06 (\"net: fix data-races around\nsk-\u003esk_forward_alloc\").\n\nHowever, there is still a small race window between tcp_v6_rcv()\nand tcp_v6_do_rcv(), where concurrent close() changes TCP_LISTEN\nto TCP_CLOSE, causing skb_clone_and_charge_r() to be called\nlocklessly and resulting in the splat below. [0]\n\nLet\u0027s avoid calling skb_clone_and_charge_r() for TCP_CLOSE as well.\n\nThis is fine for non-listeners because tcp_rcv_state_process()\ndrops skb for TCP_CLOSE and opt_skb was freed immediately anyway.\n\n[0]:\nsk-\u003esk_forward_alloc\nWARNING: net/ipv4/af_inet.c:162 at inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162, CPU#1: ksoftirqd/1/28\nModules linked in:\nCPU: 1 UID: 0 PID: 28 Comm: ksoftirqd/1 Not tainted 7.2.0 #17 PREEMPT(full)\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.17.0-debian-1.17.0-1 04/01/2014\nRIP: 0010:inet_sock_destruct+0x64d/0x810 net/ipv4/af_inet.c:162\nCode: 3d 49 ff e9 06 fd ff ff e8 d0 5b 83 f8 90 0f 0b 90 e9 35 fe ff ff e8 c2 5b 83 f8 90 0f 0b 90 e9 c5 fe ff ff e8 b4 5b 83 f8 90 \u003c0f\u003e 0b 90 e9 04 ff ff ff e8 a6 5b 83 f8 90 0f 0b 90 e9 65 fe ff ff\nRSP: 0018:ffffc90000677bb8 EFLAGS: 00010246\nRAX: 0000000000000000 RBX: ffff8880117bde80 RCX: ffffffff8957eb41\nRDX: ffff88801dad5d00 RSI: ffffffff8957ec3c RDI: 0000000000000005\nRBP: 00000000fffff000 R08: ffffffff8957eb41 R09: 00000000fffff000\nR10: 0000000000000005 R11: 0000000000000000 R12: dffffc0000000000\nR13: ffff8880117bdf10 R14: ffffffff81c08eb7 R15: 0000000000000003\nFS: 0000000000000000(0000) GS:ffff8880d7ae5000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f93a1021138 CR3: 00000000207a9000 CR4: 0000000000350ef0\nCall Trace:\n \u003cTASK\u003e\n __sk_destruct+0x82/0xae0 net/core/sock.c:2356\n rcu_do_batch kernel/rcu/tree.c:2645 [inline]\n rcu_core+0x59c/0x1100 kernel/rcu/tree.c:2897\n handle_softirqs+0x1e4/0x9b0 kernel/softirq.c:622\n run_ksoftirqd kernel/softirq.c:1076 [inline]\n run_ksoftirqd+0x38/0x60 kernel/softirq.c:1068\n smpboot_thread_fn+0x458/0xc80 kernel/smpboot.c:160\n kthread+0x396/0x4a0 kernel/kthread.c:436\n ret_from_fork+0x8e0/0xe40 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFixes: e994b2f0fb92 (\"tcp: do not lock listener to process SYN packets\")\nReported-by: Taras Madan \u003ctarasmadan@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260914011420.115556-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0654f4dba1fbc697f2653aba30cd68587fcbf10e", "tree": "1775eee83c23b1f4ff3d063cde21d2718a0d6118", "parents": [ "2cef2588c995722a901368def30befeef9ae55c6" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:09:20 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 13:30:53 2026 +0200" }, "message": "selftests/tc-testing: add hhf hh_limit cap tests\n\nCover the new TCA_HHF_HH_FLOWS_LIMIT bound: values above 2*HH_FLOWS_CNT\n(4294967295, 65536, 2049) are rejected with the configured limit left\nuntouched on both the change and the add path, the boundary value 2048 is\naccepted (installed at 100 first so the boundary change is load-bearing),\nand an add-time hh_limit 500 is preserved instead of being clobbered by\nthe default.\n\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nTested-by: hybris \u003chybris@mojatatu.ai\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-B855.v1.20260911153152@mojatatu.com.2\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2cef2588c995722a901368def30befeef9ae55c6", "tree": "8c242c03aa2c6c5b827df2511ebc986b812cb43a", "parents": [ "18a6fe05fb6e18de29fa90d388bb34044114b3d8" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Sat Sep 12 14:09:19 2026 -0400" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 13:30:53 2026 +0200" }, "message": "net/sched: hhf: cap hh_flows_limit at change time\n\nhhf_change() stores TCA_HHF_HH_FLOWS_LIMIT with no upper bound. A huge\nhh_flows_limit lets each new heavy-hitter flow pass the\nhh_flows_current_cnt check in alloc_new_hh() and forces a fixed-size\nkzalloc(GFP_ATOMIC) per flow under spoofed traffic, for unbounded memory\ngrowth.\n\nBound the attribute with NLA_POLICY_MAX() at 2*HH_FLOWS_CNT (the\nhhf_init() default) and report the rejected value via extack. The\ndeprecated nested parse is kept: legacy tc does not set NLA_F_NESTED on\nTCA_OPTIONS. Configs relying on hh_limit above the default were relying\non unbounded, unsafe behaviour and are not supported going forward.\n\nhhf_init() also ran hhf_change() before setting the default\nhh_flows_limit, so a user-supplied hh_limit at add time was clobbered\nback to 2048. Set the default before hhf_change() so the configured\nvalue sticks.\n\nThis is a follow-up to commit eb56a495f59b (\"net/sched: hhf: clamp\nquantum in change and init paths\"), which bounded the quantum of the\nsame qdisc; the hh_flows_limit bound is the remaining unbounded knob of\nthat series\u0027 scope.\n\nConditions to recreate the bug: CAP_NET_ADMIN in a user namespace;\ntc qdisc change dev X root hhf hh_limit 4294967295 succeeds and the\nvalue is echoed by tc qdisc show, unbounding heavy-hitter flow\nallocations; also tc qdisc add dev X root hhf hh_limit 500 stores 2048\ninstead of 500.\n\nFixes: 10239edf86f1 (\"net-qdisc-hhf: Heavy-Hitter Filter (HHF) qdisc\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko (gemini) \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260822195509.112717-1-jhs@mojatatu.com\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nTested-by: hybris \u003chybris@mojatatu.ai\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/QDISC-B855.v1.20260911153152@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "18a6fe05fb6e18de29fa90d388bb34044114b3d8", "tree": "2c4acf60475d91b24f7d3cd3978a353b51b2c59f", "parents": [ "7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1" ], "author": { "name": "Nikolay Aleksandrov", "email": "razor@blackwall.org", "time": "Fri Sep 11 13:50:21 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 12:27:41 2026 +0200" }, "message": "net: bridge: mst: move switchdev call outside rcu\n\nThis is a follow-up of one of sashiko\u0027s pre-existing bug reports.\nbr_mst_set_state() calls switchdev_port_attr_set() for nonzero MSTIs\nwhile holding rcu_read_lock() which invokes the blocking switchdev\nnotifier chain and may sleep. Nonzero MSTI changes come from netlink\nwith rtnl held. Move the switchdev call before entering the rcu section and\nassert that rtnl is held.\n\nThe call cannot be deferred because netlink needs its error and extack.\nAlso DSA reads the old bridge MST state during the callback and checks it.\nA deferred callback will be late and will see the updated state.\n\nFixes: 3a7c1661ae13 (\"net: bridge: mst: fix vlan use-after-free\")\nSigned-off-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260911105021.1385934-1-razor@blackwall.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7c8810c2e69c3d9ca6df870b40ae9218e50b4fb1", "tree": "8b4ffd8a2c8f70776cfeddd942fdec627d9987b4", "parents": [ "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4" ], "author": { "name": "Hohyun Sim", "email": "tlaghgus0425@korea.ac.kr", "time": "Thu Sep 10 15:37:43 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 10:31:54 2026 +0200" }, "message": "net: fddi: skfp: fix NULL deref when setting the MAC address while down\n\nskfp_ctl_set_mac_address() calls ResetAdapter() unconditionally, without\nchecking netif_running(). ResetAdapter() first calls card_stop(), which\nsets smc-\u003ehw.hw_state to STOPPED, and then mac_drv_clear_tx_queue(),\nwhich walks the two transmit queues:\n\n\tfor (i \u003d QUEUE_S; i \u003c\u003d QUEUE_A0; i++) {\n\t\tqueue \u003d smc-\u003ehw.fp.tx[i] ;\n\t\t...\n\t\tt \u003d queue-\u003etx_curr_get ;\n\nsmc-\u003ehw.fp.tx[] is only populated by init_tx(), which is reached from\nskfp_open() through init_smt() -\u003e init_fddi_driver() -\u003e init_fplus() -\u003e\ninit_mac() -\u003e init_tx(). The private area is allocated and zeroed by\nalloc_fddidev(), so on an interface that has never been brought up both\nqueue pointers are still NULL. The hw_state test at the top of\nmac_drv_clear_tx_queue() does not catch this, because card_stop() has\njust set STOPPED; the function proceeds into the loop and dereferences\nNULL. ResetAdapter() does call init_smt() itself, but only after the\nqueues have been cleared.\n\nSetting the MAC address on a down interface therefore oopses:\n\n ip link set dev fddi0 address 02:00:00:00:00:01\n\n BUG: KASAN: null-ptr-deref in mac_drv_clear_tx_queue+0x68/0x2c0 [skfp]\n Read of size 8 at addr 0000000000000010 by task ip/302\n Call Trace:\n \u003cTASK\u003e\n mac_drv_clear_tx_queue+0x68/0x2c0 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n ResetAdapter+0x29/0x100 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n skfp_ctl_set_mac_address+0x57/0x80 [skfp 6c01d4bab63c36978bd0a7d7e90837adb44cc37b]\n netif_set_mac_address+0x1e4/0x2c0\n do_setlink+0x684/0x2680\n \u003c/TASK\u003e\n\nAddress 0x10 is the offset of tx_curr_get, the third pointer in\nstruct s_smt_tx_queue, on 64-bit. mac_drv_clear_rx_queue(), which\nResetAdapter() calls immediately afterwards, dereferences\nsmc-\u003ehw.fp.rx[QUEUE_R1] in the same way behind the same ineffective\nhw_state test; the transmit queue merely crashes first. Both are\ncovered by the guard below.\n\nSkip the adapter reset when the interface is down. dev_addr_set() is\nleft unconditional, so the new address is still recorded in\ndev-\u003edev_addr. Nothing is lost by not resetting the adapter here:\nskfp_open() deliberately re-reads the factory address on every open,\n\n\tread_address(smc, NULL);\n\teth_hw_addr_set(dev, smc-\u003ehw.fddi_canon_addr.a);\n\nand the comment above it states this is done to discard exactly such an\naddress override across a close/open cycle. An address set while the\ninterface is down could not have survived the following open even\nbefore this change, so the guard removes no working behaviour. Guarding\nthe hardware side of ndo_set_mac_address() with netif_running() is\nestablished practice; skge_set_mac_address() has done so since commit\n2eb3e621c4e0 (\"skge: set mac address bonding fix\").\n\nGuarding the reset as a whole, rather than NULL-checking the queues, is\nalso what the rest of the driver expects. After a previous open/close\nthe queue pointers are stale but non-NULL, so there is no crash, yet\nResetAdapter() goes on to call smt_online() and STI_FBI() (\"Enable\nBoard Interrupts\") while skfp_close() has already called free_irq() -\nthe adapter would be brought back online with no handler installed. The\nonly other ResetAdapter() caller is skfp_interrupt(), which by\nconstruction runs only while the device is open.\n\nFound by automated driver testing against an emulated SysKonnect FDDI\nadapter under a KASAN-enabled 7.0.0 kernel. Triggering it requires\nCAP_NET_ADMIN.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nAssisted-by: LLM KASAN\nSigned-off-by: Hohyun Sim \u003ctlaghgus0425@korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260910063743.110747-1-tlaghgus0425@korea.ac.kr\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2998147b59c9df0a51477c7a6b3d1f0ba3127dd4", "tree": "f1e35ab9540af34871f3058e0da5678f64a743c4", "parents": [ "23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e" ], "author": { "name": "Dong Chenchen", "email": "dongchenchen2@huawei.com", "time": "Thu Sep 10 22:00:42 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 15 10:20:38 2026 +0200" }, "message": "ipv4: icmp: reject RTN_UNREACHABLE input routes in icmp_route_lookup\n\nWhen the forward output route cannot be used in icmp_route_lookup(),\nit enters the \"reverse path\" and calls ip_route_input() on fl4_dec.daddr,\nthe original packet\u0027s source address.\n\nip_route_input() only returns an error for truly invalid packets. For\nunreachable addresses it will succeed and return an input route whose\ndst.output is set to ip_rt_bug(). The existing check only rejects\nRTN_LOCAL routes, so the RTN_UNREACHABLE route types can still be returned\nand later used for output, syzkaller triggering a WARN_ON_ONCE()\nin ip_rt_bug() as bellow:\n\n ------------[ cut here ]------------\n WARNING: net/ipv4/route.c:1273 at ip_rt_bug+0x14/0x20\n RIP: 0010:ip_rt_bug+0x14/0x20\n Call Trace:\n ip_push_pending_frames+0xfa/0x100\n __icmp_send+0x905/0xf10\n ip_options_compile+0xc0/0xd0\n ip_rcv_finish_core+0x321/0xae0\n ip_rcv+0x1de/0x260\n __netif_receive_skb_one_core+0x11a/0x130\n netif_receive_skb+0x7b/0x260\n tun_get_user+0x11bf/0x1c10\n ------------[ cut here ]------------\n\nReject input route that is RTN_UNREACHABLE to fix it. The net warning\nis only printed for RTN_LOCAL, as RTN_UNREACHABLE is not the result of\na race condition.\n\nFixes: 8b7817f3a959 (\"[IPSEC]: Add ICMP host relookup support\")\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Jiayuan Chen \u003cjiayuan.chen@linux.dev\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nSigned-off-by: Dong Chenchen \u003cdongchenchen2@huawei.com\u003e\nLink: https://patch.msgid.link/20260910140042.1880242-1-dongchenchen2@huawei.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "23ca4ddc4fce2c233a49e9fd34d4b5b02bd7324e", "tree": "26ab5cfc6eb82646ab860c341937270413217e1f", "parents": [ "9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Sun Sep 13 21:00:52 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:21:58 2026 -0700" }, "message": "net: bcmgenet: restore the hardware filters on open\n\nbcmgenet_hfb_init() runs INIT_LIST_HEAD() on priv-\u003erxnfc_list, which drops\nevery rule off the list, and bcmgenet_open() calls it on each ifup. Every\nrule the user configured is silently lost:\n\n # ethtool -N eth0 flow-type ether dst $MAC action 0\n Added rule with ID 0\n # ethtool -n eth0 | grep -c Filter:\n 1\n # ip link set eth0 down \u0026\u0026 ip link set eth0 up\n # ethtool -n eth0 | grep -c Filter:\n 0\n\nInitialise the lists once at probe and restore the rules on open, as\nbcmgenet_resume() already does.\n\nFixes: 3e370952287c (\"net: bcmgenet: add support for ethtool rxnfc flows\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Justin Chen \u003cjustin.chen@broadcom.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260913190052.939955-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e92ad4630f5dd1838ce6bbe6b1bd2c73d34de36", "tree": "9d78a35353b6f1f33594297539f46255bfe96be9", "parents": [ "7616242a2b37883f7322aaa1d2bd6cd0fed28315" ], "author": { "name": "Daniel Golle", "email": "daniel@makrotopia.org", "time": "Thu Sep 10 14:13:15 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:05:46 2026 -0700" }, "message": "net: dsa: mxl862xx: disable the stats poll on teardown\n\nmxl862xx_setup() arms the stats poll before mxl862xx_setup_mdio(), and\nnothing stops it until dsa_register_switch() has returned an error to\nmxl862xx_probe(). DSA frees the dsa_port list before it returns, so a\npoll that fires once .setup or a later step of dsa_tree_setup() has\nfailed walks freed ports. On shutdown the user ports stay registered,\nand the WORK_STOPPED flag test in mxl862xx_get_stats64() is not atomic\nwith the cancel in mxl862xx_shutdown(), so a re-arm that read the flag\nbefore it was set queues the poll after cancel_delayed_work_sync() has\nreturned.\n\nArm the poll once .setup has succeeded and stop it from a .teardown op,\nwhich DSA calls on unregister and after a failed registration, in both\ncases before it frees the ports. Use disable_delayed_work_sync() there\nand in shutdown(): it drains a running poll as the cancel did and turns\nevery later attempt to queue the work into a no-op, so the re-arm\ncannot bring the poll back. remove() and the probe error path only set\nWORK_STOPPED, which crc_err_work tests before it walks the ports.\n\nFixes: a21d33a5265f (\"net: dsa: mxl862xx: implement .get_stats64\")\nSigned-off-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nLink: https://patch.msgid.link/1eb6f7fc1789b67e4b11e3f4d5ff080d0b6f7cbb.1789045590.git.daniel@makrotopia.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7616242a2b37883f7322aaa1d2bd6cd0fed28315", "tree": "14c54b2183cfab0d351bb5507445e285e7291b9c", "parents": [ "bde5212360bd44506edec073ebbd6d0c72f75820" ], "author": { "name": "Andrea Mayer", "email": "andrea.mayer@uniroma2.it", "time": "Sun Sep 13 21:44:21 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:03:01 2026 -0700" }, "message": "seg6: set IPSKB_L3SLAVE from IP6SKB_L3SLAVE on IPIP decapsulation\n\nWhen an SRv6 packet arrives on an interface enslaved to a VRF,\nvrf_ip6_rcv() sets IP6SKB_L3SLAVE in IP6CB, but decap_and_validate()\nhas never set IPSKB_L3SLAVE in IPCB. The bit stayed clear in the\ncommon case, and with CONFIG_IPV6_MIP6 the leftover frag_max_size of\na reassembled outer packet could even set it, with no VRF involved.\nCommit 44930446dde4 (\"ipv6: seg6: clear IPv4 control block on IPIP\ndecapsulation\") then made the unreliable bit reliably clear.\n\nThe effect of the missing flag is visible with End.DX4 when a\ndelivery to a local address of the node reaches the socket lookup.\nFor example, a UDP socket bound to the enslaved ingress interface\ndoes not receive any of the decapsulated packets, while an unbound\nsocket outside the VRF does.\nThis contradicts Documentation/networking/vrf.rst: by default the\nscope of an unbound UDP or TCP socket is limited to the default VRF.\n\nSet IPSKB_L3SLAVE for IPv4 in decap_and_validate(), which already does\nthe same for IPv6. The socket lookup then matches the decapsulated\npacket like any other packet received on that enslaved interface. Such\na packet matches an unbound UDP or TCP socket only when\nudp_l3mdev_accept or tcp_l3mdev_accept is set.\n\nFixes: 891ef8dd2a8d (\"ipv6: sr: implement additional seg6local actions\")\nSigned-off-by: Andrea Mayer \u003candrea.mayer@uniroma2.it\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260913194421.31-1-andrea.mayer@uniroma2.it\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bde5212360bd44506edec073ebbd6d0c72f75820", "tree": "64772922ee17b202efed3fef2de14e910ac456be", "parents": [ "6fb0a9d9071f1ff0cc5cfc0782302d9c90d642cb" ], "author": { "name": "Ahmed Naseef", "email": "naseefkm@gmail.com", "time": "Sat Sep 12 17:43:06 2026 +0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 19:01:51 2026 -0700" }, "message": "net: phy: mediatek: do not report link and per-speed LED rules together\n\nmtk_phy_led_hw_ctrl_get() reports TRIGGER_NETDEV_LINK whenever any of the\nspeed bits in on_set is on, and in addition reports every individual\nTRIGGER_NETDEV_LINK_* bit that is set. The netdev trigger refuses that\ncombination: netdev_led_attr_store() rejects TRIGGER_NETDEV_LINK together\nwith any per-speed rule, and it validates the whole resulting mode rather\nthan just the bit being written. Once the hardware has any link bit\nprogrammed, every write to the trigger attributes of that LED therefore\nfails with -EINVAL and the LED can no longer be configured.\n\nThe rules are also fed back into the hardware: the trigger stores what is\nread back, and a later write of device_name programs it again, expanding\nTRIGGER_NETDEV_LINK to every speed in on_set. An LED configured for a\nsingle speed is thereby silently widened to \"on at any link speed\".\n\nBoth are easy to see on the EcoNet EN7528, whose four PHYs share one LED\nblock. The first LED programs the block correctly, the second reads those\nrules back and rewrites them widened, and the remaining two then read the\nwidened value, so an LED configured for \"link_10 link_100\" ends up lit on a\n1000 Mbps link.\n\non_set holds every speed the LED can indicate and is exactly what\nmtk_phy_led_hw_ctrl_set() programs for TRIGGER_NETDEV_LINK, so report the\nspeed independent rule only when all of them are on, and the individual\nspeeds otherwise. The mapping is then the inverse of the one used when\nprogramming the LED and round trips without changing the register.\n\nFixes: c66937b0f8db (\"net: phy: mediatek-ge-soc: support PHY LEDs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ahmed Naseef \u003cnaseefkm@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260912134306.3544329-1-naseefkm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6fb0a9d9071f1ff0cc5cfc0782302d9c90d642cb", "tree": "85ccd19c466526d014968985eb97b9c30a851e51", "parents": [ "f97d8c7bab7843631206a114986c9059da03efeb" ], "author": { "name": "Chunfeng Song", "email": "springbreeze@stu.pku.edu.cn", "time": "Thu Sep 10 05:51:10 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 18:56:16 2026 -0700" }, "message": "rust: net: phy: fix off-by-one bit positions in device status accessors\n\nThe hand-written bitfield offsets in is_link_up(), is_autoneg_enabled()\nand is_autoneg_completed() were correct when the abstraction was\nmerged: at that time autoneg, link, and autoneg_complete were at bits\n13, 14, and 15 of struct phy_device\u0027s first bitfield unit. Commit\n2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nlater inserted is_genphy_driven just before autoneg, shifting the three\nfields up by one, so the accessors now read:\n\n is_link_up() reads bit 14 \u003d autoneg\n is_autoneg_enabled() reads bit 13 \u003d is_genphy_driven\n is_autoneg_completed() reads bit 15 \u003d link\n\nThe official ax88796b Rust driver uses all three accessors in its\nread_status() implementation, so it inherits the bug.\nphy_attach_direct() sets is_genphy_driven only when it falls back to\nthe generic driver, and ax88796b has a real driver, so\nis_genphy_driven stays 0. The broken is_autoneg_enabled() therefore\nreads bit 13 as 0, compares it against AUTONEG_ENABLE (1), and always\nreturns false, so read_status() never reaches the\nresolve_aneg_linkmode() call.\n\nThe ordinary bindgen accessors take \u0026self. Calling them through\n(*phydev).link() would create a shared reference to the complete\nbindings::phy_device, which is not appropriate for an object wrapped in\nOpaque.\n\nUse the bindgen-generated raw accessors (link_raw(), autoneg_raw(),\nand autoneg_complete_raw()) instead. They retain the bit positions and\nendianness handling generated from the C layout without creating a Rust\nreference to the complete phy_device. Drop the hand-written numbers\ntogether with the TODO comment that marked them as a stopgap.\n\nThe raw accessors are only emitted by bindgen 0.71 and later, and were\nadded at the Rust-for-Linux project\u0027s request, so this fix can only be\nbackported to stable branches whose minimum bindgen version is at least\nthat, hence the scope on the Cc: stable line below.\n\nFound by a static equivalence audit (C2RustDrv, a C-to-Rust driver\nmigration tool) that compares hand-written bitfield offsets against\nthe bindgen layout of struct phy_device. Verified by building the\nbindings and checking the generated accessors; no runtime testing was\npossible without PHY hardware.\n\nFixes: 2796ff1e3dca (\"net: phy: add flag is_genphy_driven to struct phy_device\")\nCc: stable@vger.kernel.org # Only 7.1.y and later (requires bindgen\u0027s raw pointer accessors).\nLink: https://github.com/rust-lang/rust-bindgen/issues/2674\nSigned-off-by: Chunfeng Song \u003cspringbreeze@stu.pku.edu.cn\u003e\nReviewed-by: FUJITA Tomonori \u003cfujita.tomonori@gmail.com\u003e\nLink: https://patch.msgid.link/20260910055110.167110-1-springbreeze@stu.pku.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f97d8c7bab7843631206a114986c9059da03efeb", "tree": "02a00c6a4559309b82f69ac6b27a5f26b8cc7f51", "parents": [ "6c21ebc81338dd8abe021dec3d01acebd789ea2c" ], "author": { "name": "Aohan Mei", "email": "henrymei@tencent.com", "time": "Fri Sep 11 15:34:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 18:47:52 2026 -0700" }, "message": "rds: ib: use rds_conn_drop() on protocol version mismatch\n\nrds_ib_cm_connect_complete() runs from the RDMA-CM event handler with\nconn-\u003ec_cm_lock held. When the peer negotiates a protocol version\nolder than RDS_PROTOCOL_COMPAT_VERSION, the handler calls\nrds_conn_destroy(), which is only safe in the rmmod path: it\nsynchronously tears the connection down and flush_work()es the\nshutdown work cp_down_w.\n\nThat shutdown work (rds_conn_shutdown()) needs cp_cm_lock, which is\nthe very lock the event handler still holds, so the flush never\ncompletes: the two workers wait on each other and the RDS connection\nworkqueues stall for good.\n\nAll other RDMA-CM failure paths (REJECTED, CONNECT_ERROR,\nDISCONNECTED) use rds_conn_drop(), which marks the connection\nRDS_CONN_ERROR and schedules the shutdown work asynchronously. Use\nit here as well.\n\nFixes: f147dd9ecabf (\"RDS/IB: Disallow connections less than RDS 3.1\")\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nCc: stable@vger.kernel.org\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nSigned-off-by: Aohan Mei \u003chenrymei@tencent.com\u003e\nLink: https://patch.msgid.link/20260911073436.3542080-1-ljp1205831794@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6c21ebc81338dd8abe021dec3d01acebd789ea2c", "tree": "2a00925dd85ee70571bc7105721b629c3692dce0", "parents": [ "e6b6078ea1731b05b3b552497b3bce4bf8b014ae", "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 17:06:52 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Sep 14 17:06:52 2026 -0700" }, "message": "Merge tag \u0027nf-26-09-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\n1) Fix KMSAN reports an uninit-value in nf_nat_setup_info() for netmap,\n from Theodor Arsenij Larionov Trichkine.\n\n2) Restrict deletion of netdevice in basechain and flowtable to exact\n matching only, from Fernando F. Mancera.\n\n3) Fix nf_nat_register_fn() error path allowing for a memleak.\n\n4) Hold reference on ct until flow is released to address, otherwise\n access to release ct-\u003eext or different ct due to typesafe RCU\n semantics.\n\n* tag \u0027nf-26-09-11\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: flowtable: hold reference on ct until flow is released\n netfilter: nf_nat: unregister and release hooks on error\n netfilter: nf_tables: fix device name and prefix match in hook lookup\n netfilter: nft_nat: fully initialise new_addr in netmap setup\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260913205447.1889203-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e6b6078ea1731b05b3b552497b3bce4bf8b014ae", "tree": "940cb0d4a69be175ee17090309096fc0cf3c4b82", "parents": [ "78445023439506ebd83b86d40b1e428a3b309d4a", "979aabdad8dd03394467ee484a1a70f3d40b19ba" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:19 2026 -0700" }, "message": "Merge branch \u0027neighbour-small-fixes-for-rtm_-get-set-neightbl\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nneighbour: Small fixes for RTM_{GET,SET}NEIGHTBL.\n\nWhile working on the follow-up suggested here,\n\n https://lore.kernel.org/20260902143023.GA3966681@shredder\n\nI found a few bugs in RTM_GETNEIGHTBL and RTM_SETNEIGHTBL,\nwhich this series fixes.\n\nPatch 1, 3, 4 will conflict with net-next in neightbl_dump_info()\ndue to removal of net_eq() below:\n\n\tp \u003d list_next_entry(\u0026tbl-\u003eparms, list);\n\tlist_for_each_entry_from_rcu(p, \u0026tbl-\u003eparms_list, list) {\n\t\tif (!net_eq(neigh_parms_net(p), net))\n\t\t\tcontinue;\n\nNote also that currently neigh_proc_dointvec_ms_jiffies_positive()\nis buggy and does not enforce min/max, and it needs this fix:\n\n https://lore.kernel.org/20260905233819.1064529-2-kuniyu@google.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909233143.2401847-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "979aabdad8dd03394467ee484a1a70f3d40b19ba", "tree": "940cb0d4a69be175ee17090309096fc0cf3c4b82", "parents": [ "7b430fcfc972f61b09cc19ca95997586af4a147d" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Sep 09 23:31:26 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:14 2026 -0700" }, "message": "neighbour: Skip default parms when resumed in neightbl_dump_info().\n\nneightbl_dump_info() calls neightbl_fill_info() in each loop\nto render the default parms.\n\nIf there are many devices and neightbl_fill_param_info() failed,\nneightbl_fill_info() is called again when the dump resumes:\n\n # ynl --family rt-neigh --dump getneightbl --output-json |\n jq \u0027.[] | {name: .name, ifindex: .parms.ifindex}\u0027\n ...\n {\n \"name\": \"ndisc_cache\",\n \"ifindex\": null\n }\n ...\n {\n \"name\": \"ndisc_cache\",\n \"ifindex\": 6\n }\n {\n \"name\": \"ndisc_cache\",\n \"ifindex\": null\n }\n {\n \"name\": \"ndisc_cache\",\n \"ifindex\": 5\n }\n\nLet\u0027s skip neightbl_fill_info() if it is already called in\nneightbl_dump_info().\n\nNote that we cannot use !neigh_skip instead of !default_skip\nbecause default_skip \u003d\u003d 1 \u0026\u0026 neigh_skip \u003d\u003d 0 could be true\nif the first neightbl_fill_param_info() fails.\n\nAlso, nidx must be cleared at the end of each table loop;\notherwise, if neightbl_fill_info() for a subsequent table\nfails, the leftover nidx from the previous table would be\nsaved in cb-\u003eargs[1], resulting in erroneously skipping parms\nof the subsequent table in the next dump.\n\nFixes: c7fb64db001f (\"[NETLINK]: Neighbour table configuration and statistics via rtnetlink\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260909233143.2401847-5-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7b430fcfc972f61b09cc19ca95997586af4a147d", "tree": "19b68eea8c78aac0654fb5b0452f77b1eb120a92", "parents": [ "6d79b223ec44ada58ad37db42f539b60985a7722" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Sep 09 23:31:25 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:13 2026 -0700" }, "message": "neighbour: Don\u0027t render blackhole_netdev via RTM_GETNEIGHTBL.\n\nThe cited commits started to initialise blackhole_netdev with\nneigh_parms_alloc().\n\nThis is visible in init_net as the ifindex\u003d\u003d0 entries via\nRTM_GETNEIGHTBL:\n\n # ynl --family rt-neigh --dump getneightbl --output-json \\\n | jq \u0027.[] | select(.parms.ifindex \u003d\u003d 0)\n | {name: .name, ifindex: .parms.ifindex}\u0027\n {\n \"name\": \"arp_cache\",\n \"ifindex\": 0\n }\n {\n \"name\": \"ndisc_cache\",\n \"ifindex\": 0\n }\n\nFor RTM_SETNEIGHTBL, ifindex being 0 means wildcard.\n\nLet\u0027s skip blackhole_netdev\u0027s parms in neightbl_dump_info().\n\nNote that lookup_neigh_parms() does not need the same change\nbecause the default parms is always the first entry and matches\nwith ifindex \u003d\u003d 0.\n\nFixes: e5f80fcf869a (\"ipv6: give an IPv6 dev to blackhole_netdev\")\nFixes: 22600596b675 (\"ipv4: give an IPv4 dev to blackhole_netdev\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260909233143.2401847-4-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6d79b223ec44ada58ad37db42f539b60985a7722", "tree": "1f6c5345bd6cb0d3ad7aa2f0c0fc9a0c054e6cdf", "parents": [ "764dcebb033764633700a036c7351a7c6350eec6" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Sep 09 23:31:24 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:13 2026 -0700" }, "message": "neighbour: Enforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\n\nNDTPA_INTERVAL_PROBE_TIME_MS sets .type and .min but misses\n.validation_type, so no validation is applied:\n\n # ynl --family rt-neigh --do setneightbl \\\n --json \u0027{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 0}}\u0027\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq \u0027.[] | select(.name \u003d\u003d \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]\u0027\n 0\n\nMoreover, nla_get_msecs() uses msecs_to_jiffies(), and u64 is\nsilently cast to u32, so a larger value can bypass the min check:\n\n e.g. 4294967296 \u003d\u003d 0x100000000\n\n # ynl --family rt-neigh --do setneightbl \\\n --json \u0027{\"name\": \"arp_cache\", \"parms\": {\"interval-probe-time-ms\": 4294967296}}\u0027\n\n # ynl --family rt-neigh --dump getneightbl --output-json | \\\n jq \u0027.[] | select(.name \u003d\u003d \"arp_cache\" and has(\"config\"))\n | .parms[\"interval-probe-time-ms\"]\u0027\n 0\n\nmsecs_to_jiffies() returns MAX_JIFFY_OFFSET if the value is\nlarger than INT_MAX. Also, INT_MAX ms overflows int NEIGH_VAR()\nwhen HZ \u003e 1000 (Alpha, MIPS), and passing a negative integer to\nqueue_delayed_work(unsigned long delay) causes sign extension,\nwhich wraps around the expiry time to the past, resulting in it\nbeing handled as 0 delay in the timer wheel.\n\nLet\u0027s use NLA_POLICY_FULL_RANGE() and limit the max to 1 day.\n\nThe same max check is applied to sysctl as well.\n\nNote that this controls the probe interval for NTF_MANAGED\nentries, so the max of 1 day is unlikely to break any\ndeployments.\n\nFixes: 211da42eaa45 (\"net, neigh: introduce interval_probe_time_ms for periodic probe\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260909233143.2401847-3-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "764dcebb033764633700a036c7351a7c6350eec6", "tree": "33800350cb91442235bf4dab59279a452e997996", "parents": [ "78445023439506ebd83b86d40b1e428a3b309d4a" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Wed Sep 09 23:31:23 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Sep 11 17:25:13 2026 -0700" }, "message": "neighbour: Add missing RCU annotation for neightbl_dump_info().\n\nneightbl_dump_info() fetches the first non-default neigh_parms\nwith list_next_entry(\u0026tbl-\u003eparms, ...) and iterates through the\nlist with list_for_each_entry_from_rcu().\n\nHowever, list_next_entry() does not use RCU helper.\n\nLet\u0027s use list_for_each_entry_rcu() and skip the default parms.\n\nFixes: 4ae34be50064 (\"neighbour: Convert RTM_GETNEIGHTBL to RCU.\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260909233143.2401847-2-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e75a9fa1d44bcbd66ea02e8781bcca6ea4076e0d", "tree": "b27502ad6dd62dcdc759c94e08279b3ca4f54123", "parents": [ "cbdd39ce42530a193c56beb206a3356cb6d01016" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Sep 07 21:04:05 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Sep 11 13:04:15 2026 +0200" }, "message": "netfilter: flowtable: hold reference on ct until flow is released\n\nnf_ct_put() releases the ct-\u003eext area inmediately, the rcu typesafe\nsemantics also allow to refer to the wrong conntrack from the flowtable\ndatapath. Hold reference on ct until flow is released after rcu grace\nperiod.\n\nAdd rcu_barrier() on module exit path, to ensure pending flow entries\nare release before module goes away.\n\nFixes: 0ff90b6c2034 (\"netfilter: nf_flow_offload: fix use-after-free and a resource leak\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "cbdd39ce42530a193c56beb206a3356cb6d01016", "tree": "9bef09431167f1830444bb782f3920afe2573e58", "parents": [ "444e4c88c9c62a3d823069006563513fe7d5aa66" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Thu Sep 03 01:28:56 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Sep 11 13:04:15 2026 +0200" }, "message": "netfilter: nf_nat: unregister and release hooks on error\n\nIf nf_hook_entries_insert_raw() fails, the NAT hooks get never released,\nresulting in a memleak.\n\nPostpone setting nat_proto_net-\u003enat_hook_ops when the hooks are\nregistered to simplify the error path to decide whether the nat hooks\nneed unwinding.\n\nFixes: 1cd472bf036c (\"netfilter: nf_nat: add nat hook register functions to nf_nat\")\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "444e4c88c9c62a3d823069006563513fe7d5aa66", "tree": "166c64ee7c3d61881e953106e1b905f1e7d355e4", "parents": [ "d313499df66159b4b7971d760d16729598ab7e5a" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Thu Aug 27 12:32:56 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Sep 11 13:04:15 2026 +0200" }, "message": "netfilter: nf_tables: fix device name and prefix match in hook lookup\n\nCurrently, a netdev chain or flowtable hooked to a device prefix can be\nunintentionally deleted by a control-plane request targeting an exact\ndevice name or even a shorter one due to the usage of min() to calculate\nthe length to match.\n\nFix this by making sure an exact device match never matches a prefix and\nthat both the target and the candidate have the same length during\ndelete operation. The add and update paths retain the existing overlap\nmatching to prevent a single device from matching multiple hooks.\n\nReported-by: Wei Fang \u003cvoid0red@gmail.com\u003e\nCloses: https://lore.kernel.org/netfilter-devel/CANE+tVrDeNCHQVmsqkV2ozeBqyE3GtRDMhZgsg1bhw10yGNTRQ@mail.gmail.com/\nFixes: 6d07a289504a (\"netfilter: nf_tables: Support wildcard netdev hook specs\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "d313499df66159b4b7971d760d16729598ab7e5a", "tree": "5498f972fbf4e86c17ffa8f39638dcbf9ed3fd30", "parents": [ "78445023439506ebd83b86d40b1e428a3b309d4a" ], "author": { "name": "Theodor Arsenij Larionov Trichkine", "email": "theodorlarionov@gmail.com", "time": "Tue Aug 25 12:10:56 2026 +0300" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Sep 11 13:04:14 2026 +0200" }, "message": "netfilter: nft_nat: fully initialise new_addr in netmap setup\n\nnft_nat_setup_netmap() builds the mapped address in an on-stack\nunion nf_inet_addr. For an IPv4 mapping it writes only the 4-byte .ip\nmember and the loop runs a single 32-bit iteration, but it then copies\nthe whole 16-byte union into range-\u003emin_addr and range-\u003emax_addr, so the\nupper 12 bytes reach nf_nat_setup_info() uninitialised.\n\nKMSAN reports an uninit-value in nf_nat_setup_info() reached from\nnft_nat_eval(). The IPv6 path fills all 16 bytes and is not affected.\n\nZero-initialise new_addr.\n\nFixes: 3ff7ddb1353d (\"netfilter: nft_nat: add netmap support\")\nSigned-off-by: Theodor Arsenij Larionov Trichkine \u003ctheodorlarionov@gmail.com\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "78445023439506ebd83b86d40b1e428a3b309d4a", "tree": "4be5947a504ab54bc7ec43697ea87cace94a962f", "parents": [ "0a96d0d726cd380423ac38e2c28f538db2940a1d", "5096947508b750bd4a65a8e61bd2083a44d61bfd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:07:48 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Nothing too exciting, usual stream of fixes. Including fixes from\n Netfilter, Bluetooth and WPAN.\n\n Current release - new code bugs:\n\n - Bluetooth: hci_sync: fix not setting CE length properly\n\n - eth: enic: match mailbox replies to request numbers\n\n Previous releases - regressions:\n\n - tunnels: drop stale dst when building an ICMP error for PMTUD\n\n - ipv6: null-check fib6_node before accessing in __ip6_del_rt_siblings()\n (bug in the rtnl_lock -\u003e RCU conversion)\n\n - eth: bnxt_en:\n - fix crashes on Thor2 due to OOB coalescing buffer accesses\n - prevent queue stop with deferred completions\n\n Previous releases - always broken:\n\n - eth:\n - ice: don\u0027t dereference pointers from TP_printk()\n - fix OOB writes on ethtool flow rule dump in 3 drivers\n - mlx5: fix FEC configuration with RS_544_514_INTERLEAVED_QUAD\n\n - dsa: tag_brcm: legacy FCS: request needed tailroom\n\n Misc:\n\n - net: cap tx_queue_len at S16_MAX to prevent oversized ring alloc\n\n - ipv6: flowlabel: cap duplicate leases per socket\"\n\n* tag \u0027net-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (164 commits)\n selftests: tc-testing: test action batch failure cleanup\n net/sched: act_api: release all action references on NEWACTION failure\n openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n ipmr: account multicast table and route memory\n net: phy: dp83td510: handle the active-high LED polarity mode\n net: macb: initialize PTP state before registering clock\n net: hsr: enable promiscuous mode on interlink port with fwd offload\n ipv6: fix fib6 walker UAF on seq stop\n net: stmmac: fix TX descriptor availability check for TSO traffic\n net/rds: fix tcp stream corruption with large pages\n net: mana: restore the XDP program pointer when pre-allocation fails\n net: phy: dp83867: handle the active-high LED polarity mode\n octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n tcp: reject non zerocopy devmem tx\n net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support\n net: dsa: mt7530: populate lpi_interfaces to fix EEE support\n net: hinic: fix mailbox segment buffer overflow\n net: sun4i-emac: fix missing of_node_put() for phy_node\n ...\n" }, { "commit": "0a96d0d726cd380423ac38e2c28f538db2940a1d", "tree": "5ca577a2941565211f3d9980bc05811b9a9f955a", "parents": [ "ad724d319c81475488794eccc11eb5e27242e1eb", "cb26524ef4ac28fcfa554c0656e8dc412c38a8ff" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 14:03:48 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - File type corruption fixes in reparse point handling: setting S_IFMT\n bits without clearing the existing type first corrupted the file mode\n (e.g. S_IFREG | S_IFCHR \u003d\u003d S_IFLNK). Fixed in the WSL, POSIX and\n native symlink reparse parsers. Also fixes an uninitialized SID\n structure in the POSIX readdir path when parsing fails.\n\n - Ownership mapping fixes: forceuid/forcegid mount options were\n ignored in several code paths (SID-to-id mapping, WSL extended\n attributes, POSIX extensions getattr), allowing an untrusted server\n to dictate local file ownership despite explicit mount overrides.\n\n - Heap overflow and overflow fixes in DACL rewriting: replacing short\n SIDs with long ones could overflow the DACL buffer, and the u16\n accumulator for DACL size could wrap around with enough ACEs.\n\n - Reference count leak fixes in oplock break and deferred close:\n duplicate oplock breaks on a queued work item leaked a\n cifsFileInfo reference, and deferred close had a similar leak when\n requeueing a running work item. Both cause busy-inode oopses on\n unmount.\n\n - DFS superblock use-after-free fix: the iterator callback stored a\n raw superblock pointer without pinning it, racing with automount\n expiry.\n\n - One-byte slab OOB read in the native symlink parser when handling\n share-root relative paths.\n\n - Hardening of legacy SMB1 input: reject userspace-crafted\n cifs.idmap key descriptions that bypass kernel origin checks, and\n validate DataOffset in CIFSSMBRead() to prevent heap info\n disclosure from a malicious server.\n\n - DFS cache fix: defer metadata updates until target copying\n succeeds to prevent partial-state cache entries on allocation\n failure.\n\n* tag \u0027cifs-fixes-7.3-rc3\u0027 of https://git.manguebit.org/linux:\n smb: client: fix one-byte OOB read in smb2_parse_native_symlink()\n smb: client: fail DACL rewrite when the new DACL exceeds 64K\n smb: client: fix heap overflow in DACL owner/group rewrite\n smb: client: fix file type corruption in cifs_reparse_point_to_fattr()\n smb: client: fix file type corruption in posix_reparse_to_fattr()\n smb: client: fix file type corruption in wsl_to_fattr()\n smb: client: avoid using uninitialized SIDs in cifs_posix_to_fattr()\n smb: client: fix WSL reparse point uid/gid override\n smb: client: honor forceuid/forcegid when mapping SIDs to uid/gid\n smb: client: fix uid/gid override in getattr with posix extensions\n smb: client: fix cifsFileInfo reference leak in deferred close\n smb: client: avoid leaking refcount when cifs_sb_tlink() fails\n smb: client: avoid leaking refcount in cifs_queue_oplock_break()\n smb: client: fill cache fields after populating cache in copy_ref_data()\n smb: client: pin DFS superblock in iterator callback\n smb: client: reject userspace cifs.idmap descriptions\n smb: client: reject out-of-bounds DataOffset in CIFSSMBRead()\n smb: client: reject short READ responses in CIFSSMBRead()\n" }, { "commit": "ad724d319c81475488794eccc11eb5e27242e1eb", "tree": "89a34a871f422f2e320eee99820218bc134cee34", "parents": [ "c9a8c0e393d6043fc29b0b527e654110ba523c36", "353a95f1cd8da8a5436a3f070be07d2f484486cd" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:36:56 2026 -0700" }, "message": "Merge tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl\n\nPull sysctl fix from Joel Granados:\n \"This fell through the cracks during the latest merge window. There are\n no more CONFIG_PROC_SYSCTL uses after this fix:\n\n - Replace CONFIG_PROC_SYSCTL with CONFIG_SYSCTL\n\n CONFIG_SYSCTL is the config string that controls sysctl subsys\"\n\n* tag \u0027sysctl-7.03-fixes-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/sysctl/sysctl:\n syscall_user_dispatch: Use CONFIG_SYSCTL for sysctl guard\n" }, { "commit": "c9a8c0e393d6043fc29b0b527e654110ba523c36", "tree": "e01cbcc26ddef4915060d28cd77d4f0abcc6a789", "parents": [ "50d05c7c76c96b90462f24debacca971d2e86713", "01504d14e47b34779911250dd308a03f6ef681c2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 10 09:11:17 2026 -0700" }, "message": "Merge tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging\n\nPull watchdog fixes from Guenter Roeck:\n\n - core: Do not start hrtimer when pretimeout is zero\n\n - msc313e: Various fixes for issues reported by Sashiko\n\n - MAINTAINERS: Update URI for watchdog tree\n\n - sunxi_wdt: preserve boot-enabled watchdog\n\n* tag \u0027watchdog-for-v7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/groeck/linux-staging:\n watchdog: msc313e: Sync timeout value if WDT was running at boot\n watchdog: msc313e: Fix undefined behavior\n watchdog: msc313e: Fix spurious reset on suspend\n watchdog: msc313e: Enable clock before accessing hardware registers\n watchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n watchdog: msc313e: Avoid division by zero\n watchdog: fix hrtimer start when pretimeout is zero\n MAINTAINERS: Update URI for watchdog tree\n watchdog: msc313e: Fix NULL pointer dereference in PM callbacks\n watchdog: sunxi_wdt: preserve boot-enabled watchdog\n" }, { "commit": "5096947508b750bd4a65a8e61bd2083a44d61bfd", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae", "2a86bbed9f60702e97a8194e40f90f4db22d7795" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:08 2026 -0700" }, "message": "Merge branch \u0027net-sched-fix-action-batch-failure-cleanup\u0027\n\nXuanqiang Luo says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: fix action batch failure cleanup\n\nFailed batched RTM_NEWACTION requests can leak action references and\nreserved IDR indices when cleanup encounters a filter-bound action.\n\nPatch 1 fixes the failure cleanup.\n\nPatch 2 adds tc-testing regression coverage.\n\nFailure reproduction (key output excerpts):\n\n python3 tdc.py -f tc-tests/actions/gact-rollback.json\n\nnot ok 1 e3b1 - Failed action batch releases a bound action reference\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 3 bind 1\n\nnot ok 2 e3b2 - Failed action batch releases entries after a bound action\n\tCommand exited with 255, expected 0\nRTNETLINK answers: Resource temporarily unavailable\nWe have an error talking to the kernel\n\nnot ok 3 e3b3 - Failed action batch releases repeated references to a bound action\n\tCould not match regex pattern. Verify command output:\n[...]\n\t index 1 ref 4 bind 1\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260909070336.32979-1-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2a86bbed9f60702e97a8194e40f90f4db22d7795", "tree": "a8c03e34c16714522b01bcf5e9db38788ce24b6c", "parents": [ "478eb5abb51931a152abab068f8a717b7ff480fd" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "selftests: tc-testing: test action batch failure cleanup\n\nAdd tests for cleanup after a batched RTM_NEWACTION request fails.\nReplace an existing gact action bound to a filter, then fail a later\nentry by requesting goto chain without a classifier context.\n\nCheck that the bound action\u0027s reference count returns to its original\nvalue. Also cover a successfully initialized new action between the\nbound action and the failing entry, verifying that its reserved index\ncan be reused. Repeat the bound action in another batch to check that\neach temporary reference to the same action is released.\n\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-3-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "478eb5abb51931a152abab068f8a717b7ff480fd", "tree": "00d7d67e4c0fb1ab2af4484bc8f6ab3c90eb1f03", "parents": [ "fc266a5dd99c4584c985b8b687c750598500a7ae" ], "author": { "name": "Xuanqiang Luo", "email": "luoxuanqiang@kylinos.cn", "time": "Wed Sep 09 15:03:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 09:06:05 2026 -0700" }, "message": "net/sched: act_api: release all action references on NEWACTION failure\n\nWhen a batched RTM_NEWACTION request replaces an existing action,\ntcf_idr_check_alloc() takes a temporary reference on it. If a later\naction fails to initialize, tcf_action_destroy() uses strict release\nsemantics to clean up the actions initialized so far. For an action\nbound to a filter, the strict check returns -EPERM without dropping\nthe temporary reference.\n\nThis error also makes tcf_action_destroy() return before releasing\nsubsequent entries. Any new action initialized between the bound\naction and the failing entry is leaked together with its reserved\nIDR slot, preventing reuse of its index.\n\nUse tcf_idr_release() to drop each reference held by the batch without\nrejecting bound actions. This allows cleanup to continue through all\ninitialized entries and preserves the module reference release when\nan action is destroyed. Explicit action deletion and flushing retain\ntheir separate bind-count checks.\n\nFixes: 55334a5db5cd (\"net_sched: act: refuse to remove bound action outside\")\nCc: stable@vger.kernel.org\nSigned-off-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260909070336.32979-2-xuanqiang.luo@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fc266a5dd99c4584c985b8b687c750598500a7ae", "tree": "74cf39e5c4d1eaac74ae943720e2ec264c383555", "parents": [ "e184a4a6f423550a25adce867036cdb1ff471745", "b8bf9bfda5f62e11444e483c2b4aaff90c5cfc6b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:55:13 2026 -0700" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-09-08 (idpf, ice)\n\nFor idpf:\nMyeonghun Pak adds calls to disable DIM work and PTM to allow for proper\ncleanup.\n\nJosh adds check, and adjustment, for VLAN headers when processing RSC\npackets.\n\nFor ice:\nJake adds call to xa_destroy for xarray sched_node_ids; also moving it\nfrom port_info struct to ice_hw to simplify its lifecycle management.\n\nJakub Kicinski stores trace event data as scalars instead of\ndereferencing pointers in TP_printk(), preventing use-after-free issues\nduring event printing and eliminating double-dereference warnings.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n eth: ice: don\u0027t dereference pointers from TP_printk()\n ice: add missing xa_destroy for sched_node_ids\n idpf: account for VLAN header when parsing RSC packet header\n idpf: disable PTM on probe failure and on remove\n idpf: disable DIM work before freeing q_vectors\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908214502.528440-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e184a4a6f423550a25adce867036cdb1ff471745", "tree": "81a226f509ca1643d3e04ee8dd923f342f75ac90", "parents": [ "b7ee18725f2292ab554aa96a101ae42d45f008bd" ], "author": { "name": "Eelco Chaudron", "email": "echaudro@redhat.com", "time": "Tue Sep 08 16:15:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:51:30 2026 -0700" }, "message": "openvswitch: fix wrong flag value in get_ipv6_ext_hdrs()\n\nThe ESP and AH cases in get_ipv6_ext_hdrs() used IPPROTO_FRAGMENT instead\nof OFPIEH12_FRAG when checking for out-of-order extension headers, causing\nthe fragment header to not be recognised as a valid predecessor.\n\nThe original code used IPPROTO_FRAGMENT (44) as a bitmask constant where\nOFPIEH12_FRAG (1 \u003c\u003c 4 \u003d 16) was intended. IPPROTO_FRAGMENT encodes bits\n2, 3 and 5 (OFPIEH12_AUTH | OFPIEH12_DEST | OFPIEH12_ROUTER), but not\nbit 4 (OFPIEH12_FRAG). This caused incorrect OFPIEH12_UNSEQ verdicts in\nboth the ESP and AH arms: the ESP arm failed to whitelist OFPIEH12_FRAG,\nwhile the AH arm accidentally whitelisted OFPIEH12_AUTH.\n\nWith the fix, a packet with two AH headers now also gets OFPIEH12_UNSEQ\nin addition to OFPIEH12_UNREP, matching the ESP arm which already sets\nUNSEQ on a repeat, which is the intended behavior.\n\nFixes: 28a3f0601727 (\"net: openvswitch: IPv6: Add IPv6 extension header support\")\nReported-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Aaron Conole \u003caconole@redhat.com\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nSigned-off-by: Eelco Chaudron \u003cechaudro@redhat.com\u003e\nLink: https://patch.msgid.link/1b1582eb07550d71f3cbe210e5cb31eeb8d0ad86.1788876917.git.echaudro@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7ee18725f2292ab554aa96a101ae42d45f008bd", "tree": "e9f27a905de4f01c5c44bf17c355c2bcc72477ce", "parents": [ "6ca81bbc31cdc964e4b74d17b86215d4a810a56f" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 11:58:39 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:48:44 2026 -0700" }, "message": "ipmr: account multicast table and route memory\n\nA netadmin in a user+net namespace can create many IPv4 and IPv6\nmulticast routing tables with MRT_TABLE and MRT6_TABLE. Each unseen\nid allocates an mr_table via the shared mr_table_alloc(), links it\ninto the per-net list, and leaves it until netns teardown. Those\nobjects were not charged to memcg, so the host unreclaimable slab\ngrows with the table count.\n\nAccount mr_table allocations with GFP_KERNEL_ACCOUNT and mark the\nIPv4/IPv6 MFC caches SLAB_ACCOUNT. This matches the established\nhandling of IP addresses, routes and alternate interface names.\n\nUnresolved MFC entries are still allocated from softIRQ with\nGFP_ATOMIC and are not charged. They expire after 10 seconds and are\nbounded by the socket receive queue; see commit 0079ad8e8dc3\n(\"ipmr: remove hard code cache_resolve_queue_len limit\").\n\nFixes: f0ad0860d01e (\"ipv4: ipmr: support multiple tables\")\nFixes: d1db275dd3f6 (\"ipv6: ip6mr: support multiple tables\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/050b58f7fc6b45da0fb12768ebb62d18fa46133d.1788784801.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6ca81bbc31cdc964e4b74d17b86215d4a810a56f", "tree": "0179c0ec9b498bdde3b83f0db783e424b5891b69", "parents": [ "e1406330d70e56dd44fa6fbafc86e77e5c80c122" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Tue Sep 08 19:59:58 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:47:22 2026 -0700" }, "message": "net: phy: dp83td510: handle the active-high LED polarity mode\n\ndp83td510_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() returns it. A device tree marking\na DP83TD510 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus leaves the mdio device\nunbound, so phy_attach_direct() falls back to the genphy driver, which\ncannot drive this 10BASE-T1L single-mode PHY, so the interface has no\nusable link.\n\nThe callback initializes polarity to DP83TD510E_LED_POLARITY(index), which\nis the active-high setting, so the request is already satisfied and only\nthe case label is missing.\n\nCc: stable@vger.kernel.org\nFixes: 5b281fe7e396 (\"net: phy: dp83td510: introduce LED framework support\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260908105959.70453-3-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e1406330d70e56dd44fa6fbafc86e77e5c80c122", "tree": "2291415b8da9eb8dcf3cdc335e1ad07c0b9c785e", "parents": [ "a2dc179481d18f6df7274522571b64dd50f31e81" ], "author": { "name": "Runyu Xiao", "email": "runyu.xiao@seu.edu.cn", "time": "Tue Sep 08 18:39:24 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:46:19 2026 -0700" }, "message": "net: macb: initialize PTP state before registering clock\n\ngem_ptp_init() registers the PTP clock before initializing\nbp-\u003etsu_clk_lock and the TSU hardware. Since ptp_clock_register()\npublishes the PTP character device, userspace may invoke PTP callbacks\nbefore the lock and hardware are ready.\n\nIn addition, gem_ptp_init() is called from both the interface open and\nresume paths. Reinitializing tsu_clk_lock there can reset the lock while\ntimestamp processing is using it.\n\nThis race is theoretical and has not been observed in practice.\n\nInitialize tsu_clk_lock once during probe and initialize the TSU before\nregistering the PTP clock.\n\nFixes: ab91f0a9b5f4 (\"net: macb: Add hardware PTP support\")\nCc: stable@vger.kernel.org\nLink: https://lore.kernel.org/netdev/20260904030439.3994047-1-runyu.xiao@seu.edu.cn/\nReviewed-by: Théo Lebrun \u003ctheo.lebrun@bootlin.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Runyu Xiao \u003crunyu.xiao@seu.edu.cn\u003e\nLink: https://patch.msgid.link/20260908103924.607033-1-runyu.xiao@seu.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a2dc179481d18f6df7274522571b64dd50f31e81", "tree": "627196c8b7c7dcdcde85e1ec1a31e74664f0a196", "parents": [ "19b4ed644d68098cc62ab612727f40d30f43476c" ], "author": { "name": "MD Danish Anwar", "email": "danishanwar@ti.com", "time": "Tue Sep 08 14:38:56 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:45:00 2026 -0700" }, "message": "net: hsr: enable promiscuous mode on interlink port with fwd offload\n\nhsr_portdev_setup() skips promiscuous mode on non-master ports when\nhsr-\u003efwd_offloaded is set. fwd_offloaded is derived only from the ring\nslaves\u0027 NETIF_F_HW_HSR_FWD bit, so this also skips it for the interlink\nport, which never gets forwarding offload. Without promiscuous mode,\nthe interlink NIC drops unicast frames addressed to hsr_dev\u0027s MAC\n(e.g. SAN traffic to the RedBox), breaking RedBox whenever the ring is\nHW-offloaded.\n\nFixes: 5055cccfc2d1 (\"net: hsr: Provide RedBox support (HSR-SAN)\")\nSigned-off-by: MD Danish Anwar \u003cdanishanwar@ti.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260908090856.2876114-1-danishanwar@ti.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "19b4ed644d68098cc62ab612727f40d30f43476c", "tree": "40c1c6cb900b27e01b6bed9adfdc66ca2c36d60b", "parents": [ "5e38d732ec67a5b1f9a56e6c73add480c4b6030a" ], "author": { "name": "Zihan Xi", "email": "zihanx@nebusec.ai", "time": "Tue Sep 08 07:42:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:39:06 2026 -0700" }, "message": "ipv6: fix fib6 walker UAF on seq stop\n\nipv6_route_iter_active() treats a walker in FWS_U at the table root as\nalready unlinked. fib6_del_route() can move a still-linked walker into\nthat same state when the current leaf is the last route at the root,\nso ipv6_route_native_seq_stop() skips fib6_walker_unlink(). The seq\nprivate object can then be freed while it remains on\nnet-\u003eipv6.fib6_walkers. A later route deletion walks the dangling list\nand uses the freed walker.\n\nUse the list head as membership state and reinitialize it when\nunlinking. Keep the existing w-\u003enode check so a never-started iterator\nwith a zeroed private object is not treated as linked.\n\nThe same stop helper is used by /proc/net/ipv6_route and by the BPF\nipv6_route iterator. The BPF show path only widens the race.\n\nFixes: 8d2ca1d7b5c3 (\"ipv6: avoid high order memory allocations for /proc/net/ipv6_route\")\nCc: stable@vger.kernel.org\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nCo-developed-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Luxing Yin \u003croot@tr0jan.top\u003e\nSigned-off-by: Zihan Xi \u003czihanx@nebusec.ai\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/89699735763f6c297584d7c2ff106239cc1e8ce0.1788837093.git.zihanx@nebusec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e38d732ec67a5b1f9a56e6c73add480c4b6030a", "tree": "2bbcab25587be47331ea1a16c89d915de1c4da7f", "parents": [ "2ac09b5353fe6858411fdc8c6efa60d832e20f13" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Sep 07 23:46:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:34:07 2026 -0700" }, "message": "net: stmmac: fix TX descriptor availability check for TSO traffic\n\nstmmac_tso_xmit() estimates the number of free TX descriptors required by\na TSO skb as:\n\n\t(skb-\u003elen - proto_hdr_len) / TSO_MAX_BUFF_SIZE + 1\n\nwhich assumes the payload is split into TSO_MAX_BUFF_SIZE chunks. This\nunderestimates the descriptors actually consumed by stmmac_tso_allocator(),\nsince each fragment is mapped individually and so it needs at least one\ndescriptor regardless of its size. Moreover, one descriptor is used for\nthe L2/L3/L4 headers and, when the MSS changes, one more is consumed for\nthe MSS context descriptor.\nFor a highly fragmented TSO skb the check can therefore pass even when the\nring has too few free slots. stmmac_tso_allocator() then writes past the\navailable descriptors, overwriting descriptors still owned by the DMA\nengine, corrupting the TX ring.\nAdd stmmac_tso_get_num_desc() to compute the exact number of descriptors\nneeded for the header, the linear payload and each fragment, plus the MSS\ncontext descriptor when required, and use it in the availability check.\n\nFixes: f748be531d70 (\"stmmac: support new GMAC4\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260907-stmmac-fix-tso-nfrags-check-v1-1-328459906cdb@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ac09b5353fe6858411fdc8c6efa60d832e20f13", "tree": "59b37dc616b531c0fd1fae4800544096428c90b7", "parents": [ "4c46beb807efcc93f5899ebe1f5958248eb296c6" ], "author": { "name": "Greg Marsden", "email": "greg.marsden@oracle.com", "time": "Sat Sep 05 10:00:41 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:19:17 2026 -0700" }, "message": "net/rds: fix tcp stream corruption with large pages\n\nrds_message_map_pages() assigns PAGE_SIZE bytes to every\nscatterlist entry, even when total_len ends in a partial page. The RDS\ncongestion map is defined as 8192 bytes, so on systems with PAGE_SIZE\ngreater than 8192 the scatterlist maps bytes beyond the end of the\ncongestion map. RDS-TCP transmits the SG contents according to those\nlengths, so the extra bytes become part of the TCP RDS stream and are\ninterpreted as subsequent RDS message headers, corrupting the stream.\n\nLimit the final scatterlist mapping to the number of bytes remaining.\nThis has no effect on systems with a 4K page size and allows RDS-TCP to\nbe used on systems with 16K and larger page sizes.\n\nThe RDS selftest, which previously hung on 16K pages, now passes.\n\nFixes: 7875e18e0996 (\"RDS: Message parsing\")\nSigned-off-by: Greg Marsden \u003cgreg.marsden@oracle.com\u003e\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/apxJjxvStibPI0AS@oracle.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c46beb807efcc93f5899ebe1f5958248eb296c6", "tree": "1fb7e99e6821c49b9479a254786d54217fb0d027", "parents": [ "36a45facedd5c8e73bfb2403f8b0dbff05124c9c" ], "author": { "name": "Long Li", "email": "longli@microsoft.com", "time": "Fri Sep 04 13:26:40 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:06:07 2026 -0700" }, "message": "net: mana: restore the XDP program pointer when pre-allocation fails\n\nmana_xdp_set() publishes the new program into apc-\u003ebpf_prog before it\nallocates anything, because mana_pre_alloc_rxbufs() sizes the buffers\nfrom it via mana_get_rxbuf_cfg(). When that allocation fails the\nfunction returns the error directly, skipping the err_dealloc_rxbuffs\nlabel which is the only place that restores the previous pointer.\n\nThe attach is reported as failed, so the BPF core drops the reference it\nheld for the caller and the program can be freed, while apc-\u003ebpf_prog\nstill points at it. The next consumer of mana_xdp_get() - typically\nmana_chn_setxdp() from mana_alloc_queues() on the following ifup, or\nafter a TX timeout reset - then calls bpf_prog_add() on freed memory.\n\nThis is reachable from an ordinary \"ip link set dev ethX xdp obj ...\"\nwhenever the per-queue RX buffer pre-allocation cannot be satisfied.\n\nRestore the previous program on that error path.\n\nFixes: 730ff06d3f5c (\"net: mana: Use page pool fragments for RX buffers instead of full pages to improve memory efficiency.\")\nSigned-off-by: Long Li \u003clongli@microsoft.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904202640.3900685-1-longli@microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "36a45facedd5c8e73bfb2403f8b0dbff05124c9c", "tree": "6d2ebc24e56c1531ba8573ae117681007a6ba286", "parents": [ "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437" ], "author": { "name": "Donggeun Yoo", "email": "donggeunyoo.kernel@gmail.com", "time": "Thu Sep 03 11:28:38 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "net: phy: dp83867: handle the active-high LED polarity mode\n\nCommit a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY\nLEDs\") added PHY_LED_ACTIVE_HIGH and made of_phy_led() set the matching\nbit in the modes mask when a LED node carries the \u0027active-high\u0027\nproperty. dp83867 was not part of that series.\n\ndp83867_led_polarity_set() only recognizes PHY_LED_ACTIVE_LOW, so\nPHY_LED_ACTIVE_HIGH falls through to the default case and returns -EINVAL.\nof_phy_led() propagates the error, of_phy_leds() drops the LEDs registered\nso far and passes it on, and phy_probe() fails. A device tree marking a\nDP83867 LED as \u0027active-high\u0027, which leds/common.yaml allows and\nethernet-phy.yaml references for led@N nodes, thus stops the PHY from\nprobing.\n\nActive high is what the function programs when no polarity mode is\nrequested at all, so the initial value of polarity already satisfies the\nrequest and only the case label is missing.\n\nThe same series updated mxl-gpy in commit eb89c79c1b8f (\"net: phy:\nmxl-gpy: correctly describe LED polarity\") and aquantia in\ncommit 9d55e68b19f2 (\"net: phy: aquantia: correctly describe LED\npolarity override\").\n\nFixes: a274465cc3be (\"net: phy: support \u0027active-high\u0027 property for PHY LEDs\")\nSigned-off-by: Donggeun Yoo \u003cdonggeunyoo.kernel@gmail.com\u003e\nLink: https://patch.msgid.link/20260903022839.4006614-1-donggeunyoo.kernel@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f4b743c2d2bbc336cb164d9d3d2ed6956ad8437", "tree": "7234cccade054ae2d9331ff8f8d2adeef5b05526", "parents": [ "985a663bf00799c1daf1c5789efa6406958780c8" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Fri Sep 04 14:21:13 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Sep 10 08:02:06 2026 -0700" }, "message": "octeontx2-af: fix PF/CGX debugfs PCI bus lookup\n\nrvu_dbg_rvu_pf_cgx_map_display() locates each RVU PF PCI device via\npci_get_domain_bus_and_slot() when printing the PF-to-CGX map. It\nassumed PF0 always sits on PCI bus 1 and derived other PF bus numbers\nas pf + 1, but the AF device can be enumerated on a different bus.\n\nUse rvu-\u003epdev-\u003ebus-\u003enumber as the base bus instead, so each PF lookup\nuses pf + start on systems where RVU functions are on contiguous buses\nbut do not start at bus 1.\n\nFixes: e2fb373038654 (\"octeontx2-af: Display CGX, NIX and PF map in debugfs.\")\nSigned-off-by: Subbaraya Sundeep \u003csbhatta@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904085114.3385530-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "985a663bf00799c1daf1c5789efa6406958780c8", "tree": "82415db2760ff82b11dc69dd6e978fb5d92e4747", "parents": [ "ccbe7540e4aad0d1c3acc249697350b93ccb8025" ], "author": { "name": "Faicker Mo", "email": "faicker.mo@gmail.com", "time": "Tue Sep 08 12:06:29 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 15:19:06 2026 +0200" }, "message": "net: net_failover: Fix the deadlock in net_failover_slave_name_change()\n\nThis is a sibling fix of commit\nb84c5632c7b3 (\"net: net_failover: Fix the deadlock in slave register\").\nThere is netdev_lock_ops() in the upper callers, so using netif_open()\ninstead of dev_open().\n\nCall Trace:\n __schedule+0x2bb/0x650\n schedule+0x27/0xb0\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x550/0xaf0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n dev_open+0x3b/0xe0\n net_failover_slave_name_change+0x22/0x40\n failover_event+0xd4/0x1e0\n notifier_call_chain+0x62/0xf0\n raw_notifier_call_chain+0x16/0x30\n call_netdevice_notifiers_info+0x50/0x80\n netif_change_name+0x200/0x330\n do_setlink.isra.0+0xb12/0xdf0\n ? security_capable+0x9a/0x1e0\n ? ns_capable+0x31/0x60\n rtnl_setlink+0x302/0x670\n ? netlink_recvmsg+0x296/0x340\n ? security_capable+0x9a/0x1e0\n ? __pfx_rtnl_setlink+0x10/0x10\n rtnetlink_rcv_msg+0x384/0x460\n ? __pfx_rtnetlink_rcv_msg+0x10/0x10\n netlink_rcv_skb+0x61/0x120\n rtnetlink_rcv+0x15/0x30\n netlink_unicast+0x28f/0x3c0\n netlink_sendmsg+0x216/0x450\n __sys_sendto+0x222/0x230\n __x64_sys_sendto+0x24/0x40\n x64_sys_call+0x1d5d/0x2390\n do_syscall_64+0x105/0x5a0\n ? do_syscall_64+0x140/0x5a0\n ? exc_page_fault+0x94/0x1e0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nFixes: 7e4d784f5810 (\"net: hold netdev instance lock during rtnetlink operations\")\nSigned-off-by: Faicker Mo \u003cfaicker.mo@gmail.com\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260908040708.3972058-1-faicker.mo@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ccbe7540e4aad0d1c3acc249697350b93ccb8025", "tree": "cc0ebd4dc7a32b9c8edf139baec73560be3df695", "parents": [ "125755776bc6d4dd53eaf551c87e3d460625d638" ], "author": { "name": "Vladislav Karmanov", "email": "vladislav.karmanov.dev@gmail.com", "time": "Tue Sep 08 17:52:13 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 14:48:21 2026 +0200" }, "message": "net: phy: mediatek-ge: disable EEE on the MT7530 PHY\n\nThe MT7530 internal GE PHY advertises EEE by hardware default, but its\nEEE support is defective: with EEE advertised, some link partners fail\nto establish a stable link. On a 2-pair (4-wire) cable where both ends\nadvertise gigabit, 1000BASE-T training cannot succeed, and instead of\nfalling back to 100 Mbps the port loops, so no link or DHCP lease is\never obtained. MediaTek confirms the hardware is the root cause (Landen\nChao, 2021): \"EEE of the 10-year-old MT7530 internal gephy has many IOT\nproblems, so it is recommended to disable its EEE.\"\n\nmtk_gephy_config_init() used to clear the EEE advertisement early, but\ncommit af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE\nadvertisement\") removed that on the rationale that the DSA subdriver\nalready performs an early disable. That holds for MT7531, whose\nmt7531_setup() clears MDIO_AN_EEE_ADV on each switch PHY, but not for\nthe MT7530 PHY: neither the MT7621 integrated switch nor the dedicated\nMT7530 IC ever had such a loop, so removing it left those boards\nwithout any working early EEE disable and the link flapping came back.\n\nSince the broken hardware is the PHY, fix it in the PHY driver so it\ncovers all users of this PHY, integrated in a switch or standalone:\n\n - clear MDIO_AN_EEE_ADV in probe(), as early as possible, before\n anything can negotiate EEE with the link partner;\n - clear it again in config_init() and call phy_disable_eee() there.\n config_init() is what phy_init_hw() replays after a PHY reset, when\n the register is back at its EEE-advertising hardware default, and\n it runs after of_set_phy_eee_broken() in phy_probe(), so the\n eee_disabled_modes mask survives and neither phylib nor userspace\n can re-enable EEE. dp83867 disables broken EEE from config_init()\n the same way.\n\nAuto-negotiation then falls back to a stable 100 Mbps link instead of\nlooping at gigabit. Tested on ASUS RT-AX53U (MT7621): with a 2-pair\ncable on the WAN port, a single clean 100 Mbps link comes up and a\nDHCP lease is obtained, where the unpatched driver loops.\n\nFixes: af3b4b0e59de (\"net: phy: mediatek-ge: do not disable EEE advertisement\")\nSuggested-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Vladislav Karmanov \u003cvladislav.karmanov.dev@gmail.com\u003e\nLink: https://patch.msgid.link/20260908145213.3976508-1-vladislav.karmanov.dev@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "125755776bc6d4dd53eaf551c87e3d460625d638", "tree": "2849f24849762901d55b340b73e9f442211eeffb", "parents": [ "7addb4e5ef1702704914b47bca3f706ef96c1589" ], "author": { "name": "Pavel Begunkov", "email": "asml.silence@gmail.com", "time": "Fri Sep 04 14:43:07 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 14:45:57 2026 +0200" }, "message": "tcp: reject non zerocopy devmem tx\n\nDevmem tcp tx doesn\u0027t work without zero-copy, however it\u0027s not currently\nenforced if NETIF_F_SG isn\u0027t present. In this case, tcp_sendmsg_locked()\nwill try the copy path and try to copy data from an iovec which consists\nof offsets into the dma-buf and would normally fail. Moreover,\nd9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nrelies on that and assumes that the devmem binding is present IFF we\u0027re\nusing the zero-copy path, which can be used to mix net-iov and pages in\na single skb, and break invariants. Let\u0027s reject devmem tx without\nzero-copy.\n\nNote, the parameter check the patch is modifying is too loose, we can\ncreate an io_uring request with dmabuf_id and all ZC flags, but which\nwon\u0027t have the binding. We replace it with stricter validation.\n\nFixes: bd61848900bff (\"net: devmem: Implement TX path\")\nFixes: d9c56501c72fd (\"net: tcp: block mixing readable and unreadable frags\")\nSigned-off-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nReviewed-by: Mina Almasry \u003calmasrymina@google.com\u003e\nLink: https://patch.msgid.link/fdc2478d8f21268d7078556409887d8e6ba0ad32.1788529053.git.asml.silence@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7addb4e5ef1702704914b47bca3f706ef96c1589", "tree": "4130ff1bd37ce68000eeef42084d6aa7f632f977", "parents": [ "5d4d985957434867bbe85e4fa5e638f3e48ad522", "d876c9cb2d16ed259449fe9da08c37a5cb81d724" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:31 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:31 2026 +0200" }, "message": "Merge branch \u0027net-restore-eee-on-mediatek-switches-and-soc-macs\u0027\n\nAleksei Sviridkin says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: restore EEE on MediaTek switches and SoC MACs\n\nBoth drivers fill in phylink_config.lpi_capabilities and\nlpi_timer_default but never lpi_interfaces. phylink treats a MAC as\nsupporting managed EEE only when the tx_lpi methods are implemented and\nBOTH bitmaps are non-empty, which phylink_create() decides once and for\nall, so EEE has been off on every mt753x port and on every mtk_eth_soc\nMAC that uses mtk_phylink_ops since the two commits named in the\nFixes: tags. Because the tx_lpi methods ARE implemented, phylink takes\nthe other branch and calls phy_disable_eee(), which fills\neee_disabled_modes - so userspace cannot enable EEE either.\n\nOn an MT7981B board with an MT7531 switch, before these patches:\n\n \u003d\u003d lan1\n Cannot get EEE settings: Not supported\n \u003d\u003d lan2\n Cannot get EEE settings: Not supported\n \u003d\u003d lan3\n Cannot get EEE settings: Not supported\n \u003d\u003d lan4\n Cannot get EEE settings: Not supported\n \u003d\u003d wan\n Cannot get EEE settings: Not supported\n\nlan1-3 are the MT7531 internal PHYs, lan4 is an EN8811H on switch port\n5 whose MAC side runs 2500BASE-X rate matched to a 1 Gbps media link,\nand wan is the mtk_eth_soc MAC with its directly attached 1 Gbps PHY -\nso both drivers are covered.\n\nEach patch fills lpi_interfaces from supported_interfaces and leaves\n2.5 Gbps out of both bitmaps for now. LPI above 1 Gbps is unvalidated\nrather than unsupported: both MACs fold 2.5 Gbps onto their 1 Gbps\nspeed encoding, so the 1 Gbps EEE force bit is what would govern it.\nMediaTek\u0027s SDK driver sets the force bits for 100 Mbps and 1 Gbps only,\nEEE signalling on 2500BASE-X is outside 802.3, and the 1 us unit of the\nwakeup timers is undocumented at 2.5 times the port clock.\n\nThe SoC MAC patch fills lpi_interfaces only on SoCs carrying a new\nMTK_GMAC_EEE capability. mtk_mac_enable_tx_lpi() programs wake-up times\ntaken from MT7531\u0027s reset values, and the capability marks the SoCs\nwhere those have been measured to work: MT7981 for now. The others keep\ntoday\u0027s behaviour, EEE unreachable from userspace, until someone with\nthe hardware confirms them.\n\nNeither driver sets eee_enabled_default, so LPI stays off until\nuserspace asks for it with ethtool --set-eee. The EEE advertisement is\na different matter: phylink stops force-clearing it, so a PHY that\nadvertises EEE out of reset advertises it again and the link may\nnegotiate EEE, without this MAC asserting LPI. MT7531\u0027s internal PHYs\nand EN7528 are the exceptions, for the reasons in patch 1. Devicetree\neee-broken-* marks act at the PHY level and keep working, so a board\nthat already distrusts its PHYs stays protected: OpenWrt marks all\nmodes broken on MT7621\u0027s internal PHYs.\n\nThe two patches are independent and touch different subsystems; they\nare sent together because they are the same bug.\n\nTargeted at net as a regression fix with an active userspace lockout;\ncan be retargeted at net-next if maintainers prefer.\n\nBased on net-next at 91ec20351349. All three files touched are byte\nidentical in net/main and the series applies there unchanged.\n\nAfter the series, all five ports report:\n\n EEE status: disabled\n Tx LPI: disabled\n Supported EEE link modes: 100baseT/Full\n 1000baseT/Full\n Advertised EEE link modes: Not reported\n\nNo 2.5G mode is offered, which is the narrowed lpi_capabilities, and\nnothing is advertised until userspace asks. On this board no PHY came\nout of reset advertising EEE, so the case where the advertisement\nreturns once phylink stops clearing it is not exercised here.\n\nEnabling it on lan1, whose partner advertises EEE at both speeds:\n\n # ethtool --set-eee lan1 eee on\n EEE status: enabled - active\n Advertised EEE link modes: 100baseT/Full 1000baseT/Full\n Link partner advertised EEE link modes: 100baseT/Full 1000baseT/Full\n\n # ethtool --set-eee lan1 eee on tx-lpi on\n EEE status: enabled - active\n Tx LPI: 30 (us)\n\nWith LPI armed, 30 parallel ICMPv6 streams of 1400-byte payload, 300\npackets each one second apart - so every gap crosses the LPI threshold\nand the link enters and leaves LPI thousands of times over 300 s - lost\nnothing: 300/300 on every stream, tx and rx error counters unchanged,\ncarrier_changes unchanged, and no mac_enable_tx_lpi errors in dmesg.\n\nOn wan, cabled for this round to a partner that advertises EEE (a\nBCM5720), the MT7981 GMAC\u0027s own LPI was exercised. With tx-lpi armed\nthe wan PHY\u0027s MMD 3.1 reads 0x0f44, Tx LPI indication set, so the MAC\nis asserting LPI; it drops to 0x0044 with tx-lpi off and comes back\nwith it on. The same 30-stream test at 1 Gbps lost nothing over 9000\npackets with the link cycling through LPI at every 1 s gap. At\n100 Mbps the only losses were the first packet or two of some\nstreams, and those reproduce with EEE disabled on both ends:\nneighbour discovery for 30 streams starting at once. The 17 and 36 that\nmtk_mac_enable_tx_lpi() programs therefore hold on MT7981 against this\npartner at both speeds. Its Tx LPI reads 1000 (us) against lan1\u0027s 30;\nsee the note below the scissors of patch 1.\n\nlan4 keeps EEE disabled and never arms LPI, which is what dropping\n2500BASE-X from lpi_interfaces is for. Forwarding through it was\nlossless with no carrier change.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260903123644.23800-1-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d876c9cb2d16ed259449fe9da08c37a5cb81d724", "tree": "4130ff1bd37ce68000eeef42084d6aa7f632f977", "parents": [ "3c18e3c9a54e1239b72849502ca4737604bfbb46" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Thu Sep 03 12:36:44 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:28 2026 +0200" }, "message": "net: ethernet: mtk_eth_soc: populate lpi_interfaces to fix EEE support\n\nphylink_create() decides once and for all that a MAC supports managed\nEEE, and it requires the tx_lpi ops plus non-empty lpi_capabilities and\nlpi_interfaces. mtk_add_mac() leaves lpi_interfaces empty.\n\nSo ever since EEE support was added, ethtool has answered \"Not\nsupported\" on every MAC that uses mtk_phylink_ops, and\nphy_disable_eee() has locked userspace out of turning EEE on. MT7628\nis unaffected, as rt5350_phylink_ops has no tx_lpi methods.\n\nLeave 2.5 Gbps out of both bitmaps, and the xGMII modes that\nmtk_mac_enable_tx_lpi() already refuses. MAC_MCR folds SPEED_2500 onto\nMAC_MCR_SPEED_1000, so MAC_MCR_EEE1G would govern LPI on such a link,\nand that is unvalidated rather than known unsupported: MediaTek\u0027s SDK\ndriver sets the EEE force bits for 100 Mbps and 1 Gbps only, and the\nunit of the wakeup timers is undocumented with the port clock at\n2.5 times the rate.\n\nmtk_mac_enable_tx_lpi() programs wake-up times taken from MT7531\u0027s\nreset values, and the SoC\u0027s own field has no reset value to fall\nback on. Only MT7981 has been seen to exit LPI cleanly with them, so\nthe LPI interfaces sit behind a new MTK_GMAC_EEE capability that only\nMT7981 sets; every other SoC keeps the current behaviour until it has\nbeen confirmed.\n\nLPI stays off until userspace enables it, but the EEE advertisement of\na PHY that advertises it out of reset comes back, since phylink stops\nforce-clearing it.\n\nFixes: 952d7325362f (\"net: ethernet: mediatek: add EEE support\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260903123644.23800-3-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3c18e3c9a54e1239b72849502ca4737604bfbb46", "tree": "606cf2e622bea14b78e4bc14ca88e43399f31698", "parents": [ "5d4d985957434867bbe85e4fa5e638f3e48ad522" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Thu Sep 03 12:36:43 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 13:31:28 2026 +0200" }, "message": "net: dsa: mt7530: populate lpi_interfaces to fix EEE support\n\nphylink_create() decides once and for all that a MAC supports managed\nEEE, and it requires the tx_lpi ops plus non-empty lpi_capabilities and\nlpi_interfaces. mt753x_phylink_get_caps() leaves lpi_interfaces empty.\n\nSo ever since the conversion to phylink managed EEE, ethtool has\nanswered \"Not supported\" on every mt753x port, and phy_disable_eee()\nhas locked userspace out of turning EEE on. That undoes what\ncommit 06dfcd4098cf (\"net: dsa: mt7530: fix enabling EEE on MT7531\nswitch on all boards\") arranged: EEE off by default, but reachable\nwith ethtool.\n\nLeave the speeds above 1 Gbps out of both bitmaps. PMCR folds\nSPEED_2500 and SPEED_10000 onto PMCR_FORCE_SPEED_1000, so\nPMCR_FORCE_EEE1G would govern LPI on such a link, and that is\nunvalidated rather than known unsupported: MediaTek\u0027s SDK driver sets\nthe EEE force bits for 100 Mbps and 1 Gbps only, and the unit of the\nwakeup timers is undocumented with the port clock at 2.5 times the\nrate.\n\nLPI stays off until userspace enables it, but the EEE advertisement of\na PHY that advertises it out of reset comes back, since phylink stops\nforce-clearing it.\n\nFixes: 9cf21773f535 (\"net: dsa: mt7530: convert to phylink managed EEE\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260903123644.23800-2-f@lex.la\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5d4d985957434867bbe85e4fa5e638f3e48ad522", "tree": "bcddb5736265d2d16cd1d1341b0b01571dddbbff", "parents": [ "af406abfecad2f48d8f1fc646d3994f0982bac62" ], "author": { "name": "Aamir Ahmed", "email": "elb12345@hotmail.co.uk", "time": "Mon Sep 07 02:42:34 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:37:09 2026 +0200" }, "message": "net: hinic: fix mailbox segment buffer overflow\n\ncheck_mbox_seq_id_and_seg_len() validates that seq_id does not\nexceed SEQ_ID_MAX_VAL (42) and seg_len does not exceed\nMBOX_SEG_LEN (48). However, this allows the last segment\n(seq_id\u003d42) to carry a full 48-byte payload, writing to offset\n42*48\u003d2016 for 48 bytes (ending at byte 2064). The receive\nbuffer is only MBOX_MAX_BUF_SZ (2048) bytes, resulting in a\n16-byte heap buffer overflow.\n\nThe hinic3 driver already handles this correctly by defining\nMBOX_LAST_SEG_MAX_LEN and rejecting the last segment when it\nexceeds the remaining buffer space. Apply the same fix to the\nhinic driver.\n\nFixes: a425b6e1c69b (\"hinic: add mailbox function support\")\nSigned-off-by: Aamir Ahmed \u003celb12345@hotmail.co.uk\u003e\nLink: https://patch.msgid.link/AS8P251MB0001AE870B09020B46B5D7DBC8B22@AS8P251MB0001.EURP251.PROD.OUTLOOK.COM\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "af406abfecad2f48d8f1fc646d3994f0982bac62", "tree": "fc76a70989b71f1f556ca5cf084a0afe034e09fc", "parents": [ "dff39930ad5e53d202bfdfb14687d1d2fd753b4d" ], "author": { "name": "Li Youhong", "email": "liyouhong@kylinos.cn", "time": "Fri Sep 04 16:07:58 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:22:01 2026 +0200" }, "message": "net: sun4i-emac: fix missing of_node_put() for phy_node\n\nof_parse_phandle() returns a node pointer with an elevated refcount.\nAdd the missing of_node_put() on the probe error path after\nregister_netdev() fails and in emac_remove().\n\nFixes: 492205050d77 (\"net: Add EMAC ethernet driver found on Allwinner A10 SoC\u0027s\")\nSigned-off-by: Li Youhong \u003cliyouhong@kylinos.cn\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260904080758.2432748-1-dayou5941@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "dff39930ad5e53d202bfdfb14687d1d2fd753b4d", "tree": "df6e8159f8cf47f7f318aa4e0ee501f71cfc3235", "parents": [ "4770e9f851b782c0047d617a62897f957e441eca" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Sep 08 20:55:25 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 12:06:23 2026 +0200" }, "message": "net/sched: cls_api: Don\u0027t replay RTM_GETCHAIN in tc_ctl_chain().\n\nIf a netlink socket sends RTM_GETCHAIN requests repeatedly\nwithout recv()ing the responses, tc_ctl_chain() hogs CPU and\ntriggers Hung Task splat. [0]\n\nAs caught in the stack trace, netlink_attachskb() could confuse\ntc_ctl_chain() by returning -EAGAIN when the userspace netlink\nsocket\u0027s receive buffer is full.\n\nThe replay: label exists since commit 32a4f5ecd738 (\"net: sched:\nintroduce chain object to uapi\") but was not used initially.\n\nSince commit 9f407f1768d3 (\"net: sched: introduce chain templates\"),\nthe label is needed for RTM_NEWCHAIN because tcf_proto_lookup_ops()\nmay release RTNL to call request_module().\n\nHowever, the replay logic is unnecessary for RTM_GETCHAIN.\n\nLet\u0027s apply the replay logic only for RTM_NEWCHAIN.\n\n[0]:\nINFO: task repro:1018 is blocked on a mutex likely owned by task repro:1022.\ntask:repro state:R running task stack:14096 pid:1022 tgid:1014 ppid:961 task_flags:0x400040 flags:0x00080000\nCall Trace:\n \u003cTASK\u003e\n ? clockevents_program_event (kernel/time/clockevents.c:372)\n ? pskb_expand_head (net/core/skbuff.c:615)\n ? skb_release_data (net/core/skbuff.c:1122)\n ? netlink_attachskb (./include/linux/skbuff.h:1323 ./include/linux/skbuff.h:1332 net/netlink/af_netlink.c:1232)\n ? __netlink_lookup (./include/linux/rcupdate.h:882 ./include/linux/rhashtable.h:711 net/netlink/af_netlink.c:499)\n ? tc_chain_notify (net/sched/cls_api.c:3045)\n ? tc_chain_notify (./include/linux/skbuff.h:1384 net/sched/cls_api.c:3041)\n ? netlink_unicast (net/netlink/af_netlink.c:1335)\n ? rtnl_unicast (./include/net/netlink.h:1198 net/core/rtnetlink.c:985)\n ? tc_ctl_chain (net/sched/cls_api.c:3242)\n ? rtnetlink_rcv_msg (net/core/rtnetlink.c:7146)\n ? netlink_unicast (net/netlink/af_netlink.c:1354)\n ? __pfx_rtnetlink_rcv_msg (net/core/rtnetlink.c:7177)\n ? netlink_rcv_skb (net/netlink/af_netlink.c:2556)\n ? netlink_unicast (net/netlink/af_netlink.c:1319)\n ? netlink_sendmsg (net/netlink/af_netlink.c:1900)\n ? __sock_sendmsg (net/socket.c:800)\n ? __sys_sendto (net/socket.c:2281)\n ? __x64_sys_sendto (net/socket.c:2288 net/socket.c:2284 net/socket.c:2284)\n ? do_syscall_64 (arch/x86/entry/syscall_64.c:61 arch/x86/entry/syscall_64.c:84)\n ? entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:121)\n \u003c/TASK\u003e\n\nFixes: 2ed9db3074fc (\"net: sched: cls_api: fix dead code in switch\")\nReported-by: Taras Madan \u003ctarasmadan@google.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nTested-by: hybris@mojatatu.ai\nLink: https://patch.msgid.link/20260908205537.863484-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4770e9f851b782c0047d617a62897f957e441eca", "tree": "c433561f4864a5ad1f4c16b690ad20a14a93070f", "parents": [ "00f9fbc12320253bfc576fb7539d860029c82d0f", "e190a7aabbea4fbfec0e74de134144cb4d040738" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:53 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:54 2026 +0200" }, "message": "Merge branch \u0027net-sched-cls_route-fix-bucket-retention-and-handle-recomputation\u0027\n\nVictor Nogueira says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: cls_route: fix bucket retention and handle recomputation\n\nPatch 1 is the v1 patch, unchanged. route4_change() can move an existing\nfilter to a different top-level bucket, since route4_set_parms()\nrecomputes the handle from TCA_ROUTE4_TO/FROM/IIF. The filter is\nunlinked from the old bucket, but the bucket itself is never freed once\nit goes empty, so route4_delete() keeps reporting *last\u003dfalse after the\nlast live filter is gone. That pins the empty tcf_proto and leaks it.\nThe filters linked to a bucket are refcounted now, and the bucket is\ndropped from head-\u003etable[] as soon as the count reaches zero.\n\nReviewing v1, Sashiko pointed out that the duplicate scan in\nroute4_set_parms() compares against the wrong handle [1]. Patches 2 and\n3 fix the two symptoms of that.\n\nPatch 2 makes the scan compare against nhandle. f-\u003ehandle is the handle\nthe filter has before the update, not the one it is about to be linked\nunder, so a change that moves a filter into a chain already holding\nnhandle misses the collision and links a second filter under the same\nhandle. The newcomer is then unreachable: route4_get() returns the\nincumbent, and route4_classify() stops at the first filter whose f-\u003eid\nmatches.\n\nPatch 3 handles the mirror case. An in-place replace computes an nhandle\nthat the filter being replaced already carries, so the scan finds that\nfilter and rejects the request with -EEXIST. The older filter is passed\nto route4_set_parms() and skipped in the scan. Skipping it alone would\nrename the filter it replaces: the 0x7F00 order bits are carried in no\nattribute and were folded into nhandle on the create path alone, so an\norder 1 filter came back as order 0, and a sibling sharing its key could\nthen no longer be replaced at all. They are carried over now whenever\nthe request builds the key the filter already has, which leaves a\nrequest that does change the key renaming the filter as before.\n\nPatch 4 adds tdc coverage for all three, including the cross-bucket move\ncase Sashiko noted route.json had no test for.\n\n[1] https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260907192133.2639067-1-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e190a7aabbea4fbfec0e74de134144cb4d040738", "tree": "c433561f4864a5ad1f4c16b690ad20a14a93070f", "parents": [ "41e85e54e5649a1617698438b0ce64c6f9d83d69" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:33 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "selftests/tc-testing: Add cls_route bucket move and change tests\n\nAdd 4 tdc tests for the cls_route bugs fixed earlier in this series:\n\n- Delete a route filter that was moved to another bucket (a7d2):\n Validates that deleting a filter, and making a bucket empty, does not\n leave a dangling empty bucket\n- Try to change a route filter onto an already used handle (c05a):\n Validates that attempting to change an existing filter\u0027s handle to an\n already taken one fails\n- Replace a route filter that shares its key with another filter (3f21):\n Validates that an in-place replace keeps the handle userspace named\n the filter by, rather than dropping the 0x7F00 bits from it\n- Replace both route filters sharing a key (9d0e):\n Validates that replacing one of the two does not make the other one\n unreplaceable\n\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-5-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "41e85e54e5649a1617698438b0ce64c6f9d83d69", "tree": "349e0e4927ccd8d2aae049a48c70cab413a73176", "parents": [ "b74a8455a2f271f54695b6a8ec1f113824a46c0e" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:32 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "net/sched: cls_route: Fix in-place replace\n\nBuilding on the previous patch, route4_set_parms rejects a duplicate by\nscanning the destination chain for nhandle, but the scan doesn\u0027t exclude\nthe older version it is replacing, so an in-place replace will match\nthe older version\u0027s handle and fail.\n\nFix this by passing the older filter as a parameter to route4_set_parms\n(replacing \"new\") and skipping it in the scan.\n\nExcluding the older version is not enough on its own. nhandle is built\nout of TCA_ROUTE4_TO, TCA_ROUTE4_FROM and TCA_ROUTE4_IIF alone, while the\n0x7F00 bits, which only tell apart filters sharing one key, are folded in\non the create path. Letting the replace through would therefore rename\nthe filter it replaces: replacing handle 0x10101 stored it back as\n0x10001, and a sibling at 0x10201 could then no longer be replaced at\nall, since its own nhandle collided with the renamed filter.\n\n\ttc filter add ... handle 0x10101 route from 1 to 1 classid 1:1\n\ttc filter add ... handle 0x10201 route from 1 to 1 classid 1:2\n\ttc filter replace ... handle 0x10101 route from 1 to 1 classid 1:9\n\t... fh 0x00010001 flowid 1:9 to 1 from 1\n\t... fh 0x00010201 flowid 1:2 to 1 from 1\n\ttc filter replace ... handle 0x10201 route from 1 to 1 classid 1:8\n\tError: Handle 10001 is already in use.\n\nSo carry those bits over when the key the request builds is the key the\nolder filter already has. An in-place replace then keeps the handle\nuserspace named the filter by, while a request that does change the key\nstill renames it, as it did before.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-4-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b74a8455a2f271f54695b6a8ec1f113824a46c0e", "tree": "6a929c033c381f6823ff93be2a33f3f20f04aba2", "parents": [ "1853f30cf5c84971f99788a76207c6f745380896" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:31 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:52 2026 +0200" }, "message": "net/sched: cls_route: Reject handle aliasing\n\nroute4_set_parms() rejects a duplicate by scanning the destination chain\nfor f-\u003ehandle, but f-\u003ehandle is the handle the filter has before the\nupdate, not the one it is about to be linked under. The comparison and\nthe insertion therefore use different handles, which causes breakage.\n\nWhen a change moves the filter to a chain that already holds nhandle,\nthe scan looks for the old handle instead, misses the collision and\nlinks a second filter with the same handle:\n\n tc filter add dev lo ingress protocol ip pref 100 \\\n route from 1 to 1 classid 1:1 action ok\n tc filter add dev lo ingress protocol ip pref 100 \\\n route from 2 to 2 classid 1:2 action drop\n tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n route from 2 to 2 classid 1:1 action ok\n tc filter show dev lo ingress\n ... fh 0x00020002 flowid 1:2 to 2 from 2\n ... fh 0x00020002 flowid 1:1 to 2 from 2\n\nThe newcomer is appended after the incumbent, and both end up with the\nsame f-\u003eid. route4_get() returns the first match, so the second filter\ncan no longer be addressed by handle, and route4_classify() stops at the\nfirst filter whose f-\u003eid matches. The second filter is dumped but is\neffectively dead.\n\nFix this by comparing against nhandle.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260829205422.854785-1-victor%40mojatatu.com\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-3-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1853f30cf5c84971f99788a76207c6f745380896", "tree": "aae6b91e43d866e5b2472d889257b436a974acf9", "parents": [ "00f9fbc12320253bfc576fb7539d860029c82d0f" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Mon Sep 07 16:21:30 2026 -0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:27:51 2026 +0200" }, "message": "net/sched: cls_route: free emptied bucket on filter move\n\nroute4_change can move an existing filter to a different top-level\nbucket: route4_set_parms recomputes the handle from TCA_ROUTE4_TO/\nFROM/IIF, and the handle-mismatch check is gated on the \u0027new\u0027 flag, so\nfor an existing filter the new handle may differ from the old one and\nland in a different bucket. When this happens, the filter is unlinked\nfrom the old bucket, but the bucket itself is never freed once it goes\nempty. The stale empty bucket remains in head-\u003etable[], causing\nroute4_delete to report *last\u003dfalse even after the last live filter is\ngone. That pins the empty tcf_proto and causes a leak.\n\nFix this by refcounting the filters linked to a bucket and freeing the\nbucket when the count drops to zero. The existing scan in route4_delete\ngoes away with it.\n\nThe count is updated at all sites that link or unlink a filter during add,\nchange and delete, and the bucket is dropped from head-\u003etable[] as soon as\nit reaches zero.\n\nConditions to recreate the bug:\n CONFIG_NET_CLS_ROUTE4\u003dy, CONFIG_NET_SCH_INGRESS\u003dy, CONFIG_NET_CLS_ACT\u003dy.\n\n tc qdisc replace dev lo clsact\n tc filter add dev lo ingress protocol ip pref 100 route from 1 to 1\n tc filter change dev lo ingress protocol ip pref 100 handle 0x10001 \\\n route from 1 to 2\n tc filter del dev lo ingress protocol ip pref 100 handle 0x10002 \\\n route from 1 to 2\n tc filter show dev lo ingress | grep -c \u0027pref 100 route chain 0 \u0027\n\nFixes: 1e052be69d04 (\"net_sched: destroy proto tp when all filters are gone\")\nReported-by: Vega \u003cvega@nebusec.ai\u003e\nAcked-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260907192133.2639067-2-victor@mojatatu.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "00f9fbc12320253bfc576fb7539d860029c82d0f", "tree": "55e716d39ed306da2d8d31804654b5ae8ea2982b", "parents": [ "7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937" ], "author": { "name": "Johan Hovold", "email": "johan@kernel.org", "time": "Mon Sep 07 08:52:35 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 10 11:09:50 2026 +0200" }, "message": "net: hso: fix TIOCMIWAIT race\n\nThe task state must be updated before checking the wakeup condition to\navoid missing a racing modem status update.\n\nFixes: 542f54823614 (\"tty: Modem functions for the HSO driver\")\nCc: stable@vger.kernel.org\t# 2.6.29\nSigned-off-by: Johan Hovold \u003cjohan@kernel.org\u003e\nLink: https://patch.msgid.link/20260907065235.100848-1-johan@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7f26a5e8040b4957ef4dbdfcde6cc7ba2db53937", "tree": "89ad779f5d6e25ba4b91cf2a2fdf4cf7bb7f2a20", "parents": [ "0338c68e22abd2ee509ec2e32508a50896618c32" ], "author": { "name": "Carolina Jubran", "email": "cjubran@nvidia.com", "time": "Sun Sep 06 12:07:00 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 19:24:15 2026 -0700" }, "message": "net/mlx5e: Move representor vnic reporter to eswitch devlink port\n\nThe representor vnic devlink health reporter is created and destroyed\nalong the representor netdev (un)load path, which is not serialized by\nthe devlink instance lock. Destroying the reporter from there triggers\na devl_assert_locked() splat on driver unbind:\n WARNING: net/devlink/core.c:259 at devl_assert_locked+0x54/0x70, CPU#2: bash/3758\n Modules linked in: mlx5_vdpa vringh vdpa mlx5_ib mlx5_fwctl mlx5_core ...\n CPU: 2 UID: 0 PID: 3758 Comm: bash Tainted: G W 6.19.0+ #1 PREEMPT\n Tainted: [W]\u003dWARN\n Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), ...\n RIP: 0010:devl_assert_locked+0x54/0x70\n Call Trace:\n \u003cTASK\u003e\n devl_health_reporter_destroy+0x3a/0x1b0\n mlx5e_vport_rep_unload+0x12d/0x2b0 [mlx5_core]\n mlx5_eswitch_unregister_vport_reps+0x1b8/0x220 [mlx5_core]\n ? __esw_offloads_unload_rep+0x190/0x190 [mlx5_core]\n ? kernfs_remove_by_name_ns+0xc3/0xf0\n device_release_driver_internal+0x3b2/0x560\n unbind_store+0xce/0xf0\n\nMove the reporter\u0027s lifecycle to the eswitch devlink port (un)register\npaths, which are already serialized by the devlink instance lock, and\nstore the handle on mlx5_devlink_port. Use the port\u0027s mlx5_vport as the\nreporter priv since the diagnose callback only needs a device handle and\na vport number, and mlx5_vport carries both and is initialized before\nany representor driver probes.\n\nFixes: cf14af140a5a (\"net/mlx5e: Add vnic devlink health reporter to representors\")\nSigned-off-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260906090700.3761260-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0338c68e22abd2ee509ec2e32508a50896618c32", "tree": "55f5434749a08b072480429b4750435a060341be", "parents": [ "113998aa372f4869bf62cfc75c28a2849e8487be" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Fri Sep 04 12:32:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 19:07:36 2026 -0700" }, "message": "net: stmmac: initialize ptp_lock at probe time\n\npriv-\u003eptp_lock is only initialized in stmmac_ptp_register(), which runs\nduring __stmmac_open(). However, the lock is also used while the\ninterface is down and has never been opened: tc_taprio_configure()\ninvokes the PTP gettime64() callback to compute the EST base time when\noffloading a TAPRIO schedule, and stmmac_get_time() takes\npriv-\u003eptp_lock. Using an uninitialized rwlock is undefined behaviour.\nMove the rwlock_init() to __stmmac_dvr_probe(), together with the other\nprivate locks, so that ptp_lock is always valid regardless of the\ninterface state.\n\nFixes: b60189e0392f (\"net: stmmac: Integrate EST with TAPRIO scheduler API\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260904-stmmac-fix-ptp-clock-init-v1-1-df70eb1eb04d@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "113998aa372f4869bf62cfc75c28a2849e8487be", "tree": "2d1b2a3d4acc932bf7f3e20f5d6fbb6b41f306e6", "parents": [ "8aaeb56aff2a557a88f83ae866da2c91ad247e59" ], "author": { "name": "Aleksei Sviridkin", "email": "f@lex.la", "time": "Fri Sep 04 18:55:40 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:47:16 2026 -0700" }, "message": "net: phylink: initialise link_state before a forced major config\n\nphylink_resolve() leaves link_state on the stack unpopulated on its\ndisable and link-failed branches, which set only link_state.link.\nphylink_apply_manual_flow() then reads the struct\u0027s advertising on\nevery mode but MLO_AN_FIXED, and has done so since long before\nforce_major_config existed.\n\nforce_major_config turns that into a write to the hardware. It is the\nonly trigger for the major-config block that does not require\nmac_config, so phylink_major_config() programs the MAC for whatever\nthe stack held, a zeroed interface is PHY_INTERFACE_MODE_NA, and the\nwrite-back stores it in pl-\u003elink_config.interface.\n\nphylink_replay_link_end() is the only in-tree setter, and\nsja1105_static_config_reload() calls it for every port that has a\nphylink instance, regardless of admin state. On a stopped port\nphylink_run_resolve() no-ops, so the flag outlives the call. The next\nresolve consumes it whatever branch it takes; an unpopulated branch is\nwhere that does damage.\n\nFound while developing a series that attaches a late PHY from a\ndelayed work item and sets this flag there, so the PHY attached after\nits port was already up. The link stayed down until the port was\ncycled 29 minutes later. With this patch on the same board the same\nattach programs the MAC for 2500base-x rather than unknown, and the\nPHY\u0027s interrupt fires without a port bounce where it had stayed at\nzero throughout the failure.\n\nFixes: 96969b132bf1 (\"net: phylink: introduce helpers for replaying link callbacks\")\nSigned-off-by: Aleksei Sviridkin \u003cf@lex.la\u003e\nLink: https://patch.msgid.link/20260904185540.2844261-1-f@lex.la\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8aaeb56aff2a557a88f83ae866da2c91ad247e59", "tree": "9b47cc4ca7782909de720259a209dd529625f48d", "parents": [ "be83178bfc44588f6e3adb827ed874c683193466" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Tue Sep 08 15:21:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:41:57 2026 -0700" }, "message": "ppp_synctty: ensure a writeable skb header\n\nppp_sync_txmunge() checks headroom before prepending the address and\ncontrol bytes, but does not ensure that the skb header is writable.\nA received skb can reach this function through PPP channel bridging\nwithout passing through ppp_start_xmit(), which calls skb_cow_head().\n\nFor example, a PPPoE frame may share its buffer with a clone queued to\nan AF_PACKET socket. If it is bridged to a synchronous tty channel, the\naddress/control bytes can overwrite data still visible to that socket.\n\nUse skb_cow_head() to ensure both sufficient headroom and a writable\nheader.\n\nFixes: 4cf476ced45d (\"ppp: add PPPIOCBRIDGECHAN and PPPIOCUNBRIDGECHAN ioctls\")\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260908072135.877364-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be83178bfc44588f6e3adb827ed874c683193466", "tree": "a5d741ab567653b9bdf6733ac607ea52921d7f0a", "parents": [ "ef39fca8508597fa565cf2be72a884a712fb98af" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Sun Sep 06 18:01:04 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:33:02 2026 -0700" }, "message": "vxlan: initialize _md in vxlan_xmit_one()\n\nIf a VXLAN device is configured with both VXLAN_F_COLLECT_METADATA and\nVXLAN_F_GBP, and a packet is transmitted through it using an external\nip_tunnel_info that lacks the IP_TUNNEL_VXLAN_OPT_BIT flag, md is left\npointing to the uninitialized _md stack variable:\n\n if (test_bit(IP_TUNNEL_VXLAN_OPT_BIT, info-\u003ekey.tun_flags)) {\n if (info-\u003eoptions_len \u003c sizeof(*md))\n goto drop;\n md \u003d ip_tunnel_info_opts(info);\n }\n\nBecause IP_TUNNEL_VXLAN_OPT_BIT is not set, md is not updated and remains\npointing to _md. Later, vxlan_build_skb() is called with md, which\neventually calls vxlan_build_gbp_hdr():\n\n if (vxflags \u0026 VXLAN_F_GBP)\n vxlan_build_gbp_hdr(vxh, md);\n\nInside vxlan_build_gbp_hdr(), md-\u003egbp is read:\n\n if (!md-\u003egbp)\n return;\n gbp \u003d (struct vxlanhdr_gbp *)vxh;\n ...\n if (md-\u003egbp \u0026 VXLAN_GBP_DONT_LEARN)\n gbp-\u003edont_learn \u003d 1;\n\nIf the stack contains garbage, this causes:\n1) VXLAN_HF_GBP flag to be spuriously set in the VXLAN header.\n2) gbp-\u003edont_learn and gbp-\u003epolicy_applied to be set from stack bits.\n3) gbp-\u003epolicy_id to receive 16 bits of uninitialized kernel stack data,\n leaking it onto the wire.\n\nFix this by zero-initializing _md. If IP_TUNNEL_VXLAN_OPT_BIT is not\npresent, md-\u003egbp remains 0, and vxlan_build_gbp_hdr() returns early\nwithout modifying the VXLAN header.\n\nFixes: ee122c79d422 (\"vxlan: Flow based tunneling\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260906180111.1973188-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ef39fca8508597fa565cf2be72a884a712fb98af", "tree": "d8a161c570facfc257b8090ddad6e19d1ad7cd76", "parents": [ "66ef5adb75446627f8b6c26cd04f2adc86d4de56" ], "author": { "name": "Ratheesh Kannoth", "email": "rkannoth@marvell.com", "time": "Thu Sep 03 07:35:33 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:17:19 2026 -0700" }, "message": "octeontx2-pf: reset HTB scheduler topology before freeing queues\n\nHTB offload programs NIX_AF_TLxX_TOPOLOGY on QoS-allocated scheduler\nqueues via otx2_qos_txschq_set_parent_topology(), but teardown freed\nthose queues without clearing TOPOLOGY. The AF only restores PARENT and\nSCHEDULE on free, so PRIO_ANCHOR/RR_PRIO settings can survive in the\nshared scheduler pool and affect later allocations.\n\nAdd otx2_qos_reset_schq_topology() and otx2_qos_free_hw_schq() to zero\nTL4 through TL2 TOPOLOGY before each schq is returned to the AF during\nhierarchy teardown and cfg rollback. Skip the aggregation level (TL1):\nit is a per-tx-link queue shared by the PF, default Tx hierarchy and VFs,\nand is not freed back to the AF by nix_txschq_free_one().\n\nFixes: 5e6808b4c68d (\"octeontx2-pf: Add support for HTB offload\")\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260903020533.3068041-1-rkannoth@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cb26524ef4ac28fcfa554c0656e8dc412c38a8ff", "tree": "180e48b49155c3fa78a100e58708a34f29f8f8eb", "parents": [ "d05045177a855386bca5e1909e08d06290e6e3b3" ], "author": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Wed Sep 09 17:02:40 2026 -0300" }, "committer": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Wed Sep 09 22:06:05 2026 -0300" }, "message": "smb: client: fix one-byte OOB read in smb2_parse_native_symlink()\n\nWhen parsing a share-root relative native symlink, memcpy copies\nsmb_target+1 (skipping the leading separator) but uses\nstrlen(smb_target)+1 as the length, reading one byte past the\nallocated buffer.\n\nThis fixes the following KASAN splat when accessing an SMB symlink\nwith a target of \u0027\\a\\b\u0027:\n\n BUG: KASAN: slab-out-of-bounds in smb2_parse_native_symlink+0x4f5/0xca0\n Read of size 5 at addr ffff88800878fe21 by task netfsfuzz-execu/1\n CPU: 1 UID: 0 PID: 1 Comm: netfsfuzz-execu Tainted: G N\n 7.2.0-11943-g2709dd5ae32f-dirty #1 PREEMPT(lazy)\n Hardware name: QEMU Ubuntu 24.04 PC v2 (i440FX + PIIX, arch_caps fix,\n 1996)\n Call Trace:\n \u003cTASK\u003e\n dump_stack_lvl+0x7b/0xa0\n print_report+0xd0/0x630\n kasan_report+0xe5/0x120\n kasan_check_range+0x105/0x1b0\n __asan_memcpy+0x23/0x60\n smb2_parse_native_symlink+0x4f5/0xca0\n parse_reparse_point+0x68a/0x1530\n reparse_info_to_fattr+0x752/0xa20\n cifs_get_fattr+0x873/0x15b0\n cifs_get_inode_info+0xc0/0x310\n cifs_lookup+0x308/0xa70\n __lookup_slow+0x122/0x2b0\n lookup_slow+0x50/0x70\n path_lookupat+0x525/0xaf0\n filename_lookup+0x1f2/0x550\n vfs_statx+0xd1/0x1a0\n vfs_fstatat+0x65/0xc0\n __do_sys_newfstatat+0x9a/0x120\n do_syscall_64+0xdd/0x4a0\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nReported-by: Yuanfu Xie \u003cyuanfuxie@stu.pku.edu.cn\u003e\nFixes: 723f4ef90452 (\"cifs: Fix parsing native symlinks relative to the export\")\nSuggested-by: Pali Rohar \u003cpali@kernel.org\u003e\nReviewed-by: Pali Rohar \u003cpali@kernel.org\u003e\nReviewed-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\nCc: Ronnie Sahlberg \u003cronniesahlberg@gmail.com\u003e\nCc: Shyam Prasad N \u003csprasad@microsoft.com\u003e\nCc: Tom Talpey \u003ctom@talpey.com\u003e\nCc: Bharath SM \u003cbharathsm@microsoft.com\u003e\nCc: stable@vger.kernel.org\n" }, { "commit": "66ef5adb75446627f8b6c26cd04f2adc86d4de56", "tree": "ec6b3bd47c1212e666511ddaffe7a21f623d957f", "parents": [ "59fb389ad6bf50916189e56dafcd225ab977f874" ], "author": { "name": "Marek Vasut", "email": "marex@nabladev.com", "time": "Sat Sep 05 15:02:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 18:04:05 2026 -0700" }, "message": "net: ks8851: Fix receiver error in 100BASE-TX mode following software power-down\n\nKSZ8851 errata sheet DS80000716D-page 4 Module 3 [1] states that,\nwhen issuing a software power-down (PMECR[1:0] \u003d 10) followed by a\npower-on (PMECR[1:0] \u003d 00), the receiver circuit can fail to start\nproperly preventing communication. The Transmitter will still send\ndata, but no data will be received.\n\nThe errata sheet also includes a workaround, which states that,\nit is recommended that the software power-down feature not be used.\n\nImplement that workaround and drop the entry into software power-down\nmode. The ks8851_write_mac_addr() calls entry into normal power-on\nmode at the very beginning of the function, therefore dropping the\nsecond call to enter software power-down mode is sufficient here.\nThe ks8851_net_stop() can only be called after ks8851_net_start()\nwas already called, and ks8851_net_start() also makes the MAC enter\nnormal power-on mode, therefore it is also fine to drop the call to\nenter software power-down mode from ks8851_net_stop().\n\nThis will lead to a slight increase in power consumption, but it also\nfixes a sporadic reliability problem on at least KSZ8851-16MLL, which\nis where the problem was reported and this fix was tested.\n\n[1] https://ww1.microchip.com/downloads/en/DeviceDoc/80000716D.pdf\n\nFixes: 3ba81f3ece3c (\"net: Micrel KS8851 SPI network driver\")\nReviewed-by: Sebastian Andrzej Siewior \u003cbigeasy@linutronix.de\u003e\nSigned-off-by: Marek Vasut \u003cmarex@nabladev.com\u003e\nLink: https://patch.msgid.link/20260905130327.203851-1-marex@nabladev.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "59fb389ad6bf50916189e56dafcd225ab977f874", "tree": "0265d8482452d3dd124e7c4364bc9c9496ff891f", "parents": [ "b824476c56a153934c67c9e0f873e1fd967743d6" ], "author": { "name": "Jan Havran (Advantech Czech)", "email": "havran.jan@email.cz", "time": "Mon Sep 07 15:48:18 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:59:33 2026 -0700" }, "message": "net: dsa: lantiq_gswip: fix GSWIP_MDIO_PHY_FCONTX_EN value\n\nPer the GSW145 data sheet, the FCONTX (bits 8:7) and FCONRX (bits 6:5)\nflow-control fields of the PHY_ADDR_n register both encode 00 \u003d AUTO,\n01 \u003d EN, 10 \u003d reserved, 11 \u003d DIS. GSWIP_MDIO_PHY_FCONTX_EN was 0x0100,\ni.e. field value 10 (the reserved encoding), instead of 0x0080 (01 \u003d EN);\nFCONRX_EN is already 0x0020 (01). Enabling tx flow control therefore wrote\nthe reserved value.\n\nSet FCONTX_EN to 0x0080. The register is shared by all supported parts.\n\nFixes: 14fceff4771e (\"net: dsa: Add Lantiq / Intel DSA driver for vrx200\")\nSigned-off-by: Jan Havran (Advantech Czech) \u003chavran.jan@email.cz\u003e\nReviewed-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260907134818.16670-4-havran.jan@email.cz\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b824476c56a153934c67c9e0f873e1fd967743d6", "tree": "86a8881466a617dbf3e8218ca51515ae11e976e4", "parents": [ "9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed" ], "author": { "name": "Yilin Zhang", "email": "yilinzhang@moonshot.ai", "time": "Sat Sep 05 00:28:00 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 17:43:03 2026 -0700" }, "message": "inet: frags: invalidate queues before flushing them\n\nfqdir_pre_exit() flushes the skbs from incomplete queues without\nchanging their completion state. A fragment which found a queue before\nhigh_thresh was cleared can then acquire the queue lock and reuse stale\nreassembly metadata. A queue concurrently killed after fqdir-\u003edead is\nset can instead become INET_FRAG_COMPLETE|INET_FRAG_HASH_DEAD while\nstill holding its old skbs; skipping it because it is complete leaves\nthose references behind until asynchronous fqdir teardown.\n\nFor IPv6, stale metadata can make ip6_frag_reasm() use the old\nnhoffset with a new skb and access memory out of bounds. The resulting\nheap corruption can be leveraged for local privilege escalation when\nunprivileged network namespaces are available. Unflushed fragments can\nalso keep conntrack references alive after the conntrack per-net\ncleanup point.\n\nKill each incomplete queue, then flush every queue still owned by the\ndying rhashtable. HASH_DEAD identifies that ownership, while complete\nqueues without it are already owned by another destroy path and must be\nleft alone. Releasing a timer reference removed by inet_frag_kill() is\ndeferred to inet_frag_putn(), after the queue lock is dropped.\n\nKASAN report:\n\n BUG: KASAN: slab-out-of-bounds in ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n Write of size 1 at addr ff110001039c6e00 by task poc/771\n Call Trace:\n ? ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n ipv6_frag_rcv (net/ipv6/reassembly.c:289 (discriminator 2) net/ipv6/reassembly.c:229 (discriminator 2) net/ipv6/reassembly.c:391 (discriminator 2))\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:479 (discriminator 5))\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n The buggy address belongs to the object at ff110001039c6b40\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 0 bytes to the right of\n allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)\n\n BUG: KASAN: slab-out-of-bounds in ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n Read of size 1 at addr ff110001039c6e08 by task poc/771\n Call Trace:\n ? ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:423 (discriminator 1))\n ip6_input_finish (net/ipv6/ip6_input.c:534)\n ipv6_rcv (include/net/dst.h:480 (discriminator 3) net/ipv6/ip6_input.c:119 (discriminator 3) net/ipv6/ip6_input.c:109 (discriminator 3) include/linux/netfilter.h:325 (discriminator 3) include/linux/netfilter.h:319 (discriminator 3) net/ipv6/ip6_input.c:351 (discriminator 3))\n packet_sendmsg (net/packet/af_packet.c:3110 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n packet_sendmsg (net/packet/af_packet.c:2959 net/packet/af_packet.c:3053 net/packet/af_packet.c:3142)\n __x64_sys_sendmmsg (net/socket.c:2883 net/socket.c:2880 net/socket.c:2880)\n The buggy address belongs to the object at ff110001039c6b40\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 8 bytes to the right of\n allocated 704-byte region [ff110001039c6b40, ff110001039c6e00)\n\nFixes: 006a5035b495 (\"inet: frags: flush pending skbs in fqdir_pre_exit()\")\nCc: stable@vger.kernel.org\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nTested-by: Weiming Shi \u003cshiweiming@moonshot.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\nLink: https://patch.msgid.link/20260904162800.1095662-1-yilinzhang@moonshot.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "01504d14e47b34779911250dd308a03f6ef681c2", "tree": "88302bb856ee9d84f0fdfc63202c10db72ef0979", "parents": [ "ab390021b2a3bb4cc875f28a6f76d13de90d7457" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:46 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:18:25 2026 -0700" }, "message": "watchdog: msc313e: Sync timeout value if WDT was running at boot\n\nIf WDT was running at boot, the hardware timeout might be set to values\nother than the final software timeout.\n\nTo be consistent, set the hardware timeout to match the final software\ntimeout (i.e., after watchdog_init_timeout()) if WDT was running.\n\nFixes: ffd264bd152c (\"watchdog: msc313e: Check if the WDT was running at boot\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-8-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "ab390021b2a3bb4cc875f28a6f76d13de90d7457", "tree": "f221001d97dba410de604ace3e53af531f48553b", "parents": [ "4f6817c9eff4aa1078e16652d82e4b7ef4ffae3e" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:45 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:17:40 2026 -0700" }, "message": "watchdog: msc313e: Fix undefined behavior\n\nreadw() returns a u16. Left shifting a u16 by 16 bits yields undefined\nbehavior.\n\nCast to u32 explicitly before the shift.\n\nFixes: ffd264bd152c (\"watchdog: msc313e: Check if the WDT was running at boot\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-7-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "4f6817c9eff4aa1078e16652d82e4b7ef4ffae3e", "tree": "95539ee0eb10b2bb8f1c5db3592d0781a53c5ae9", "parents": [ "3db2df24e7f11fb117718f6abe326628d91bc500" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:44 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:15:53 2026 -0700" }, "message": "watchdog: msc313e: Fix spurious reset on suspend\n\nIf the hardware watchdog was started by the bootloader and the device is\nsuspended before userspace opens it, the ping worker (from watchdog\ncore) is frozen and the active hardware timer continues running. This\nleads to a spurious system reset.\n\nCheck both watchdog_active() and watchdog_hw_running() when deciding\nwhether to start or stop the watchdog during suspend and resume.\n\nAdditionally, call watchdog_stop_ping_on_suspend() to ensure the ping\nworker be correctly paused and restarted during suspend and resume.\n\nFixes: ffd264bd152c (\"watchdog: msc313e: Check if the WDT was running at boot\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-6-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "3db2df24e7f11fb117718f6abe326628d91bc500", "tree": "1ff319618ba5edf602d61d501e678610bac0f541", "parents": [ "3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:43 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:11:43 2026 -0700" }, "message": "watchdog: msc313e: Enable clock before accessing hardware registers\n\nmsc313e_wdt_probe() reads from hardware registers without ensuring the\nrequired clock is enabled. Furthermore, if the bootloader leaves the\nwatchdog running, msc313e_wdt_probe() sets WDOG_HW_RUNNING without\nincreasing the clock\u0027s reference count.\n\nWhile the clock is currently supplied as a fixed clock by the device\ntree (`xtal_div2` in arch/arm/boot/dts/sigmastar/mstar-v7.dtsi) which\nmasks the physical issue, this still violates the API usage.\n\nCall clk_prepare_enable() before reading WDT registers. If the WDT is\nrunning, leave the clock enabled so the CCF reference counter is\nbalanced.\n\nFixes: ffd264bd152c (\"watchdog: msc313e: Check if the WDT was running at boot\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-5-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "3db30f315935c2fb0d95f46b7a593b5b4d3ec3d0", "tree": "c5d7f904043accecd1e9a03e2141868caa49a61c", "parents": [ "3c73a37f5e40972ce26d8eeb98e8b938d719b069" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:42 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:09:29 2026 -0700" }, "message": "watchdog: msc313e: Fix clock leak and spurious timer in settimeout()\n\nmsc313e_wdt_settimeout() unconditionally calls msc313e_wdt_start() which\nintroduces two severe bugs:\n\n1. If the watchdog is already active, calling start() again will\n increase the reference count of the clock again. However stop() is\n only called once, the reference count is unbalance.\n2. If the watchdog is stopped, calling settimeout() will start\n the hardware timer accidentally.\n\nFactor out the register-writing logic into a helper function. Only call\nit in settimeout() if the watchdog is running. Otherwise, simply update\n`wdev-\u003etimeout`.\n\nFixes: e9800b799464 (\"watchdog: Add Mstar MSC313e WDT driver\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-4-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "3c73a37f5e40972ce26d8eeb98e8b938d719b069", "tree": "3c8ae418e283ba81f3e7e9a95bb46350d7366a07", "parents": [ "0fa37512eb747e4ffdcf367274f9e72845f1bca4" ], "author": { "name": "Tzung-Bi Shih", "email": "tzungbi@kernel.org", "time": "Sat Aug 29 00:13:41 2026 +0800" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 14:08:11 2026 -0700" }, "message": "watchdog: msc313e: Avoid division by zero\n\nclk_get_rate() could return 0. Avoid a division by zero panic.\n\nFixes: e9800b799464 (\"watchdog: Add Mstar MSC313e WDT driver\")\nSigned-off-by: Tzung-Bi Shih \u003ctzungbi@kernel.org\u003e\nLink: https://patch.msgid.link/20260828161348.13212-3-tzungbi@kernel.org\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "0fa37512eb747e4ffdcf367274f9e72845f1bca4", "tree": "57fe396eaf31f15f8d7e78befe25d39f0b830ddb", "parents": [ "d83b7502bb087fa54daf0fdd419d2910c34bc97d" ], "author": { "name": "David Arcari", "email": "darcari@redhat.com", "time": "Thu Sep 03 14:20:29 2026 -0400" }, "committer": { "name": "Guenter Roeck", "email": "linux@roeck-us.net", "time": "Wed Sep 09 13:40:59 2026 -0700" }, "message": "watchdog: fix hrtimer start when pretimeout is zero\n\nPer the watchdog API, a pretimeout value of 0 disables the feature.\nHowever, watchdog_hrtimer_pretimeout_start() fails to verify if the\npretimeout is non-zero before arming the timer.\n\nThis omission inadvertently starts the software pretimeout timer,\nwhich could result in the pretimeout handler executing incorrectly\nwhen the watchdog timeout is reached.\n\nFix this by adding a check for wdd-\u003epretimeout before calling\nhrtimer_start(), ensuring the disabled state is respected.\n\nFixes: 7b7d2fdc8c3e (\"watchdog: Add hrtimer-based pretimeout feature\")\nSigned-off-by: David Arcari \u003cdarcari@redhat.com\u003e\nLink: https://patch.msgid.link/20260903182029.936030-1-darcari@redhat.com\nSigned-off-by: Guenter Roeck \u003clinux@roeck-us.net\u003e\n" }, { "commit": "9a1599eeb8d18a2113e4cabcbd3bec5a8377dbed", "tree": "92e0cddb72622090ff5b173e752cab2f03e818b1", "parents": [ "5be081b83abd3f17d908953b4bb77279f5a149e3", "f01b8275745efe611284f6c3628099a81a421f0d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:59 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-3-rc1\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.3-rc1\n\nHere are various unrelated fixes:\n\n- Patch 1: Do not reschedule the RTX timer for sockets that fell back to\n TCP. A fix for v5.7.\n\n- Patch 2: Avoid copying thmac which will not be used and could be\n uninitialised. A fix for v5.7.\n\n- Patch 3: Re-set the request backup flag when SYN cookies are used. A\n fix for v5.9.\n\n- Patch 4: Drop pending ADD_ADDR when removing ID0, and avoid a WARN. A\n fix for v5.13.\n\n- Patch 5: Handle invalid suboptions where the checksum is requested in\n the MP_CAPABLE 4th ACK with data, but not added in the option. A fix\n for v5.14.\n\n- Patch 6: Prevent a race between mptcp_disconnect() and the retransmit\n timer. A fix for v5.17.\n\n- Patch 7: Fix a use-after-free in the selftests that could lead to\n false positive. A fix for v5.17.\n\n- Patch 8: Limit new addresses with the userspace PM to avoid an address\n ID overflow. A fix for v5.19.\n\n- Patch 9: Reset the ADD_ADDR retransmission counter when the timer is\n reused. A fix for v5.19.\n\n- Patch 10: Remove unneeded and confusing READ_ONCE() annotations. A fix\n for v6.13.\n\n- Patches 11-12: Get nstat counters for the current test, not since the\n creation of the netns. A fix for v6.19.\n\n- Patch 13: Fix an uninit-value in mptcp_write_data_fin for a corner\n case now that only a part of the tcp_out_options struct is reset. A\n fix for v7.1.\n\n- Patches 14-15: Two follow-up patches addressing minor comments\n discovered after the human review. A fix for v7.3-rc1.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-0-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f01b8275745efe611284f6c3628099a81a421f0d", "tree": "92e0cddb72622090ff5b173e752cab2f03e818b1", "parents": [ "a4257a91af7a77a8347d33413ec9e54106f7ff48" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 08 16:07:20 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:56 2026 -0700" }, "message": "mptcp: avoid pruning for OoW data\n\nPruning is expansive and destructive, do it only when we expect\nto accept the skb triggering the cleanup.\n\nFixes: e468d371180d (\"mptcp: implemented OoO queue pruning\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-15-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a4257a91af7a77a8347d33413ec9e54106f7ff48", "tree": "a109ab224d460de07febf1068d49a4a729304924", "parents": [ "b110f1dd6cb6a9930503354a01a315e0a821eaa7" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 08 16:07:19 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:56 2026 -0700" }, "message": "mptcp: being below memory limit is a likely() condition\n\nThe current compiler hint annotation is wrong, due to inverted\nlogic in the previous revision of the relevant code.\n\nFixes: e468d371180d (\"mptcp: implemented OoO queue pruning\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-14-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b110f1dd6cb6a9930503354a01a315e0a821eaa7", "tree": "e9f6ef374a4b75029d8396c5f3bb5588837f1677", "parents": [ "d23c41366e85f149b48323d66adc36c4a9f18cbd" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:18 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:56 2026 -0700" }, "message": "mptcp: options: fix uninit-value in mptcp_write_data_fin\n\nWhen sending a DATA_FIN without data, and because the DATA_FIN occupies\n1 octet of the connection-level sequence space [1], it is then required\nto add a DSS mapping with specific values.\n\nIf the checksum has been negotiated, it also needs to be computed, and\nincluded in the outgoing packet, and thus the initial csum data needs to\nbe reset to 0 as well. This is no longer the case since commit\ncfcceb7a39fc (\"tcp: shrink per-packet memset in __tcp_transmit_skb()\"),\nbecause the whole ext_copy structure is no longer zeroed by default.\n\nThis seems to be the only case where use_map is changed and set\nafterwards, so initialising the csum field only in this case, along with\nother fields for this specific case.\n\nFixes: cfcceb7a39fc (\"tcp: shrink per-packet memset in __tcp_transmit_skb()\")\nCc: stable@vger.kernel.org\nLink: https://datatracker.ietf.org/doc/html/rfc8684#section-3.3.3 [1]\nLink: https://sashiko.dev/#/patchset/20260812-net-next-mptcp-misc-feat-7-3-v1-0-1905a818f6cb%40kernel.org?part\u003d2\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-13-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d23c41366e85f149b48323d66adc36c4a9f18cbd", "tree": "76cd18c11a864541ea8065e78ea322a73b7f332f", "parents": [ "e1a56368eac18b3b4b956b794526e8713c48a0ec" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:17 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:56 2026 -0700" }, "message": "selftests: mptcp: lib: get counters for the right test\n\nWhen the value for a MIB counter is required, mptcp_lib_get_counter is\ncalled. It tries to use the cache, if available. If not it falls back to\ncalling \u0027nstat\u0027 directly by looking at the absolute counters.\n\nThat\u0027s an issue for tests that don\u0027t recreate the netns for each\nsubtest. In this case, \u0027nstat -a\u0027 will look at the counters for the\nnetns.\n\nInstead, it should look at the increment for the current test, by using\nthe history recorded in /tmp/\u003cns\u003e.nstat, if available, and not using\n\u0027-a\u0027 which was dumping the absolute values.\n\nWhile at it, rename the previous \u0027hist\u0027 variable to \u0027cache\u0027 as it was\nused to look at the cache, not the nstat history.\n\nFixes: 71388a9f331d (\"selftests: mptcp: lib: get counters from nstat history\")\nCc: stable@vger.kernel.org\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-12-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e1a56368eac18b3b4b956b794526e8713c48a0ec", "tree": "a6c8b6cbbae01ec3adeb1d1e4d76f50390500a93", "parents": [ "caa4a79f74f32084ce28aee8653bc04df745970d" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:56 2026 -0700" }, "message": "selftests: mptcp: lib: dump nstat for the right test\n\nIn case of errors, mptcp_lib_pr_nstat is called to dump the nstat\ncounters, but for some tests, it was dumping the counters for all\nsubtests, not just the current one.\n\nThat\u0027s an issue for tests that don\u0027t recreate the netns for each\nsubtest, e.g. mptcp_connect.sh. In this case, \u0027nstat -a\u0027 will look at\nthe absolute counters since the creation of the netns, making\ndebugging harder.\n\nInstead, it should dump the counters for the current test, by using the\nhistory recorded in /tmp/\u003cns\u003e.nstat if available, and not using \u0027-a\u0027\nwhich was dumping the absolute values instead of calculating increments.\n\nWhile at it, rename the previous \u0027hist\u0027 variable to \u0027cache\u0027 as it was\nused to look at the cache, not the nstat history.\n\nFixes: 658e53141780 (\"selftests: mptcp: join: dump stats from history\")\nCc: stable@vger.kernel.org\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-11-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "caa4a79f74f32084ce28aee8653bc04df745970d", "tree": "096ce50bc7d8b1619e18f77c3447848279817e26", "parents": [ "f968190c0b42ea2004dc1426359a53ec365a7a37" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 08 16:07:15 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "mptcp: remove unneeded READ_ONCE() annotation\n\nThe subflow-\u003efully_established flag is always written under the subflow\nsocket lock. Reading such value under the same lock does not require any\nONCE annotation.\n\nFixes: 581c8cbfa934 (\"mptcp: annotate data-races around subflow-\u003efully_established\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-10-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f968190c0b42ea2004dc1426359a53ec365a7a37", "tree": "16f1801c047d88bc935138a50359642c207a7753", "parents": [ "f9f0068e8813d8c10d016b030fc3a320d0b6767c" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:14 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "mptcp: pm: reset retrans_time when ADD_ADDR entry is reused\n\nWhen an ADD_ADDR entry is reused, the timer is re-armed, because the\ngoal is to re-announce an ADD_ADDR, and eventually retransmit it if\nneeded.\n\nIn this case, the retransmission counter should be reset as well, so the\nre-announced address gets its retransmissions back instead of relying on\nwhat was left before, and possibly not being able to retransmit it.\n\nFixes: 304ab97f4c7c (\"mptcp: allow ADD_ADDR reissuance by userspace PMs\")\nCc: stable@vger.kernel.org\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-0-b8f496d71664%40kernel.org?part\u003d4\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-9-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f9f0068e8813d8c10d016b030fc3a320d0b6767c", "tree": "939dc7a9e2c8f0ee67b78d1136849c1cbc62f08d", "parents": [ "730444f094b12052916ebd7e14fe57bc3d47bf38" ], "author": { "name": "Qing Luo", "email": "luoqing@kylinos.cn", "time": "Tue Sep 08 16:07:13 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "mptcp: pm: userspace: fix address ID overflow\n\nWhen all MPTCP address IDs (1-255) are exhausted in the userspace PM,\nfind_next_zero_bit() returns MPTCP_PM_MAX_ADDR_ID + 1 (256). This value\noverflows when stored in the u8 field e-\u003eaddr.id, resulting in ID 0\nbeing stored and the entry being incorrectly added to the list.\n\nID 0 is reserved for the initial connection in MPTCP, so this overflow\ncan cause address conflicts.\n\nNote: the in-kernel PM already has an \u0027endpoints \u003d\u003d MPTCP_PM_MAX_ADDR_ID\u0027\ncheck in mptcp_pm_nl_append_new_local_addr() that returns -ERANGE before\nreaching find_next_zero_bit(), preventing this overflow. So this fix only\naddresses the userspace PM path.\n\nCheck the find_next_zero_bit() result against MPTCP_PM_MAX_ADDR_ID and\nreturn -ENOSPC if all IDs are truly exhausted. Move the ID allocation\ncheck before the memory allocation so that the error path does not need\nto free the allocated entry.\n\nFixes: 4638de5aefe5 (\"mptcp: handle local addrs announced by userspace PMs\")\nCc: stable@vger.kernel.org\nSigned-off-by: Qing Luo \u003cluoqing@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-8-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "730444f094b12052916ebd7e14fe57bc3d47bf38", "tree": "b739947dd9094cf03fef58bd363a4a7c177c90b1", "parents": [ "85c580b0d8590520ae00a15c29e9fb9c99427a3e" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Tue Sep 08 16:07:12 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "selftests: mptcp: fix an UAF in mptcp_connect.c\n\nAt the end of \u0027sock_connect_mptcp()\u0027, it calls \u0027freeaddrinfo(addr)\u0027,\nthe \u0027peer\u0027 pointer (which points into \u0027addr\u0027) remains. Later, the main\nloop uses this peer pointer for reconnection attempts. If the memory has\nbeen freed and reused, the address data could be overwritten, resulting\nin an invalid remote address.\n\nThis patch keeps the addrinfo list allocated for the whole process\nlifetime so \"peer\" remains valid across reconnects; the memory will be\nreleased at exit() time.\n\nFixes: 05be5e273c84 (\"selftests: mptcp: add disconnect tests\")\nCc: stable@vger.kernel.org\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-7-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "85c580b0d8590520ae00a15c29e9fb9c99427a3e", "tree": "3bcfad4d29dbe0d92d16af11955f74b077537546", "parents": [ "ab36b1a80942c78ddb04d006ff38aa7ed3ec0e5e" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 08 16:07:11 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "mptcp: prevent race between disconnect() and rtx\n\nSashiko noted that the two event can race, leading to inconsistent\nstatus. Prevent the race using the synchronous timer stop operation.\n\nCc: stable@vger.kernel.org\nFixes: b29fcfb54cd7 (\"mptcp: full disconnect implementation\")\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-6-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab36b1a80942c78ddb04d006ff38aa7ed3ec0e5e", "tree": "9eb033650f84b8f531a40db0fd9f486232d87dc9", "parents": [ "2ac7d6e620764f1fc79eb4edd3610a7a661981ca" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:10 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:55 2026 -0700" }, "message": "mptcp: options: handle MPC data + csum reqd + no csum\n\nBefore this modification, a remote peer could send an MP_CAPABLE with\ndata, with the checksum flag set, but without adding the actual 2 bytes\nof checksum. As a result, uninitialised bytes could be used for the\n\u0027csum\u0027 field.\n\nThat was not a critical issue, because this \u0027csum\u0027 field is only used to\ncompare with the expected one, if previously negotiated in the 3WHS.\nWorst case, the checksum is likely wrong, a fallback is done without a\nreject if the negotiation was done earlier. That\u0027s OK.\n\nYet, better to take the expected path with this case: only look at the\nchecksum flag for MP_CAPABLEs not carrying a data-len.\n\nSuch packet can be seen as a 3rd or 4th ACK. The RFC8684 mentions [1]\nthat the 3rd packet should have the checksum flag set. When an MPC + ACK\ncontains data, the checksum flag is redundant with the checksum field.\nIt is not clear what should be done for the 4th ACK, nor if the flag has\nto be set if the checksum field is set.\n\nTherefore, it seems fine to only look at the presence of the checksum\nfield, not to break the interaction with stacks that were not setting\nboth.\n\nNote that linked to this checksum flag on the 3rd ACK, with the current\nimplementation, we can have a situation where the SYN packets have no\nchecksum flag, but the 3rd ACK has one, and this is the one that will be\ntaken into account. First, that\u0027s clearly not directly linked to this\npatch, but Clashiko forced us to look at that. At the end, that seems\nfine to act like that: yes that\u0027s not how the negotiation should work,\nbut being flexible without introducing side effects is also fine: fixing\nthis would mean increasing the complexity, and that\u0027s not worth it.\n\nFixes: 208e8f66926c (\"mptcp: receive checksum for MP_CAPABLE with data\")\nCc: stable@vger.kernel.org\nLink: https://datatracker.ietf.org/doc/html/rfc8684#section-3.1-23 [1]\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260803-net-mptcp-misc-fixes-7-2-rc6-v2-0-b8f496d71664%40kernel.org?part\u003d1\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-5-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2ac7d6e620764f1fc79eb4edd3610a7a661981ca", "tree": "75a3133228b5185602c3a1751155661dd4252091", "parents": [ "b76c0e28b392620dfbaf92cdeedbf115820b44cb" ], "author": { "name": "Kalpan Jani", "email": "kalpan.jani@mpiricsoftware.com", "time": "Tue Sep 08 16:07:09 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:54 2026 -0700" }, "message": "mptcp: pm: kernel: drop pending ADD_ADDR when removing ID0\n\nThe in-kernel MPTCP path manager can leave a stale ADD_ADDR announcement\nentry alive when removing the id 0 endpoint. This happens because the id 0\nremoval path does not tear down pending announcements, unlike the non-zero\nid path.\n\nWhen the PM later reselects id 0 after adding another signal endpoint, it\nfinds the stale anno_list entry and hits WARN_ON_ONCE(mptcp_pm_is_kernel())\nin mptcp_pm_announced_alloc().\n\nRoot cause: asymmetry between removal paths.\n- Non-zero id path: mptcp_nl_remove_subflow_and_signal_addr() calls\n mptcp_pm_remove_announced() to clean up.\n- Id 0 path: mptcp_nl_remove_id_zero_address() skips cleanup entirely.\n\nFix by making the id 0 path symmetric: call mptcp_pm_announced_remove()\nand decrement add_addr_signaled before queuing the RM_ADDR.\n\nSubtle detail: signal endpoints are stored in anno_list with port 0, but\nmsk_local carries the connection\u0027s local port. In other words, entries\nlinked to ID0 paths should have port \u003d\u003d 0. A follow-up patch will ensure\nthat. mptcp_pm_announced_remove() uses use_port\u003dtrue for comparison. So\nclear the port before the lookup.\n\nFixes: 740d798e8767 (\"mptcp: remove id 0 address\")\nCc: stable@vger.kernel.org\nReported-by: syzbot+55c2a5c871441261ed14@syzkaller.appspotmail.com\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/620\nSuggested-by: Tao Cui \u003ccuitao@kylinos.cn\u003e\nSigned-off-by: Kalpan Jani \u003ckalpan.jani@mpiricsoftware.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-4-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b76c0e28b392620dfbaf92cdeedbf115820b44cb", "tree": "49239e904435da01c35397dcb716e58201d23212", "parents": [ "29f641951be0d91036d77edf677807f1447dbe65" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:08 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:54 2026 -0700" }, "message": "mptcp: syncookies: remember the request backup flag\n\nInstead of using an uninitialised bit when copying the info in\nsubflow_ulp_clone().\n\nTo fix this, no need to extend the join_entry structure: backup is\ncoming from struct mptcp_subflow_request_sock, only one bit. Do the same\nhere by using one bit for both.\n\nFixes: efd340bf3d77 (\"mptcp: distinguish rcv vs sent backup flag in requests\")\nCc: stable@vger.kernel.org\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-3-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "29f641951be0d91036d77edf677807f1447dbe65", "tree": "d4918cc8148e1e5064205244ee018cf98e0b37aa", "parents": [ "e2ab913f68c7d11e2561b8a8ad0b87ffefcad667" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Tue Sep 08 16:07:07 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:54 2026 -0700" }, "message": "mptcp: subflow: no need to copy thmac during ulp_clone\n\n\u0027thmac\u0027 is not used after that point.\n\nIndeed, subflow_ulp_clone() is called when the request on the passive\nside is over, so when the truncated HMAC is no longer needed.\n\nNote that in case of SYN cookies, thmac will not be initialised. So\nbetter to remove it to avoid a warning from debug tools like KMSAN for\nreading uninitialised data.\n\nFixes: f296234c98a8 (\"mptcp: Add handling of incoming MP_JOIN requests\")\nCc: stable@vger.kernel.org\nReviewed-by: Geliang Tang \u003cgeliang@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-2-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2ab913f68c7d11e2561b8a8ad0b87ffefcad667", "tree": "bed11f367f4456694aa6642a1a48d57af69fcd20", "parents": [ "5be081b83abd3f17d908953b4bb77279f5a149e3" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 08 16:07:06 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:32:54 2026 -0700" }, "message": "mptcp: do not reschedule the RTX timer for fallback sockets\n\nOn fallback socket the retrans timer is a quite convoluted no-op, but\ncurrently nothing prevents the MPTCP core to keep rescheduling it.\n\nAdditionally gate RTX timer reset to the msk not being fallen back to\nTCP yet. To avoid adding multiple tests in fast-path, use a new flags\nbit for such condition.\n\nThe RTX enable bit is clear at close time and set before the msk could\nstart retransmitting, with a couple of caveats:\n\n- passive sockets inherit the bit from the listener msk; set the bit on\n such socket to avoid flipping it in the fast-path, even if the\n listener will obviously never retransmit.\n\n- while fastopening (MPTFO), mptcp_sendmsg_fastopen still ends-up\n calling mptcp_connect via tcp_sendmsg_fastopen -\u003e\n __inet_stream_connect(ssk-\u003esk_socket), and the first subflow\u0027s\n sk_socket points to the msk one.\n\nFixes: b51f9b80c032 (\"mptcp: introduce MPTCP retransmission timer\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260908-net-mptcp-misc-fixes-7-3-rc1-v2-1-df1de70348b6@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5be081b83abd3f17d908953b4bb77279f5a149e3", "tree": "5e6d76e7bc3ac83e5f8c6beb5382e742282b1c34", "parents": [ "bbee0759d363d1297d08b285acfec999570158a6" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Wed Sep 09 00:50:47 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 13:31:08 2026 -0700" }, "message": "net: dsa: tag_brcm: legacy FCS: request needed tailroom\n\nThe legacy FCS tagger calculates the CRC over skb-\u003elen bytes starting at\nskb-\u003edata. When a nonlinear skb reaches the tagger, this reads past the\nlinear head into unrelated slab memory.\n\nThe tagger appends an Ethernet FCS but does not declare that tailroom. As a\nresult, DSA leaves NETIF_F_SG and NETIF_F_FRAGLIST enabled on the user\nport, and nonlinear skbs can reach the CRC calculation.\n\nDeclare the required tailroom. DSA will then clear those features and the\nnetworking core will linearize skbs before the tagger runs.\n\nA KASAN-enabled dsa_loop test using this tagger reports:\n\n BUG: KASAN: slab-out-of-bounds in crc32_le\n Read of size 1 at addr ffff8880397086c0 by task exp/135\n\n Call Trace:\n crc32_le (lib/crc/crc32-main.c:38)\n brcm_leg_fcs_tag_xmit (net/dsa/tag_brcm.c:343)\n dsa_user_xmit (net/dsa/user.c:942)\n dev_hard_start_xmit (net/core/dev.c:3937)\n __dev_queue_xmit (net/core/dev.c:4926)\n packet_sendmsg (net/packet/af_packet.c:3110)\n __sys_sendto (net/socket.c:2281)\n\n The buggy address belongs to the object at ffff888039708400\n which belongs to the cache skbuff_small_head of size 704\n The buggy address is located 0 bytes to the right of\n allocated 704-byte region [ffff888039708400, ffff8880397086c0)\n\nFixes: ef07df397a62 (\"net: dsa: tag_brcm: add support for legacy FCS tags\")\nCc: stable@vger.kernel.org\nReported-by: co+28eef7d8af9428e6@bugs.sh\nCloses: https://lore.kernel.org/all/jH6u350kaBRuqklDjd3k3BW4nWzp0tYRjq3p%40bugs.sh/\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Florian Fainelli \u003cflorian.fainelli@broadcom.com\u003e\nLink: https://patch.msgid.link/20260908165047.2786340-1-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bbee0759d363d1297d08b285acfec999570158a6", "tree": "33f238e4891ecaed91dfdc8e66c83cb577ba843f", "parents": [ "a401a9d547c50ef34db1088cc1fb9a201a7af657", "c93922dd316b7273a8667d29084632066fa8a2d3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 12:51:52 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 09 12:51:52 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-09-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\nCore:\n\n - hci_sysfs: Fix NULL pointer dereference in device_del()\n - hci_sync: Fix not setting CE length properly\n - btqcomsmd: destroy RPMsg endpoints before freeing hci_dev\n\nDrivers:\n\n - btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware\n - btusb: mediatek: Fix leaked runtime PM reference in reset\n - btusb: Fix leaked runtime PM reference in btusb_reset\n - btusb: Fix UAF of btusb_data by rx_work\n - btusb: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform\n - btintel_pcie: validate packet_len before skb_put_data\n - btintel_pcie: fix tx_handle bounds off-by-one\n - btrtl: Don\u0027t leak return code when parsing firmware format v2\n\n* tag \u0027for-net-2026-09-08\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: btusb: Fix leaked runtime PM reference in btusb_reset\n Bluetooth: btusb: mediatek: Fix leaked runtime PM reference in reset\n Bluetooth: btqcomsmd: destroy RPMsg endpoints before freeing hci_dev\n Bluetooth: hci_sysfs: Fix NULL pointer dereference in device_del()\n Bluetooth: btmtk: Declare MT7920 (MT7961 1a) Bluetooth firmware\n Bluetooth: hci_sync: Fix not setting CE length properly\n Bluetooth: btintel_pcie: fix tx_handle bounds off-by-one\n Bluetooth: btintel_pcie: validate packet_len before skb_put_data\n Bluetooth: btrtl: Don\u0027t leak return code when parsing firmware format v2\n Bluetooth: btusb: Fix UAF of btusb_data by rx_work\n Bluetooth: Properly disable remote wakeup for MT7922/MT7925 on Ryzen platform\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260908212127.1022197-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "50d05c7c76c96b90462f24debacca971d2e86713", "tree": "25602b0e57ea0a59ae40f5f55a5e73bd99b29646", "parents": [ "5e1287972b649aab54a894addeaf1fdd6bc23e6b", "d41d0021a6ea3e9fcd14126a00fead47f981c46e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 11:00:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 11:00:35 2026 -0700" }, "message": "Merge tag \u0027landlock-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux\n\nPull Landlock fixes from Mickaël Salaün:\n \"This fixes a use-after-free and a lockdep assert NULL dereferencing,\n and properly truncates too-long strings printed by a Landlock\n tracepoint. Most of the changes are brought by new tests\"\n\n* tag \u0027landlock-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mic/linux:\n landlock: Test trace path output boundaries\n landlock: Bound escaped trace path output\n landlock: Clean up ruleset validation checks\n selftests/landlock: Test abstract socket trace name limits\n landlock: Fix use-after-free of the source\u0027s parent directory\n" }, { "commit": "5e1287972b649aab54a894addeaf1fdd6bc23e6b", "tree": "0d5a00af94529d2aa685b1be4eb50e7c75cf5b75", "parents": [ "4f3989d75d33414389a57e78f4979931a0164df4", "56ea4e86832d8abe8930394473566c194d189f85" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 09:38:03 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 09:38:03 2026 -0700" }, "message": "Merge tag \u0027vfs-7.3-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs\n\nPull vfs fixes from Christian Brauner:\n\n - netfs:\n\n - Fix an uninitialized return value in netfs_unbuffered_write()\n when preparing the first subrequest fails\n\n - For partial unbuffered/DIO writes return the amount transferred\n rather than an error\n\n - Update i_size with the amount actually written when a partial\n transfer ends in an error\n\n - Fix a subrequest reference leak when the io_iter ends up empty\n\n - Handle netfs_alloc_subrequest() failure during unbuffered writes\n\n - Load all readahead folios into the rolling buffer upfront and\n drop the readahead references once the first subrequest is\n dispatched\n\n - Mark folios for copy-to-cache while issuing subrequests\n\n - Fix read progress reporting\n\n - afs:\n\n - Add the missing kunmap in the error path of afs_dir_search_bucket()\n\n - Fix a double kunmap in afs_edit_dir_remove()\n\n - Don\u0027t free an existing server\u0027s endpoint state when cleaning up a\n candidate server in afs_lookup_server()\n\n - Unbind peers removed from a server\u0027s address list\n\n - ufs:\n\n - Load the cylinder group metadata before creating the root dentry\n\n - Validate the cylinder group index and rotor positions before\n caching them\n\n - Treat an unreadable directory block as not empty\n\n - exec:\n\n - Close the close-on-exec files before taking exec_update_lock\n\n Closing a file can block on the filesystem, so a hung filesystem\n blocked everything that takes exec_update_lock and a FUSE server\n inspecting the calling process could deadlock\n\n - Drop the bprm loader before closing bprm-\u003efile in free_bprm()\n\n - exit: Hold a reference to thread_pid across proc_flush_pid()\n\n - reboot: Fix a use-after-free on cad_pid\n\n - nsfs: Keep the namespace tree fields out of the rcu_head used by\n kfree_rcu()\n\n - nstree: Check listing permission before taking a namespace\n reference in listns()\n\n - super: Return 0 when a nested thaw drops its hold while other\n freezers remain\n\n - ext4: Don\u0027t set I_METADATA_WRITEBACK during fastcommit replay\n\n - adfs: Free s_fs_info in -\u003ekill_sb()\n\n - autofs: Free the inode info allocated in autofs_fill_super() when\n the root inode allocation fails\n\n - ovl: Return EINVAL instead of EIO on a user namespace mismatch now\n that it\u0027s a plain refusal and not an internal error\n\n - cachefiles: Don\u0027t cast the variable-length coherency data to a\n __be64 in the coherency tracepoint\n\n* tag \u0027vfs-7.3-rc3.fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (28 commits)\n nstree: check listing permission before taking a namespace reference\n exec: do_close_on_exec() before taking exec_update_lock\n exit: hold a reference to thread_pid across proc_flush_pid\n fs: autofs: fix memory leak in autofs_fill_super()\n exec: Drop bprm loader before closing bprm-\u003efile\n afs: Clear stale peer app data after address list changes\n afs: Fix incorrect free in candidate cleanup in afs_lookup_server()\n afs: Fix double-unmap of directory block\n afs: Fix missing kunmap in afs_dir_search_bucket()\n ovl: return EINVAL instead of EIO in case of mismatched user_ns\n reboot: fix cad_pid use-after-free race\n cachefiles: Fix potential UAF/KASAN warning\n netfs: Fix read progress reporting\n netfs: Mark folios with COPY_TO_CACHE whilst issuing subreqs\n netfs: Fix readahead synchronisation issues by loading all folios upfront\n netfs: break unbuffered write when netfs_alloc_subrequest() fails\n netfs: Fix subreq ref leak\n netfs: Fix i_size update for partial transfer\n netfs: Fix error vs transferred passed to -\u003eki_complete()\n netfs: Fix unbuffered/DIO write partial transfer error return\n ...\n" }, { "commit": "4f3989d75d33414389a57e78f4979931a0164df4", "tree": "9b9678e04db36df6e48d1292a3d9b7430c64228a", "parents": [ "3f8b8c94a723ab6c0a62005e69a0872717f01709", "48a4ee65e677559776349128e6a81a6041986c99" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 08:50:05 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 08:50:05 2026 -0700" }, "message": "Merge tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost\n\nPull virtio fixes from Michael Tsirkin:\n \"Just a ton of small fixes all over the place.\n\n Also includes virtio and virtio-rng MAINTAINERS updates\"\n\n* tag \u0027for_linus\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mst/vhost: (27 commits)\n vduse: return compat ioctl results directly\n virtio_input: stop callbacks before unregistering input device\n virtio_input: reset device if input_register_device() fails\n vhost: invalidate vring access on IOTLB transitions\n vduse: validate virtqueue alignment\n vduse: do not take dev-\u003erwsem in the virtqueue kick path\n vhost-scsi: clamp max_io_vqs module parameter\n vhost-scsi: use kvzalloc for vq array allocation\n virtio-pci: return IRQ_HANDLED after non-zero ISR\n virtio: add Eugenio Pérez as Maintainer\n vhost: limit outstanding IOTLB misses per virtqueue\n MAINTAINERS: Add a section for virtio-rng\n vdpa_sim_net: check TX pull result before RX copy\n vdpa_sim_blk: reject out-of-range sector starts\n virtio-vdpa: Use queue id when setting vq affinity\n vdpa: octeon_ep: Check dev_set_name() in dev add\n vdpa: ifcvf: Put device on unsupported feature error\n vdpa: solidrun: Free IRQs after request failure\n vdpa: alibaba: Keep DRIVER_OK clear if IRQ setup fails\n vdpa/pds: check virtqueue notify mapping\n ...\n" }, { "commit": "d05045177a855386bca5e1909e08d06290e6e3b3", "tree": "7823febfe4fec16c1e111cd73dc1721281285055", "parents": [ "0ee150794c75bcd0be0e24ff3394f433cbae18cc" ], "author": { "name": "Bjoern Doebel", "email": "doebel@amazon.de", "time": "Tue Sep 08 16:10:01 2026 +0000" }, "committer": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Wed Sep 09 11:56:47 2026 -0300" }, "message": "smb: client: fail DACL rewrite when the new DACL exceeds 64K\n\nreplace_sids_and_copy_aces() and set_chmod_dacl() accumulate the size of\nthe DACL they build in a u16. That accumulator can wrap.\n\nvalidate_dacl() caps num_aces at (dacl_size - sizeof(struct smb_acl)) /\n20, i.e. 3276 for a maximally sized DACL, while each rewritten ACE can\ngrow to sizeof(struct smb_ace) (76 bytes) once its SID is replaced with\none carrying SID_MAX_SUB_AUTHORITIES sub-authorities. The worst case is\ntherefore sizeof(struct smb_acl) + 3276 * 76 \u003d 248984 bytes, far beyond\nwhat a u16 can hold. A wraparound is reached with 863 ACEs.\n\nAfter the wraparound, ndacl_ptr-\u003esize becomes meaningless and the offset\nwill point anywhere in the ACE array. As a result, we will see\ncorruption of the DACL, which then gets sent to the server. This is not\nan out-of-bounds write as the allocation now covers the worst-case\nexpansion, so writes will always go into the buffer.\n\nAdjust the code to use a u32 internally and return -EOVERFLOW in the\noverflow case. The operation must be refused, because a DACL can only\nhold 2^16-1 bytes on the wire and larger DACLs cannot be represented.\n\nset_chmod_dacl() carries the same pattern and is fixed the same way. It\nonly wraps once the source DACL comes within roughly 380 bytes of the\n64K ceiling, but the failure mode is identical.\n\nSuggested-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nCc: stable@vger.kernel.org\nFixes: f5065508897a (\"cifs: Retain old ACEs when converting between mode bits and ACL.\")\nAssisted-by: Kiro:claude-opus-5\nSigned-off-by: Bjoern Doebel \u003cdoebel@amazon.de\u003e\nReviewed-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n" }, { "commit": "0ee150794c75bcd0be0e24ff3394f433cbae18cc", "tree": "4d2f942df14fbbf46b30ed21c7864d3de1836c71", "parents": [ "6bd360447941357e959414a525aa62576a448116" ], "author": { "name": "Bjoern Doebel", "email": "doebel@amazon.de", "time": "Tue Sep 08 16:10:00 2026 +0000" }, "committer": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Wed Sep 09 11:56:47 2026 -0300" }, "message": "smb: client: fix heap overflow in DACL owner/group rewrite\n\nWhen id_mode_to_cifs_acl rewrites an existing DACL, it allocates a\nbuffer sized according to the on-disk DACL length reported by\ndacl_ptr-\u003esize. However, replace_sids_and_copy_aces may rewrite each\nACE with a new owner/group SID obtained from the cifs.idmap upcall.\nThose SIDs can have up to SID_MAX_SUB_AUTHORITIES (15) sub-authorities,\nmaking each ACE up to 76 bytes (sizeof(struct smb_ace)).\n\nIf the original DACL contains short SIDs (e.g., 1 sub-authority) while\nthe replacement SIDs are long, the rewritten ACEs overflow the\nallocation.\n\nFix this by always budgeting for worst-case SID expansion: allocate\nsizeof(struct smb_acl) plus num_aces * sizeof(struct smb_ace), which\ncovers the smb_acl header and room for every ACE at maximum SID size.\nThis replaces the previous split logic that used dacl_ptr-\u003esize for\ncifsacl mounts but num_aces * sizeof(struct smb_ace) for mode_from_sid\nmounts: both paths can trigger the same rewrite and need the same\nheadroom.\n\nKASAN reports this as:\n BUG: KASAN: slab-out-of-bounds in build_sec_desc+0x1e8a/0x2680 [cifs]\n Write of size 4 at addr ffff8881a5e25374 by task chown/5298\n ...\n The buggy address is located 0 bytes to the right of\n allocated 884-byte region [ffff8881a5e25000, ffff8881a5e25374)\n\nCc: stable@vger.kernel.org\nFixes: bc3e9dd9d104 (\"cifs: Change SIDs in ACEs while transferring file ownership.\")\nAssisted-by: Kiro:claude-opus-4.6\nSigned-off-by: Bjoern Doebel \u003cdoebel@amazon.de\u003e\nReviewed-by: Namjae Jeon \u003clinkinjeon@kernel.org\u003e\nFixes: 5c3564852c58 (\"cifs: Minimize the number of cifs_acl memory allocations\")\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\n" }, { "commit": "3f8b8c94a723ab6c0a62005e69a0872717f01709", "tree": "9f8a0318dd9733fd40fc7031c7a1e024eabe1be9", "parents": [ "893e11787f78e43b534e252249ac3fff4d1333f8", "a76f015d424e1956e7be9ead2224ab9816be5d79" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 07:06:18 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 09 07:06:18 2026 -0700" }, "message": "Merge tag \u0027printk-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux\n\nPull printk fixes from Petr Mladek:\n\n - Use lazy irq_work for waking printk kthreads\n\n - Flush pending irq_work before destroying printk kthreads\n\n - Remove redundant WARN() when a printk kthread can\u0027t be created\n\n - Typo fix\n\n* tag \u0027printk-for-7.3-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/printk/linux:\n printk/nbcon: Change nbcon_irq_work to IRQ_WORK_LAZY\n printk/nbcon: Flush nbcon_irq_work in nbcon_free()\n console: fix /dev/kmsg reference in flags kernel doc\n printk: Don\u0027t WARN on kthread_run failure.\n" }, { "commit": "56ea4e86832d8abe8930394473566c194d189f85", "tree": "7540dc1479e3377c8e665af6209571274a1ce0d0", "parents": [ "e780259b54e618ceb4763fbc21314acf3565e813" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Mon Sep 07 16:22:17 2026 +0200" }, "committer": { "name": "Christian Brauner", "email": "brauner@kernel.org", "time": "Wed Sep 09 10:03:15 2026 +0200" }, "message": "nstree: check listing permission before taking a namespace reference\n\nlegitimize_ns() takes a reference on the candidate namespace before\nmay_list_ns() has decided whether the caller may see it. The\n__free(ns_put) cleanup on the denied path can drop the last reference to a\nmount namespace while we still hold the rcu read lock, and put_mnt_ns()\nmay sleep there. This is the same problem commit 2ec2aff3c8e2 (\"ns: make\nsure reference are dropped outside of rcu lock\") fixed for the put_user()\npath. Neither ns_requested() nor may_list_ns() needs a reference, both\nonly look at the namespace type and at the caller\u0027s own namespaces, so do\nthe checks first and take the reference last.\n\nSplat:\n\n Voluntary context switch within RCU read-side critical section!\n WARNING: kernel/rcu/tree_plugin.h:332 at rcu_note_context_switch+0x238/0x2a0, CPU#5: a/3442\n CPU: 5 UID: 1000 PID: 3442 Comm: a Not tainted 7.0.0-30-generic #30-Ubuntu PREEMPT(lazy)\n RIP: 0010:rcu_note_context_switch+0x238/0x2a0\n Call Trace:\n \u003cTASK\u003e\n __schedule+0xcf/0x650\n schedule+0x27/0x90\n schedule_preempt_disabled+0x15/0x30\n __mutex_lock.constprop.0+0x550/0xaf0\n __mutex_lock_slowpath+0x13/0x20\n mutex_lock+0x3b/0x50\n exp_funnel_lock+0xb2/0x260\n synchronize_rcu_expedited+0xe7/0x220\n namespace_unlock+0x26a/0x320\n put_mnt_ns+0xd3/0x120\n mntns_put+0xe/0x20\n do_listns+0x13e/0x560\n __do_sys_listns+0x126/0x2d0\n __x64_sys_listns+0x20/0x30\n x64_sys_call+0x2366/0x2390\n do_syscall_64+0x105/0x5a0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n \u003c/TASK\u003e\n\nFixes: 76b6f5dfb3fd (\"nstree: add listns()\")\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nLink: https://patch.msgid.link/ABA32239-733B-438C-B95A-B13ED69FF0F3@doyensec.com\nReviewed-by: Bradley Morgan \u003cbrads@mainlining.org\u003e\nSigned-off-by: Christian Brauner (Amutable) \u003cbrauner@kernel.org\u003e\n" }, { "commit": "a76f015d424e1956e7be9ead2224ab9816be5d79", "tree": "c35a46695cac79752279d9cb26daa3b56947cd60", "parents": [ "560f4deda32785e260056200f8bb911c475c5b88", "ffe0486b139e45cd9c9ca2584f04a1910fe4f8a6" ], "author": { "name": "Petr Mladek", "email": "pmladek@suse.com", "time": "Wed Sep 09 09:52:21 2026 +0200" }, "committer": { "name": "Petr Mladek", "email": "pmladek@suse.com", "time": "Wed Sep 09 09:52:21 2026 +0200" }, "message": "Merge branch \u0027for-7.4-trivial\u0027 into for-linus\n" } ], "next": "e780259b54e618ceb4763fbc21314acf3565e813" }