)]}' { "log": [ { "commit": "878e7b11736e062514e58f3b445ff343e6705537", "tree": "dd860d60687153ecba56b2f54d50e351af4113ec", "parents": [ "9b6412e6979f6f9e0632075f8f008937b5cd4efd" ], "author": { "name": "Haoxiang Li", "email": "haoxiang_li2024@163.com", "time": "Tue Feb 18 11:04:09 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Feb 20 09:35:49 2025 +0100" }, "message": "nfp: bpf: Add check for nfp_app_ctrl_msg_alloc()\n\nAdd check for the return value of nfp_app_ctrl_msg_alloc() in\nnfp_bpf_cmsg_alloc() to prevent null pointer dereference.\n\nFixes: ff3d43f7568c (\"nfp: bpf: implement helpers for FW map ops\")\nCc: stable@vger.kernel.org\nSigned-off-by: Haoxiang Li \u003chaoxiang_li2024@163.com\u003e\nLink: https://patch.msgid.link/20250218030409.2425798-1-haoxiang_li2024@163.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "9b6412e6979f6f9e0632075f8f008937b5cd4efd", "tree": "1cbc6de21bf56ae0f79a02e009682f989e853f20", "parents": [ "a370295367b55662a32a4be92565fe72a5aa79bb" ], "author": { "name": "Sabrina Dubroca", "email": "sd@queasysnail.net", "time": "Mon Feb 17 11:23:35 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Feb 20 09:24:08 2025 +0100" }, "message": "tcp: drop secpath at the same time as we currently drop dst\n\nXiumei reported hitting the WARN in xfrm6_tunnel_net_exit while\nrunning tests that boil down to:\n - create a pair of netns\n - run a basic TCP test over ipcomp6\n - delete the pair of netns\n\nThe xfrm_state found on spi_byaddr was not deleted at the time we\ndelete the netns, because we still have a reference on it. This\nlingering reference comes from a secpath (which holds a ref on the\nxfrm_state), which is still attached to an skb. This skb is not\nleaked, it ends up on sk_receive_queue and then gets defer-free\u0027d by\nskb_attempt_defer_free.\n\nThe problem happens when we defer freeing an skb (push it on one CPU\u0027s\ndefer_list), and don\u0027t flush that list before the netns is deleted. In\nthat case, we still have a reference on the xfrm_state that we don\u0027t\nexpect at this point.\n\nWe already drop the skb\u0027s dst in the TCP receive path when it\u0027s no\nlonger needed, so let\u0027s also drop the secpath. At this point,\ntcp_filter has already called into the LSM hooks that may require the\nsecpath, so it should not be needed anymore. However, in some of those\nplaces, the MPTCP extension has just been attached to the skb, so we\ncannot simply drop all extensions.\n\nFixes: 68822bdf76f1 (\"net: generalize skb freeing deferral to per-cpu lists\")\nReported-by: Xiumei Mu \u003cxmu@redhat.com\u003e\nSigned-off-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/5055ba8f8f72bdcb602faa299faca73c280b7735.1739743613.git.sd@queasysnail.net\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "a370295367b55662a32a4be92565fe72a5aa79bb", "tree": "77804bc2f078bb3239bf4ea5ba9596f1ce3ad4ed", "parents": [ "62520094e98c197c5ae34af9a17b67381678cb9d" ], "author": { "name": "Nick Hu", "email": "nick.hu@sifive.com", "time": "Mon Feb 17 13:58:42 2025 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Feb 20 09:14:04 2025 +0100" }, "message": "net: axienet: Set mac_managed_pm\n\nThe external PHY will undergo a soft reset twice during the resume process\nwhen it wake up from suspend. The first reset occurs when the axienet\ndriver calls phylink_of_phy_connect(), and the second occurs when\nmdio_bus_phy_resume() invokes phy_init_hw(). The second soft reset of the\nexternal PHY does not reinitialize the internal PHY, which causes issues\nwith the internal PHY, resulting in the PHY link being down. To prevent\nthis, setting the mac_managed_pm flag skips the mdio_bus_phy_resume()\nfunction.\n\nFixes: a129b41fe0a8 (\"Revert \"net: phy: dp83867: perform soft reset and retain established link\"\")\nSigned-off-by: Nick Hu \u003cnick.hu@sifive.com\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20250217055843.19799-1-nick.hu@sifive.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "62520094e98c197c5ae34af9a17b67381678cb9d", "tree": "818ebc8875ac63355786b92f4ec53a02d614a356", "parents": [ "606572eb22c1786a3957d24307f5760bb058ca19", "4eae0ee0f1e6256d0b0b9dd6e72f1d9cf8f72e08" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 19:01:00 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 19:01:00 2025 -0800" }, "message": "Merge branch \u0027net-core-improvements-to-device-lookup-by-hardware-address\u0027\n\nBreno Leitao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: core: improvements to device lookup by hardware address.\n\nThe first patch adds a new dev_getbyhwaddr() helper function for\nfinding devices by hardware address when the rtnl lock is held. This\nprevents PROVE_LOCKING warnings that occurred when rtnl lock was held\nbut the RCU read lock wasn\u0027t. The common address comparison logic is\nextracted into dev_comp_addr() to avoid code duplication.\n\nThe second coverts arp_req_set_public() to the new helper.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250218-arm_fix_selftest-v5-0-d3d6892db9e1@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4eae0ee0f1e6256d0b0b9dd6e72f1d9cf8f72e08", "tree": "818ebc8875ac63355786b92f4ec53a02d614a356", "parents": [ "4b5a28b38c4a0106c64416a1b2042405166b26ce" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Feb 18 05:49:31 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 19:00:01 2025 -0800" }, "message": "arp: switch to dev_getbyhwaddr() in arp_req_set_public()\n\nThe arp_req_set_public() function is called with the rtnl lock held,\nwhich provides enough synchronization protection. This makes the RCU\nvariant of dev_getbyhwaddr() unnecessary. Switch to using the simpler\ndev_getbyhwaddr() function since we already have the required rtnl\nlocking.\n\nThis change helps maintain consistency in the networking code by using\nthe appropriate helper function for the existing locking context.\nSince we\u0027re not holding the RCU read lock in arp_req_set_public()\nexisting code could trigger false positive locking warnings.\n\nFixes: 941666c2e3e0 (\"net: RCU conversion of dev_getbyhwaddr() and arp_ioctl()\")\nSuggested-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20250218-arm_fix_selftest-v5-2-d3d6892db9e1@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4b5a28b38c4a0106c64416a1b2042405166b26ce", "tree": "4a92863e33cf96c65fa9f4d04ad58b9bfa96322c", "parents": [ "606572eb22c1786a3957d24307f5760bb058ca19" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Feb 18 05:49:30 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:59:29 2025 -0800" }, "message": "net: Add non-RCU dev_getbyhwaddr() helper\n\nAdd dedicated helper for finding devices by hardware address when\nholding rtnl_lock, similar to existing dev_getbyhwaddr_rcu(). This prevents\nPROVE_LOCKING warnings when rtnl_lock is held but RCU read lock is not.\n\nExtract common address comparison logic into dev_addr_cmp().\n\nThe context about this change could be found in the following\ndiscussion:\n\nLink: https://lore.kernel.org/all/20250206-scarlet-ermine-of-improvement-1fcac5@leitao/\n\nCc: kuniyu@amazon.com\nCc: ushankar@purestorage.com\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://patch.msgid.link/20250218-arm_fix_selftest-v5-1-d3d6892db9e1@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "606572eb22c1786a3957d24307f5760bb058ca19", "tree": "c61110f96d6b6dfb859ee15107392b9ae8807664", "parents": [ "5bcd3d15ca13671fa7e221be38c8aed725630602" ], "author": { "name": "Yu-Chun Lin", "email": "eleanor15x@gmail.com", "time": "Tue Feb 18 16:12:16 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:55:40 2025 -0800" }, "message": "sctp: Fix undefined behavior in left shift operation\n\nAccording to the C11 standard (ISO/IEC 9899:2011, 6.5.7):\n\"If E1 has a signed type and E1 x 2^E2 is not representable in the result\ntype, the behavior is undefined.\"\n\nShifting 1 \u003c\u003c 31 causes signed integer overflow, which leads to undefined\nbehavior.\n\nFix this by explicitly using \u00271U \u003c\u003c 31\u0027 to ensure the shift operates on\nan unsigned type, avoiding undefined behavior.\n\nSigned-off-by: Yu-Chun Lin \u003celeanor15x@gmail.com\u003e\nLink: https://patch.msgid.link/20250218081217.3468369-1-eleanor15x@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5bcd3d15ca13671fa7e221be38c8aed725630602", "tree": "da65e53ebb9aa56a82105959a376c8576f97c7e3", "parents": [ "346b3416fd129025bdfe5a27a2d1224b99932227", "15de6ba95dbe98af7eb71e644205a37c2f1a9aea" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:55:32 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:55:33 2025 -0800" }, "message": "Merge branch \u0027flow_dissector-fix-handling-of-mixed-port-and-port-range-keys\u0027\n\nCong Wang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nflow_dissector: Fix handling of mixed port and port-range keys\n\nThis patchset contains two fixes for flow_dissector handling of mixed\nport and port-range keys, for both tc-flower case and bpf case. Each\nof them also comes with a selftest.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250218043210.732959-1-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15de6ba95dbe98af7eb71e644205a37c2f1a9aea", "tree": "da65e53ebb9aa56a82105959a376c8576f97c7e3", "parents": [ "69ab34f705fbfabcace64b5d53bb7a4450fac875" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Mon Feb 17 20:32:10 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:54:59 2025 -0800" }, "message": "selftests/bpf: Add a specific dst port matching\n\nAfter this patch:\n\n #102/1 flow_dissector_classification/ipv4:OK\n #102/2 flow_dissector_classification/ipv4_continue_dissect:OK\n #102/3 flow_dissector_classification/ipip:OK\n #102/4 flow_dissector_classification/gre:OK\n #102/5 flow_dissector_classification/port_range:OK\n #102/6 flow_dissector_classification/ipv6:OK\n #102 flow_dissector_classification:OK\n Summary: 1/6 PASSED, 0 SKIPPED, 0 FAILED\n\nCc: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: Andrii Nakryiko \u003candrii@kernel.org\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nLink: https://patch.msgid.link/20250218043210.732959-5-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "69ab34f705fbfabcace64b5d53bb7a4450fac875", "tree": "d2afaec03ea8047143b4492525c3a179fc077ad8", "parents": [ "dfc1580f960bf70bdaacda8f3d644e3e58160f9d" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Mon Feb 17 20:32:09 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:54:59 2025 -0800" }, "message": "flow_dissector: Fix port range key handling in BPF conversion\n\nFix how port range keys are handled in __skb_flow_bpf_to_target() by:\n- Separating PORTS and PORTS_RANGE key handling\n- Using correct key_ports_range structure for range keys\n- Properly initializing both key types independently\n\nThis ensures port range information is correctly stored in its dedicated\nstructure rather than incorrectly using the regular ports key structure.\n\nFixes: 59fb9b62fb6c (\"flow_dissector: Fix to use new variables for port ranges in bpf hook\")\nReported-by: Qiang Zhang \u003cdtzq01@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAPx+-5uvFxkhkz4\u003dj_Xuwkezjn9U6kzKTD5jz4tZ9msSJ0fOJA@mail.gmail.com/\nCc: Yoshiki Komachi \u003ckomachi.yoshiki@gmail.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nLink: https://patch.msgid.link/20250218043210.732959-4-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dfc1580f960bf70bdaacda8f3d644e3e58160f9d", "tree": "d4a62c11199036b102cdb3956869cb2e007dae45", "parents": [ "3e5796862c692ea608d96f0a1437f9290f44953a" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Mon Feb 17 20:32:08 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:54:59 2025 -0800" }, "message": "selftests/net/forwarding: Add a test case for tc-flower of mixed port and port-range\n\nAfter this patch:\n\n # ./tc_flower_port_range.sh\n TEST: Port range matching - IPv4 UDP [ OK ]\n TEST: Port range matching - IPv4 TCP [ OK ]\n TEST: Port range matching - IPv6 UDP [ OK ]\n TEST: Port range matching - IPv6 TCP [ OK ]\n TEST: Port range matching - IPv4 UDP Drop [ OK ]\n\nCc: Qiang Zhang \u003cdtzq01@gmail.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nTested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20250218043210.732959-3-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3e5796862c692ea608d96f0a1437f9290f44953a", "tree": "e80c481fe820e71ab5ea0d0b435a9553cfc2178e", "parents": [ "346b3416fd129025bdfe5a27a2d1224b99932227" ], "author": { "name": "Cong Wang", "email": "xiyou.wangcong@gmail.com", "time": "Mon Feb 17 20:32:07 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:54:58 2025 -0800" }, "message": "flow_dissector: Fix handling of mixed port and port-range keys\n\nThis patch fixes a bug in TC flower filter where rules combining a\nspecific destination port with a source port range weren\u0027t working\ncorrectly.\n\nThe specific case was when users tried to configure rules like:\n\ntc filter add dev ens38 ingress protocol ip flower ip_proto udp \\\ndst_port 5000 src_port 2000-3000 action drop\n\nThe root cause was in the flow dissector code. While both\nFLOW_DISSECTOR_KEY_PORTS and FLOW_DISSECTOR_KEY_PORTS_RANGE flags\nwere being set correctly in the classifier, the __skb_flow_dissect_ports()\nfunction was only populating one of them: whichever came first in\nthe enum check. This meant that when the code needed both a specific\nport and a port range, one of them would be left as 0, causing the\nfilter to not match packets as expected.\n\nFix it by removing the either/or logic and instead checking and\npopulating both key types independently when they\u0027re in use.\n\nFixes: 8ffb055beae5 (\"cls_flower: Fix the behavior using port ranges with hw-offload\")\nReported-by: Qiang Zhang \u003cdtzq01@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/CAPx+-5uvFxkhkz4\u003dj_Xuwkezjn9U6kzKTD5jz4tZ9msSJ0fOJA@mail.gmail.com/\nCc: Yoshiki Komachi \u003ckomachi.yoshiki@gmail.com\u003e\nCc: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nCc: Jiri Pirko \u003cjiri@resnulli.us\u003e\nSigned-off-by: Cong Wang \u003cxiyou.wangcong@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20250218043210.732959-2-xiyou.wangcong@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "346b3416fd129025bdfe5a27a2d1224b99932227", "tree": "a4e9a1601889f108d02657e720dcfa743b14e139", "parents": [ "a92c3228766429fe175ecc815f895043ea505587", "62fab6eef61f245dc8797e3a6a5b890ef40e8628" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:49:30 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:49:31 2025 -0800" }, "message": "Merge branch \u0027gtp-geneve-suppress-list_del-splat-during-exit_batch_rtnl\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngtp/geneve: Suppress list_del() splat during -\u003eexit_batch_rtnl().\n\nThe common pattern in tunnel device\u0027s -\u003eexit_batch_rtnl() is iterating\ntwo netdev lists for each netns: (i) for_each_netdev() to clean up\ndevices in the netns, and (ii) the device type specific list to clean\nup devices in other netns.\n\n\tlist_for_each_entry(net, net_list, exit_list) {\n\t\tfor_each_netdev_safe(net, dev, next) {\n\t\t\t/* (i) call unregister_netdevice_queue(dev, list) */\n\t\t}\n\n\t\tlist_for_each_entry_safe(xxx, xxx_next, \u0026net-\u003eyyy, zzz) {\n\t\t\t/* (ii) call unregister_netdevice_queue(xxx-\u003edev, list) */\n\t\t}\n\t}\n\nThen, -\u003eexit_batch_rtnl() could touch the same device twice.\n\nSay we have two netns A \u0026 B and device B that is created in netns A and\nmoved to netns B.\n\n 1. cleanup_net() processes netns A and then B.\n\n 2. -\u003eexit_batch_rtnl() finds the device B while iterating netns A\u0027s (ii)\n\n [ device B is not yet unlinked from netns B as\n unregister_netdevice_many() has not been called. ]\n\n 3. -\u003eexit_batch_rtnl() finds the device B while iterating netns B\u0027s (i)\n\ngtp and geneve calls -\u003edellink() at 2. and 3. that calls list_del() for (ii)\nand unregister_netdevice_queue().\n\nCalling unregister_netdevice_queue() twice is fine because it uses\nlist_move_tail(), but the 2nd list_del() triggers a splat when\nCONFIG_DEBUG_LIST is enabled.\n\nPossible solution is either of\n\n (a) Use list_del_init() in -\u003edellink()\n\n (b) Iterate dev with empty -\u003eunreg_list for (i) like\n\n\t#define for_each_netdev_alive(net, d)\t\t\t\t\\\n\t\tlist_for_each_entry(d, \u0026(net)-\u003edev_base_head, dev_list)\t\\\n\t\t\tif (list_empty(\u0026d-\u003eunreg_list))\n\n (c) Remove (i) and delegate it to default_device_exit_batch().\n\nThis series avoids the 2nd -\u003edellink() by (c) to suppress the splat for\ngtp and geneve.\n\nNote that IPv4/IPv6 tunnels calls just unregister_netdevice() during\n-\u003eexit_batch_rtnl() and dev is unlinked from (ii) later in -\u003endo_uninit(),\nso they are safe.\n\nAlso, pfcp has the same pattern but is safe because\nunregister_netdevice_many() is called for each netns.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250217203705.40342-1-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "62fab6eef61f245dc8797e3a6a5b890ef40e8628", "tree": "a4e9a1601889f108d02657e720dcfa743b14e139", "parents": [ "4ccacf86491d33d2486b62d4d44864d7101b299d" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Mon Feb 17 12:37:05 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:49:29 2025 -0800" }, "message": "geneve: Suppress list corruption splat in geneve_destroy_tunnels().\n\nAs explained in the previous patch, iterating for_each_netdev() and\ngn-\u003egeneve_list during -\u003eexit_batch_rtnl() could trigger -\u003edellink()\ntwice for the same device.\n\nIf CONFIG_DEBUG_LIST is enabled, we will see a list_del() corruption\nsplat in the 2nd call of geneve_dellink().\n\nLet\u0027s remove for_each_netdev() in geneve_destroy_tunnels() and delegate\nthat part to default_device_exit_batch().\n\nFixes: 9593172d93b9 (\"geneve: Fix use-after-free in geneve_find_dev().\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://patch.msgid.link/20250217203705.40342-3-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ccacf86491d33d2486b62d4d44864d7101b299d", "tree": "7536cda6b6b1e7a5842bcd5372c1ccdce36e3aec", "parents": [ "a92c3228766429fe175ecc815f895043ea505587" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Mon Feb 17 12:37:04 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 19 18:49:28 2025 -0800" }, "message": "gtp: Suppress list corruption splat in gtp_net_exit_batch_rtnl().\n\nBrad Spengler reported the list_del() corruption splat in\ngtp_net_exit_batch_rtnl(). [0]\n\nCommit eb28fd76c0a0 (\"gtp: Destroy device along with udp socket\u0027s netns\ndismantle.\") added the for_each_netdev() loop in gtp_net_exit_batch_rtnl()\nto destroy devices in each netns as done in geneve and ip tunnels.\n\nHowever, this could trigger -\u003edellink() twice for the same device during\n-\u003eexit_batch_rtnl().\n\nSay we have two netns A \u0026 B and gtp device B that resides in netns B but\nwhose UDP socket is in netns A.\n\n 1. cleanup_net() processes netns A and then B.\n\n 2. gtp_net_exit_batch_rtnl() finds the device B while iterating\n netns A\u0027s gn-\u003egtp_dev_list and calls -\u003edellink().\n\n [ device B is not yet unlinked from netns B\n as unregister_netdevice_many() has not been called. ]\n\n 3. gtp_net_exit_batch_rtnl() finds the device B while iterating\n netns B\u0027s for_each_netdev() and calls -\u003edellink().\n\ngtp_dellink() cleans up the device\u0027s hash table, unlinks the dev from\ngn-\u003egtp_dev_list, and calls unregister_netdevice_queue().\n\nBasically, calling gtp_dellink() multiple times is fine unless\nCONFIG_DEBUG_LIST is enabled.\n\nLet\u0027s remove for_each_netdev() in gtp_net_exit_batch_rtnl() and\ndelegate the destruction to default_device_exit_batch() as done\nin bareudp.\n\n[0]:\nlist_del corruption, ffff8880aaa62c00-\u003enext (autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]) is LIST_POISON1 (ffffffffffffff02) (prev is 0xffffffffffffff04)\nkernel BUG at lib/list_debug.c:58!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN\nCPU: 1 UID: 0 PID: 1804 Comm: kworker/u8:7 Tainted: G T 6.12.13-grsec-full-20250211091339 #1\nTainted: [T]\u003dRANDSTRUCT\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS 1.15.0-1 04/01/2014\nWorkqueue: netns cleanup_net\nRIP: 0010:[\u003cffffffff84947381\u003e] __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58\nCode: c2 76 91 31 c0 e8 9f b1 f7 fc 0f 0b 4d 89 f0 48 c7 c1 02 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 e0 c2 76 91 31 c0 e8 7f b1 f7 fc \u003c0f\u003e 0b 4d 89 e8 48 c7 c1 04 ff ff ff 48 89 ea 48 89 ee 48 c7 c7 60\nRSP: 0018:fffffe8040b4fbd0 EFLAGS: 00010283\nRAX: 00000000000000cc RBX: dffffc0000000000 RCX: ffffffff818c4054\nRDX: ffffffff84947381 RSI: ffffffff818d1512 RDI: 0000000000000000\nRBP: ffff8880aaa62c00 R08: 0000000000000001 R09: fffffbd008169f32\nR10: fffffe8040b4f997 R11: 0000000000000001 R12: a1988d84f24943e4\nR13: ffffffffffffff02 R14: ffffffffffffff04 R15: ffff8880aaa62c08\nRBX: kasan shadow of 0x0\nRCX: __wake_up_klogd.part.0+0x74/0xe0 kernel/printk/printk.c:4554\nRDX: __list_del_entry_valid_or_report+0x141/0x200 lib/list_debug.c:58\nRSI: vprintk+0x72/0x100 kernel/printk/printk_safe.c:71\nRBP: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc00/0x1000 [slab object]\nRSP: process kstack fffffe8040b4fbd0+0x7bd0/0x8000 [kworker/u8:7+netns 1804 ]\nR09: kasan shadow of process kstack fffffe8040b4f990+0x7990/0x8000 [kworker/u8:7+netns 1804 ]\nR10: process kstack fffffe8040b4f997+0x7997/0x8000 [kworker/u8:7+netns 1804 ]\nR15: autoslab_size_M_dev_P_net_core_dev_11127_8_1328_8_S_4096_A_64_n_139+0xc08/0x1000 [slab object]\nFS: 0000000000000000(0000) GS:ffff888116000000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000748f5372c000 CR3: 0000000015408000 CR4: 00000000003406f0 shadow CR4: 00000000003406f0\nStack:\n 0000000000000000 ffffffff8a0c35e7 ffffffff8a0c3603 ffff8880aaa62c00\n ffff8880aaa62c00 0000000000000004 ffff88811145311c 0000000000000005\n 0000000000000001 ffff8880aaa62000 fffffe8040b4fd40 ffffffff8a0c360d\nCall Trace:\n \u003cTASK\u003e\n [\u003cffffffff8a0c360d\u003e] __list_del_entry_valid include/linux/list.h:131 [inline] fffffe8040b4fc28\n [\u003cffffffff8a0c360d\u003e] __list_del_entry include/linux/list.h:248 [inline] fffffe8040b4fc28\n [\u003cffffffff8a0c360d\u003e] list_del include/linux/list.h:262 [inline] fffffe8040b4fc28\n [\u003cffffffff8a0c360d\u003e] gtp_dellink+0x16d/0x360 drivers/net/gtp.c:1557 fffffe8040b4fc28\n [\u003cffffffff8a0d0404\u003e] gtp_net_exit_batch_rtnl+0x124/0x2c0 drivers/net/gtp.c:2495 fffffe8040b4fc88\n [\u003cffffffff8e705b24\u003e] cleanup_net+0x5a4/0xbe0 net/core/net_namespace.c:635 fffffe8040b4fcd0\n [\u003cffffffff81754c97\u003e] process_one_work+0xbd7/0x2160 kernel/workqueue.c:3326 fffffe8040b4fd88\n [\u003cffffffff81757195\u003e] process_scheduled_works kernel/workqueue.c:3407 [inline] fffffe8040b4fec0\n [\u003cffffffff81757195\u003e] worker_thread+0x6b5/0xfa0 kernel/workqueue.c:3488 fffffe8040b4fec0\n [\u003cffffffff817782a0\u003e] kthread+0x360/0x4c0 kernel/kthread.c:397 fffffe8040b4ff78\n [\u003cffffffff814d8594\u003e] ret_from_fork+0x74/0xe0 arch/x86/kernel/process.c:172 fffffe8040b4ffb8\n [\u003cffffffff8110f509\u003e] ret_from_fork_asm+0x29/0xc0 arch/x86/entry/entry_64.S:399 fffffe8040b4ffe8\n \u003c/TASK\u003e\nModules linked in:\n\nFixes: eb28fd76c0a0 (\"gtp: Destroy device along with udp socket\u0027s netns dismantle.\")\nReported-by: Brad Spengler \u003cspender@grsecurity.net\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://patch.msgid.link/20250217203705.40342-2-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a92c3228766429fe175ecc815f895043ea505587", "tree": "1e47db05f7a5332144f6f601fd7e5c778adb81b6", "parents": [ "f6093c5ec74d5cc495f89bd359253d9c738d04d9", "d4c6bfc83936cb61fac99e9891c406fbdd40f964" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:33:31 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:33:32 2025 -0800" }, "message": "Merge branch \u0027net-fix-race-of-rtnl_net_lock-dev_net-dev\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: Fix race of rtnl_net_lock(dev_net(dev)).\n\nYael Chemla reported that commit 7fb1073300a2 (\"net: Hold rtnl_net_lock()\nin (un)?register_netdevice_notifier_dev_net().\") started to trigger KASAN\u0027s\nuse-after-free splat.\n\nThe problem is that dev_net(dev) fetched before rtnl_net_lock() might be\ndifferent after rtnl_net_lock().\n\nThe patch 2 fixes the issue by checking dev_net(dev) after rtnl_net_lock(),\nand the patch 3 fixes the same potential issue that would emerge once RTNL\nis removed.\n\nv4: https://lore.kernel.org/20250212064206.18159-1-kuniyu@amazon.com\nv3: https://lore.kernel.org/20250211051217.12613-1-kuniyu@amazon.com\nv2: https://lore.kernel.org/20250207044251.65421-1-kuniyu@amazon.com\nv1: https://lore.kernel.org/20250130232435.43622-1-kuniyu@amazon.com\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250217191129.19967-1-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d4c6bfc83936cb61fac99e9891c406fbdd40f964", "tree": "1e47db05f7a5332144f6f601fd7e5c778adb81b6", "parents": [ "65161fb544aada499c912b6010a8f7d8e04f6130" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Mon Feb 17 11:11:29 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:33:30 2025 -0800" }, "message": "dev: Use rtnl_net_dev_lock() in unregister_netdev().\n\nThe following sequence is basically illegal when dev was fetched\nwithout lookup because dev_net(dev) might be different after holding\nrtnl_net_lock():\n\n net \u003d dev_net(dev);\n rtnl_net_lock(net);\n\nLet\u0027s use rtnl_net_dev_lock() in unregister_netdev().\n\nNote that there is no real bug in unregister_netdev() for now\nbecause RTNL protects the scope even if dev_net(dev) is changed\nbefore/after RTNL.\n\nFixes: 00fb9823939e (\"dev: Hold per-netns RTNL in (un)?register_netdev().\")\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20250217191129.19967-4-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "65161fb544aada499c912b6010a8f7d8e04f6130", "tree": "da165cd9fe66da4b1696e5fb3e9b675337124adc", "parents": [ "e57a6320215c3967f51ab0edeff87db2095440e4" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Mon Feb 17 11:11:28 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:33:30 2025 -0800" }, "message": "net: Fix dev_net(dev) race in unregister_netdevice_notifier_dev_net().\n\nAfter the cited commit, dev_net(dev) is fetched before holding RTNL\nand passed to __unregister_netdevice_notifier_net().\n\nHowever, dev_net(dev) might be different after holding RTNL.\n\nIn the reported case [0], while removing a VF device, its netns was\nbeing dismantled and the VF was moved to init_net.\n\nSo the following sequence is basically illegal when dev was fetched\nwithout lookup:\n\n net \u003d dev_net(dev);\n rtnl_net_lock(net);\n\nLet\u0027s use a new helper rtnl_net_dev_lock() to fix the race.\n\nIt fetches dev_net_rcu(dev), bumps its net-\u003epassive, and checks if\ndev_net_rcu(dev) is changed after rtnl_net_lock().\n\n[0]:\nBUG: KASAN: slab-use-after-free in notifier_call_chain (kernel/notifier.c:75 (discriminator 2))\nRead of size 8 at addr ffff88810cefb4c8 by task test-bridge-lag/21127\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS rel-1.13.0-0-gf21b5a4aeb02-prebuilt.qemu.org 04/01/2014\nCall Trace:\n \u003cTASK\u003e\n dump_stack_lvl (lib/dump_stack.c:123)\n print_report (mm/kasan/report.c:379 mm/kasan/report.c:489)\n kasan_report (mm/kasan/report.c:604)\n notifier_call_chain (kernel/notifier.c:75 (discriminator 2))\n call_netdevice_notifiers_info (net/core/dev.c:2011)\n unregister_netdevice_many_notify (net/core/dev.c:11551)\n unregister_netdevice_queue (net/core/dev.c:11487)\n unregister_netdev (net/core/dev.c:11635)\n mlx5e_remove (drivers/net/ethernet/mellanox/mlx5/core/en_main.c:6552 drivers/net/ethernet/mellanox/mlx5/core/en_main.c:6579) mlx5_core\n auxiliary_bus_remove (drivers/base/auxiliary.c:230)\n device_release_driver_internal (drivers/base/dd.c:1275 drivers/base/dd.c:1296)\n bus_remove_device (./include/linux/kobject.h:193 drivers/base/base.h:73 drivers/base/bus.c:583)\n device_del (drivers/base/power/power.h:142 drivers/base/core.c:3855)\n mlx5_rescan_drivers_locked (./include/linux/auxiliary_bus.h:241 drivers/net/ethernet/mellanox/mlx5/core/dev.c:333 drivers/net/ethernet/mellanox/mlx5/core/dev.c:535 drivers/net/ethernet/mellanox/mlx5/core/dev.c:549) mlx5_core\n mlx5_unregister_device (drivers/net/ethernet/mellanox/mlx5/core/dev.c:468) mlx5_core\n mlx5_uninit_one (./include/linux/instrumented.h:68 ./include/asm-generic/bitops/instrumented-non-atomic.h:141 drivers/net/ethernet/mellanox/mlx5/core/main.c:1563) mlx5_core\n remove_one (drivers/net/ethernet/mellanox/mlx5/core/main.c:965 drivers/net/ethernet/mellanox/mlx5/core/main.c:2019) mlx5_core\n pci_device_remove (./include/linux/pm_runtime.h:129 drivers/pci/pci-driver.c:475)\n device_release_driver_internal (drivers/base/dd.c:1275 drivers/base/dd.c:1296)\n unbind_store (drivers/base/bus.c:245)\n kernfs_fop_write_iter (fs/kernfs/file.c:338)\n vfs_write (fs/read_write.c:587 (discriminator 1) fs/read_write.c:679 (discriminator 1))\n ksys_write (fs/read_write.c:732)\n do_syscall_64 (arch/x86/entry/common.c:52 (discriminator 1) arch/x86/entry/common.c:83 (discriminator 1))\n entry_SYSCALL_64_after_hwframe (arch/x86/entry/entry_64.S:130)\nRIP: 0033:0x7f6a4d5018b7\n\nFixes: 7fb1073300a2 (\"net: Hold rtnl_net_lock() in (un)?register_netdevice_notifier_dev_net().\")\nReported-by: Yael Chemla \u003cychemla@nvidia.com\u003e\nCloses: https://lore.kernel.org/netdev/146eabfe-123c-4970-901e-e961b4c09bc3@nvidia.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20250217191129.19967-3-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e57a6320215c3967f51ab0edeff87db2095440e4", "tree": "8e6775ea09f53dfce1e7fbca09991804c05aba65", "parents": [ "f6093c5ec74d5cc495f89bd359253d9c738d04d9" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Mon Feb 17 11:11:27 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:33:29 2025 -0800" }, "message": "net: Add net_passive_inc() and net_passive_dec().\n\nnet_drop_ns() is NULL when CONFIG_NET_NS is disabled.\n\nThe next patch introduces a function that increments\nand decrements net-\u003epassive.\n\nAs a prep, let\u0027s rename and export net_free() to\nnet_passive_dec() and add net_passive_inc().\n\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://lore.kernel.org/netdev/CANn89i+oUCt2VGvrbrweniTendZFEh+nwS\u003duonc004-aPkWy-Q@mail.gmail.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20250217191129.19967-2-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6093c5ec74d5cc495f89bd359253d9c738d04d9", "tree": "a320457816b9aec91faeefdfb7310265dd8e2ed6", "parents": [ "2f56be7f52ece7fc8c16a58ca9683f0a73e288e1" ], "author": { "name": "Kory Maincent", "email": "kory.maincent@bootlin.com", "time": "Mon Feb 17 14:48:11 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:30:27 2025 -0800" }, "message": "net: pse-pd: pd692x0: Fix power limit retrieval\n\nFix incorrect data offset read in the pd692x0_pi_get_pw_limit callback.\nThe issue was previously unnoticed as it was only used by the regulator\nAPI and not thoroughly tested, since the PSE is mainly controlled via\nethtool.\n\nThe function became actively used by ethtool after commit 3e9dbfec4998\n(\"net: pse-pd: Split ethtool_get_status into multiple callbacks\"),\nwhich led to the discovery of this issue.\n\nFix it by using the correct data offset.\n\nFixes: a87e699c9d33 (\"net: pse-pd: pd692x0: Enhance with new current limit and voltage read callbacks\")\nSigned-off-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20250217134812.1925345-1-kory.maincent@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2f56be7f52ece7fc8c16a58ca9683f0a73e288e1", "tree": "45bb50540898a19759a6cd0b03d68d361c28e768", "parents": [ "415cadd505464d9a11ff5e0f6e0329c127849da5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Feb 15 08:26:46 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:06:18 2025 -0800" }, "message": "MAINTAINERS: trim the GVE entry\n\nWe requested in the past that GVE patches coming out of Google should\nbe submitted only by GVE maintainers. There were too many patches\nposted which didn\u0027t follow the subsystem guidance.\n\nRecently Joshua was added to maintainers, but even tho he was asked\nto follow the netdev \"FAQ\" in the past [1] he does not follow\nthe local customs. It is not reasonable for a person who hasn\u0027t read\nthe maintainer entry for the subsystem to be a driver maintainer.\n\nWe can re-add once Joshua does some on-list reviews to prove\nthe fluency with the upstream process.\n\nLink: https://lore.kernel.org/20240610172720.073d5912@kernel.org # [1]\nLink: https://patch.msgid.link/20250215162646.2446559-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "415cadd505464d9a11ff5e0f6e0329c127849da5", "tree": "29769b04c518dd51f96bad33d82e86e51e2a87b3", "parents": [ "f5da7c45188eea71394bf445655cae2df88a7788" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Fri Feb 14 14:43:59 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 18:01:24 2025 -0800" }, "message": "gve: set xdp redirect target only when it is available\n\nBefore this patch the NETDEV_XDP_ACT_NDO_XMIT XDP feature flag is set by\ndefault as part of driver initialization, and is never cleared. However,\nthis flag differs from others in that it is used as an indicator for\nwhether the driver is ready to perform the ndo_xdp_xmit operation as\npart of an XDP_REDIRECT. Kernel helpers\nxdp_features_(set|clear)_redirect_target exist to convey this meaning.\n\nThis patch ensures that the netdev is only reported as a redirect target\nwhen XDP queues exist to forward traffic.\n\nFixes: 39a7f4aa3e4a (\"gve: Add XDP REDIRECT support for GQI-QPL format\")\nCc: stable@vger.kernel.org\nReviewed-by: Praveen Kaligineedi \u003cpkaligineedi@google.com\u003e\nReviewed-by: Jeroen de Borst \u003cjeroendb@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nLink: https://patch.msgid.link/20250214224417.1237818-1-joshwash@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f5da7c45188eea71394bf445655cae2df88a7788", "tree": "563f7b5a52f66929a8e35e188c7493e679acfa48", "parents": [ "f7b5279b67e76978ad7b3800030680774bfba4cb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Feb 17 15:29:05 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 18 16:02:18 2025 -0800" }, "message": "tcp: adjust rcvq_space after updating scaling ratio\n\nSince commit under Fixes we set the window clamp in accordance\nto newly measured rcvbuf scaling_ratio. If the scaling_ratio\ndecreased significantly we may put ourselves in a situation\nwhere windows become smaller than rcvq_space, preventing\ntcp_rcv_space_adjust() from increasing rcvbuf.\n\nThe significant decrease of scaling_ratio is far more likely\nsince commit 697a6c8cec03 (\"tcp: increase the default TCP scaling ratio\"),\nwhich increased the \"default\" scaling ratio from ~30% to 50%.\n\nHitting the bad condition depends a lot on TCP tuning, and\ndrivers at play. One of Meta\u0027s workloads hits it reliably\nunder following conditions:\n - default rcvbuf of 125k\n - sender MTU 1500, receiver MTU 5000\n - driver settles on scaling_ratio of 78 for the config above.\nInitial rcvq_space gets calculated as TCP_INIT_CWND * tp-\u003eadvmss\n(10 * 5k \u003d 50k). Once we find out the true scaling ratio and\nMSS we clamp the windows to 38k. Triggering the condition also\ndepends on the message sequence of this workload. I can\u0027t repro\nthe problem with simple iperf or TCP_RR-style tests.\n\nFixes: a2cbb1603943 (\"tcp: Update window clamping condition\")\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nLink: https://patch.msgid.link/20250217232905.3162187-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f7b5279b67e76978ad7b3800030680774bfba4cb", "tree": "f9df1432187a4be7273716c30e8e939a674dbca2", "parents": [ "0a4f598c84fc0eeb143ba03cdd3fc3d857061c3c", "85928e9c436398abcac32a9afa2f591895dd497d" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:16 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:17 2025 +0100" }, "message": "Merge branch \u0027sockmap-vsock-for-connectible-sockets-allow-only-connected\u0027\n\nMichal Luczaj says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsockmap, vsock: For connectible sockets allow only connected\n\nSeries deals with one more case of vsock surprising BPF/sockmap by being\ninconsistency about (having an) assigned transport.\n\nKASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]\nCPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+\nWorkqueue: vsock-loopback vsock_loopback_work\nRIP: 0010:vsock_read_skb+0x4b/0x90\nCall Trace:\n sk_psock_verdict_data_ready+0xa4/0x2e0\n virtio_transport_recv_pkt+0x1ca8/0x2acc\n vsock_loopback_work+0x27d/0x3f0\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x35a/0x700\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n\nThis bug, similarly to commit f6abafcd32f9 (\"vsock/bpf: return early if\ntransport is not assigned\"), could be fixed with a single NULL check. But\ninstead, let\u0027s explore another approach: take a hint from\nvsock_bpf_update_proto() and teach sockmap to accept only vsocks that are\nalready connected (no risk of transport being dropped or reassigned). At\nthe same time straight reject the listeners (vsock listening sockets do not\ncarry any transport anyway). This way BPF does not have to worry about\nvsk-\u003etransport becoming NULL.\n\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250213-vsock-listen-sockmap-nullptr-v1-0-994b7cd2f16b@rbox.co\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "85928e9c436398abcac32a9afa2f591895dd497d", "tree": "f9df1432187a4be7273716c30e8e939a674dbca2", "parents": [ "8350695bfb169b1924626a68f76b369ad01f18f2" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Thu Feb 13 12:58:52 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:01 2025 +0100" }, "message": "selftest/bpf: Add vsock test for sockmap rejecting unconnected\n\nVerify that for a connectible AF_VSOCK socket, merely having a transport\nassigned is insufficient; socket must be connected for the sockmap to\naccept.\n\nThis does not test datagram vsocks. Even though it hardly matters. VMCI is\nthe only transport that features VSOCK_TRANSPORT_F_DGRAM, but it has an\nunimplemented vsock_transport::readskb() callback, making it unsupported by\nBPF/sockmap.\n\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "8350695bfb169b1924626a68f76b369ad01f18f2", "tree": "66ac6fc2c53bf050cf78ee17d6e8933efc022c85", "parents": [ "857ae05549ee2542317e7084ecaa5f8536634dd9" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Thu Feb 13 12:58:51 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:01 2025 +0100" }, "message": "selftest/bpf: Adapt vsock_delete_on_close to sockmap rejecting unconnected\n\nCommit 515745445e92 (\"selftest/bpf: Add test for vsock removal from sockmap\non close()\") added test that checked if proto::close() callback was invoked\non AF_VSOCK socket release. I.e. it verified that a close()d vsock does\nindeed get removed from the sockmap.\n\nIt was done simply by creating a socket pair and attempting to replace a\nclose()d one with its peer. Since, due to a recent change, sockmap does not\nallow updating index with a non-established connectible vsock, redo it with\na freshly established one.\n\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "857ae05549ee2542317e7084ecaa5f8536634dd9", "tree": "7be39d140f3ad13f7b8926196745c21c6d01cac2", "parents": [ "8fb5bb169d17cdd12c2dcc2e96830ed487d77a0f" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Thu Feb 13 12:58:50 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:01 2025 +0100" }, "message": "vsock/bpf: Warn on socket without transport\n\nIn the spirit of commit 91751e248256 (\"vsock: prevent null-ptr-deref in\nvsock_*[has_data|has_space]\"), armorize the \"impossible\" cases with a\nwarning.\n\nFixes: 634f1a7110b4 (\"vsock: support sockmap\")\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "8fb5bb169d17cdd12c2dcc2e96830ed487d77a0f", "tree": "fd6b14c3d7efbe00c68110dc941b90fefff6b59c", "parents": [ "0a4f598c84fc0eeb143ba03cdd3fc3d857061c3c" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Thu Feb 13 12:58:49 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 18 12:00:00 2025 +0100" }, "message": "sockmap, vsock: For connectible sockets allow only connected\n\nsockmap expects all vsocks to have a transport assigned, which is expressed\nin vsock_proto::psock_update_sk_prot(). However, there is an edge case\nwhere an unconnected (connectible) socket may lose its previously assigned\ntransport. This is handled with a NULL check in the vsock/BPF recv path.\n\nAnother design detail is that listening vsocks are not supposed to have any\ntransport assigned at all. Which implies they are not supported by the\nsockmap. But this is complicated by the fact that a socket, before\nswitching to TCP_LISTEN, may have had some transport assigned during a\nfailed connect() attempt. Hence, we may end up with a listening vsock in a\nsockmap, which blows up quickly:\n\nKASAN: null-ptr-deref in range [0x0000000000000120-0x0000000000000127]\nCPU: 7 UID: 0 PID: 56 Comm: kworker/7:0 Not tainted 6.14.0-rc1+\nWorkqueue: vsock-loopback vsock_loopback_work\nRIP: 0010:vsock_read_skb+0x4b/0x90\nCall Trace:\n sk_psock_verdict_data_ready+0xa4/0x2e0\n virtio_transport_recv_pkt+0x1ca8/0x2acc\n vsock_loopback_work+0x27d/0x3f0\n process_one_work+0x846/0x1420\n worker_thread+0x5b3/0xf80\n kthread+0x35a/0x700\n ret_from_fork+0x2d/0x70\n ret_from_fork_asm+0x1a/0x30\n\nFor connectible sockets, instead of relying solely on the state of\nvsk-\u003etransport, tell sockmap to only allow those representing established\nconnections. This aligns with the behaviour for AF_INET and AF_UNIX.\n\nFixes: 634f1a7110b4 (\"vsock: support sockmap\")\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" }, { "commit": "0a4f598c84fc0eeb143ba03cdd3fc3d857061c3c", "tree": "94f1709969882a9cb654f29c0aea2a7af019a043", "parents": [ "bdf5d13aa05ec314d4385b31ac974d6c7e0997c9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Feb 15 14:52:00 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Feb 17 16:52:07 2025 -0800" }, "message": "MAINTAINERS: create entry for ethtool MAC merge\n\nVladimir implemented the MAC merge support and reviews all\nthe new driver implementations.\n\nAcked-by: Vladimir Oltean \u003cvladimir.oltean@nxp.com\u003e\nLink: https://patch.msgid.link/20250215225200.2652212-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bdf5d13aa05ec314d4385b31ac974d6c7e0997c9", "tree": "5afd5551e8c91a2cd0be61eeb638f83c6f1bb658", "parents": [ "915e34d5ad35a6a9e56113f852ade4a730fb88f0" ], "author": { "name": "Nick Child", "email": "nnac123@linux.ibm.com", "time": "Fri Feb 14 09:52:33 2025 -0600" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Feb 17 16:41:57 2025 -0800" }, "message": "ibmvnic: Don\u0027t reference skb after sending to VIOS\n\nPreviously, after successfully flushing the xmit buffer to VIOS,\nthe tx_bytes stat was incremented by the length of the skb.\n\nIt is invalid to access the skb memory after sending the buffer to\nthe VIOS because, at any point after sending, the VIOS can trigger\nan interrupt to free this memory. A race between reading skb-\u003elen\nand freeing the skb is possible (especially during LPM) and will\nresult in use-after-free:\n \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n BUG: KASAN: slab-use-after-free in ibmvnic_xmit+0x75c/0x1808 [ibmvnic]\n Read of size 4 at addr c00000024eb48a70 by task hxecom/14495\n \u003c...\u003e\n Call Trace:\n [c000000118f66cf0] [c0000000018cba6c] dump_stack_lvl+0x84/0xe8 (unreliable)\n [c000000118f66d20] [c0000000006f0080] print_report+0x1a8/0x7f0\n [c000000118f66df0] [c0000000006f08f0] kasan_report+0x128/0x1f8\n [c000000118f66f00] [c0000000006f2868] __asan_load4+0xac/0xe0\n [c000000118f66f20] [c0080000046eac84] ibmvnic_xmit+0x75c/0x1808 [ibmvnic]\n [c000000118f67340] [c0000000014be168] dev_hard_start_xmit+0x150/0x358\n \u003c...\u003e\n Freed by task 0:\n kasan_save_stack+0x34/0x68\n kasan_save_track+0x2c/0x50\n kasan_save_free_info+0x64/0x108\n __kasan_mempool_poison_object+0x148/0x2d4\n napi_skb_cache_put+0x5c/0x194\n net_tx_action+0x154/0x5b8\n handle_softirqs+0x20c/0x60c\n do_softirq_own_stack+0x6c/0x88\n \u003c...\u003e\n The buggy address belongs to the object at c00000024eb48a00 which\n belongs to the cache skbuff_head_cache of size 224\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nFixes: 032c5e82847a (\"Driver for IBM System i/p VNIC protocol\")\nSigned-off-by: Nick Child \u003cnnac123@linux.ibm.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250214155233.235559-1-nnac123@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "915e34d5ad35a6a9e56113f852ade4a730fb88f0", "tree": "6a0e4d9144e8b1900370eb2cf645122c136f91a9", "parents": [ "07b598c0e6f06a0f254c88dafb4ad50f8a8c6eea" ], "author": { "name": "Julian Ruess", "email": "julianr@linux.ibm.com", "time": "Fri Feb 14 13:01:37 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Feb 17 16:40:07 2025 -0800" }, "message": "s390/ism: add release function for struct device\n\nAccording to device_release() in /drivers/base/core.c,\na device without a release function is a broken device\nand must be fixed.\n\nThe current code directly frees the device after calling device_add()\nwithout waiting for other kernel parts to release their references.\nThus, a reference could still be held to a struct device,\ne.g., by sysfs, leading to potential use-after-free\nissues if a proper release function is not set.\n\nFixes: 8c81ba20349d (\"net/smc: De-tangle ism and smc device initialization\")\nReviewed-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nReviewed-by: Wenjia Zhang \u003cwenjia@linux.ibm.com\u003e\nSigned-off-by: Julian Ruess \u003cjulianr@linux.ibm.com\u003e\nSigned-off-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20250214120137.563409-1-wintera@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "07b598c0e6f06a0f254c88dafb4ad50f8a8c6eea", "tree": "dbb210b7fc9ee5aad1a980107fac015b343fdc54", "parents": [ "071ed42cff4fcdd89025d966d48eabef59913bf2" ], "author": { "name": "Gavrilov Ilia", "email": "Ilia.Gavrilov@infotecs.ru", "time": "Thu Feb 13 15:20:55 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Feb 17 16:35:55 2025 -0800" }, "message": "drop_monitor: fix incorrect initialization order\n\nSyzkaller reports the following bug:\n\nBUG: spinlock bad magic on CPU#1, syz-executor.0/7995\n lock: 0xffff88805303f3e0, .magic: 00000000, .owner: \u003cnone\u003e/-1, .owner_cpu: 0\nCPU: 1 PID: 7995 Comm: syz-executor.0 Tainted: G E 5.10.209+ #1\nHardware name: VMware, Inc. VMware Virtual Platform/440BX Desktop Reference Platform, BIOS 6.00 11/12/2020\nCall Trace:\n __dump_stack lib/dump_stack.c:77 [inline]\n dump_stack+0x119/0x179 lib/dump_stack.c:118\n debug_spin_lock_before kernel/locking/spinlock_debug.c:83 [inline]\n do_raw_spin_lock+0x1f6/0x270 kernel/locking/spinlock_debug.c:112\n __raw_spin_lock_irqsave include/linux/spinlock_api_smp.h:117 [inline]\n _raw_spin_lock_irqsave+0x50/0x70 kernel/locking/spinlock.c:159\n reset_per_cpu_data+0xe6/0x240 [drop_monitor]\n net_dm_cmd_trace+0x43d/0x17a0 [drop_monitor]\n genl_family_rcv_msg_doit+0x22f/0x330 net/netlink/genetlink.c:739\n genl_family_rcv_msg net/netlink/genetlink.c:783 [inline]\n genl_rcv_msg+0x341/0x5a0 net/netlink/genetlink.c:800\n netlink_rcv_skb+0x14d/0x440 net/netlink/af_netlink.c:2497\n genl_rcv+0x29/0x40 net/netlink/genetlink.c:811\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x54b/0x800 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x914/0xe00 net/netlink/af_netlink.c:1916\n sock_sendmsg_nosec net/socket.c:651 [inline]\n __sock_sendmsg+0x157/0x190 net/socket.c:663\n ____sys_sendmsg+0x712/0x870 net/socket.c:2378\n ___sys_sendmsg+0xf8/0x170 net/socket.c:2432\n __sys_sendmsg+0xea/0x1b0 net/socket.c:2461\n do_syscall_64+0x30/0x40 arch/x86/entry/common.c:46\n entry_SYSCALL_64_after_hwframe+0x62/0xc7\nRIP: 0033:0x7f3f9815aee9\nCode: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f3f972bf0c8 EFLAGS: 00000246 ORIG_RAX: 000000000000002e\nRAX: ffffffffffffffda RBX: 00007f3f9826d050 RCX: 00007f3f9815aee9\nRDX: 0000000020000000 RSI: 0000000020001300 RDI: 0000000000000007\nRBP: 00007f3f981b63bd R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000\nR13: 000000000000006e R14: 00007f3f9826d050 R15: 00007ffe01ee6768\n\nIf drop_monitor is built as a kernel module, syzkaller may have time\nto send a netlink NET_DM_CMD_START message during the module loading.\nThis will call the net_dm_monitor_start() function that uses\na spinlock that has not yet been initialized.\n\nTo fix this, let\u0027s place resource initialization above the registration\nof a generic netlink family.\n\nFound by InfoTeCS on behalf of Linux Verification Center\n(linuxtesting.org) with Syzkaller.\n\nFixes: 9a8afc8d3962 (\"Network Drop Monitor: Adding drop monitor implementation \u0026 Netlink protocol\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ilia Gavrilov \u003cIlia.Gavrilov@infotecs.ru\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20250213152054.2785669-1-Ilia.Gavrilov@infotecs.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "071ed42cff4fcdd89025d966d48eabef59913bf2", "tree": "15e4beca2e5938509346b29852741d23fb05c804", "parents": [ "9593172d93b9f91c362baec4643003dc29802929" ], "author": { "name": "Pierre Riteau", "email": "pierre@stackhpc.com", "time": "Thu Feb 13 23:36:10 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Sat Feb 15 09:07:09 2025 -0800" }, "message": "net/sched: cls_api: fix error handling causing NULL dereference\n\ntcf_exts_miss_cookie_base_alloc() calls xa_alloc_cyclic() which can\nreturn 1 if the allocation succeeded after wrapping. This was treated as\nan error, with value 1 returned to caller tcf_exts_init_ex() which sets\nexts-\u003eactions to NULL and returns 1 to caller fl_change().\n\nfl_change() treats err \u003d\u003d 1 as success, calling tcf_exts_validate_ex()\nwhich calls tcf_action_init() with exts-\u003eactions as argument, where it\nis dereferenced.\n\nExample trace:\n\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nCPU: 114 PID: 16151 Comm: handler114 Kdump: loaded Not tainted 5.14.0-503.16.1.el9_5.x86_64 #1\nRIP: 0010:tcf_action_init+0x1f8/0x2c0\nCall Trace:\n tcf_action_init+0x1f8/0x2c0\n tcf_exts_validate_ex+0x175/0x190\n fl_change+0x537/0x1120 [cls_flower]\n\nFixes: 80cd22c35c90 (\"net/sched: cls_api: Support hardware miss to tc action\")\nSigned-off-by: Pierre Riteau \u003cpierre@stackhpc.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nLink: https://patch.msgid.link/20250213223610.320278-1-pierre@stackhpc.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9593172d93b9f91c362baec4643003dc29802929", "tree": "958d6d1f09d3a88b88ac9d507bb365b51c369474", "parents": [ "55eff109e76a14e5ed10c8c3c3978d20a35e2a4d" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@amazon.com", "time": "Thu Feb 13 13:33:54 2025 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Feb 14 19:55:41 2025 -0800" }, "message": "geneve: Fix use-after-free in geneve_find_dev().\n\nsyzkaller reported a use-after-free in geneve_find_dev() [0]\nwithout repro.\n\ngeneve_configure() links struct geneve_dev.next to\nnet_generic(net, geneve_net_id)-\u003egeneve_list.\n\nThe net here could differ from dev_net(dev) if IFLA_NET_NS_PID,\nIFLA_NET_NS_FD, or IFLA_TARGET_NETNSID is set.\n\nWhen dev_net(dev) is dismantled, geneve_exit_batch_rtnl() finally\ncalls unregister_netdevice_queue() for each dev in the netns,\nand later the dev is freed.\n\nHowever, its geneve_dev.next is still linked to the backend UDP\nsocket netns.\n\nThen, use-after-free will occur when another geneve dev is created\nin the netns.\n\nLet\u0027s call geneve_dellink() instead in geneve_destroy_tunnels().\n\n[0]:\nBUG: KASAN: slab-use-after-free in geneve_find_dev drivers/net/geneve.c:1295 [inline]\nBUG: KASAN: slab-use-after-free in geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\nRead of size 2 at addr ffff000054d6ee24 by task syz.1.4029/13441\n\nCPU: 1 UID: 0 PID: 13441 Comm: syz.1.4029 Not tainted 6.13.0-g0ad9617c78ac #24 dc35ca22c79fb82e8e7bc5c9c9adafea898b1e3d\nHardware name: linux,dummy-virt (DT)\nCall trace:\n show_stack+0x38/0x50 arch/arm64/kernel/stacktrace.c:466 (C)\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0xbc/0x108 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x16c/0x6f0 mm/kasan/report.c:489\n kasan_report+0xc0/0x120 mm/kasan/report.c:602\n __asan_report_load2_noabort+0x20/0x30 mm/kasan/report_generic.c:379\n geneve_find_dev drivers/net/geneve.c:1295 [inline]\n geneve_configure+0x234/0x858 drivers/net/geneve.c:1343\n geneve_newlink+0xb8/0x128 drivers/net/geneve.c:1634\n rtnl_newlink_create+0x23c/0x868 net/core/rtnetlink.c:3795\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892\n sock_sendmsg_nosec net/socket.c:713 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568\n ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622\n __sys_sendmsg net/socket.c:2654 [inline]\n __do_sys_sendmsg net/socket.c:2659 [inline]\n __se_sys_sendmsg net/socket.c:2657 [inline]\n __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151\n el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600\n\nAllocated by task 13247:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x30/0x68 mm/kasan/common.c:68\n kasan_save_alloc_info+0x44/0x58 mm/kasan/generic.c:568\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x84/0xa0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __do_kmalloc_node mm/slub.c:4298 [inline]\n __kmalloc_node_noprof+0x2a0/0x560 mm/slub.c:4304\n __kvmalloc_node_noprof+0x9c/0x230 mm/util.c:645\n alloc_netdev_mqs+0xb8/0x11a0 net/core/dev.c:11470\n rtnl_create_link+0x2b8/0xb50 net/core/rtnetlink.c:3604\n rtnl_newlink_create+0x19c/0x868 net/core/rtnetlink.c:3780\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n rtnl_newlink+0x1054/0x1630 net/core/rtnetlink.c:4021\n rtnetlink_rcv_msg+0x61c/0x918 net/core/rtnetlink.c:6911\n netlink_rcv_skb+0x1dc/0x398 net/netlink/af_netlink.c:2543\n rtnetlink_rcv+0x34/0x50 net/core/rtnetlink.c:6938\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0x618/0x838 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x5fc/0x8b0 net/netlink/af_netlink.c:1892\n sock_sendmsg_nosec net/socket.c:713 [inline]\n __sock_sendmsg net/socket.c:728 [inline]\n ____sys_sendmsg+0x410/0x6f8 net/socket.c:2568\n ___sys_sendmsg+0x178/0x1d8 net/socket.c:2622\n __sys_sendmsg net/socket.c:2654 [inline]\n __do_sys_sendmsg net/socket.c:2659 [inline]\n __se_sys_sendmsg net/socket.c:2657 [inline]\n __arm64_sys_sendmsg+0x12c/0x1c8 net/socket.c:2657\n __invoke_syscall arch/arm64/kernel/syscall.c:35 [inline]\n invoke_syscall+0x90/0x278 arch/arm64/kernel/syscall.c:49\n el0_svc_common+0x13c/0x250 arch/arm64/kernel/syscall.c:132\n do_el0_svc+0x54/0x70 arch/arm64/kernel/syscall.c:151\n el0_svc+0x4c/0xa8 arch/arm64/kernel/entry-common.c:744\n el0t_64_sync_handler+0x78/0x108 arch/arm64/kernel/entry-common.c:762\n el0t_64_sync+0x198/0x1a0 arch/arm64/kernel/entry.S:600\n\nFreed by task 45:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x30/0x68 mm/kasan/common.c:68\n kasan_save_free_info+0x58/0x70 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x48/0x68 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2353 [inline]\n slab_free mm/slub.c:4613 [inline]\n kfree+0x140/0x420 mm/slub.c:4761\n kvfree+0x4c/0x68 mm/util.c:688\n netdev_release+0x94/0xc8 net/core/net-sysfs.c:2065\n device_release+0x98/0x1c0\n kobject_cleanup lib/kobject.c:689 [inline]\n kobject_release lib/kobject.c:720 [inline]\n kref_put include/linux/kref.h:65 [inline]\n kobject_put+0x2b0/0x438 lib/kobject.c:737\n netdev_run_todo+0xe5c/0xfc8 net/core/dev.c:11185\n rtnl_unlock+0x20/0x38 net/core/rtnetlink.c:151\n cleanup_net+0x4fc/0x8c0 net/core/net_namespace.c:648\n process_one_work+0x700/0x1398 kernel/workqueue.c:3236\n process_scheduled_works kernel/workqueue.c:3317 [inline]\n worker_thread+0x8c4/0xe10 kernel/workqueue.c:3398\n kthread+0x4bc/0x608 kernel/kthread.c:464\n ret_from_fork+0x10/0x20 arch/arm64/kernel/entry.S:862\n\nThe buggy address belongs to the object at ffff000054d6e000\n which belongs to the cache kmalloc-cg-4k of size 4096\nThe buggy address is located 3620 bytes inside of\n freed 4096-byte region [ffff000054d6e000, ffff000054d6f000)\n\nThe buggy address belongs to the physical page:\npage: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x94d68\nhead: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\nmemcg:ffff000016276181\nflags: 0x3fffe0000000040(head|node\u003d0|zone\u003d0|lastcpupid\u003d0x1ffff)\npage_type: f5(slab)\nraw: 03fffe0000000040 ffff0000c000f500 dead000000000122 0000000000000000\nraw: 0000000000000000 0000000000040004 00000001f5000000 ffff000016276181\nhead: 03fffe0000000040 ffff0000c000f500 dead000000000122 0000000000000000\nhead: 0000000000000000 0000000000040004 00000001f5000000 ffff000016276181\nhead: 03fffe0000000003 fffffdffc1535a01 ffffffffffffffff 0000000000000000\nhead: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000\npage dumped because: kasan: bad access detected\n\nMemory state around the buggy address:\n ffff000054d6ed00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff000054d6ed80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\u003effff000054d6ee00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ^\n ffff000054d6ee80: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n ffff000054d6ef00: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n\nFixes: 2d07dc79fe04 (\"geneve: add initial netdev driver for GENEVE tunnels\")\nReported-by: syzkaller \u003csyzkaller@googlegroups.com\u003e\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@amazon.com\u003e\nLink: https://patch.msgid.link/20250213043354.91368-1-kuniyu@amazon.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "55eff109e76a14e5ed10c8c3c3978d20a35e2a4d", "tree": "e78ba8b368dc4ebf2b83ac3ff2d5b48e4885af2c", "parents": [ "0d1fac6d26aff5df21bb4ec980d9b7a11c410b96" ], "author": { "name": "Junnan Wu", "email": "junnan01.wu@samsung.com", "time": "Fri Feb 14 09:22:00 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Feb 14 19:52:06 2025 -0800" }, "message": "vsock/virtio: fix variables initialization during resuming\n\nWhen executing suspend to ram twice in a row,\nthe `rx_buf_nr` and `rx_buf_max_nr` increase to three times vq-\u003enum_free.\nThen after virtqueue_get_buf and `rx_buf_nr` decreased\nin function virtio_transport_rx_work,\nthe condition to fill rx buffer\n(rx_buf_nr \u003c rx_buf_max_nr / 2) will never be met.\n\nIt is because that `rx_buf_nr` and `rx_buf_max_nr`\nare initialized only in virtio_vsock_probe(),\nbut they should be reset whenever virtqueues are recreated,\nlike after a suspend/resume.\n\nMove the `rx_buf_nr` and `rx_buf_max_nr` initialization in\nvirtio_vsock_vqs_init(), so we are sure that they are properly\ninitialized, every time we initialize the virtqueues, either when we\nload the driver or after a suspend/resume.\n\nTo prevent erroneous atomic load operations on the `queued_replies`\nin the virtio_transport_send_pkt_work() function\nwhich may disrupt the scheduling of vsock-\u003erx_work\nwhen transmitting reply-required socket packets,\nthis atomic variable must undergo synchronized initialization\nalongside the preceding two variables after a suspend/resume.\n\nFixes: bd50c5dc182b (\"vsock/virtio: add support for device suspend/resume\")\nLink: https://lore.kernel.org/virtualization/20250207052033.2222629-1-junnan01.wu@samsung.com/\nCo-developed-by: Ying Gao \u003cying01.gao@samsung.com\u003e\nSigned-off-by: Ying Gao \u003cying01.gao@samsung.com\u003e\nSigned-off-by: Junnan Wu \u003cjunnan01.wu@samsung.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nAcked-by: Michael S. Tsirkin \u003cmst@redhat.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20250214012200.1883896-1-junnan01.wu@samsung.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0d1fac6d26aff5df21bb4ec980d9b7a11c410b96", "tree": "92592a5c74b7d292e7936f3ce7a121bf5209bb6f", "parents": [ "054e61bb1de4fa02d148344152007facbcb28583" ], "author": { "name": "Stephan Gerhold", "email": "stephan.gerhold@linaro.org", "time": "Wed Feb 12 12:15:35 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Feb 14 13:39:55 2025 -0800" }, "message": "net: wwan: mhi_wwan_mbim: Silence sequence number glitch errors\n\nWhen using the Qualcomm X55 modem on the ThinkPad X13s, the kernel log is\nconstantly being filled with errors related to a \"sequence number glitch\",\ne.g.:\n\n\t[ 1903.284538] sequence number glitch prev\u003d16 curr\u003d0\n\t[ 1913.812205] sequence number glitch prev\u003d50 curr\u003d0\n\t[ 1923.698219] sequence number glitch prev\u003d142 curr\u003d0\n\t[ 2029.248276] sequence number glitch prev\u003d1555 curr\u003d0\n\t[ 2046.333059] sequence number glitch prev\u003d70 curr\u003d0\n\t[ 2076.520067] sequence number glitch prev\u003d272 curr\u003d0\n\t[ 2158.704202] sequence number glitch prev\u003d2655 curr\u003d0\n\t[ 2218.530776] sequence number glitch prev\u003d2349 curr\u003d0\n\t[ 2225.579092] sequence number glitch prev\u003d6 curr\u003d0\n\nInternet connectivity is working fine, so this error seems harmless. It\nlooks like modem does not preserve the sequence number when entering low\npower state; the amount of errors depends on how actively the modem is\nbeing used.\n\nA similar issue has also been seen on USB-based MBIM modems [1]. However,\nin cdc_ncm.c the \"sequence number glitch\" message is a debug message\ninstead of an error. Apply the same to the mhi_wwan_mbim.c driver to\nsilence these errors when using the modem.\n\n[1]: https://lists.freedesktop.org/archives/libmbim-devel/2016-November/000781.html\n\nSigned-off-by: Stephan Gerhold \u003cstephan.gerhold@linaro.org\u003e\nReviewed-by: Loic Poulain \u003cloic.poulain@linaro.org\u003e\nAcked-by: Manivannan Sadhasivam \u003cmanivannan.sadhasivam@linaro.org\u003e\nLink: https://patch.msgid.link/20250212-mhi-wwan-mbim-sequence-glitch-v1-1-503735977cbd@linaro.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "054e61bb1de4fa02d148344152007facbcb28583", "tree": "49bf67064fde0747bbbee1af17cec90930da618b", "parents": [ "348f968b89bfeec0bb53dd82dba58b94d97fbd34" ], "author": { "name": "Jeroen de Borst", "email": "jeroendb@google.com", "time": "Thu Feb 13 10:45:23 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Feb 14 13:33:11 2025 -0800" }, "message": "gve: Update MAINTAINERS\n\nUpdating MAINTAINERS to include active contributers.\n\nSigned-off-by: Jeroen de Borst \u003cjeroendb@google.com\u003e\nLink: https://patch.msgid.link/20250213184523.2002582-1-jeroendb@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "348f968b89bfeec0bb53dd82dba58b94d97fbd34", "tree": "6346da22168bc50cc5d077405aad86f982b962ca", "parents": [ "945ce413ac14388219afe09de84ee08994f05e53", "488fb6effe03e20f38d34da7425de77bbd3e2665" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 12:17:04 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 12:17:04 2025 -0800" }, "message": "Merge tag \u0027net-6.14-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Including fixes from netfilter, wireless and bluetooth.\n\n Kalle Valo steps down after serving as the WiFi driver maintainer for\n over a decade.\n\n Current release - fix to a fix:\n\n - vsock: orphan socket after transport release, avoid null-deref\n\n - Bluetooth: L2CAP: fix corrupted list in hci_chan_del\n\n Current release - regressions:\n\n - eth:\n - stmmac: correct Rx buffer layout when SPH is enabled\n - iavf: fix a locking bug in an error path\n\n - rxrpc: fix alteration of headers whilst zerocopy pending\n\n - s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH\n\n - Revert \"netfilter: flowtable: teardown flow if cached mtu is stale\"\n\n Current release - new code bugs:\n\n - rxrpc: fix ipv6 path MTU discovery, only ipv4 worked\n\n - pse-pd: fix deadlock in current limit functions\n\n Previous releases - regressions:\n\n - rtnetlink: fix netns refleak with rtnl_setlink()\n\n - wifi: brcmfmac: use random seed flag for BCM4355 and BCM4364\n firmware\n\n Previous releases - always broken:\n\n - add missing RCU protection of struct net throughout the stack\n\n - can: rockchip: bail out if skb cannot be allocated\n\n - eth: ti: am65-cpsw: base XDP support fixes\n\n Misc:\n\n - ethtool: tsconfig: update the format of hwtstamp flags, changes the\n uAPI but this uAPI was not in any release yet\"\n\n* tag \u0027net-6.14-rc3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (72 commits)\n net: pse-pd: Fix deadlock in current limit functions\n rxrpc: Fix ipv6 path MTU discovery\n Reapply \"net: skb: introduce and use a single page frag cache\"\n s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH\n mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()\n ipv6: mcast: add RCU protection to mld_newpack()\n team: better TEAM_OPTION_TYPE_STRING validation\n Bluetooth: L2CAP: Fix corrupted list in hci_chan_del\n Bluetooth: btintel_pcie: Fix a potential race condition\n Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case\n net: ethernet: ti: am65-cpsw: fix RX \u0026 TX statistics for XDP_TX case\n net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\n vsock/test: Add test for SO_LINGER null ptr deref\n vsock: Orphan socket after transport release\n MAINTAINERS: Add sctp headers to the general netdev entry\n Revert \"netfilter: flowtable: teardown flow if cached mtu is stale\"\n iavf: Fix a locking bug in an error path\n rxrpc: Fix alteration of headers whilst zerocopy pending\n net: phylink: make configuring clock-stop dependent on MAC support\n ...\n" }, { "commit": "945ce413ac14388219afe09de84ee08994f05e53", "tree": "04ff4367e7403406337a83a847c9a1b255b654c7", "parents": [ "1854c7f79dcaaba9f1c0b131445ace03f9fd532d", "da2dccd7451de62b175fb8f0808d644959e964c7" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 12:06:29 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 12:06:29 2025 -0800" }, "message": "Merge tag \u0027for-6.14-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux\n\nPull btrfs fixes from David Sterba:\n\n - fix stale page cache after race between readahead and direct IO write\n\n - fix hole expansion when writing at an offset beyond EOF, the range\n will not be zeroed\n\n - use proper way to calculate offsets in folio ranges\n\n* tag \u0027for-6.14-rc2-tag\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kdave/linux:\n btrfs: fix hole expansion when writing at an offset beyond EOF\n btrfs: fix stale page cache after race between readahead and direct IO write\n btrfs: fix two misuses of folio_shift()\n" }, { "commit": "1854c7f79dcaaba9f1c0b131445ace03f9fd532d", "tree": "329fba56f58c788616b13f4019a815b0d129ab25", "parents": [ "ab68d7eb7b1a64f3f4710da46cc5f93c6c154942", "406e445b3c6be65ab0ee961145e74bfd7ef6c9e1" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 11:58:11 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 11:58:11 2025 -0800" }, "message": "Merge tag \u0027bcachefs-2025-02-12\u0027 of git://evilpiepirate.org/bcachefs\n\nPull bcachefs fixes from Kent Overstreet:\n \"Just small stuff.\n\n As a general announcement, on disk format is now frozen in my master\n branch - future on disk format changes will be optional, not required.\n\n - More fixes for going read-only: the previous fix was insufficient,\n but with more work on ordering journal reclaim flushing (and a\n btree node accounting fix so we don\u0027t split until we have to) the\n tiering_replication test now consistently goes read-only in less\n than a second.\n\n - fix for fsck when we have reflink pointers to missing indirect\n extents\n\n - some transaction restart handling fixes from Alan; the \"Pass\n _orig_restart_count to trans_was_restarted\" likely fixes some rare\n undefined behaviour heisenbugs\"\n\n* tag \u0027bcachefs-2025-02-12\u0027 of git://evilpiepirate.org/bcachefs:\n bcachefs: Reuse transaction\n bcachefs: Pass _orig_restart_count to trans_was_restarted\n bcachefs: CONFIG_BCACHEFS_INJECT_TRANSACTION_RESTARTS\n bcachefs: Fix want_new_bset() so we write until the end of the btree node\n bcachefs: Split out journal pins by btree level\n bcachefs: Fix use after free\n bcachefs: Fix marking reflink pointers to missing indirect extents\n" }, { "commit": "488fb6effe03e20f38d34da7425de77bbd3e2665", "tree": "4d3eaee7d33827df98a9b993c2f73a26afedbd17", "parents": [ "540cda75884a6ba4c289980c84392261b1f61a9c" ], "author": { "name": "Kory Maincent", "email": "kory.maincent@bootlin.com", "time": "Wed Feb 12 16:17:51 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 10:00:39 2025 -0800" }, "message": "net: pse-pd: Fix deadlock in current limit functions\n\nFix a deadlock in pse_pi_get_current_limit and pse_pi_set_current_limit\ncaused by consecutive mutex_lock calls. One in the function itself and\nanother in pse_pi_get_voltage.\n\nResolve the issue by using the unlocked version of pse_pi_get_voltage\ninstead.\n\nFixes: e0a5e2bba38a (\"net: pse-pd: Use power limit at driver side instead of current limit\")\nSigned-off-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nLink: https://patch.msgid.link/20250212151751.1515008-1-kory.maincent@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "540cda75884a6ba4c289980c84392261b1f61a9c", "tree": "76c56bce8738059d57a1036fb5584ac33f49c5d8", "parents": [ "82c260c8806bf248ee11a053dd69665b8b207531" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Wed Feb 12 11:21:24 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 10:00:12 2025 -0800" }, "message": "rxrpc: Fix ipv6 path MTU discovery\n\nrxrpc path MTU discovery currently only makes use of ICMPv4, but not\nICMPv6, which means that pmtud for IPv6 doesn\u0027t work correctly. Fix it to\ncheck for ICMPv6 messages also.\n\nFixes: eeaedc5449d9 (\"rxrpc: Implement path-MTU probing using padded PING ACKs (RFC8899)\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\nLink: https://patch.msgid.link/3517283.1739359284@warthog.procyon.org.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "82c260c8806bf248ee11a053dd69665b8b207531", "tree": "e5af61901f00a46abb0dbd69890b985bf8d5cf59", "parents": [ "458bf63d175ec5f192a3213380c1456bf17f2075", "ab4eedb790cae44313759b50fe47da285e2519d5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 09:41:33 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 09:41:34 2025 -0800" }, "message": "Merge tag \u0027for-net-2025-02-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\n - btintel_pcie: Fix a potential race condition\n - L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n - L2CAP: Fix corrupted list in hci_chan_del\n\n* tag \u0027for-net-2025-02-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: L2CAP: Fix corrupted list in hci_chan_del\n Bluetooth: btintel_pcie: Fix a potential race condition\n Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250213162446.617632-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "458bf63d175ec5f192a3213380c1456bf17f2075", "tree": "72eb69964a438fbbfa9760cf931a8749769c63e1", "parents": [ "0892b840318daa6ae739b7cdec5ecdfca4006689", "cf56aa8dd26328a9af4ffe7fb0bd8fcfa9407112" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 09:38:50 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 09:38:50 2025 -0800" }, "message": "Merge tag \u0027nf-25-02-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following batch contains one revert for:\n\n1) Revert flowtable entry teardown cycle when skbuff exceeds mtu to\n deal with DF flag unset scenarios. This is reverts a patch coming\n in the previous merge window (available in 6.14-rc releases).\n\n* tag \u0027nf-25-02-13\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n Revert \"netfilter: flowtable: teardown flow if cached mtu is stale\"\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250213100502.3983-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0892b840318daa6ae739b7cdec5ecdfca4006689", "tree": "92cb84d934885bd5fdd42ccd22e0d24496d7d8e5", "parents": [ "0d0b752f2497471ddd2b32143d167d42e18a8f3c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:49:44 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:49:44 2025 -0800" }, "message": "Reapply \"net: skb: introduce and use a single page frag cache\"\n\nThis reverts commit 011b0335903832facca86cd8ed05d7d8d94c9c76.\n\nSabrina reports that the revert may trigger warnings due to intervening\nchanges, especially the ability to rise MAX_SKB_FRAGS. Let\u0027s drop it\nand revisit once that part is also ironed out.\n\nFixes: 011b03359038 (\"Revert \"net: skb: introduce and use a single page frag cache\"\")\nReported-by: Sabrina Dubroca \u003csd@queasysnail.net\u003e\nLink: https://lore.kernel.org/6bf54579233038bc0e76056c5ea459872ce362ab.1739375933.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab68d7eb7b1a64f3f4710da46cc5f93c6c154942", "tree": "a89d1ef775e81206856bf162514e1774c9f5c9b4", "parents": [ "d63609e4129596cbf86d91c1fb6903273ca26269", "3011b29ec5a33ec16502e687c4264d57416a8b1f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 08:43:46 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 08:43:46 2025 -0800" }, "message": "Merge tag \u0027loongarch-fixes-6.14-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson\n\nPull LoongArch fixes from Huacai Chen:\n \"Fix bugs about idle, kernel_page_present(), IP checksum and KVM, plus\n some trival cleanups\"\n\n* tag \u0027loongarch-fixes-6.14-1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:\n LoongArch: KVM: Set host with kernel mode when switch to VM mode\n LoongArch: KVM: Remove duplicated cache attribute setting\n LoongArch: KVM: Fix typo issue about GCFG feature detection\n LoongArch: csum: Fix OoB access in IP checksum code for negative lengths\n LoongArch: Remove the deprecated notifier hook mechanism\n LoongArch: Use str_yes_no() helper function for /proc/cpuinfo\n LoongArch: Fix kernel_page_present() for KPRANGE/XKPRANGE\n LoongArch: Fix idle VS timer enqueue\n" }, { "commit": "d63609e4129596cbf86d91c1fb6903273ca26269", "tree": "1e3606b6465d01860bf93cfc6010ea01ac2c0914", "parents": [ "4dc1d1bec89864d8076e5ab314f86f46442bfb02", "b3e127dacad60a384c92baafdc74f1508bf7dd47" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 08:41:48 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Feb 13 08:41:48 2025 -0800" }, "message": "Merge tag \u0027platform-drivers-x86-v6.14-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86\n\nPull x86 platform driver fixes from Ilpo Järvinen:\n\n - thinkpad_acpi:\n - Fix registration of tpacpi platform driver\n - Support fan speed in ticks per revolution (Thinkpad X120e)\n - Support V9 DYTC profiles (new Thinkpad AMD platforms)\n\n - int3472: Handle GPIO \"enable\" vs \"reset\" variation (ov7251)\n\n* tag \u0027platform-drivers-x86-v6.14-3\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86:\n platform/x86: thinkpad_acpi: Fix registration of tpacpi platform driver\n platform/x86: int3472: Call \"reset\" GPIO \"enable\" for INT347E\n platform/x86: int3472: Use correct type for \"polarity\", call it gpio_flags\n platform/x86: thinkpad_acpi: Support for V9 DYTC platform profiles\n platform/x86: thinkpad_acpi: Fix invalid fan speed on ThinkPad X120e\n" }, { "commit": "0d0b752f2497471ddd2b32143d167d42e18a8f3c", "tree": "cc7e40e466ee6d5be55f0f9d8583d9a59155f584", "parents": [ "fee5d688940690cc845937459e340e4e02598e90" ], "author": { "name": "Alexandra Winter", "email": "wintera@linux.ibm.com", "time": "Wed Feb 12 17:36:59 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:39:57 2025 -0800" }, "message": "s390/qeth: move netif_napi_add_tx() and napi_enable() from under BH\n\nLike other drivers qeth is calling local_bh_enable() after napi_schedule()\nto kick-start softirqs [0].\nSince netif_napi_add_tx() and napi_enable() now take the netdev_lock()\nmutex [1], move them out from under the BH protection. Same solution as in\ncommit a60558644e20 (\"wifi: mt76: move napi_enable() from under BH\")\n\nFixes: 1b23cdbd2bbc (\"net: protect netdev-\u003enapi_list with netdev_lock()\")\nLink: https://lore.kernel.org/netdev/20240612181900.4d9d18d0@kernel.org/ [0]\nLink: https://lore.kernel.org/netdev/20250115035319.559603-1-kuba@kernel.org/ [1]\nSigned-off-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nAcked-by: Joe Damato \u003cjdamato@fastly.com\u003e\nLink: https://patch.msgid.link/20250212163659.2287292-1-wintera@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fee5d688940690cc845937459e340e4e02598e90", "tree": "c26fc0d92bf2bc1a52ba0dbc22b5168a786f32ff", "parents": [ "a527750d877fd334de87eef81f1cb5f0f0ca3373" ], "author": { "name": "Wentao Liang", "email": "vulab@iscas.ac.cn", "time": "Wed Feb 12 23:23:11 2025 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:38:06 2025 -0800" }, "message": "mlxsw: Add return value check for mlxsw_sp_port_get_stats_raw()\n\nAdd a check for the return value of mlxsw_sp_port_get_stats_raw()\nin __mlxsw_sp_port_get_stats(). If mlxsw_sp_port_get_stats_raw()\nreturns an error, exit the function to prevent further processing\nwith potentially invalid data.\n\nFixes: 614d509aa1e7 (\"mlxsw: Move ethtool_ops to spectrum_ethtool.c\")\nCc: stable@vger.kernel.org # 5.9+\nSigned-off-by: Wentao Liang \u003cvulab@iscas.ac.cn\u003e\nReviewed-by: Petr Machata \u003cpetrm@nvidia.com\u003e\nLink: https://patch.msgid.link/20250212152311.1332-1-vulab@iscas.ac.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a527750d877fd334de87eef81f1cb5f0f0ca3373", "tree": "0f608fb0e2f6a8221831a1eeb06e5e176b44ab83", "parents": [ "5bef3ac184b5626ea62385d6b82a1992b89d7940" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Feb 12 14:10:21 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:37:21 2025 -0800" }, "message": "ipv6: mcast: add RCU protection to mld_newpack()\n\nmld_newpack() can be called without RTNL or RCU being held.\n\nNote that we no longer can use sock_alloc_send_skb() because\nipv6.igmp_sk uses GFP_KERNEL allocations which can sleep.\n\nInstead use alloc_skb() and charge the net-\u003eipv6.igmp_sk\nsocket under RCU protection.\n\nFixes: b8ad0cbc58f7 (\"[NETNS][IPV6] mcast - handle several network namespace\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20250212141021.1663666-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5bef3ac184b5626ea62385d6b82a1992b89d7940", "tree": "563a25cdd3405e7aac038e38657bf346a49f196b", "parents": [ "0469b410c888414c3505d8d2b5814eb372404638" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Feb 12 13:49:28 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Feb 13 08:36:55 2025 -0800" }, "message": "team: better TEAM_OPTION_TYPE_STRING validation\n\nsyzbot reported following splat [1]\n\nMake sure user-provided data contains one nul byte.\n\n[1]\n BUG: KMSAN: uninit-value in string_nocheck lib/vsprintf.c:633 [inline]\n BUG: KMSAN: uninit-value in string+0x3ec/0x5f0 lib/vsprintf.c:714\n string_nocheck lib/vsprintf.c:633 [inline]\n string+0x3ec/0x5f0 lib/vsprintf.c:714\n vsnprintf+0xa5d/0x1960 lib/vsprintf.c:2843\n __request_module+0x252/0x9f0 kernel/module/kmod.c:149\n team_mode_get drivers/net/team/team_core.c:480 [inline]\n team_change_mode drivers/net/team/team_core.c:607 [inline]\n team_mode_option_set+0x437/0x970 drivers/net/team/team_core.c:1401\n team_option_set drivers/net/team/team_core.c:375 [inline]\n team_nl_options_set_doit+0x1339/0x1f90 drivers/net/team/team_core.c:2662\n genl_family_rcv_msg_doit net/netlink/genetlink.c:1115 [inline]\n genl_family_rcv_msg net/netlink/genetlink.c:1195 [inline]\n genl_rcv_msg+0x1214/0x12c0 net/netlink/genetlink.c:1210\n netlink_rcv_skb+0x375/0x650 net/netlink/af_netlink.c:2543\n genl_rcv+0x40/0x60 net/netlink/genetlink.c:1219\n netlink_unicast_kernel net/netlink/af_netlink.c:1322 [inline]\n netlink_unicast+0xf52/0x1260 net/netlink/af_netlink.c:1348\n netlink_sendmsg+0x10da/0x11e0 net/netlink/af_netlink.c:1892\n sock_sendmsg_nosec net/socket.c:718 [inline]\n __sock_sendmsg+0x30f/0x380 net/socket.c:733\n ____sys_sendmsg+0x877/0xb60 net/socket.c:2573\n ___sys_sendmsg+0x28d/0x3c0 net/socket.c:2627\n __sys_sendmsg net/socket.c:2659 [inline]\n __do_sys_sendmsg net/socket.c:2664 [inline]\n __se_sys_sendmsg net/socket.c:2662 [inline]\n __x64_sys_sendmsg+0x212/0x3c0 net/socket.c:2662\n x64_sys_call+0x2ed6/0x3c30 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/common.c:52 [inline]\n do_syscall_64+0xcd/0x1e0 arch/x86/entry/common.c:83\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFixes: 3d249d4ca7d0 (\"net: introduce ethernet teaming device\")\nReported-by: syzbot+1fcd957a82e3a1baa94d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d1fcd957a82e3a1baa94d\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@nvidia.com\u003e\nLink: https://patch.msgid.link/20250212134928.1541609-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ab4eedb790cae44313759b50fe47da285e2519d5", "tree": "e2e0adf24761cb927a2dad8a88ee9b93dffca97f", "parents": [ "872274b992839ff64fe560767fe7ee5f942ccdb1" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Feb 06 15:54:45 2025 -0500" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Feb 13 11:15:37 2025 -0500" }, "message": "Bluetooth: L2CAP: Fix corrupted list in hci_chan_del\n\nThis fixes the following trace by reworking the locking of l2cap_conn\nso instead of only locking when changing the chan_l list this promotes\nchan_lock to a general lock of l2cap_conn so whenever it is being held\nit would prevents the likes of l2cap_conn_del to run:\n\nlist_del corruption, ffff888021297e00-\u003eprev is LIST_POISON2 (dead000000000122)\n------------[ cut here ]------------\nkernel BUG at lib/list_debug.c:61!\nOops: invalid opcode: 0000 [#1] PREEMPT SMP KASAN PTI\nCPU: 1 UID: 0 PID: 5896 Comm: syz-executor213 Not tainted 6.14.0-rc1-next-20250204-syzkaller #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024\nRIP: 0010:__list_del_entry_valid_or_report+0x12c/0x190 lib/list_debug.c:59\nCode: 8c 4c 89 fe 48 89 da e8 32 8c 37 fc 90 0f 0b 48 89 df e8 27 9f 14 fd 48 c7 c7 a0 c0 60 8c 4c 89 fe 48 89 da e8 15 8c 37 fc 90 \u003c0f\u003e 0b 4c 89 e7 e8 0a 9f 14 fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 cb\nRSP: 0018:ffffc90003f6f998 EFLAGS: 00010246\nRAX: 000000000000004e RBX: dead000000000122 RCX: 01454d423f7fbf00\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: dffffc0000000000 R08: ffffffff819f077c R09: 1ffff920007eded0\nR10: dffffc0000000000 R11: fffff520007eded1 R12: dead000000000122\nR13: dffffc0000000000 R14: ffff8880352248d8 R15: ffff888021297e00\nFS: 00007f7ace6686c0(0000) GS:ffff8880b8700000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7aceeeb1d0 CR3: 000000003527c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n __list_del_entry_valid include/linux/list.h:124 [inline]\n __list_del_entry include/linux/list.h:215 [inline]\n list_del_rcu include/linux/rculist.h:168 [inline]\n hci_chan_del+0x70/0x1b0 net/bluetooth/hci_conn.c:2858\n l2cap_conn_free net/bluetooth/l2cap_core.c:1816 [inline]\n kref_put include/linux/kref.h:65 [inline]\n l2cap_conn_put+0x70/0xe0 net/bluetooth/l2cap_core.c:1830\n l2cap_sock_shutdown+0xa8a/0x1020 net/bluetooth/l2cap_sock.c:1377\n l2cap_sock_release+0x79/0x1d0 net/bluetooth/l2cap_sock.c:1416\n __sock_release net/socket.c:642 [inline]\n sock_close+0xbc/0x240 net/socket.c:1393\n __fput+0x3e9/0x9f0 fs/file_table.c:448\n task_work_run+0x24f/0x310 kernel/task_work.c:227\n ptrace_notify+0x2d2/0x380 kernel/signal.c:2522\n ptrace_report_syscall include/linux/ptrace.h:415 [inline]\n ptrace_report_syscall_exit include/linux/ptrace.h:477 [inline]\n syscall_exit_work+0xc7/0x1d0 kernel/entry/common.c:173\n syscall_exit_to_user_mode_prepare kernel/entry/common.c:200 [inline]\n __syscall_exit_to_user_mode_work kernel/entry/common.c:205 [inline]\n syscall_exit_to_user_mode+0x24a/0x340 kernel/entry/common.c:218\n do_syscall_64+0x100/0x230 arch/x86/entry/common.c:89\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f7aceeaf449\nCode: 28 00 00 00 75 05 48 83 c4 28 c3 e8 41 19 00 00 90 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 b0 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007f7ace668218 EFLAGS: 00000246 ORIG_RAX: 000000000000002a\nRAX: fffffffffffffffc RBX: 00007f7acef39328 RCX: 00007f7aceeaf449\nRDX: 000000000000000e RSI: 0000000020000100 RDI: 0000000000000004\nRBP: 00007f7acef39320 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003\nR13: 0000000000000004 R14: 00007f7ace668670 R15: 000000000000000b\n \u003c/TASK\u003e\nModules linked in:\n---[ end trace 0000000000000000 ]---\nRIP: 0010:__list_del_entry_valid_or_report+0x12c/0x190 lib/list_debug.c:59\nCode: 8c 4c 89 fe 48 89 da e8 32 8c 37 fc 90 0f 0b 48 89 df e8 27 9f 14 fd 48 c7 c7 a0 c0 60 8c 4c 89 fe 48 89 da e8 15 8c 37 fc 90 \u003c0f\u003e 0b 4c 89 e7 e8 0a 9f 14 fd 42 80 3c 2b 00 74 08 4c 89 e7 e8 cb\nRSP: 0018:ffffc90003f6f998 EFLAGS: 00010246\nRAX: 000000000000004e RBX: dead000000000122 RCX: 01454d423f7fbf00\nRDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000\nRBP: dffffc0000000000 R08: ffffffff819f077c R09: 1ffff920007eded0\nR10: dffffc0000000000 R11: fffff520007eded1 R12: dead000000000122\nR13: dffffc0000000000 R14: ffff8880352248d8 R15: ffff888021297e00\nFS: 00007f7ace6686c0(0000) GS:ffff8880b8600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007f7acef05b08 CR3: 000000003527c000 CR4: 00000000003526f0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\n\nReported-by: syzbot+10bd8fe6741eedd2be2e@syzkaller.appspotmail.com\nTested-by: syzbot+10bd8fe6741eedd2be2e@syzkaller.appspotmail.com\nFixes: b4f82f9ed43a (\"Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\")\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\nSigned-off-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\n" }, { "commit": "872274b992839ff64fe560767fe7ee5f942ccdb1", "tree": "ea5aefc335308a47bc4adb2590d5bb588b9d66eb", "parents": [ "b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d" ], "author": { "name": "Kiran K", "email": "kiran.k@intel.com", "time": "Fri Jan 31 18:30:19 2025 +0530" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Feb 13 11:14:04 2025 -0500" }, "message": "Bluetooth: btintel_pcie: Fix a potential race condition\n\nOn HCI_OP_RESET command, firmware raises alive interrupt. Driver needs\nto wait for this before sending other command. This patch fixes the potential\nmiss of alive interrupt due to which HCI_OP_RESET can timeout.\n\nExpected flow:\nIf tx command is HCI_OP_RESET,\n 1. set data-\u003egp0_received \u003d false\n 2. send HCI_OP_RESET\n 3. wait for alive interrupt\n\nActual flow having potential race:\nIf tx command is HCI_OP_RESET,\n 1. send HCI_OP_RESET\n 1a. Firmware raises alive interrupt here and in ISR\n data-\u003egp0_received is set to true\n 2. set data-\u003egp0_received \u003d false\n 3. wait for alive interrupt\n\nSigned-off-by: Kiran K \u003ckiran.k@intel.com\u003e\nFixes: 05c200c8f029 (\"Bluetooth: btintel_pcie: Add handshake between driver and firmware\")\nReported-by: Bjorn Helgaas \u003chelgaas@kernel.org\u003e\nCloses: https://patchwork.kernel.org/project/bluetooth/patch/20241001104451.626964-1-kiran.k@intel.com/\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "b4f82f9ed43aefa79bec2504ae8c29be0c0f5d1d", "tree": "be2f6fa666fac5b2cdf3ed1a3e49cf5509f10f16", "parents": [ "0469b410c888414c3505d8d2b5814eb372404638" ], "author": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Jan 16 10:35:03 2025 -0500" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Thu Feb 13 11:13:48 2025 -0500" }, "message": "Bluetooth: L2CAP: Fix slab-use-after-free Read in l2cap_send_cmd\n\nAfter the hci sync command releases l2cap_conn, the hci receive data work\nqueue references the released l2cap_conn when sending to the upper layer.\nAdd hci dev lock to the hci receive data work queue to synchronize the two.\n\n[1]\nBUG: KASAN: slab-use-after-free in l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\nRead of size 8 at addr ffff8880271a4000 by task kworker/u9:2/5837\n\nCPU: 0 UID: 0 PID: 5837 Comm: kworker/u9:2 Not tainted 6.13.0-rc5-syzkaller-00163-gab75170520d4 #0\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 09/13/2024\nWorkqueue: hci1 hci_rx_work\nCall Trace:\n \u003cTASK\u003e\n __dump_stack lib/dump_stack.c:94 [inline]\n dump_stack_lvl+0x241/0x360 lib/dump_stack.c:120\n print_address_description mm/kasan/report.c:378 [inline]\n print_report+0x169/0x550 mm/kasan/report.c:489\n kasan_report+0x143/0x180 mm/kasan/report.c:602\n l2cap_build_cmd net/bluetooth/l2cap_core.c:2964 [inline]\n l2cap_send_cmd+0x187/0x8d0 net/bluetooth/l2cap_core.c:954\n l2cap_sig_send_rej net/bluetooth/l2cap_core.c:5502 [inline]\n l2cap_sig_channel net/bluetooth/l2cap_core.c:5538 [inline]\n l2cap_recv_frame+0x221f/0x10db0 net/bluetooth/l2cap_core.c:6817\n hci_acldata_packet net/bluetooth/hci_core.c:3797 [inline]\n hci_rx_work+0x508/0xdb0 net/bluetooth/hci_core.c:4040\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n \u003c/TASK\u003e\n\nAllocated by task 5837:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n poison_kmalloc_redzone mm/kasan/common.c:377 [inline]\n __kasan_kmalloc+0x98/0xb0 mm/kasan/common.c:394\n kasan_kmalloc include/linux/kasan.h:260 [inline]\n __kmalloc_cache_noprof+0x243/0x390 mm/slub.c:4329\n kmalloc_noprof include/linux/slab.h:901 [inline]\n kzalloc_noprof include/linux/slab.h:1037 [inline]\n l2cap_conn_add+0xa9/0x8e0 net/bluetooth/l2cap_core.c:6860\n l2cap_connect_cfm+0x115/0x1090 net/bluetooth/l2cap_core.c:7239\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_remote_features_evt+0x68e/0xac0 net/bluetooth/hci_event.c:3726\n hci_event_func net/bluetooth/hci_event.c:7473 [inline]\n hci_event_packet+0xac2/0x1540 net/bluetooth/hci_event.c:7525\n hci_rx_work+0x3f3/0xdb0 net/bluetooth/hci_core.c:4035\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nFreed by task 54:\n kasan_save_stack mm/kasan/common.c:47 [inline]\n kasan_save_track+0x3f/0x80 mm/kasan/common.c:68\n kasan_save_free_info+0x40/0x50 mm/kasan/generic.c:582\n poison_slab_object mm/kasan/common.c:247 [inline]\n __kasan_slab_free+0x59/0x70 mm/kasan/common.c:264\n kasan_slab_free include/linux/kasan.h:233 [inline]\n slab_free_hook mm/slub.c:2353 [inline]\n slab_free mm/slub.c:4613 [inline]\n kfree+0x196/0x430 mm/slub.c:4761\n l2cap_connect_cfm+0xcc/0x1090 net/bluetooth/l2cap_core.c:7235\n hci_connect_cfm include/net/bluetooth/hci_core.h:2057 [inline]\n hci_conn_failed+0x287/0x400 net/bluetooth/hci_conn.c:1266\n hci_abort_conn_sync+0x56c/0x11f0 net/bluetooth/hci_sync.c:5603\n hci_cmd_sync_work+0x22b/0x400 net/bluetooth/hci_sync.c:332\n process_one_work kernel/workqueue.c:3229 [inline]\n process_scheduled_works+0xa66/0x1840 kernel/workqueue.c:3310\n worker_thread+0x870/0xd30 kernel/workqueue.c:3391\n kthread+0x2f0/0x390 kernel/kthread.c:389\n ret_from_fork+0x4b/0x80 arch/x86/kernel/process.c:147\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:244\n\nReported-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d31c2f641b850a348a734\nTested-by: syzbot+31c2f641b850a348a734@syzkaller.appspotmail.com\nSigned-off-by: Edward Adam Davis \u003ceadavis@qq.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "0469b410c888414c3505d8d2b5814eb372404638", "tree": "cb621e10542714c058683b50a2114c8423c225fb", "parents": [ "b698b9a8acc804e1b777aece0b3699850d736087", "4542536f664f752db5feba2c5998b165933c34f2" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:08:47 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:12:59 2025 -0800" }, "message": "Merge branch \u0027net-ethernet-ti-am65-cpsw-xdp-fixes\u0027\n\nRoger Quadros says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: ethernet: ti: am65-cpsw: XDP fixes\n\nThis series fixes memleak and statistics for XDP cases.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250210-am65-cpsw-xdp-fixes-v1-0-ec6b1f7f1aca@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4542536f664f752db5feba2c5998b165933c34f2", "tree": "cb621e10542714c058683b50a2114c8423c225fb", "parents": [ "8a9f82ff15da03a6804cdd6557fb36ff71c0924f" ], "author": { "name": "Roger Quadros", "email": "rogerq@kernel.org", "time": "Mon Feb 10 16:52:17 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:12:59 2025 -0800" }, "message": "net: ethernet: ti: am65_cpsw: fix tx_cleanup for XDP case\n\nFor XDP transmit case, swdata doesn\u0027t contain SKB but the\nXDP Frame. Infer the correct swdata based on buffer type\nand return the XDP Frame for XDP transmit case.\n\nSigned-off-by: Roger Quadros \u003crogerq@kernel.org\u003e\nFixes: 8acacc40f733 (\"net: ethernet: ti: am65-cpsw: Add minimal XDP support\")\nLink: https://patch.msgid.link/20250210-am65-cpsw-xdp-fixes-v1-3-ec6b1f7f1aca@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8a9f82ff15da03a6804cdd6557fb36ff71c0924f", "tree": "9840c7046767c4a09e402b3820425058789189e8", "parents": [ "5db843258de1e4e6b1ef1cbd1797923c9e3de548" ], "author": { "name": "Roger Quadros", "email": "rogerq@kernel.org", "time": "Mon Feb 10 16:52:16 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:12:58 2025 -0800" }, "message": "net: ethernet: ti: am65-cpsw: fix RX \u0026 TX statistics for XDP_TX case\n\nFor successful XDP_TX and XDP_REDIRECT cases, the packet was received\nsuccessfully so update RX statistics. Use original received\npacket length for that.\n\nTX packets statistics are incremented on TX completion so don\u0027t\nupdate it while TX queueing.\n\nIf xdp_convert_buff_to_frame() fails, increment tx_dropped.\n\nSigned-off-by: Roger Quadros \u003crogerq@kernel.org\u003e\nFixes: 8acacc40f733 (\"net: ethernet: ti: am65-cpsw: Add minimal XDP support\")\nLink: https://patch.msgid.link/20250210-am65-cpsw-xdp-fixes-v1-2-ec6b1f7f1aca@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5db843258de1e4e6b1ef1cbd1797923c9e3de548", "tree": "99946fcf2d0372a0e56c4aa8d985a83923d84e52", "parents": [ "b698b9a8acc804e1b777aece0b3699850d736087" ], "author": { "name": "Roger Quadros", "email": "rogerq@kernel.org", "time": "Mon Feb 10 16:52:15 2025 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:12:38 2025 -0800" }, "message": "net: ethernet: ti: am65-cpsw: fix memleak in certain XDP cases\n\nIf the XDP program doesn\u0027t result in XDP_PASS then we leak the\nmemory allocated by am65_cpsw_build_skb().\n\nIt is pointless to allocate SKB memory before running the XDP\nprogram as we would be wasting CPU cycles for cases other than XDP_PASS.\nMove the SKB allocation after evaluating the XDP program result.\n\nThis fixes the memleak. A performance boost is seen for XDP_DROP test.\n\nXDP_DROP test:\nBefore: 460256 rx/s 0 err/s\nAfter: 784130 rx/s 0 err/s\n\nFixes: 8acacc40f733 (\"net: ethernet: ti: am65-cpsw: Add minimal XDP support\")\nSigned-off-by: Roger Quadros \u003crogerq@kernel.org\u003e\nLink: https://patch.msgid.link/20250210-am65-cpsw-xdp-fixes-v1-1-ec6b1f7f1aca@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3011b29ec5a33ec16502e687c4264d57416a8b1f", "tree": "8c23b3979eed68ec9057bda735ee4575417726fa", "parents": [ "d8cc4fee3f8ad21f83326ec8a6d200e04c8f0a00" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "message": "LoongArch: KVM: Set host with kernel mode when switch to VM mode\n\nPRMD register is only meaningful on the beginning stage of exception\nentry, and it is overwritten with nested irq or exception.\n\nWhen CPU runs in VM mode, interrupt need be enabled on host. And the\nmode for host had better be kernel mode rather than random or user mode.\n\nWhen VM is running, the running mode with top command comes from CRMD\nregister, and running mode should be kernel mode since kernel function\nis executing with perf command. It needs be consistent with both top and\nperf command.\n\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "d8cc4fee3f8ad21f83326ec8a6d200e04c8f0a00", "tree": "3aab911d283698563da0aa6a58962b6bec110e6b", "parents": [ "bdb13252e5d1518823b81f458d9975c85d5240c2" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "message": "LoongArch: KVM: Remove duplicated cache attribute setting\n\nCache attribute comes from GPA-\u003eHPA secondary mmu page table and is\nconfigured when kvm is enabled. It is the same for all VMs, so remove\nduplicated cache attribute setting on vCPU context switch.\n\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "bdb13252e5d1518823b81f458d9975c85d5240c2", "tree": "ca39e1e922d82bf6efa7a38feed4a679d9103e07", "parents": [ "6287f1a8c16138c2ec750953e35039634018c84a" ], "author": { "name": "Bibo Mao", "email": "maobibo@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:56 2025 +0800" }, "message": "LoongArch: KVM: Fix typo issue about GCFG feature detection\n\nThis is typo issue and misusage about GCFG feature macro. The code\nis wrong, only that it does not cause obvious problem since GCFG is\nset again on vCPU context switch.\n\nFixes: 0d0df3c99d4f (\"LoongArch: KVM: Implement kvm hardware enable, disable interface\")\nSigned-off-by: Bibo Mao \u003cmaobibo@loongson.cn\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "6287f1a8c16138c2ec750953e35039634018c84a", "tree": "7a1eb325bfca1266fa967bad1dff386c0c91fd4a", "parents": [ "6b72cd9ef062702390fc96c469beea1729a5dffe" ], "author": { "name": "Yuli Wang", "email": "wangyuli@uniontech.com", "time": "Thu Feb 13 12:02:40 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:40 2025 +0800" }, "message": "LoongArch: csum: Fix OoB access in IP checksum code for negative lengths\n\nCommit 69e3a6aa6be2 (\"LoongArch: Add checksum optimization for 64-bit\nsystem\") would cause an undefined shift and an out-of-bounds read.\n\nCommit 8bd795fedb84 (\"arm64: csum: Fix OoB access in IP checksum code\nfor negative lengths\") fixes the same issue on ARM64.\n\nFixes: 69e3a6aa6be2 (\"LoongArch: Add checksum optimization for 64-bit system\")\nCo-developed-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Yuli Wang \u003cwangyuli@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "6b72cd9ef062702390fc96c469beea1729a5dffe", "tree": "b9a962af4824a65ac992ace22722753161ed4b27", "parents": [ "03a99d16e64fad41c8d39700bef9b0ac9c4e148b" ], "author": { "name": "Yuli Wang", "email": "wangyuli@uniontech.com", "time": "Thu Feb 13 12:02:40 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:40 2025 +0800" }, "message": "LoongArch: Remove the deprecated notifier hook mechanism\n\nThe notifier hook mechanism in proc and cpuinfo is actually unnecessary\nfor LoongArch because it\u0027s not used anywhere.\n\nIt was originally added to the MIPS code in commit d6d3c9afaab4 (\"MIPS:\nMT: proc: Add support for printing VPE and TC ids\"), and LoongArch then\ninherited it.\n\nBut as the kernel code stands now, this notifier hook mechanism doesn\u0027t\nreally make sense for either LoongArch or MIPS.\n\nIn addition, the seq_file forward declaration needs to be moved to its\nproper place, as only the show_ipi_list() function in smp.c requires it.\n\nCo-developed-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Yuli Wang \u003cwangyuli@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "03a99d16e64fad41c8d39700bef9b0ac9c4e148b", "tree": "0a0ad7d2f3eecbabcf1185954101917c805e98eb", "parents": [ "619b52777a4972bdb6ddf86ac54c6f68a47b51c4" ], "author": { "name": "Yuli Wang", "email": "wangyuli@uniontech.com", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "message": "LoongArch: Use str_yes_no() helper function for /proc/cpuinfo\n\nRemove hard-coded strings by using the str_yes_no() helper function.\n\nSimilar to commit c4a0a4a45a45 (\"MIPS: kernel: proc: Use str_yes_no()\nhelper function\").\n\nCo-developed-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Wentao Guan \u003cguanwentao@uniontech.com\u003e\nSigned-off-by: Yuli Wang \u003cwangyuli@uniontech.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "619b52777a4972bdb6ddf86ac54c6f68a47b51c4", "tree": "e708d6820e479c6a6d820c8fdd4b53360c0dd7a3", "parents": [ "edb1942542bc538707cea221e9c7923a6270465f" ], "author": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "message": "LoongArch: Fix kernel_page_present() for KPRANGE/XKPRANGE\n\nNow kernel_page_present() always return true for KPRANGE/XKPRANGE\naddresses, this isn\u0027t correct because hibernation (ACPI S4) use it\nto distinguish whether a page is saveable. If all KPRANGE/XKPRANGE\naddresses are considered as saveable, then reserved memory such as\nEFI_RUNTIME_SERVICES_CODE / EFI_RUNTIME_SERVICES_DATA will also be\nsaved and restored.\n\nFix this by returning true only if the KPRANGE/XKPRANGE address is in\nmemblock.memory.\n\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "edb1942542bc538707cea221e9c7923a6270465f", "tree": "d46d29299dd3c23d38e5278aec19cb481e45c164", "parents": [ "a64dcfb451e254085a7daee5fe51bf22959d52d3" ], "author": { "name": "Marco Crivellari", "email": "marco.crivellari@suse.com", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "committer": { "name": "Huacai Chen", "email": "chenhuacai@loongson.cn", "time": "Thu Feb 13 12:02:35 2025 +0800" }, "message": "LoongArch: Fix idle VS timer enqueue\n\nLoongArch re-enables interrupts on its idle routine and performs a\nTIF_NEED_RESCHED check afterwards before putting the CPU to sleep.\n\nThe IRQs firing between the check and the idle instruction may set the\nTIF_NEED_RESCHED flag. In order to deal with such a race, IRQs\ninterrupting __arch_cpu_idle() rollback their return address to the\nbeginning of __arch_cpu_idle() so that TIF_NEED_RESCHED is checked\nagain before going back to sleep.\n\nHowever idle IRQs can also queue timers that may require a tick\nreprogramming through a new generic idle loop iteration but those timers\nwould go unnoticed here because __arch_cpu_idle() only checks\nTIF_NEED_RESCHED. It doesn\u0027t check for pending timers.\n\nFix this with fast-forwarding idle IRQs return address to the end of the\nidle routine instead of the beginning, so that the generic idle loop can\nhandle both TIF_NEED_RESCHED and pending timers.\n\nFixes: 0603839b18f4 (\"LoongArch: Add exception/interrupt handling\")\nSigned-off-by: Peter Zijlstra (Intel) \u003cpeterz@infradead.org\u003e\nSigned-off-by: Frederic Weisbecker \u003cfrederic@kernel.org\u003e\nSigned-off-by: Marco Crivellari \u003cmarco.crivellari@suse.com\u003e\nSigned-off-by: Huacai Chen \u003cchenhuacai@loongson.cn\u003e\n" }, { "commit": "b698b9a8acc804e1b777aece0b3699850d736087", "tree": "3247411d05fb9743fe478f4a8f88e6786c32ac0c", "parents": [ "15d6f74f03f84c5b8d032bb1be6b90af82e5b679", "440c9d488705366b00372ea7213af69827a6c7af" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:01:30 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:01:31 2025 -0800" }, "message": "Merge branch \u0027vsock-null-ptr-deref-when-so_linger-enabled\u0027\n\nMichal Luczaj says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvsock: null-ptr-deref when SO_LINGER enabled\n\nsyzbot pointed out that a recent patching of a use-after-free introduced a\nnull-ptr-deref. This series fixes the problem and adds a test.\n\nv2: https://lore.kernel.org/20250206-vsock-linger-nullderef-v2-0-f8a1f19146f8@rbox.co\nv1: https://lore.kernel.org/20250204-vsock-linger-nullderef-v1-0-6eb1760fa93e@rbox.co\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-0-ef6244d02b54@rbox.co\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "440c9d488705366b00372ea7213af69827a6c7af", "tree": "3247411d05fb9743fe478f4a8f88e6786c32ac0c", "parents": [ "78dafe1cf3afa02ed71084b350713b07e72a18fb" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Mon Feb 10 13:15:01 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:01:29 2025 -0800" }, "message": "vsock/test: Add test for SO_LINGER null ptr deref\n\nExplicitly close() a TCP_ESTABLISHED (connectible) socket with SO_LINGER\nenabled.\n\nAs for now, test does not verify if close() actually lingers.\nOn an unpatched machine, may trigger a null pointer dereference.\n\nTested-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nLink: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-2-ef6244d02b54@rbox.co\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "78dafe1cf3afa02ed71084b350713b07e72a18fb", "tree": "72c3dd6e119909d8e502a8051dbc91fb52a47cb3", "parents": [ "15d6f74f03f84c5b8d032bb1be6b90af82e5b679" ], "author": { "name": "Michal Luczaj", "email": "mhal@rbox.co", "time": "Mon Feb 10 13:15:00 2025 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 20:01:28 2025 -0800" }, "message": "vsock: Orphan socket after transport release\n\nDuring socket release, sock_orphan() is called without considering that it\nsets sk-\u003esk_wq to NULL. Later, if SO_LINGER is enabled, this leads to a\nnull pointer dereferenced in virtio_transport_wait_close().\n\nOrphan the socket only after transport release.\n\nPartially reverts the \u0027Fixes:\u0027 commit.\n\nKASAN: null-ptr-deref in range [0x0000000000000018-0x000000000000001f]\n lock_acquire+0x19e/0x500\n _raw_spin_lock_irqsave+0x47/0x70\n add_wait_queue+0x46/0x230\n virtio_transport_release+0x4e7/0x7f0\n __vsock_release+0xfd/0x490\n vsock_release+0x90/0x120\n __sock_release+0xa3/0x250\n sock_close+0x14/0x20\n __fput+0x35e/0xa90\n __x64_sys_close+0x78/0xd0\n do_syscall_64+0x93/0x1b0\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\n\nReported-by: syzbot+9d55b199192a4be7d02c@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d9d55b199192a4be7d02c\nFixes: fcdd2242c023 (\"vsock: Keep the binding until socket destruction\")\nTested-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nReviewed-by: Luigi Leonardi \u003cleonardi@redhat.com\u003e\nSigned-off-by: Michal Luczaj \u003cmhal@rbox.co\u003e\nLink: https://patch.msgid.link/20250210-vsock-linger-nullderef-v3-1-ef6244d02b54@rbox.co\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "15d6f74f03f84c5b8d032bb1be6b90af82e5b679", "tree": "0b717b3ecb1f04b128700fed8a574ed1ec7c9ad6", "parents": [ "7229fa6b303cdaa3375b419a207b4d54c04c5b88" ], "author": { "name": "Marcelo Ricardo Leitner", "email": "marcelo.leitner@gmail.com", "time": "Mon Feb 10 10:24:55 2025 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 19:58:42 2025 -0800" }, "message": "MAINTAINERS: Add sctp headers to the general netdev entry\n\nAll SCTP patches are picked up by netdev maintainers. Two headers were\nmissing to be listed there.\n\nReported-by: Thorsten Blum \u003cthorsten.blum@linux.dev\u003e\nSigned-off-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/b3c2dc3a102eb89bd155abca2503ebd015f50ee0.1739193671.git.marcelo.leitner@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7229fa6b303cdaa3375b419a207b4d54c04c5b88", "tree": "3b4603771b022f19b6e8be6355aff43787788cb6", "parents": [ "e589adf5b70c07b1ab974d077046fdbf583b2f36", "63f20f00d23d569e4e67859b4e8dcc9de79221cb" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 19:53:03 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Feb 12 19:53:03 2025 -0800" }, "message": "Merge branch \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2025-02-11 (idpf, ixgbe, igc)\n\nFor idpf:\n\nSridhar fixes a couple issues in handling of RSC packets.\n\nJosh adds a call to set_real_num_queues() to keep queue count in sync.\n\nFor ixgbe:\n\nPiotr removes missed IS_ERR() removal when ERR_PTR usage was removed.\n\nFor igc:\n\nZdenek Bouska fixes reporting of Rx timestamp with AF_XDP.\n\nSiang sets buffer type on empty frame to ensure proper handling.\n\n* \u0027200GbE\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tnguy/net-queue:\n igc: Set buffer type for empty frames in igc_init_empty_frame\n igc: Fix HW RX timestamp when passed by ZC XDP\n ixgbe: Fix possible skb NULL pointer dereference\n idpf: call set_real_num_queues in idpf_open\n idpf: record rx queue in skb for RSC packets\n idpf: fix handling rsc packet with a single segment\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250211214343.4092496-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "406e445b3c6be65ab0ee961145e74bfd7ef6c9e1", "tree": "e364ecc50411a17e387754a30bd473e346330b0b", "parents": [ "531323a2efc3fbe20b540e3f41ecc94d68e74b76" ], "author": { "name": "Alan Huang", "email": "mmpgouride@gmail.com", "time": "Wed Feb 12 17:27:51 2025 +0800" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Wed Feb 12 18:44:50 2025 -0500" }, "message": "bcachefs: Reuse transaction\n\nbch2_nocow_write_convert_unwritten is already in transaction context:\n\n00191 \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d TEST generic/648\n00242 kernel BUG at fs/bcachefs/btree_iter.c:3332!\n00242 Internal error: Oops - BUG: 00000000f2000800 [#1] PREEMPT SMP\n00242 Modules linked in:\n00242 CPU: 4 UID: 0 PID: 2593 Comm: fsstress Not tainted 6.13.0-rc3-ktest-g345af8f855b7 #14403\n00242 Hardware name: linux,dummy-virt (DT)\n00242 pstate: 60001005 (nZCv daif -PAN -UAO -TCO -DIT +SSBS BTYPE\u003d--)\n00242 pc : __bch2_trans_get+0x120/0x410\n00242 lr : __bch2_trans_get+0xcc/0x410\n00242 sp : ffffff80d89af600\n00242 x29: ffffff80d89af600 x28: ffffff80ddb23000 x27: 00000000fffff705\n00242 x26: ffffff80ddb23028 x25: ffffff80d8903fe0 x24: ffffff80ebb30168\n00242 x23: ffffff80c8aeb500 x22: 000000000000005d x21: ffffff80d8904078\n00242 x20: ffffff80d8900000 x19: ffffff80da9e8000 x18: 0000000000000000\n00242 x17: 64747568735f6c61 x16: 6e72756f6a20726f x15: 0000000000000028\n00242 x14: 0000000000000004 x13: 000000000000f787 x12: ffffffc081bbcdc8\n00242 x11: 0000000000000000 x10: 0000000000000003 x9 : ffffffc08094efbc\n00242 x8 : 000000001092c111 x7 : 000000000000000c x6 : ffffffc083c31fc4\n00242 x5 : ffffffc083c31f28 x4 : ffffff80c8aeb500 x3 : ffffff80ebb30000\n00242 x2 : 0000000000000001 x1 : 0000000000000a21 x0 : 000000000000028e\n00242 Call trace:\n00242 __bch2_trans_get+0x120/0x410 (P)\n00242 bch2_inum_offset_err_msg+0x48/0xb0\n00242 bch2_nocow_write_convert_unwritten+0x3d0/0x530\n00242 bch2_nocow_write+0xeb0/0x1000\n00242 __bch2_write+0x330/0x4e8\n00242 bch2_write+0x1f0/0x530\n00242 bch2_direct_write+0x530/0xc00\n00242 bch2_write_iter+0x160/0xbe0\n00242 vfs_write+0x1cc/0x360\n00242 ksys_write+0x5c/0xf0\n00242 __arm64_sys_write+0x20/0x30\n00242 invoke_syscall.constprop.0+0x54/0xe8\n00242 do_el0_svc+0x44/0xc0\n00242 el0_svc+0x34/0xa0\n00242 el0t_64_sync_handler+0x104/0x130\n00242 el0t_64_sync+0x154/0x158\n00242 Code: 6b01001f 54ffff01 79408460 3617fec0 (d4210000)\n00242 ---[ end trace 0000000000000000 ]---\n00242 Kernel panic - not syncing: Oops - BUG: Fatal exception\n\nSigned-off-by: Alan Huang \u003cmmpgouride@gmail.com\u003e\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "531323a2efc3fbe20b540e3f41ecc94d68e74b76", "tree": "846ef4ca51ececdf272ef7b98ff229f465a0377d", "parents": [ "9cf6b84b71adb97f3c19476ebb5a42228fad89b5" ], "author": { "name": "Alan Huang", "email": "mmpgouride@gmail.com", "time": "Thu Feb 13 02:11:01 2025 +0800" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Wed Feb 12 18:40:19 2025 -0500" }, "message": "bcachefs: Pass _orig_restart_count to trans_was_restarted\n\n_orig_restart_count is unused now, according to the logic, trans_was_restarted\nshould be using _orig_restart_count.\n\nSigned-off-by: Alan Huang \u003cmmpgouride@gmail.com\u003e\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "9cf6b84b71adb97f3c19476ebb5a42228fad89b5", "tree": "d5cda508ff0836cc09bc44d13c17c5a01df8a82a", "parents": [ "9f734cd076931fa4d7feb5728e5cd95cde0af114" ], "author": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Mon Sep 23 22:12:31 2024 -0400" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Wed Feb 12 18:40:19 2025 -0500" }, "message": "bcachefs: CONFIG_BCACHEFS_INJECT_TRANSACTION_RESTARTS\n\nIncorrectly handled transaction restarts can be a source of heisenbugs;\nadd a mode where we randomly inject them to shake them out.\n\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "4dc1d1bec89864d8076e5ab314f86f46442bfb02", "tree": "6eb4819ef46b8e0437012997878308437e4db30b", "parents": [ "09fbf3d502050282bf47ab3babe1d4ed54dd1fd8", "5728c92ae112301936006c5e305677beb1a7f578" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 12 14:22:37 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Feb 12 14:22:37 2025 -0800" }, "message": "Merge tag \u0027mfd-fixes-6.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd\n\nPull MFD fix from Lee Jones:\n\n - Fix syscon users not specifying the \"syscon\" compatible\n\n* tag \u0027mfd-fixes-6.14\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/lee/mfd:\n mfd: syscon: Restore device_node_to_regmap() for non-syscon nodes\n" }, { "commit": "b3e127dacad60a384c92baafdc74f1508bf7dd47", "tree": "4e3c37f023e25fc0622304e61d66fbebe1c32049", "parents": [ "569617dbbd06286fb73f3f1c2ac91e51d863c7de" ], "author": { "name": "Mark Pearson", "email": "mpearson-lenovo@squebb.ca", "time": "Tue Feb 11 12:36:11 2025 -0500" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Wed Feb 12 13:49:37 2025 +0200" }, "message": "platform/x86: thinkpad_acpi: Fix registration of tpacpi platform driver\n\nThe recent platform profile changes prevent the tpacpi platform driver\nfrom registering. This error is seen in the kernel logs, and the\nvarious tpacpi entries are not created:\n\n[ 7550.642171] platform thinkpad_acpi: Resources present before probing\n\nThis happens because devm_platform_profile_register() is called before\ntpacpi_pdev probes (thanks to Kurt Borja for identifying the root\ncause).\n\nFor now revert back to the old platform_profile_register to fix the\nissue. This is quick fix and will be re-implemented later as more\ntesting is needed for full solution.\n\nTested on X1 Carbon G12.\n\nFixes: 31658c916fa6 (\"platform/x86: thinkpad_acpi: Use devm_platform_profile_register()\")\nSigned-off-by: Mark Pearson \u003cmpearson-lenovo@squebb.ca\u003e\nReviewed-by: Kurt Borja \u003ckuurtb@gmail.com\u003e\nLink: https://lore.kernel.org/r/20250211173620.16522-1-mpearson-lenovo@squebb.ca\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "cf56aa8dd26328a9af4ffe7fb0bd8fcfa9407112", "tree": "c67c9db5761d79f030ed1f15e1e2d9929aa4a10c", "parents": [ "e589adf5b70c07b1ab974d077046fdbf583b2f36" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Feb 07 13:25:57 2025 +0100" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Wed Feb 12 10:35:20 2025 +0100" }, "message": "Revert \"netfilter: flowtable: teardown flow if cached mtu is stale\"\n\nThis reverts commit b8baac3b9c5cc4b261454ff87d75ae8306016ffd.\n\nIPv4 packets with no DF flag set on result in frequent flow entry\nteardown cycles, this is visible in the network topology that is used in\nthe nft_flowtable.sh test.\n\nnft_flowtable.sh test ocassionally fails reporting that the dscp_fwd\ntest sees no packets going through the flowtable path.\n\nFixes: b8baac3b9c5c (\"netfilter: flowtable: teardown flow if cached mtu is stale\")\nReported-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "e589adf5b70c07b1ab974d077046fdbf583b2f36", "tree": "6e115238688744b8764078955a823ab347156f91", "parents": [ "06ea2c9c4163b8a8fde890a9e21d1059f22bb76d" ], "author": { "name": "Bart Van Assche", "email": "bvanassche@acm.org", "time": "Thu Feb 06 09:51:08 2025 -0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 11 18:02:04 2025 -0800" }, "message": "iavf: Fix a locking bug in an error path\n\nIf the netdev lock has been obtained, unlock it before returning.\nThis bug has been detected by the Clang thread-safety analyzer.\n\nFixes: afc664987ab3 (\"eth: iavf: extend the netdev_lock usage\")\nSigned-off-by: Bart Van Assche \u003cbvanassche@acm.org\u003e\nLink: https://patch.msgid.link/20250206175114.1974171-28-bvanassche@acm.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "06ea2c9c4163b8a8fde890a9e21d1059f22bb76d", "tree": "b2bac66b5e0827e2701b082f3e80bc324365d719", "parents": [ "1942b1c6f687b9d1efc93f35239f185a84900e93" ], "author": { "name": "David Howells", "email": "dhowells@redhat.com", "time": "Sun Feb 09 20:07:55 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 11 16:53:41 2025 -0800" }, "message": "rxrpc: Fix alteration of headers whilst zerocopy pending\n\nrxrpc: Fix alteration of headers whilst zerocopy pending\n\nAF_RXRPC now uses MSG_SPLICE_PAGES to do zerocopy of the DATA packets when\nit transmits them, but to reduce the number of descriptors required in the\nDMA ring, it allocates a space for the protocol header in the memory\nimmediately before the data content so that it can include both in a single\ndescriptor. This is used for either the main RX header or the smaller\njumbo subpacket header as appropriate:\n\n +----+------+\n | RX | |\n +-+--+DATA |\n |JH| |\n +--+------+\n\nNow, when it stitches a large jumbo packet together from a number of\nindividual DATA packets (each of which is 1412 bytes of data), it uses the\nfull RX header from the first and then the jumbo subpacket header for the\nrest of the components:\n\n +---+--+------+--+------+--+------+--+------+--+------+--+------+\n |UDP|RX|DATA |JH|DATA |JH|DATA |JH|DATA |JH|DATA |JH|DATA |\n +---+--+------+--+------+--+------+--+------+--+------+--+------+\n\nAs mentioned, the main RX header and the jumbo header overlay one another\nin memory and the formats don\u0027t match, so switching from one to the other\nmeans rearranging the fields and adjusting the flags.\n\nHowever, now that TLP has been included, it wants to retransmit the last\nsubpacket as a new data packet on its own, which means switching between\nthe header formats... and if the transmission is still pending, because of\nthe MSG_SPLICE_PAGES, we end up corrupting the jumbo subheader.\n\nThis has a variety of effects, with the RX service number overwriting the\njumbo checksum/key number field and the RX checksum overwriting the jumbo\nflags - resulting in, at the very least, a confused connection-level abort\nfrom the peer.\n\nFix this by leaving the jumbo header in the allocation with the data, but\nallocating the RX header from the page frag allocator and concocting it on\nthe fly at the point of transmission as it does for ACK packets.\n\nFixes: 7c482665931b (\"rxrpc: Implement RACK/TLP to deal with transmission stalls [RFC8985]\")\nSigned-off-by: David Howells \u003cdhowells@redhat.com\u003e\ncc: Marc Dionne \u003cmarc.dionne@auristor.com\u003e\ncc: Chuck Lever \u003cchuck.lever@oracle.com\u003e\ncc: Simon Horman \u003chorms@kernel.org\u003e\ncc: linux-afs@lists.infradead.org\nLink: https://patch.msgid.link/2181712.1739131675@warthog.procyon.org.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1942b1c6f687b9d1efc93f35239f185a84900e93", "tree": "c8a82faf5e66c5174c13ba020485df530461d3f1", "parents": [ "5805402dcc56241987bca674a1b4da79a249bab7" ], "author": { "name": "Russell King (Oracle)", "email": "rmk+kernel@armlinux.org.uk", "time": "Sat Feb 08 11:52:23 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 11 16:08:34 2025 -0800" }, "message": "net: phylink: make configuring clock-stop dependent on MAC support\n\nWe should not be configuring the PHYs clock-stop settings unless the\nMAC supports phylink managed EEE. Make this dependent on MAC support.\n\nThis was noticed in a suspicious RCU usage report from the kernel\ntest robot (the suspicious RCU usage due to calling phy_detach()\nremains unaddressed, but is triggered by the error this was\ngenerating.)\n\nFixes: 03abf2a7c654 (\"net: phylink: add EEE management\")\nSigned-off-by: Russell King (Oracle) \u003crmk+kernel@armlinux.org.uk\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/E1tgjNn-003q0w-Pw@rmk-PC.armlinux.org.uk\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5805402dcc56241987bca674a1b4da79a249bab7", "tree": "454c2c959560a5840747964ab07a27d05ae4fce2", "parents": [ "44ce3511c21c6ba87a719a0b9f140822cc1cc00b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Feb 10 10:52:42 2025 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Feb 11 15:24:48 2025 -0800" }, "message": "vxlan: check vxlan_vnigroup_init() return value\n\nvxlan_init() must check vxlan_vnigroup_init() success\notherwise a crash happens later, spotted by syzbot.\n\nOops: general protection fault, probably for non-canonical address 0xdffffc000000002c: 0000 [#1] PREEMPT SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000160-0x0000000000000167]\nCPU: 0 UID: 0 PID: 7313 Comm: syz-executor147 Not tainted 6.14.0-rc1-syzkaller-00276-g69b54314c975 #0\nHardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014\n RIP: 0010:vxlan_vnigroup_uninit+0x89/0x500 drivers/net/vxlan/vxlan_vnifilter.c:912\nCode: 00 48 8b 44 24 08 4c 8b b0 98 41 00 00 49 8d 86 60 01 00 00 48 89 c2 48 89 44 24 10 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 \u003c80\u003e 3c 02 00 0f 85 4d 04 00 00 49 8b 86 60 01 00 00 48 ba 00 00 00\nRSP: 0018:ffffc9000cc1eea8 EFLAGS: 00010202\nRAX: dffffc0000000000 RBX: 0000000000000001 RCX: ffffffff8672effb\nRDX: 000000000000002c RSI: ffffffff8672ecb9 RDI: ffff8880461b4f18\nRBP: ffff8880461b4ef4 R08: 0000000000000001 R09: 0000000000000000\nR10: 0000000000000001 R11: 0000000000000000 R12: 0000000000020000\nR13: ffff8880461b0d80 R14: 0000000000000000 R15: dffffc0000000000\nFS: 00007fecfa95d6c0(0000) GS:ffff88806a600000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00007fecfa95cfb8 CR3: 000000004472c000 CR4: 0000000000352ef0\nDR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000\nDR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400\nCall Trace:\n \u003cTASK\u003e\n vxlan_uninit+0x1ab/0x200 drivers/net/vxlan/vxlan_core.c:2942\n unregister_netdevice_many_notify+0x12d6/0x1f30 net/core/dev.c:11824\n unregister_netdevice_many net/core/dev.c:11866 [inline]\n unregister_netdevice_queue+0x307/0x3f0 net/core/dev.c:11736\n register_netdevice+0x1829/0x1eb0 net/core/dev.c:10901\n __vxlan_dev_create+0x7c6/0xa30 drivers/net/vxlan/vxlan_core.c:3981\n vxlan_newlink+0xd1/0x130 drivers/net/vxlan/vxlan_core.c:4407\n rtnl_newlink_create net/core/rtnetlink.c:3795 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3906 [inline]\n\nFixes: f9c4bb0b245c (\"vxlan: vni filtering support on collect metadata device\")\nReported-by: syzbot+6a9624592218c2c5e7aa@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/67a9d9b4.050a0220.110943.002d.GAE@google.com/T/#u\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Roopa Prabhu \u003croopa@nvidia.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20250210105242.883482-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "da2dccd7451de62b175fb8f0808d644959e964c7", "tree": "5c9b5ae31914446fb01e535cd4597825e9af890d", "parents": [ "acc18e1c1d8c0d59d793cf87790ccfcafb1bf5f0" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Wed Feb 05 17:36:48 2025 +0000" }, "committer": { "name": "David Sterba", "email": "dsterba@suse.com", "time": "Tue Feb 11 23:09:03 2025 +0100" }, "message": "btrfs: fix hole expansion when writing at an offset beyond EOF\n\nAt btrfs_write_check() if our file\u0027s i_size is not sector size aligned and\nwe have a write that starts at an offset larger than the i_size that falls\nwithin the same page of the i_size, then we end up not zeroing the file\nrange [i_size, write_offset).\n\nThe code is this:\n\n start_pos \u003d round_down(pos, fs_info-\u003esectorsize);\n oldsize \u003d i_size_read(inode);\n if (start_pos \u003e oldsize) {\n /* Expand hole size to cover write data, preventing empty gap */\n loff_t end_pos \u003d round_up(pos + count, fs_info-\u003esectorsize);\n\n ret \u003d btrfs_cont_expand(BTRFS_I(inode), oldsize, end_pos);\n if (ret)\n return ret;\n }\n\nSo if our file\u0027s i_size is 90269 bytes and a write at offset 90365 bytes\ncomes in, we get \u0027start_pos\u0027 set to 90112 bytes, which is less than the\ni_size and therefore we don\u0027t zero out the range [90269, 90365) by\ncalling btrfs_cont_expand().\n\nThis is an old bug introduced in commit 9036c10208e1 (\"Btrfs: update hole\nhandling v2\"), from 2008, and the buggy code got moved around over the\nyears.\n\nFix this by discarding \u0027start_pos\u0027 and comparing against the write offset\n(\u0027pos\u0027) without any alignment.\n\nThis bug was recently exposed by test case generic/363 which tests this\nscenario by polluting ranges beyond EOF with an mmap write and than verify\nthat after a file increases we get zeroes for the range which is supposed\nto be a hole and not what we wrote with the previous mmaped write.\n\nWe\u0027re only seeing this exposed now because generic/363 used to run only\non xfs until last Sunday\u0027s fstests update.\n\nThe test was failing like this:\n\n $ ./check generic/363\n FSTYP -- btrfs\n PLATFORM -- Linux/x86_64 debian0 6.13.0-rc7-btrfs-next-185+ #17 SMP PREEMPT_DYNAMIC Mon Feb 3 12:28:46 WET 2025\n MKFS_OPTIONS -- /dev/sdc\n MOUNT_OPTIONS -- /dev/sdc /home/fdmanana/btrfs-tests/scratch_1\n\n generic/363 0s ... [failed, exit status 1]- output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/363.out.bad)\n --- tests/generic/363.out\t2025-02-05 15:31:14.013646509 +0000\n +++ /home/fdmanana/git/hub/xfstests/results//generic/363.out.bad\t2025-02-05 17:25:33.112630781 +0000\n @@ -1 +1,46 @@\n QA output created by 363\n +READ BAD DATA: offset \u003d 0xdcad, size \u003d 0xd921, fname \u003d /home/fdmanana/btrfs-tests/dev/junk\n +OFFSET GOOD BAD RANGE\n +0x1609d 0x0000 0x3104 0x0\n +operation# (mod 256) for the bad data may be 4\n +0x1609e 0x0000 0x0472 0x1\n +operation# (mod 256) for the bad data may be 4\n ...\n (Run \u0027diff -u /home/fdmanana/git/hub/xfstests/tests/generic/363.out /home/fdmanana/git/hub/xfstests/results//generic/363.out.bad\u0027 to see the entire diff)\n Ran: generic/363\n Failures: generic/363\n Failed 1 of 1 tests\n\nFixes: 9036c10208e1 (\"Btrfs: update hole handling v2\")\nCC: stable@vger.kernel.org\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n" }, { "commit": "acc18e1c1d8c0d59d793cf87790ccfcafb1bf5f0", "tree": "d937e4f07a3627a8ec8a3643b625b0e87cbd8e2c", "parents": [ "01af106a076352182b2916b143fc50272600bd81" ], "author": { "name": "Filipe Manana", "email": "fdmanana@suse.com", "time": "Tue Feb 04 11:02:32 2025 +0000" }, "committer": { "name": "David Sterba", "email": "dsterba@suse.com", "time": "Tue Feb 11 23:09:03 2025 +0100" }, "message": "btrfs: fix stale page cache after race between readahead and direct IO write\n\nAfter commit ac325fc2aad5 (\"btrfs: do not hold the extent lock for entire\nread\") we can now trigger a race between a task doing a direct IO write\nand readahead. When this race is triggered it results in tasks getting\nstale data when they attempt do a buffered read (including the task that\ndid the direct IO write).\n\nThis race can be sporadically triggered with test case generic/418, failing\nlike this:\n\n $ ./check generic/418\n FSTYP -- btrfs\n PLATFORM -- Linux/x86_64 debian0 6.13.0-rc7-btrfs-next-185+ #17 SMP PREEMPT_DYNAMIC Mon Feb 3 12:28:46 WET 2025\n MKFS_OPTIONS -- /dev/sdc\n MOUNT_OPTIONS -- /dev/sdc /home/fdmanana/btrfs-tests/scratch_1\n\n generic/418 14s ... - output mismatch (see /home/fdmanana/git/hub/xfstests/results//generic/418.out.bad)\n --- tests/generic/418.out\t2020-06-10 19:29:03.850519863 +0100\n +++ /home/fdmanana/git/hub/xfstests/results//generic/418.out.bad\t2025-02-03 15:42:36.974609476 +0000\n @@ -1,2 +1,5 @@\n QA output created by 418\n +cmpbuf: offset 0: Expected: 0x1, got 0x0\n +[6:0] FAIL - comparison failed, offset 24576\n +diotest -wp -b 4096 -n 8 -i 4 failed at loop 3\n Silence is golden\n ...\n (Run \u0027diff -u /home/fdmanana/git/hub/xfstests/tests/generic/418.out /home/fdmanana/git/hub/xfstests/results//generic/418.out.bad\u0027 to see the entire diff)\n Ran: generic/418\n Failures: generic/418\n Failed 1 of 1 tests\n\nThe race happens like this:\n\n1) A file has a prealloc extent for the range [16K, 28K);\n\n2) Task A starts a direct IO write against file range [24K, 28K).\n At the start of the direct IO write it invalidates the page cache at\n __iomap_dio_rw() with kiocb_invalidate_pages() for the 4K page at file\n offset 24K;\n\n3) Task A enters btrfs_dio_iomap_begin() and locks the extent range\n [24K, 28K);\n\n4) Task B starts a readahead for file range [16K, 28K), entering\n btrfs_readahead().\n\n First it attempts to read the page at offset 16K by entering\n btrfs_do_readpage(), where it calls get_extent_map(), locks the range\n [16K, 20K) and gets the extent map for the range [16K, 28K), caching\n it into the \u0027em_cached\u0027 variable declared in the local stack of\n btrfs_readahead(), and then unlocks the range [16K, 20K).\n\n Since the extent map has the prealloc flag, at btrfs_do_readpage() we\n zero out the page\u0027s content and don\u0027t submit any bio to read the page\n from the extent.\n\n Then it attempts to read the page at offset 20K entering\n btrfs_do_readpage() where we reuse the previously cached extent map\n (decided by get_extent_map()) since it spans the page\u0027s range and\n it\u0027s still in the inode\u0027s extent map tree.\n\n Just like for the previous page, we zero out the page\u0027s content since\n the extent map has the prealloc flag set.\n\n Then it attempts to read the page at offset 24K entering\n btrfs_do_readpage() where we reuse the previously cached extent map\n (decided by get_extent_map()) since it spans the page\u0027s range and\n it\u0027s still in the inode\u0027s extent map tree.\n\n Just like for the previous pages, we zero out the page\u0027s content since\n the extent map has the prealloc flag set. Note that we didn\u0027t lock the\n extent range [24K, 28K), so we didn\u0027t synchronize with the ongoing\n direct IO write being performed by task A;\n\n5) Task A enters btrfs_create_dio_extent() and creates an ordered extent\n for the range [24K, 28K), with the flags BTRFS_ORDERED_DIRECT and\n BTRFS_ORDERED_PREALLOC set;\n\n6) Task A unlocks the range [24K, 28K) at btrfs_dio_iomap_begin();\n\n7) The ordered extent enters btrfs_finish_one_ordered() and locks the\n range [24K, 28K);\n\n8) Task A enters fs/iomap/direct-io.c:iomap_dio_complete() and it tries\n to invalidate the page at offset 24K by calling\n kiocb_invalidate_post_direct_write(), resulting in a call chain that\n ends up at btrfs_release_folio().\n\n The btrfs_release_folio() call ends up returning false because the range\n for the page at file offset 24K is currently locked by the task doing\n the ordered extent completion in the previous step (7), so we have:\n\n btrfs_release_folio() -\u003e\n __btrfs_release_folio() -\u003e\n try_release_extent_mapping() -\u003e\n\t try_release_extent_state()\n\n This last function checking that the range is locked and returning false\n and propagating it up to btrfs_release_folio().\n\n So this results in a failure to invalidate the page and\n kiocb_invalidate_post_direct_write() triggers this message logged in\n dmesg:\n\n Page cache invalidation failure on direct I/O. Possible data corruption due to collision with buffered I/O!\n\n After this we leave the page cache with stale data for the file range\n [24K, 28K), filled with zeroes instead of the data written by direct IO\n write (all bytes with a 0x01 value), so any task attempting to read with\n buffered IO, including the task that did the direct IO write, will get\n all bytes in the range with a 0x00 value instead of the written data.\n\nFix this by locking the range, with btrfs_lock_and_flush_ordered_range(),\nat the two callers of btrfs_do_readpage() instead of doing it at\nget_extent_map(), just like we did before commit ac325fc2aad5 (\"btrfs: do\nnot hold the extent lock for entire read\"), and unlocking the range after\nall the calls to btrfs_do_readpage(). This way we never reuse a cached\nextent map without flushing any pending ordered extents from a concurrent\ndirect IO write.\n\nFixes: ac325fc2aad5 (\"btrfs: do not hold the extent lock for entire read\")\nReviewed-by: Qu Wenruo \u003cwqu@suse.com\u003e\nSigned-off-by: Filipe Manana \u003cfdmanana@suse.com\u003e\nSigned-off-by: David Sterba \u003cdsterba@suse.com\u003e\n" }, { "commit": "09fbf3d502050282bf47ab3babe1d4ed54dd1fd8", "tree": "b53b2f28b67fbd58ce07fcdcfd39cdaaf87c8369", "parents": [ "318e8c339c9a0891c389298bb328ed0762a9935e", "bdc35f164b0f60480b2f5e098bb8f3c0cea05cd2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 11 10:19:36 2025 -0800" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 11 10:19:36 2025 -0800" }, "message": "Merge tag \u0027tomoyo-pr-20250211\u0027 of git://git.code.sf.net/p/tomoyo/tomoyo\n\nPull tomoyo fixes from Tetsuo Handa:\n \"Redo of pathname patternization and fix spelling errors\"\n\n* tag \u0027tomoyo-pr-20250211\u0027 of git://git.code.sf.net/p/tomoyo/tomoyo:\n tomoyo: use better patterns for procfs in learning mode\n tomoyo: fix spelling errors\n tomoyo: fix spelling error\n" }, { "commit": "318e8c339c9a0891c389298bb328ed0762a9935e", "tree": "39624dc8ec1fadc68bdf5b01619a1e59cf55088d", "parents": [ "febbc555cf0fff895546ddb8ba2c9a523692fb55" ], "author": { "name": "Patrick Bellasi", "email": "derkling@google.com", "time": "Wed Feb 05 14:04:41 2025 +0000" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Feb 11 10:07:52 2025 -0800" }, "message": "x86/cpu/kvm: SRSO: Fix possible missing IBPB on VM-Exit\n\nIn [1] the meaning of the synthetic IBPB flags has been redefined for a\nbetter separation of concerns:\n - ENTRY_IBPB -- issue IBPB on entry only\n - IBPB_ON_VMEXIT -- issue IBPB on VM-Exit only\nand the Retbleed mitigations have been updated to match this new\nsemantics.\n\nCommit [2] was merged shortly before [1], and their interaction was not\nhandled properly. This resulted in IBPB not being triggered on VM-Exit\nin all SRSO mitigation configs requesting an IBPB there.\n\nSpecifically, an IBPB on VM-Exit is triggered only when\nX86_FEATURE_IBPB_ON_VMEXIT is set. However:\n\n - X86_FEATURE_IBPB_ON_VMEXIT is not set for \"spec_rstack_overflow\u003dibpb\",\n because before [1] having X86_FEATURE_ENTRY_IBPB was enough. Hence,\n an IBPB is triggered on entry but the expected IBPB on VM-exit is\n not.\n\n - X86_FEATURE_IBPB_ON_VMEXIT is not set also when\n \"spec_rstack_overflow\u003dibpb-vmexit\" if X86_FEATURE_ENTRY_IBPB is\n already set.\n\n That\u0027s because before [1] this was effectively redundant. Hence, e.g.\n a \"retbleed\u003dibpb spec_rstack_overflow\u003dbpb-vmexit\" config mistakenly\n reports the machine still vulnerable to SRSO, despite an IBPB being\n triggered both on entry and VM-Exit, because of the Retbleed selected\n mitigation config.\n\n - UNTRAIN_RET_VM won\u0027t still actually do anything unless\n CONFIG_MITIGATION_IBPB_ENTRY is set.\n\nFor \"spec_rstack_overflow\u003dibpb\", enable IBPB on both entry and VM-Exit\nand clear X86_FEATURE_RSB_VMEXIT which is made superfluous by\nX86_FEATURE_IBPB_ON_VMEXIT. This effectively makes this mitigation\noption similar to the one for \u0027retbleed\u003dibpb\u0027, thus re-order the code\nfor the RETBLEED_MITIGATION_IBPB option to be less confusing by having\nall features enabling before the disabling of the not needed ones.\n\nFor \"spec_rstack_overflow\u003dibpb-vmexit\", guard this mitigation setting\nwith CONFIG_MITIGATION_IBPB_ENTRY to ensure UNTRAIN_RET_VM sequence is\neffectively compiled in. Drop instead the CONFIG_MITIGATION_SRSO guard,\nsince none of the SRSO compile cruft is required in this configuration.\nAlso, check only that the required microcode is present to effectively\nenabled the IBPB on VM-Exit.\n\nFinally, update the KConfig description for CONFIG_MITIGATION_IBPB_ENTRY\nto list also all SRSO config settings enabled by this guard.\n\nFixes: 864bcaa38ee4 (\"x86/cpu/kvm: Provide UNTRAIN_RET_VM\") [1]\nFixes: d893832d0e1e (\"x86/srso: Add IBPB on VMEXIT\") [2]\nReported-by: Yosry Ahmed \u003cyosryahmed@google.com\u003e\nSigned-off-by: Patrick Bellasi \u003cderkling@google.com\u003e\nReviewed-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\nCc: stable@kernel.org\nSigned-off-by: Linus Torvalds \u003ctorvalds@linux-foundation.org\u003e\n" }, { "commit": "569617dbbd06286fb73f3f1c2ac91e51d863c7de", "tree": "be4c3210f0a03d0defd3be5ba796211470227b80", "parents": [ "fc22b06fbd2afefa1eddff69a6fd30c539cef577" ], "author": { "name": "Sakari Ailus", "email": "sakari.ailus@linux.intel.com", "time": "Tue Feb 11 09:28:40 2025 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Tue Feb 11 19:15:00 2025 +0200" }, "message": "platform/x86: int3472: Call \"reset\" GPIO \"enable\" for INT347E\n\nThe DT bindings for ov7251 specify \"enable\" GPIO (xshutdown in\ndocumentation) but the int3472 indiscriminately provides this as a \"reset\"\nGPIO to sensor drivers. Take this into account by assigning it as \"enable\"\nwith active high polarity for INT347E devices, i.e. ov7251. \"reset\" with\nactive low polarity remains the default GPIO name for other devices.\n\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nReviewed-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20250211072841.7713-3-sakari.ailus@linux.intel.com\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "fc22b06fbd2afefa1eddff69a6fd30c539cef577", "tree": "142615696caa01e4111c33f884df365d1140a25f", "parents": [ "9cff907cbf8c7fb5345918dbcc7b74a01656f34f" ], "author": { "name": "Sakari Ailus", "email": "sakari.ailus@linux.intel.com", "time": "Tue Feb 11 09:28:39 2025 +0200" }, "committer": { "name": "Ilpo Järvinen", "email": "ilpo.jarvinen@linux.intel.com", "time": "Tue Feb 11 19:14:57 2025 +0200" }, "message": "platform/x86: int3472: Use correct type for \"polarity\", call it gpio_flags\n\nStruct gpiod_lookup flags field\u0027s type is unsigned long. Thus use unsigned\nlong for values to be assigned to that field. Similarly, also call the\nfield gpio_flags which it really is.\n\nSigned-off-by: Sakari Ailus \u003csakari.ailus@linux.intel.com\u003e\nReviewed-by: Hans de Goede \u003chdegoede@redhat.com\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nLink: https://lore.kernel.org/r/20250211072841.7713-2-sakari.ailus@linux.intel.com\nReviewed-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\nSigned-off-by: Ilpo Järvinen \u003cilpo.jarvinen@linux.intel.com\u003e\n" }, { "commit": "63f20f00d23d569e4e67859b4e8dcc9de79221cb", "tree": "82cb8afd95e7f395ac92bfdf05da42f36936e924", "parents": [ "7822dd4d6d4bebca5045a395e1784ef09cae2d43" ], "author": { "name": "Song Yoong Siang", "email": "yoong.siang.song@intel.com", "time": "Wed Feb 05 10:36:03 2025 +0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:11 2025 -0800" }, "message": "igc: Set buffer type for empty frames in igc_init_empty_frame\n\nSet the buffer type to IGC_TX_BUFFER_TYPE_SKB for empty frame in the\nigc_init_empty_frame function. This ensures that the buffer type is\ncorrectly identified and handled during Tx ring cleanup.\n\nFixes: db0b124f02ba (\"igc: Enhance Qbv scheduling by using first flag bit\")\nCc: stable@vger.kernel.org # 6.2+\nSigned-off-by: Song Yoong Siang \u003cyoong.siang.song@intel.com\u003e\nAcked-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Mor Bar-Gabay \u003cmorx.bar.gabay@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "7822dd4d6d4bebca5045a395e1784ef09cae2d43", "tree": "6e6e263359794fbd448320dfa9e504227c66733b", "parents": [ "61fb097f9a644407b9342a8169d0edef868612d7" ], "author": { "name": "Zdenek Bouska", "email": "zdenek.bouska@siemens.com", "time": "Tue Jan 28 13:26:48 2025 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:11 2025 -0800" }, "message": "igc: Fix HW RX timestamp when passed by ZC XDP\n\nFixes HW RX timestamp in the following scenario:\n- AF_PACKET socket with enabled HW RX timestamps is created\n- AF_XDP socket with enabled zero copy is created\n- frame is forwarded to the BPF program, where the timestamp should\n still be readable (extracted by igc_xdp_rx_timestamp(), kfunc\n behind bpf_xdp_metadata_rx_timestamp())\n- the frame got XDP_PASS from BPF program, redirecting to the stack\n- AF_PACKET socket receives the frame with HW RX timestamp\n\nMoves the skb timestamp setting from igc_dispatch_skb_zc() to\nigc_construct_skb_zc() so that igc_construct_skb_zc() is similar to\nigc_construct_skb().\n\nThis issue can also be reproduced by running:\n # tools/testing/selftests/bpf/xdp_hw_metadata enp1s0\nWhen a frame with the wrong port 9092 (instead of 9091) is used:\n # echo -n xdp | nc -u -q1 192.168.10.9 9092\nthen the RX timestamp is missing and xdp_hw_metadata prints:\n skb hwtstamp is not found!\n\nWith this fix or when copy mode is used:\n # tools/testing/selftests/bpf/xdp_hw_metadata -c enp1s0\nthen RX timestamp is found and xdp_hw_metadata prints:\n found skb hwtstamp \u003d 1736509937.852786132\n\nFixes: 069b142f5819 (\"igc: Add support for PTP .getcyclesx64()\")\nSigned-off-by: Zdenek Bouska \u003czdenek.bouska@siemens.com\u003e\nAcked-by: Vinicius Costa Gomes \u003cvinicius.gomes@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Florian Bezdeka \u003cflorian.bezdeka@siemens.com\u003e\nReviewed-by: Song Yoong Siang \u003cyoong.siang.song@intel.com\u003e\nTested-by: Mor Bar-Gabay \u003cmorx.bar.gabay@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "61fb097f9a644407b9342a8169d0edef868612d7", "tree": "64bd5b0ae91abbdc603dd5ef52e4f2ddceb08700", "parents": [ "52c11d31b5a1d1c747bb5f36cc4808e93e2348f4" ], "author": { "name": "Piotr Kwapulinski", "email": "piotr.kwapulinski@intel.com", "time": "Fri Jan 31 13:14:50 2025 +0100" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:11 2025 -0800" }, "message": "ixgbe: Fix possible skb NULL pointer dereference\n\nThe commit c824125cbb18 (\"ixgbe: Fix passing 0 to ERR_PTR in\nixgbe_run_xdp()\") stopped utilizing the ERR-like macros for xdp status\nencoding. Propagate this logic to the ixgbe_put_rx_buffer().\n\nThe commit also relaxed the skb NULL pointer check - caught by Smatch.\nRestore this check.\n\nFixes: c824125cbb18 (\"ixgbe: Fix passing 0 to ERR_PTR in ixgbe_run_xdp()\")\nReported-by: Dan Carpenter \u003cdan.carpenter@linaro.org\u003e\nCloses: https://lore.kernel.org/intel-wired-lan/2c7d6c31-192a-4047-bd90-9566d0e14cc0@stanley.mountain/\nAcked-by: Maciej Fijalkowski \u003cmaciej.fijalkowski@intel.com\u003e\nSigned-off-by: Piotr Kwapulinski \u003cpiotr.kwapulinski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Saritha Sanigani \u003csarithax.sanigani@intel.com\u003e (A Contingent Worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "52c11d31b5a1d1c747bb5f36cc4808e93e2348f4", "tree": "0e7e051bdb7e6cc23e156cc2b7f0a8500bd49d94", "parents": [ "2ff66c2f9ea4e9311e9a00004348b6c465bd5d3b" ], "author": { "name": "Joshua Hay", "email": "joshua.a.hay@intel.com", "time": "Tue Feb 04 18:08:11 2025 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:11 2025 -0800" }, "message": "idpf: call set_real_num_queues in idpf_open\n\nOn initial driver load, alloc_etherdev_mqs is called with whatever max\nqueue values are provided by the control plane. However, if the driver\nis loaded on a system where num_online_cpus() returns less than the max\nqueues, the netdev will think there are more queues than are actually\navailable. Only num_online_cpus() will be allocated, but\nskb_get_queue_mapping(skb) could possibly return an index beyond the\nrange of allocated queues. Consequently, the packet is silently dropped\nand it appears as if TX is broken.\n\nSet the real number of queues during open so the netdev knows how many\nqueues will be allocated.\n\nFixes: 1c325aac10a8 (\"idpf: configure resources for TX queues\")\nSigned-off-by: Joshua Hay \u003cjoshua.a.hay@intel.com\u003e\nReviewed-by: Madhu Chittim \u003cmadhu.chittim@intel.com\u003e\nTested-by: Samuel Salin \u003cSamuel.salin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "2ff66c2f9ea4e9311e9a00004348b6c465bd5d3b", "tree": "2bc40516ef114a3f49120ee3a3cbce57ac9e6bd3", "parents": [ "69ab25a74e2df53edc2de4acfce0a484bdb88155" ], "author": { "name": "Sridhar Samudrala", "email": "sridhar.samudrala@intel.com", "time": "Fri Jan 10 16:29:58 2025 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:10 2025 -0800" }, "message": "idpf: record rx queue in skb for RSC packets\n\nMove the call to skb_record_rx_queue in idpf_rx_process_skb_fields()\nso that RX queue is recorded for RSC packets too.\n\nFixes: 90912f9f4f2d (\"idpf: convert header split mode to libeth + napi_build_skb()\")\nSigned-off-by: Sridhar Samudrala \u003csridhar.samudrala@intel.com\u003e\nReviewed-by: Madhu Chittim \u003cmadhu.chittim@intel.com\u003e\nTested-by: Samuel Salin \u003cSamuel.salin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "69ab25a74e2df53edc2de4acfce0a484bdb88155", "tree": "6d4ba95be902c3cd97f7df37cc13ff31be1f21c2", "parents": [ "44ce3511c21c6ba87a719a0b9f140822cc1cc00b" ], "author": { "name": "Sridhar Samudrala", "email": "sridhar.samudrala@intel.com", "time": "Fri Jan 10 16:29:22 2025 -0800" }, "committer": { "name": "Tony Nguyen", "email": "anthony.l.nguyen@intel.com", "time": "Tue Feb 11 09:13:10 2025 -0800" }, "message": "idpf: fix handling rsc packet with a single segment\n\nHandle rsc packet with a single segment same as a multi\nsegment rsc packet so that CHECKSUM_PARTIAL is set in the\nskb-\u003eip_summed field. The current code is passing CHECKSUM_NONE\nresulting in TCP GRO layer doing checksum in SW and hiding the\nissue. This will fail when using dmabufs as payload buffers as\nskb frag would be unreadable.\n\nFixes: 3a8845af66ed (\"idpf: add RX splitq napi poll support\")\nSigned-off-by: Sridhar Samudrala \u003csridhar.samudrala@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Samuel Salin \u003cSamuel.salin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\n" }, { "commit": "9f734cd076931fa4d7feb5728e5cd95cde0af114", "tree": "e7cea71d497a61b9af408bdd9cdce189145682ba", "parents": [ "1e690efa72596a1163dc56709707f459221889d2" ], "author": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Mon Feb 10 17:46:36 2025 -0500" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Tue Feb 11 10:10:32 2025 -0500" }, "message": "bcachefs: Fix want_new_bset() so we write until the end of the btree node\n\nwant_new_bset() returns the address of a new bset to initialize if we\nwish to do so in a btree node - either because the previous one is too\nbig, or because it\u0027s been written.\n\nThe case for \u0027previous bset was written\u0027 was wrong: it\u0027s only supposed\nto check for if we have space in the node for one more block, but\nbecause it subtracted the header from the space available it would never\ninitialize a new bset if we were down to the last block in a node.\n\nFixing this results in fewer btree node splits/compactions, which fixes\na bug with flushing the journal to go read-only sometimes not\nterminating or taking excessively long.\n\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "1e690efa72596a1163dc56709707f459221889d2", "tree": "9f9b1197a4453f502fa10eb8ea71ac5ce420fefd", "parents": [ "1c316eb57c11fb3dc447b04ef765459cd61c8647" ], "author": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Mon Feb 10 11:34:59 2025 -0500" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Tue Feb 11 10:10:32 2025 -0500" }, "message": "bcachefs: Split out journal pins by btree level\n\nThis lets us flush the journal to go read-only more effectively.\n\nFlushing the journal and going read-only requires halting mutually\nrecursive processes, which strictly speaking are not guaranteed to\nterminate.\n\nFlushing btree node journal pins will kick off a btree node write, and\nbtree node writes on completion must do another btree update to the\nparent node to update the \u0027sectors_written\u0027 field for that node\u0027s key.\n\nIf the parent node is full and requires a split or compaction, that\u0027s\ngoing to generate a whole bunch of additional btree updates - alloc\ninfo, LRU btree, and more - which then have to be flushed, and the cycle\nrepeats.\n\nThis process will terminate much more effectively if we tweak journal\nreclaim to flush btree updates leaf to root: i.e., don\u0027t flush updates\nfor a given btree node (kicking off a write, and consuming space within\nthat node up to the next block boundary) if there might still be\nunflushed updates in child nodes.\n\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "1c316eb57c11fb3dc447b04ef765459cd61c8647", "tree": "fe1efbd986f2076843a0da2bc33842db1386e990", "parents": [ "595170d4b660640289003d1881a9a6ef8ded6865" ], "author": { "name": "Alan Huang", "email": "mmpgouride@gmail.com", "time": "Mon Feb 10 11:04:22 2025 +0800" }, "committer": { "name": "Kent Overstreet", "email": "kent.overstreet@linux.dev", "time": "Tue Feb 11 10:10:32 2025 -0500" }, "message": "bcachefs: Fix use after free\n\nacc-\u003ek.data should be used with the lock hold:\n\n00221 \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d TEST generic/187\n00221 run fstests generic/187 at 2025-02-09 21:08:10\n00221 spectre-v4 mitigation disabled by command-line option\n00222 bcachefs (vdc): starting version 1.20: directory_size opts\u003derrors\u003dro\n00222 bcachefs (vdc): initializing new filesystem\n00222 bcachefs (vdc): going read-write\n00222 bcachefs (vdc): marking superblocks\n00222 bcachefs (vdc): initializing freespace\n00222 bcachefs (vdc): done initializing freespace\n00222 bcachefs (vdc): reading snapshots table\n00222 bcachefs (vdc): reading snapshots done\n00222 bcachefs (vdc): done starting filesystem\n00222 bcachefs (vdc): shutting down\n00222 bcachefs (vdc): going read-only\n00222 bcachefs (vdc): finished waiting for writes to stop\n00223 bcachefs (vdc): flushing journal and stopping allocators, journal seq 6\n00223 bcachefs (vdc): flushing journal and stopping allocators complete, journal seq 8\n00223 bcachefs (vdc): clean shutdown complete, journal seq 9\n00223 bcachefs (vdc): marking filesystem clean\n00223 bcachefs (vdc): shutdown complete\n00223 bcachefs (vdc): starting version 1.20: directory_size opts\u003derrors\u003dro\n00223 bcachefs (vdc): initializing new filesystem\n00223 bcachefs (vdc): going read-write\n00223 bcachefs (vdc): marking superblocks\n00223 bcachefs (vdc): initializing freespace\n00223 bcachefs (vdc): done initializing freespace\n00223 bcachefs (vdc): reading snapshots table\n00223 bcachefs (vdc): reading snapshots done\n00223 bcachefs (vdc): done starting filesystem\n00244 hrtimer: interrupt took 123350440 ns\n00264 bcachefs (vdc): shutting down\n00264 bcachefs (vdc): going read-only\n00264 bcachefs (vdc): finished waiting for writes to stop\n00264 bcachefs (vdc): flushing journal and stopping allocators, journal seq 97\n00265 bcachefs (vdc): flushing journal and stopping allocators complete, journal seq 101\n00265 bcachefs (vdc): clean shutdown complete, journal seq 102\n00265 bcachefs (vdc): marking filesystem clean\n00265 bcachefs (vdc): shutdown complete\n00265 bcachefs (vdc): starting version 1.20: directory_size opts\u003derrors\u003dro\n00265 bcachefs (vdc): recovering from clean shutdown, journal seq 102\n00265 bcachefs (vdc): accounting_read...\n00265 \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n00265 done\n00265 BUG: KASAN: slab-use-after-free in bch2_fs_to_text+0x12b4/0x1728\n00265 bcachefs (vdc): alloc_read... done\n00265 bcachefs (vdc): stripes_read... done\n00265 Read of size 4 at addr ffffff80c57eac00 by task cat/7531\n00265 bcachefs (vdc): snapshots_read... done\n00265\n00265 CPU: 6 UID: 0 PID: 7531 Comm: cat Not tainted 6.13.0-rc3-ktest-g16fc6fa3819d #14103\n00265 Hardware name: linux,dummy-virt (DT)\n00265 Call trace:\n00265 show_stack+0x1c/0x30 (C)\n00265 dump_stack_lvl+0x6c/0x80\n00265 print_report+0xf8/0x5d8\n00265 kasan_report+0x90/0xd0\n00265 __asan_report_load4_noabort+0x1c/0x28\n00265 bch2_fs_to_text+0x12b4/0x1728\n00265 bch2_fs_show+0x94/0x188\n00265 sysfs_kf_seq_show+0x1a4/0x348\n00265 kernfs_seq_show+0x12c/0x198\n00265 seq_read_iter+0x27c/0xfd0\n00265 kernfs_fop_read_iter+0x390/0x4f8\n00265 vfs_read+0x480/0x7f0\n00265 ksys_read+0xe0/0x1e8\n00265 __arm64_sys_read+0x70/0xa8\n00265 invoke_syscall.constprop.0+0x74/0x1e8\n00265 do_el0_svc+0xc8/0x1c8\n00265 el0_svc+0x20/0x60\n00265 el0t_64_sync_handler+0x104/0x130\n00265 el0t_64_sync+0x154/0x158\n00265\n00265 Allocated by task 7510:\n00265 kasan_save_stack+0x28/0x50\n00265 kasan_save_track+0x1c/0x38\n00265 kasan_save_alloc_info+0x3c/0x50\n00265 __kasan_kmalloc+0xac/0xb0\n00265 __kmalloc_node_noprof+0x168/0x348\n00265 __kvmalloc_node_noprof+0x20/0x140\n00265 __bch2_darray_resize_noprof+0x90/0x1b0\n00265 __bch2_accounting_mem_insert+0x76c/0xb08\n00265 bch2_accounting_mem_insert+0x224/0x3b8\n00265 bch2_accounting_mem_mod_locked+0x480/0xc58\n00265 bch2_accounting_read+0xa94/0x3eb8\n00265 bch2_run_recovery_pass+0x80/0x178\n00265 bch2_run_recovery_passes+0x340/0x698\n00265 bch2_fs_recovery+0x1c98/0x2bd8\n00265 bch2_fs_start+0x240/0x490\n00265 bch2_fs_get_tree+0xe1c/0x1458\n00265 vfs_get_tree+0x7c/0x250\n00265 path_mount+0xe24/0x1648\n00265 __arm64_sys_mount+0x240/0x438\n00265 invoke_syscall.constprop.0+0x74/0x1e8\n00265 do_el0_svc+0xc8/0x1c8\n00265 el0_svc+0x20/0x60\n00265 el0t_64_sync_handler+0x104/0x130\n00265 el0t_64_sync+0x154/0x158\n00265\n00265 Freed by task 7510:\n00265 kasan_save_stack+0x28/0x50\n00265 kasan_save_track+0x1c/0x38\n00265 kasan_save_free_info+0x48/0x88\n00265 __kasan_slab_free+0x48/0x60\n00265 kfree+0x188/0x408\n00265 kvfree+0x3c/0x50\n00265 __bch2_darray_resize_noprof+0xe0/0x1b0\n00265 __bch2_accounting_mem_insert+0x76c/0xb08\n00265 bch2_accounting_mem_insert+0x224/0x3b8\n00265 bch2_accounting_mem_mod_locked+0x480/0xc58\n00265 bch2_accounting_read+0xa94/0x3eb8\n00265 bch2_run_recovery_pass+0x80/0x178\n00265 bch2_run_recovery_passes+0x340/0x698\n00265 bch2_fs_recovery+0x1c98/0x2bd8\n00265 bch2_fs_start+0x240/0x490\n00265 bch2_fs_get_tree+0xe1c/0x1458\n00265 vfs_get_tree+0x7c/0x250\n00265 path_mount+0xe24/0x1648\n00265 bcachefs (vdc): going read-write\n00265 __arm64_sys_mount+0x240/0x438\n00265 invoke_syscall.constprop.0+0x74/0x1e8\n00265 do_el0_svc+0xc8/0x1c8\n00265 el0_svc+0x20/0x60\n00265 el0t_64_sync_handler+0x104/0x130\n00265 el0t_64_sync+0x154/0x158\n00265\n00265 The buggy address belongs to the object at ffffff80c57eac00\n00265 which belongs to the cache kmalloc-128 of size 128\n00265 The buggy address is located 0 bytes inside of\n00265 freed 128-byte region [ffffff80c57eac00, ffffff80c57eac80)\n00265\n00265 The buggy address belongs to the physical page:\n00265 page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1057ea\n00265 head: order:1 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0\n00265 flags: 0x8000000000000040(head|zone\u003d2)\n00265 page_type: f5(slab)\n00265 raw: 8000000000000040 ffffff80c0002800 dead000000000100 dead000000000122\n00265 raw: 0000000000000000 0000000000200020 00000001f5000000 ffffff80c57a6400\n00265 head: 8000000000000040 ffffff80c0002800 dead000000000100 dead000000000122\n00265 head: 0000000000000000 0000000000200020 00000001f5000000 ffffff80c57a6400\n00265 head: 8000000000000001 fffffffec315fa81 ffffffffffffffff 0000000000000000\n00265 head: 0000000000000002 0000000000000000 00000000ffffffff 0000000000000000\n00265 page dumped because: kasan: bad access detected\n00265\n00265 Memory state around the buggy address:\n00265 ffffff80c57eab00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00\n00265 ffffff80c57eab80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n00265 \u003effffff80c57eac00: fa fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb\n00265 ^\n00265 ffffff80c57eac80: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc\n00265 ffffff80c57ead00: 00 00 00 00 00 00 00 00 00 00 00 00 00 fc fc fc\n00265 \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n00265 Kernel panic - not syncing: kasan.fault\u003dpanic set ...\n00265 CPU: 6 UID: 0 PID: 7531 Comm: cat Not tainted 6.13.0-rc3-ktest-g16fc6fa3819d #14103\n00265 Hardware name: linux,dummy-virt (DT)\n00265 Call trace:\n00265 show_stack+0x1c/0x30 (C)\n00265 dump_stack_lvl+0x30/0x80\n00265 dump_stack+0x18/0x20\n00265 panic+0x4d4/0x518\n00265 start_report.constprop.0+0x0/0x90\n00265 kasan_report+0xa0/0xd0\n00265 __asan_report_load4_noabort+0x1c/0x28\n00265 bch2_fs_to_text+0x12b4/0x1728\n00265 bch2_fs_show+0x94/0x188\n00265 sysfs_kf_seq_show+0x1a4/0x348\n00265 kernfs_seq_show+0x12c/0x198\n00265 seq_read_iter+0x27c/0xfd0\n00265 kernfs_fop_read_iter+0x390/0x4f8\n00265 vfs_read+0x480/0x7f0\n00265 ksys_read+0xe0/0x1e8\n00265 __arm64_sys_read+0x70/0xa8\n00265 invoke_syscall.constprop.0+0x74/0x1e8\n00265 do_el0_svc+0xc8/0x1c8\n00265 el0_svc+0x20/0x60\n00265 el0t_64_sync_handler+0x104/0x130\n00265 el0t_64_sync+0x154/0x158\n00265 SMP: stopping secondary CPUs\n00265 Kernel Offset: disabled\n00265 CPU features: 0x000,00000070,00000010,8240500b\n00265 Memory Limit: none\n00265 ---[ end Kernel panic - not syncing: kasan.fault\u003dpanic set ... ]---\n00270 \u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d FAILED TIMEOUT generic.187 in 1200s\n\nSigned-off-by: Alan Huang \u003cmmpgouride@gmail.com\u003e\nSigned-off-by: Kent Overstreet \u003ckent.overstreet@linux.dev\u003e\n" }, { "commit": "5728c92ae112301936006c5e305677beb1a7f578", "tree": "602f943c90d813306238036428c6d19d9f3d883d", "parents": [ "2014c95afecee3e76ca4a56956a936e23283f05b" ], "author": { "name": "Rob Herring (Arm)", "email": "robh@kernel.org", "time": "Fri Jan 24 13:16:44 2025 -0600" }, "committer": { "name": "Lee Jones", "email": "lee@kernel.org", "time": "Tue Feb 11 14:53:39 2025 +0000" }, "message": "mfd: syscon: Restore device_node_to_regmap() for non-syscon nodes\n\nCommit ba5095ebbc7a (\"mfd: syscon: Allow syscon nodes without a\n\"syscon\" compatible\") broke drivers which call device_node_to_regmap()\non nodes without a \"syscon\" compatible. Restore the prior behavior for\ndevice_node_to_regmap().\n\nThis also makes using device_node_to_regmap() incompatible with\nof_syscon_register_regmap() again, so add kerneldoc for\ndevice_node_to_regmap() and syscon_node_to_regmap() to make it clear\nhow and when each one should be used.\n\nFixes: ba5095ebbc7a (\"mfd: syscon: Allow syscon nodes without a \"syscon\" compatible\")\nReported-by: Vaishnav Achath \u003cvaishnav.a@ti.com\u003e\nSigned-off-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\nReviewed-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nReviewed-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nTested-by: Chen-Yu Tsai \u003cwenst@chromium.org\u003e\nTested-by: Nishanth Menon \u003cnm@ti.com\u003e\nTested-by: Daniel Golle \u003cdaniel@makrotopia.org\u003e\nTested-by: Frank Wunderlich \u003cfrank-w@public-files.de\u003e\nTested-by: Dhruva Gole \u003cd-gole@ti.com\u003e\nTested-by: Nícolas F. R. A. Prado \u003cnfraprado@collabora.com\u003e\nTested-by: AngeloGioacchino Del Regno \u003cangelogioacchino.delregno@collabora.com\u003e\nLink: https://lore.kernel.org/r/20250124191644.2309790-1-robh@kernel.org\nSigned-off-by: Lee Jones \u003clee@kernel.org\u003e\n" }, { "commit": "44ce3511c21c6ba87a719a0b9f140822cc1cc00b", "tree": "de9ccea98c727f0ffd46d0a46f99946948cd427c", "parents": [ "2196ceea2d39018a85a037cbb4c22666edb5a72c", "f4c9c2cc827d803159730b1da813a0c595969831" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 11 10:39:46 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 11 10:39:46 2025 +0100" }, "message": "Merge tag \u0027batadv-net-pullrequest-20250207\u0027 of git://git.open-mesh.org/linux-merge\n\nSimon Wunderlich says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nHere are some batman-adv bugfixes:\n\n - Fix panic during interface removal in BATMAN V, by Andy Strohman\n\n - Cleanup BATMAN V/ELP metric handling, by Sven Eckelmann (2 patches)\n\n - Fix incorrect offset in batadv_tt_tvlv_ogm_handler_v1(),\n by Remi Pommarel\n\n* tag \u0027batadv-net-pullrequest-20250207\u0027 of git://git.open-mesh.org/linux-merge:\n batman-adv: Fix incorrect offset in batadv_tt_tvlv_ogm_handler_v1()\n batman-adv: Drop unmanaged ELP metric worker\n batman-adv: Ignore neighbor throughput metrics in error case\n batman-adv: fix panic during interface removal\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250207095823.26043-1-sw@simonwunderlich.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2196ceea2d39018a85a037cbb4c22666edb5a72c", "tree": "c85e429e674730f4ddf58f1ff7345a126a861dd6", "parents": [ "8e248f2dbb1885647e259837d38200942f3591a3", "b4c1fde5ced93d9f4ad89e2c940d3fd56ad82288" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 11 10:20:55 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 11 10:20:55 2025 +0100" }, "message": "Merge branch \u0027ptp-vmclock-bugfixes-and-cleanups-for-error-handling\u0027\n\n says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nptp: vmclock: bugfixes and cleanups for error handling\n\nSome error handling issues I noticed while looking at the code.\n\nOnly compile-tested.\n\nv1: https://lore.kernel.org/r/20250206-vmclock-probe-v1-0-17a3ea07be34@linutronix.de\n\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20250207-vmclock-probe-v2-0-bc2fce0bdf07@linutronix.de\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "b4c1fde5ced93d9f4ad89e2c940d3fd56ad82288", "tree": "c85e429e674730f4ddf58f1ff7345a126a861dd6", "parents": [ "9a884c3800b207bac36e27be4ec7277c78a84568" ], "author": { "name": "Thomas Weißschuh", "email": "thomas.weissschuh@linutronix.de", "time": "Fri Feb 07 10:39:06 2025 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Feb 11 10:20:52 2025 +0100" }, "message": "ptp: vmclock: Remove goto-based cleanup logic\n\nvmclock_probe() uses an \"out:\" label to return from the function on\nerror. This indicates that some cleanup operation is necessary.\nHowever the label does not do anything as all resources are managed\nthrough devres, making the code slightly harder to read.\n\nRemove the label and just return directly.\n\nSigned-off-by: Thomas Weißschuh \u003cthomas.weissschuh@linutronix.de\u003e\nAcked-by: Richard Cochran \u003crichardcochran@gmail.com\u003e\nReviewed-by: David Woodhouse \u003cdwmw@amazon.co.uk\u003e\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n\n" } ], "next": "9a884c3800b207bac36e27be4ec7277c78a84568" }