)]}' { "log": [ { "commit": "a500db7819c50db59e55f1b4fa1c3baa5a2616f3", "tree": "67974d29e48055c28bac6ba89bc94a659c470f54", "parents": [ "36b03c3e270a2a4cf73202e07a93bd3a9ebd86c7", "4299767d772d4e498998e32157e45841178ab192" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 13:36:21 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 13:36:21 2026 -0700" }, "message": "Merge tag \u0027selinux-pr-20260903\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux\n\nPull SELinux fixes from Paul Moore:\n \"Two SELinux fixes: one to fix how we lookup a BPF token\u0027s creator\n label to prevent a possible TOCTOU, and one to update Ondrej\u0027s email\n address\"\n\n* tag \u0027selinux-pr-20260903\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/pcmoore/selinux:\n MAINTAINERS, mailmap: update email address for Ondrej Mosnáček\n selinux: fix BPF token permission checks\n" }, { "commit": "4299767d772d4e498998e32157e45841178ab192", "tree": "29077f34d383059de0350ce9e9d0ea11b757f781", "parents": [ "77d499e61d36e883a6ad1f10afe05f556aa7e0cc" ], "author": { "name": "Ondrej Mosnáček", "email": "omosnacek@gmail.com", "time": "Thu Sep 03 17:56:15 2026 +0200" }, "committer": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Thu Sep 03 16:24:05 2026 -0400" }, "message": "MAINTAINERS, mailmap: update email address for Ondrej Mosnáček\n\nI\u0027m going to use my personal email for kernel contributions from now on.\nUpdate MAINTAINERS and .mailmap to reflect this.\n\nAlso switch to use proper spelling with diacritics, since I normally use\nthe full Unicode name with my personal email address. I\u0027m leaving\nin-code occurences unchanged though, as that would be just unnecessary\nchurn.\n\nLink: https://lore.kernel.org/lkml/CAFqZXNvOGbzy8-ZnJtKi94jfu2H173Tz7VYpK8KuseMQS-9tNA@mail.gmail.com/\nSigned-off-by: Ondrej Mosnáček \u003comosnacek@gmail.com\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n" }, { "commit": "36b03c3e270a2a4cf73202e07a93bd3a9ebd86c7", "tree": "2713cb7eabac5bd567ce87eb785bf7bff7a54300", "parents": [ "841e384b841a3d89c50b4b2d6c5bb6abab1a7e39", "4a819ee5f2834330656d6ac168c4c8cf27fdeec2" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 12:17:52 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 12:17:52 2026 -0700" }, "message": "Merge tag \u0027acpi-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm\n\nPull ACPI fix from Rafael Wysocki:\n \"Drop two structure fields that have no more users after recent\n changes\"\n\n* tag \u0027acpi-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/rafael/linux-pm:\n ACPI: bus: Drop two fields from struct acpi_device_pnp\n" }, { "commit": "841e384b841a3d89c50b4b2d6c5bb6abab1a7e39", "tree": "a8005e8b794c3ef00940b265e7d60742013e3784", "parents": [ "adf50c47a47f0f0f0b79dd58ffade9919cddebea", "98d23edcd41432286cf03672252507a841323c8c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:28:27 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:28:27 2026 -0700" }, "message": "Merge tag \u0027s390-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux\n\nPull s390 fixes from Heiko Carstens:\n\n - Use jiffies instead of jiffies_64 to address a data-race reported by\n KCSAN\n\n - Unpoison cpacf instruction results to address KMSAN reports\n\n - Drop unused member from ap_device_id\n\n - Fix potential NULL pointer dereferences in IPL code\n\n - Add missing length check to SCLP error report handling\n\n - Add missing length check to zcrypt CCA code\n\n - Fix return code handling in diag324 code\n\n - Handle multiple PMU stop callback invocations in perf pai code\n correctly\n\n - Reduce excessive debug feature size in perf pai code from 32 MiB to\n 4KiB\n\n - Switch to common CPU capacity code in topology code to get rid of few\n lines of code\n\n - Address various bugs in corner cases in boot code\n\n - Simplify/Rework crst_table_upgrade() to address a potential NULL\n pointer dereference in case of an allocation failure\n\n - Initialize padding bytes in CRT key structure in zcrypt code\n\n* tag \u0027s390-7.3-2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/s390/linux:\n s390/zcrypt: Fix uninitialized padding in CRT key structure\n s390/mm: Simplify crst_table_upgrade()\n s390/boot: Bound command line facility ranges\n s390/boot: Avoid IPL parameter append past command line\n s390/boot: Fix physical memory search range\n s390/topology: Switch to common cpu capacity code\n s390/pai: Reduce excessive debug feature size\n s390/pai: Handle multiple PMU stop callback invocations\n s390/diag324: Preserve -EBUSY return code\n s390/zcrypt: Validate length in reply before using it\n s390/pci: Fix leak of uninitialized kernel data in SCLP report\n s390/ipl: Fix NULL deref in dump_reipl without re-IPL parm block\n s390/ipl: Fix NULL deref in kdump without re-IPL parm block\n s390/ap: Drop unused member from ap_device_id\n s390/cpacf: Unpoison instruction results\n s390/time: Use jiffies instead of jiffies_64\n" }, { "commit": "adf50c47a47f0f0f0b79dd58ffade9919cddebea", "tree": "9389cb569c2e813439e401dcc6b16aeebc3e0718", "parents": [ "8ab1afb2eb246ab15b301cd255b5943d208a93c1", "66817a9794263cd2a5dc4e99bf8e5fcc5ff7181e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:18:12 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 10:18:12 2026 -0700" }, "message": "Merge tag \u0027net-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from bluetooth.\n\n Previous releases - regressions:\n\n - page_pool: keep frag_offset aligned for odd-sized requests\n\n - sched: fix u32 duplicate handle when node ID pool is exhausted\n\n - udp: create exceptions before socket matching\n\n - igmp: convert struct ip_sf_list to RCU\n\n - ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit\n\n - rds: acquire the fastpath locks in rds_conn_shutdown()\n\n - tipc:\n - protect node reset trace dump with node lock\n - fix NULL deref in tipc_named_node_up() on empty publication\n list\n\n - bluetooth:\n - L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n - hci_core: fix race condition during device registration\n\n - eth:\n - mlx5e: prevent stale XSK buffer release on refill retries\n - bridge: don\u0027t truncate the port group walk on teardown\n\n Previous releases - always broken:\n\n - gro: fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n\n - sched: fix skb sizing and action leak on reoffload delete\n\n - tcp: fix use-after-free in do_tcp_getsockopt()\n\n - af_packet: don\u0027t cast tpacket_hdr.tp_len to int in\n tpacket_parse_header()\n\n - sctp: fix soft lockup from unpadded ASCONF-ACK parameter iteration\n\n - iptunnel: fix stale transport header during tunnel decapsulation\n\n - eth:\n - vxlan: fix use-after-free in vxlan_mdb_remote_src_del()\n - bonding: fix uninitialized transport header access in\n alb_determine_nd()\"\n\n* tag \u0027net-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (83 commits)\n net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset\n net: airoha: enable RX_DONE interrupt for RX queue 31\n net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\n net/rds: acquire the fastpath locks in rds_conn_shutdown()\n net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n net/rds: tcp: don\u0027t force RDS_CONN_RESETTING over a concurrent shutdown\n net/rds: clear cp_flags bits individually in rds_conn_path_reset()\n net/rds: use clear_bit_unlock() in release_refill()\n net/rds: use wq_has_sleeper() in release_in_xmit()\n net: usb: qmi_wwan: add Compal EXM-G1x support\n net: macb: exclude software FCS from TX byte statistics\n net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n net: bridge: mcast: don\u0027t truncate the port group walk on teardown\n bonding: do not clear curr_active_slave prematurely when releasing all slaves\n net: qrtr: Send HELLO message on endpoint register\n octeontx2-af: Fix limiting SRIOV VF count logic\n bonding: alb: fix uninitialized transport header access in alb_determine_nd()\n s390/ctcm: Prevent XID null dereference\n net: psp: do not inherit the Rx association on clone\n ...\n" }, { "commit": "8ab1afb2eb246ab15b301cd255b5943d208a93c1", "tree": "24e95bd603d4bf846f1c247e5e50a191e0f2e1fb", "parents": [ "97be98b94dc8e43a3e4dedccaf9683fb806e49aa", "7ac81e2d2240f2c57bd073b0733e0b2abca38e82" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:30:45 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:30:45 2026 -0700" }, "message": "Merge tag \u0027for-7.3/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm\n\nPull device mapper fixes from Mikulas Patocka:\n\n - fix a dm-crypt race condition that could make errors not being reported\n\n - dm-cache:\n - fix rwsem being locked and unlocked from different processes\n - fix demotion statistics\n\n - dm-integrity:\n - set the \u0027stable writes\u0027 flag\n - fix a buffer overflow introduced in this merge window\n - fix an infinite loop if tag size is greater than 64\n\n - fix NULL pointer dereference in dm-integrity data-recovery mode\n\n - remove a bogus restriction on the dm-ebs starting sector offset\n\n* tag \u0027for-7.3/dm-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/device-mapper/linux-dm:\n dm-ebs: fix incorrect device offset check in ebs_ctr()\n dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n dm cache: fix demotion stats in passthrough mode\n dm-integrity: fix infinite loop on discard with large tag size\n dm-integrity: fix buffer overflow with keyed discard\n dm-integrity: require stable writes for internal hash modes\n dm cache: fix issue with background work locking\n dm-crypt: fix a tiny race condition in crypt_dec_pending\n" }, { "commit": "97be98b94dc8e43a3e4dedccaf9683fb806e49aa", "tree": "f61a049a26ba4148e085c985a5d7827c74700f17", "parents": [ "940de590b839f71d6dc846160534bf202401b8b7", "0fecc393f2060e6bc25138df32cb923ec7071c6b" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:10:04 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Sep 03 08:10:04 2026 -0700" }, "message": "Merge tag \u0027ntfs-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs\n\nPull ntfs fixes from Namjae Jeon:\n\n - Serialize truncate, fallocate, and mmap fault paths with\n invalidate_lock, avoiding mmap failures during concurrent size\n changes and exposure of uninitialized data during allocation\n\n - Correct fallocate signal and zeroing error handling\n\n - Fix FITRIM range alignment to prevent discard requests from extending\n into allocated clusters\n\n - Fix free-cluster accounting when cluster-freeing rollback or bitmap\n clearing fails\n\n - Keep volumes marked dirty when ntfs errors have been recorded\n\n - Compute bi_sector in 512-byte units, preventing silent corruption on\n 4Kn devices\n\n - Validate sectors_per_cluster values and prevent undefined shifts when\n parsing MFT and index record sizes\n\n - Bound $AttrDef traversal to the loaded table size\n\n - Fix MFT record resizing, memmove overlap, and kmap_local cleanup\n issues\n\n - Improve error propagation across attribute, EA, and reparse\n operations, including returning -ERANGE for undersized xattr buffers\n\n - Avoid modifying the HasEA flag when setxattr fails and return\n DT_UNKNOWN when directory inode lookup fails\n\n - Reduce contention in WOF decompression by performing block reads\n outside the decompression lock\n\n* tag \u0027ntfs-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/ntfs: (23 commits)\n ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()\n ntfs: take invalidate_lock in ntfs_setattr_size()\n ntfs: handle signal interruption in fallocate\n ntfs: fix FITRIM range alignment\n ntfs: read WOF chunks outside the decompression lock\n ntfs: leave HasEA flag untouched on setxattr failure\n ntfs: fix race between fallocate and mmap reads\n ntfs: fix memmove overlap in ntfs_new_attr_flags\n ntfs: compute bi_sector in 512-byte units\n ntfs: reject invalid sectors_per_cluster in the boot sector\n ntfs: bound $AttrDef table walk to the loaded table size\n ntfs: fix undefined behavior in mft/index record size calculation\n ntfs: treat any nonzero dio zero-range return as an error\n ntfs: fix incorrect MFT record pointer passed to ntfs_attr_record_resize\n ntfs: do not mark the volume clean in sync_fs when errors were recorded\n ntfs: skip free cluster decrement when rollback fails\n ntfs: only count successfully cleared runs when freeing clusters\n ntfs: fix kmap_local leak in write_mft_record_nolock() error paths\n ntfs: return real error from ntfs_non_resident_attr_record_add()\n ntfs: preserve error code in ntfs_resident_attr_record_add()\n ...\n" }, { "commit": "66817a9794263cd2a5dc4e99bf8e5fcc5ff7181e", "tree": "244b4a550f193d410e66e16d6e10fabdb5eb1ea5", "parents": [ "6b8fed2675fb75d23e6cf2b7e49c94926e884b34" ], "author": { "name": "HW He", "email": "hw.he@mediatek.com", "time": "Tue Sep 01 16:23:12 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 12:20:38 2026 +0200" }, "message": "net: gro: Fix nesting of TCP GSO SKBs in skb_gro_receive_list()\n\nFraglist GRO and hardware GRO can create an fraglist of\nHW-GRO packets. This cannot be segmented back into\nthe original form on TCP tethering scenario.\n\nAvoid constructing such a GSO packet, by flushing an already\nbuilt fraglist GRO packet if a hardware GRO packet arrives.\n\nScenario (Tethering/Forwarding):\n1.Driver submits a single TCP packet, P1. P1 is kept in the\ngro_list as the first packet.\n\n2. The driver submits a TCP GSO skb, P2. P2 has already aggregated\nmultiple TCP packets by HW_GRO, and its non-linear data is stored in\nfrags[].\n\n3. P1 and P2 match the GRO rules, and since there is no local socket,\nthey are aggregated by skb_gro_receive_list(). The resulting skb,\nP3, has a frag_list entry that still contains frags[]:\nP3: [ Linear Data ] -\u003e frag_list -\u003e [ Linear Data ]\n [ frag[1] ]\n [ frag[2] ]\n ...\n4. Later, tcp4_gso_segment() or tcp6_gso_segment() calls\nskb_segment_list() to segment P3. However, skb_segment_list() only\nsegments the entries in frag_list. It does not segment the frags[]\ninside P2, so P3 is not restored to the original packets, which leads\nto IP fragmentation or packet drop in the following path.\n\nCheck skb_is_gso(skb) and current GRO method, make sure fraglist GRO\napplies to consecutive non-GSO skb, others adopt regular GRO path.\n\nFixes: 8d95dc474f85 (\"net: add code for TCP fraglist GRO\")\nSigned-off-by: Zhaoping Shu \u003czhaoping.shu@mediatek.com\u003e\nSigned-off-by: HW He \u003chw.he@mediatek.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260901082312.14596-1-zhaoping.shu@mediatek.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6b8fed2675fb75d23e6cf2b7e49c94926e884b34", "tree": "f7238d9d7cb82214b24aa5a914354f8f25512765", "parents": [ "7db28abbea0f7dc1ec4fdfdc149db5fbd9e4c994" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo.bianconi@oss.qualcomm.com", "time": "Mon Aug 31 19:06:38 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 11:45:30 2026 +0200" }, "message": "net: stmmac: reconfigure RX packet parser table in stmmac_hw_setup() after reset\n\nThe core software reset issued in stmmac_init_dma_engine() during\nndo_open() callback clears the MTL RX packet parser registers, but\nstmmac_rxp_config() is only invoked from the cls_u32 add/delete paths.\nAfter an ifdown/ifup cycle the hardware therefore runs with the default\nall-pass table while priv-\u003etc_entries still reports the filters as\ninstalled. Re-apply the RX packet parser table from priv-\u003etc_entries in\nstmmac_hw_setup(), right after the software reset, so the filters are\nrestored when the interface is brought up again.\n\nFixes: 4dbbe8dde848 (\"net: stmmac: Add support for U32 TC filter using Flexible RX Parser\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo.bianconi@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260831-stmmac_tc_cls32_reconfigure-v1-1-21cb459e64ae@oss.qualcomm.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7db28abbea0f7dc1ec4fdfdc149db5fbd9e4c994", "tree": "f95fcc38e8737cce543a0e9b9d174088384ff542", "parents": [ "2f38e26a5741abdf152c1b56b22144a06d30fd66" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Sun Aug 30 14:28:27 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Sep 03 11:40:51 2026 +0200" }, "message": "net: airoha: enable RX_DONE interrupt for RX queue 31\n\nRX queue 31 has always been allocated and filled by airoha_qdma_init_rx()\nsince RX_DONE_INT_MASK spans queues 0-31, but none of the RX_IRQ*\n_BANK_PIN_MASK values covered BIT(31). As a consequence the RX_DONE\ninterrupt for queue 31 was never enabled, airoha_qdma_rx_process() never\nran on that queue and its buffers were never reaped.\n\nRoute RX queue 31\u0027s RX_DONE interrupt to IRQ bank 1 so that the queue\nis drained and its buffers returned to the page pool.\n\nFixes: f252493e1835 (\"net: airoha: Enable multiple IRQ lines support in airoha_eth driver.\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260830-airoha-rxdone-rxq31-v1-1-830a91503f2f@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "2f38e26a5741abdf152c1b56b22144a06d30fd66", "tree": "cce250f75fa456622621f08487d9932bb3600e45", "parents": [ "08710f033e3e35704e45adf8a95b5043ece34899", "260c6308fe2e19ad519389d44d582e292aecc3af" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:26 2026 -0700" }, "message": "Merge branch \u0027net-rds-own-the-fastpath-locks-across-connection-teardown\u0027\n\nAllison Henderson says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/rds: own the fastpath locks across connection teardown\n\nThis is v5 of the follow-up set to \"net/rds: Bug fix ports, part 2\"\n[1] (v1 at [2], v2 at [3], v3 at [4], v4 at [5]). During review of part 2,\nthe later half of that series needed more work than a respin, so it was\nsplit off into this set together with the companion fixes identified\nalong the way. As discussed on the v2 thread, it is targeted at net.\n\nRDS connection teardown quiesces the transmit and receive-refill fast\npaths by waiting for the RDS_IN_XMIT/RDS_RECV_REFILL bits to be\nsampled clear. Sampling a bit clear is not owning it: the fast path\ncan re-take its bit right after the wait returns and then run\nconcurrently with the transport shutdown and the send-state reset.\nOracle UEK closed this by making teardown acquire the bits as locks\n(\"rds: Make sure transmit path and connection tear-down does not run\nconcurrently\"); patches 5 and 6 do the same for the two\nrds_send_path_reset() call sites upstream.\n\nMaking teardown block on the bits as locks promotes several latent\nordering bugs from rare to load-bearing, so they are fixed first:\n\n Patches 1 and 2 fix the release side of the two bit locks.\n release_in_xmit() and release_refill() both clear their bit and then\n test for waiters, but the barrier is on the wrong side of the clear\n to order the critical section\u0027s stores before the release, and the\n waiter check does not order against the clear. Once teardown blocks\n on these bits as locks (uninterruptible and untimed), a lost wake-up\n or a store observed out of order stops mattering only in theory.\n Use clear_bit_unlock() and wq_has_sleeper(), the pattern already\n half-present in release_in_xmit().\n\n Patch 3: rds_conn_path_reset() wipes the whole cp_flags word with a\n plain store. Once teardown owns bits in that word across the reset,\n a blanket store would end lock ownership early - and it already\n races atomic RMWs on the same word today. Clear the bits the reset\n is responsible for individually, as Oracle UEK also does.\n\n Patch 4: rds_tcp_reset_callbacks() stores RDS_CONN_RESETTING\n unconditionally, which can overwrite the RDS_CONN_ERROR or\n RDS_CONN_DISCONNECTING of a shutdown already in progress on the same\n path and send that shutdown through an extra drop cycle. Once the\n accept path can park for the duration of a teardown (patch 6) that\n window widens, so make the transition conditional first, as Oracle\n UEK does.\n\nWith those in place, patch 5 converts rds_tcp_reset_callbacks() from\nwaiting on RDS_IN_XMIT to acquiring it, holding it across the socket\nswap and rds_send_path_reset(), and patch 6 has rds_conn_shutdown()\nhold both bit locks across the transport shutdown and path reset.\n\nPatch 7 fixes a pre-existing teardown-state hole that this series\nmakes easier to hit but did not introduce. Since commit\ne97656d03ca0 the final transition in rds_conn_shutdown() accepts\nRDS_CONN_ERROR as well as RDS_CONN_DISCONNECTING, so that a FIN\nprocessed during the teardown does not derail the shutdown. But\nconsuming that RDS_CONN_ERROR also consumes the shutdown pass that a\nconcurrent rds_conn_path_drop() queued along with it. For a FIN that\nis harmless; for rds_tcp_accept_one() it is not. A drop can race the\naccept\u0027s DOWN -\u003e CONNECTING path claim, the accept then installs the\nfreshly accepted socket while the drop\u0027s teardown - which sampled\ntc-\u003et_sock before that socket existed - is still running,\nrds_connect_path_complete() fails and drops the path again, and if the\nin-flight shutdown\u0027s final transition then swallows that\nRDS_CONN_ERROR, the pass that should reap the just-installed socket\nfinds the path already RDS_CONN_DOWN and does nothing. The socket is\nleaked with its callbacks armed and its rds_tcp_connection still on\nrds_tcp_tc_list, the peer sees an established connection that nothing\nreads, and the path wedges in RDS_CONN_DOWN. Make the final\ntransition DISCONNECTING -\u003e DOWN only and leave a racing drop\u0027s\nRDS_CONN_ERROR alone, so the pass it queued runs and tears down\nwhatever attached to the path; the branch quiesces the reconnect\ntimer itself, since a pending destroy can suppress that pass (see the\nchanges below).\n\nThis surfaced while re-reviewing v3: whether the\nrelease-then-transition ordering in patch 6 could let a woken waiter\ninstall a socket that the teardown then strands. Chasing that down,\nthe reachable form of the leak turned out to be the accept-vs-drop\nrace above rather than the parked-waiter path (a path mid-teardown is\nnever handed to rds_tcp_reset_callbacks(): rds_tcp_accept_one_path()\nonly claims a path it can move DOWN -\u003e CONNECTING), and it predates\nthis series. It reproduces on an instrumented kernel - a test-only\ndrop injected into the accept window plus a widened teardown-to-tail\nwindow - as an ESTABLISHED socket with an ever-growing receive queue\non a path stuck down; the same kernel runs clean with patch 7.\n\nThe set was built per-commit, run through the rds selftests (tcp and\nrdma/rxe), and exercised with a connection/netns churn load and\nmodule load/unload cycles; the patch 7 destroy-window fix was\nadditionally verified against an instrumented kernel that reproduces\nthe timer-left-armed WARN deterministically (fires on every destroyed\npath unfixed, silent with the fix).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260828223921.202913-1-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "260c6308fe2e19ad519389d44d582e292aecc3af", "tree": "cce250f75fa456622621f08487d9932bb3600e45", "parents": [ "813f3582ac7ae9f60f917937d54660e0952d5f2d" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:21 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:24 2026 -0700" }, "message": "net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\n\nrds_conn_shutdown() finishes by moving the path from\nRDS_CONN_DISCONNECTING to RDS_CONN_DOWN, and also accepts\nRDS_CONN_ERROR as the starting state of that final transition, so that\na FIN processed in softirq context during the teardown does not derail\nthe shutdown into a noisy error path.\n\nBut consuming that RDS_CONN_ERROR also consumes the shutdown pass that\ncame with it: rds_conn_path_drop() sets RDS_CONN_ERROR and then queues\ncp_down_w, and a pass that starts on a path already in RDS_CONN_DOWN\nis a no-op. For the FIN case that is harmless - the socket the FIN\narrived on is the very socket the teardown just released. It is not\nharmless for a dropper that attached something to the path first.\n\nrds_tcp_accept_one() is such a dropper. Its path claim in\nrds_tcp_accept_one_path() transitions RDS_CONN_DOWN -\u003e\nRDS_CONN_CONNECTING, and a concurrent drop - a FIN on a previous\nsocket in softirq context, an administrative reset - can put the path\ninto RDS_CONN_ERROR between that claim and the state check that\nfollows, which accepts RDS_CONN_ERROR. The accept then installs the\nfreshly accepted socket with rds_tcp_set_callbacks() while the queued\nteardown - which sampled tc-\u003et_sock before this socket existed - is\nstill running. rds_connect_path_complete() fails its transition to\nRDS_CONN_UP and drops the path again, queueing the pass that should\nreap the socket it just installed. If the in-flight shutdown\u0027s final\ntransition consumes that drop\u0027s RDS_CONN_ERROR, the queued pass finds\nthe path in RDS_CONN_DOWN and does nothing. The installed socket is\nnever torn down: it sits established with its callbacks armed and its\nrds_tcp_connection on rds_tcp_tc_list, the peer sees a connection that\nnothing ever reads, and the path is wedged in RDS_CONN_DOWN until some\nlater event drops it again. Reproduced with widened race windows as\nan ever-growing receive queue on a socket owned by a path stuck in\nRDS_CONN_DOWN, with the peer\u0027s send path wedged behind it.\n\nMake the final transition only DISCONNECTING -\u003e DOWN. If it fails\nbecause the path is in RDS_CONN_ERROR, a drop raced the teardown:\ncancel the reconnect timer and clear RDS_RECONNECT_PENDING - the one\npiece of the skipped tail that must not be left behind - and return,\nletting the pass the drop queued finish the job: it tears down\nwhatever attached to the path in the meantime, completes the\ntransition to RDS_CONN_DOWN, and re-arms the reconnect from its own\ntail.\n\nThe timer quiesce in that branch matters because the racing drop does\nnot always queue that pass: rds_conn_path_drop() returns without\nqueueing when a destroy is pending - exactly the situation during a\nnetns teardown or module unload, when a FIN on the dying socket is\nprocessed while rds_conn_path_destroy() flushes cp_down_w. If the\nflushed pass is the one that takes this return, no later pass exists,\nand rds_conn_path_destroy() would find cp_conn_w still armed\n(WARN_ON) and then free a path whose reconnect timer can still fire.\nWith the cancel in the branch, every exit of a shutdown pass leaves\nthe timer quiesced no matter which pass completes the transition.\n\nThe FIN case keeps making progress, one pass later and still without\nnoisy logging. Any other state keeps today\u0027s rds_conn_path_error()\nhandling; no current cp_state writer can leave a DISCONNECTING path\nin anything but RDS_CONN_ERROR (every other writer is a cmpxchg from\na non-DISCONNECTING state), so that branch is defensive.\n\nOn kernels without the preceding patches the same hazard exists with\nthe sample-based quiesce; the fix applies there equally.\n\nFixes: e97656d03ca0 (\"rds: tcp: allow progress of rds_conn_shutdown if the rds_connection is marked ERROR by an intervening FIN\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-8-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "813f3582ac7ae9f60f917937d54660e0952d5f2d", "tree": "19de5d2f0ae68ece68ccc342f8d94d72afc4fb2c", "parents": [ "02c5f9dc2efd823e061954d564ce00bacd1bebeb" ], "author": { "name": "Håkon Bugge", "email": "haakon.bugge@oracle.com", "time": "Fri Aug 28 15:39:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: acquire the fastpath locks in rds_conn_shutdown()\n\nrds_conn_shutdown() quiesces the transmit and receive-refill paths by\nwaiting for RDS_IN_XMIT and RDS_RECV_REFILL to be sampled clear, and\nthen runs the transport shutdown and rds_conn_path_reset(). Sampling\nthe bits clear is not the same as owning them: the moment after the\nwait_event() returns, rds_send_xmit() can re-acquire RDS_IN_XMIT (or\nrds_ib_recv_refill() can re-acquire RDS_RECV_REFILL) and run\nconcurrently with the teardown.\n\nThe sender does recheck the connection state after taking the lock,\nbut that recheck is a classic store-buffering pattern: teardown writes\nthe state and reads the bit while the sender writes the bit and reads\nthe state. acquire_in_xmit() is only an acquire operation, so on\nweakly ordered architectures both sides can miss each other\u0027s write,\nand the transmit path then runs while the transport zeroes its rings\n(e.g. rds_ib_ring_init()) and rds_send_path_reset() rewrites the\ntransmit state under it.\n\nOracle UEK fixed the same class of crashes - a 14-year tail of\nBUG_ON()s in rds_ib_sub_signaled(), unexpected op-codes and NULL\ndereferences in rds_ib_send_cqe_handler() during failover testing -\nby making the teardown path *acquire* the fastpath bit locks instead\nof testing them (\"rds: Make sure transmit path and connection\ntear-down does not run concurrently\"). Ownership of a single word is\ndecided by RMW atomicity, so no cross-variable ordering is needed.\n\nDo the same here: take both locks before calling the transport\nshutdown, hold them across rds_conn_path_reset(), and release them\nexplicitly with a wake-up afterwards. Both are released with\nclear_bit_unlock(), so that the ring re-initialization done by the\ntransport shutdown and the transmit state rewritten by\nrds_send_path_reset() are ordered before either bit is seen clear by\nthe next acquire_in_xmit() or acquire_refill().\n\nThe fastpath users of these bits - rds_send_xmit() and\nrds_ib_recv_refill() - are trylock style and back off while teardown\nowns the locks, so no new lock dependency is introduced for them.\nrds_tcp_reset_callbacks() is different: since the previous patch it\nacquires RDS_IN_XMIT as well, and it blocks doing so, so its wait now\nspans the teardown instead of at most one send batch. That waiter\nruns from rds_tcp_accept_one() on the single-threaded krdsd workqueue\nand holds rds_tcp_accept_lock and t_conn_path_lock while it waits, so\na duelling SYN accepted while its path is being torn down parks\naccept processing for the duration of the teardown - for TCP bounded\nby the (up to 5 s) drain loop in rds_tcp_conn_path_shutdown(). An IB\npath\u0027s drain in rds_ib_conn_path_shutdown() has no round cap, but no\nblocking waiter either: rds_tcp_reset_callbacks() is the only blocking\nacquirer of these bits and waits only on its own TCP path, and the\nfastpaths are trylock-and-back-off on both transports, so a long IB\ndrain lengthens only that path\u0027s own quiesce. The\nwindow is narrow: the accept-side state check has to pass before the\nteardown moves the path to RDS_CONN_DISCONNECTING.\n\nBecause krdsd is a single global workqueue, everything else queued\nthere - accept processing for other connections and network\nnamespaces, and the flush_workqueue(rds_wq) in rds_tcp_listen_stop()\nduring namespace teardown - waits behind the parked accept worker for\nthat time. It cannot deadlock, although the waits do point at each\nother: the teardown blocks until the bit\u0027s holder releases it, and\nthe holder may be that krdsd accept worker. The holder finishes\nwithout needing anything the teardown owns: the sync cancels\nrds_tcp_reset_callbacks() issues target cp_send_w and cp_recv_w on\nthe path\u0027s ordered cp_wq, whose only execution slot is occupied by\nthe blocked cp_down_w itself, so they are pending at most and cancel\nwithout flushing - a reliance on cp_wq being ordered that is now\nnoted next to those cancels (on the allocation-failure fallback where\na path shares rds_wq, the work items simply serialize).\nNor is the blocking wait itself new: rds_tcp_reset_callbacks() has\nwaited on RDS_IN_XMIT from the krdsd work item since\ncommit 335b48d980f6 (\"RDS: TCP: Add/use rds_tcp_reset_callbacks to\nreset tcp socket safely\"); this patch stretches its worst case from\na sender\u0027s batch to the teardown\u0027s drain. The alternative to parking\nis the accept path racing the teardown, which is what these patches\nclose; making the teardown itself non-blocking is a separate item.\n\nOne observable side effect: the SENDING flag reported by rds-info has\nalways mirrored RDS_IN_XMIT, so it now also covers the window where\nteardown owns the bit.\n\nThe comments that describe the old sample-based handshake or name\nrds_send_xmit() as the only other holder of these bits - in\nrds_send_xmit(), above rds_conn_path_reset(), in rds_ib_recv_refill()\nand in rds_tcp_reset_callbacks() - are updated to match.\n\nFor anyone backporting this patch standalone: it depends on\n\"net/rds: clear cp_flags bits individually in rds_conn_path_reset()\"\nand \"net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\"\nearlier in this series. Without the former, the blanket cp_flags\nclear in rds_conn_path_reset() would drop both held bits in the middle\nof the teardown; without the latter, rds_tcp_reset_callbacks() would\nstill sample t_sock without owning RDS_IN_XMIT. \"net/rds: use\nclear_bit_unlock() in release_refill()\" is needed for the refill\nside\u0027s release to pair with the acquire added here, and the follow-up\n\"net/rds: don\u0027t let rds_conn_shutdown() consume a concurrent drop\"\ncompletes the teardown-state handling for the waiter this patch\nparks; a backport should carry all four.\n\nFixes: 0f4b1c7e89e6 (\"rds: fix rds_send_xmit() serialization\")\nSigned-off-by: Håkon Bugge \u003chaakon.bugge@oracle.com\u003e\n[achender: reimplement for net-next shutdown path: acquire the existing\n RDS_IN_XMIT/RDS_RECV_REFILL bit locks in rds_conn_shutdown() and release\n after teardown; update comments and commit message]\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-7-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "02c5f9dc2efd823e061954d564ce00bacd1bebeb", "tree": "f716f6c75f5fa2ab2cf7809d63fed75a58da18c3", "parents": [ "e8e60d74fec49ccae2aea9b04a6eb162feb8d9af" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: acquire RDS_IN_XMIT in rds_tcp_reset_callbacks()\n\nrds_tcp_reset_callbacks() quiesces the transmit path by setting the\npath state to RDS_CONN_RESETTING and then waiting for RDS_IN_XMIT to\nbe sampled clear before swapping the underlying socket and calling\nrds_send_path_reset().\n\nSampling the bit clear is not the same as owning it: rds_send_xmit()\ncan re-acquire RDS_IN_XMIT right after the wait_event() returns. Its\nstate recheck after taking the lock is a store-buffering pattern (the\nresetter writes the state and reads the bit, the sender writes the\nbit and reads the state) and acquire_in_xmit() is only an acquire\noperation, so on weakly ordered architectures both sides can miss\neach other\u0027s write and the transmit path then runs concurrently with\nrds_send_path_reset() rewriting cp_xmit_* state - which is exactly\nwhat the comment above rds_send_path_reset() tells its callers to\nprevent.\n\nTake the lock instead, hold it across the socket swap and\nrds_send_path_reset(), and release it with a wake-up at the end. The\nlock-ordering constraint documented above the wait still holds: the\nlock is acquired before lock_sock(), so a sender inside tcp_sendmsg()\ncan never be waited on while we hold the socket lock.\n\nTwo details of the old code go away with the same change:\n\n - t_sock is now read only after the lock is acquired. The old code\n cached it before waiting; the teardown in rds_conn_shutdown()\n releases that socket and clears t_sock, so a pointer cached before\n the wait can be stale by the time the accept path resumes. Reading\n it under RDS_IN_XMIT is what makes the exclusion complete once the\n teardown owns the same lock, which the next patch arranges; until\n then the teardown still only samples the bit, and the two paths\n remain as exposed to each other as they are today.\n\n - The old !osock early path called rds_send_path_reset() with no\n serialization at all. It now runs under the lock like the normal\n path. The conditional RDS_CONN_RESETTING transition of the\n previous patch happens before the socket check either way: a path\n found without a socket is either still connecting (its reconnect\n worker blocked on t_conn_path_lock) and legitimately goes\n RESETTING -\u003e UP on the new socket, or it has been torn down\n meanwhile and is dropped.\n\nThe in-function comment describing the old wait-based quiesce is\nrewritten to describe the lock-based one, and the stale block comment\nabove the function (which still described a return value and an\nincomplete list of t_sock writers) is refreshed to name all four\nwriters - the connect, accept, teardown and swap paths - and what\nserializes each of them.\n\nFixes: 335b48d980f6 (\"RDS: TCP: Add/use rds_tcp_reset_callbacks to reset tcp socket safely\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-6-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e8e60d74fec49ccae2aea9b04a6eb162feb8d9af", "tree": "e971742be58b45b05808c4ffb2f5112d79bc94a7", "parents": [ "103c4b13c4f50322910078d1c02f29334a574122" ], "author": { "name": "Gerd Rausch", "email": "gerd.rausch@oracle.com", "time": "Fri Aug 28 15:39:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: tcp: don\u0027t force RDS_CONN_RESETTING over a concurrent shutdown\n\nrds_tcp_reset_callbacks() resolves a duelling SYN by storing\nRDS_CONN_RESETTING into cp_state unconditionally. Nothing serializes\nthat store against the shutdown path: rds_tcp_accept_one() checks\nfor RDS_CONN_CONNECTING or RDS_CONN_ERROR under t_conn_path_lock, but\nneither rds_conn_path_drop(), which forces RDS_CONN_ERROR, nor\nrds_conn_shutdown(), which moves the path to RDS_CONN_DISCONNECTING\nunder cp_cm_lock, takes that lock. The store can therefore land on\ntop of a shutdown that is already in progress, or that gets queued\nright after the accept-side check.\n\nWhen it does, the shutdown worker\u0027s final DISCONNECTING -\u003e DOWN\ntransition fails and the path goes through rds_conn_path_error() and\na second drop/shutdown cycle instead of a clean reconnect, tearing\ndown the socket the accept path has just installed. Before commit\nad22d24be635 (\"net/rds: No shortcut out of RDS_CONN_ERROR\") a path\nfound in RDS_CONN_RESETTING even made rds_conn_shutdown() bail out\naltogether.\n\nMake the transition conditional: move CONNECTING -\u003e RESETTING (or\nstay in RESETTING from an earlier duel), and drop the path in any\nother state. The drop has side effects of its own: it replaces the\nshutdown\u0027s RDS_CONN_DISCONNECTING (or RDS_CONN_ERROR) with\nRDS_CONN_ERROR and queues one more cp_down_w run. The difference is\nthat rds_conn_shutdown() accepts RDS_CONN_ERROR in its final\ntransition to RDS_CONN_DOWN, so the shutdown in flight completes\nnormally instead of through rds_conn_path_error(); the extra\ndown-work pass then finds the path already down and falls through to\nthe reconnect check, or catches a reconnect that has already started\nand restarts it. The accept path still installs the new socket,\nrds_connect_path_complete() then fails its RESETTING -\u003e UP transition\nand drops it: the raced socket ends up torn down as it does today.\nThe comment at that call site, which promised that\nrds_connect_path_complete() marks the path RDS_CONN_UP, is updated to\nname this outcome as well.\n\nThe state can change again between the failed transitions and the\ndrop. That is inherent to rds_conn_path_drop(), which the socket\nstate-change callbacks also call unconditionally, and costs at most\none extra drop/reconnect cycle.\n\nBased on Oracle UEK commit \"net/rds: Don\u0027t force state\nRDS_CONN_RESETTING\" by Gerd Rausch.\n\nFixes: 9c79440e2c5e (\"RDS: TCP: fix race windows in send-path quiescence by rds_tcp_accept_one()\")\nSigned-off-by: Gerd Rausch \u003cgerd.rausch@oracle.com\u003e\n[achender: port to net-next: use the two-argument\n rds_conn_path_transition()/rds_conn_path_drop() and rewrite the\n changelog for the upstream shutdown path]\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-5-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "103c4b13c4f50322910078d1c02f29334a574122", "tree": "55c18f8b84e75d4be091acfa58b7ae7ecc3ab02f", "parents": [ "17c4476dbb9c3bfd34193a6c22f2c3da8747134a" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:17 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: clear cp_flags bits individually in rds_conn_path_reset()\n\nrds_conn_path_reset() wipes the whole flag word with a plain\ncp-\u003ecp_flags \u003d 0 store. Every other accessor of that word uses\natomic bitops, and some of them can run concurrently with the reset:\nRDS_LL_SEND_FULL is set from rds_send_xmit() and cleared from the\ntransport completion paths, neither of which holds anything that\nexcludes the shutdown worker. A plain store racing an atomic\nread-modify-write on the same word is a data race, and whichever\nside loses has its update silently discarded.\n\nClear the two bits the reset is actually responsible for instead.\nRDS_IN_XMIT and RDS_RECV_REFILL need no store at all here: they\nbelong to the caller, rds_conn_shutdown(), which waits for both to be\nclear before calling the transport shutdown and this reset.\n\nThis also gives every bit in cp_flags a single well-defined writer\ndiscipline, which the following patches rely on when they turn\nRDS_IN_XMIT and RDS_RECV_REFILL into bit locks held across the\nteardown: a blanket store mid-teardown would destroy lock ownership\nthat an atomic clear preserves.\n\nOracle UEK carries the same conversion (\"net/rds: Preserve essential\nconnection state flags\"), motivated by its asynchronous shutdown\nstate machine, whose progress and destroy flags must survive the\nreset. UEK\u0027s variant also clears RDS_IN_XMIT and RDS_RECV_REFILL\nbecause there the reset runs as the final step of a teardown that\nowns both bits, making those clears its unlock. Upstream that\nrelease belongs in rds_conn_shutdown(): once a later patch in this\nseries turns the two bits into locks held across the teardown, ending\nownership needs release semantics and a wake-up that a plain clear\ninside the reset would not provide.\n\nBased on Oracle UEK commit \"net/rds: Preserve essential connection\nstate flags\" by Gerd Rausch.\n\nFixes: 00e0f34c6166 (\"RDS: Connection handling\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-4-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17c4476dbb9c3bfd34193a6c22f2c3da8747134a", "tree": "10a8da810c0f185e1a2f5ecbe04d7c0d84109e4a", "parents": [ "6d0c8b7073913011459cf968cbbadd341e166bc3" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: use clear_bit_unlock() in release_refill()\n\nrelease_refill() drops the RDS_RECV_REFILL bit with a plain\nclear_bit(). clear_bit() has no ordering semantics, and the\nsmp_mb__after_atomic() that follows it sits on the wrong side for a\nlock release: it orders the clear against the waitqueue_active() load\nbelow it, but does nothing to order the refill critical section\u0027s ring\nand descriptor stores before the clear itself.\n\nThat matters once connection teardown owns RDS_RECV_REFILL as a lock\nacross the transport shutdown and path reset, rather than sampling it\nclear, which \"net/rds: acquire the fastpath locks in\nrds_conn_shutdown()\" later in this series arranges: on a weakly\nordered architecture the teardown can win the bit and start the\nshutdown and reset while some of the refill\u0027s stores are not yet\nvisible to it. The same gap existed under the sample-based scheme - a\nwaiter that saw the bit clear had no guarantee it also observed the\nrefill\u0027s stores - but taking the bit as a lock makes the missing\nrelease pairing load-bearing.\n\nSwitch to clear_bit_unlock(), which orders the critical section before\nthe release, and replace the open-coded barrier-plus-waitqueue_active()\nwith wq_has_sleeper(), whose internal full barrier keeps the\nstore-buffering guarantee between clearing the bit and checking for\nsleepers. This mirrors what \"net/rds: use wq_has_sleeper() in\nrelease_in_xmit()\" does for RDS_IN_XMIT.\n\nThe fast-path acquire side, acquire_refill(), uses test_and_set_bit(),\na full-barrier RMW that pairs with this release. The teardown at this\npoint in the series still samples the bit, so on its own this change\nis release-side hardening; the shutdown-conversion patch named above\nmakes the teardown acquire the bit with the same RMW, completing the\npairing at the end of the series.\n\nFixes: 73ce4317bf98 (\"RDS: make sure we post recv buffers\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-3-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6d0c8b7073913011459cf968cbbadd341e166bc3", "tree": "39e53a090abe24c871e94b1bfefda11b377f345d", "parents": [ "08710f033e3e35704e45adf8a95b5043ece34899" ], "author": { "name": "Allison Henderson", "email": "achender@kernel.org", "time": "Fri Aug 28 15:39:15 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:42:23 2026 -0700" }, "message": "net/rds: use wq_has_sleeper() in release_in_xmit()\n\nrelease_in_xmit() clears RDS_IN_XMIT with clear_bit_unlock() and then\nchecks waitqueue_active() to decide whether anyone needs waking.\nclear_bit_unlock() is only a release operation: it orders the\ncritical section before the bit clear, but does not order the\nsubsequent plain load of the wait queue head after it. The waiter\nside does the mirror image - it adds itself to the wait queue and\nthen tests the bit. That is the classic store-buffering pattern: the\nreleasing CPU can read the wait queue as empty while the waiting CPU\nstill reads the bit as set, so the sleeper is never woken.\n\nThe waiters are rds_conn_shutdown() and rds_tcp_reset_callbacks(),\nboth in uninterruptible wait_event() with no timeout. A lost wake-up\nstrands the shutdown worker on its single-threaded workqueue until\nsome other sender releases the bit again - and on a connection that\nis being torn down precisely because it failed, there may never be\nanother sender.\n\nThe barrier used to be there: release_in_xmit() did clear_bit()\nfollowed by smp_mb__after_atomic() until commit 1422f28826d2 (\"rds:\nintroduce acquire/release ordering in acquire/release_in_xmit()\")\nfolded both into clear_bit_unlock(), which strengthened the lock\nhand-off but silently dropped the full barrier the wake-up check\ndepends on. The refill counterpart, release_refill() in\nnet/rds/ib_recv.c, still carries its smp_mb__after_atomic() for\nexactly this reason.\n\nUse wq_has_sleeper(), which is waitqueue_active() preceded by the\nrequired full barrier.\n\nFixes: 1422f28826d2 (\"rds: introduce acquire/release ordering in acquire/release_in_xmit()\")\nSigned-off-by: Allison Henderson \u003cachender@kernel.org\u003e\nLink: https://patch.msgid.link/20260828223921.202913-2-achender@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08710f033e3e35704e45adf8a95b5043ece34899", "tree": "e162c4988cecb4093ab0fa38b49e68810bb4170a", "parents": [ "d85f521a9afb786b1d95bbcb218d3afdf3fe73ab" ], "author": { "name": "Ian Lin", "email": "jisayme@gmail.com", "time": "Mon Aug 31 16:41:24 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:24:38 2026 -0700" }, "message": "net: usb: qmi_wwan: add Compal EXM-G1x support\n\nThe Compal EXM-G1x is a Qualcomm SDX12-based LTE modem. Add support for\nits QMI WWAN interface 8 using the DTR quirk.\n\nTested on a Compal EXM-G1x modem.\n\nSigned-off-by: Ian Lin \u003cjisayme@gmail.com\u003e\nLink: https://patch.msgid.link/20260831084124.65074-1-jisayme@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d85f521a9afb786b1d95bbcb218d3afdf3fe73ab", "tree": "8c0ba499247c7f4e662185c2c9cf06a9ef6811a9", "parents": [ "debac3a20dec524a59625cf10fa2f18571127824" ], "author": { "name": "Nicolai Buchwitz", "email": "nb@tipi-net.de", "time": "Mon Aug 31 13:31:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 19:22:53 2026 -0700" }, "message": "net: macb: exclude software FCS from TX byte statistics\n\nFrames for which macb_pad_and_fcs() supplies the FCS have four FCS\nbytes appended, and TX completion then accounts the grown skb-\u003elen.\ntx_bytes is defined to exclude the FCS, so these frames are reported\nfour bytes too large.\n\nTrack only the number of FCS bytes appended in software, 0 or\nETH_FCS_LEN, and subtract that from skb-\u003elen at completion. skb-\u003elen\nalready reflects the padded length by then, so there is nothing else\nto store. macb_pad_and_fcs() already returns 0 on every non-error\npath. Return the FCS length from there instead, rather than\nrecomputing the same check in the caller. BQL stays on the padded\nskb-\u003elen that netdev_tx_sent_queue() saw.\n\nFixes: 653e92a9175e (\"net: macb: add support for padding and fcs computation\")\nSigned-off-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nLink: https://patch.msgid.link/20260831113128.1678674-1-nb@tipi-net.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "debac3a20dec524a59625cf10fa2f18571127824", "tree": "e5b6dd1577de39abcf7cf853d8f8215380860412", "parents": [ "5a3f7a683aee56e1f15c9d53041f3236767eaae7" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Sep 01 00:55:44 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:30:00 2026 -0700" }, "message": "net: Remove conflicting altnames for dying netns in __dev_change_net_namespace().\n\nsyzbot reported the warning in cfg80211_pernet_exit(). [0]\n\nThe repro does the following:\n\n 1. create two device in root netns and non-root netns\n 2. assign the same altname for the two devices\n 3. remove the non-root netns\n\nSince commit 7663d522099e (\"net: check for altname conflicts\nwhen changing netdev\u0027s netns\"), cfg80211_switch_netns() and\ncfg802154_switch_netns() fail if init_net has a device with the\nconflicting altname.\n\ndefault_device_exit_net() had the same issue and commit d09486a04f5d\n(\"net: fix removing a namespace with conflicting altnames\") fixed it.\n\ncfg80211_pernet_exit() and cfg802154_pernet_exit() need the same fix.\n\nLet\u0027s generalise the fix by removing conflicting altnames for dying\nnetns in __dev_change_net_namespace().\n\n[0]:\ncfg80211_switch_netns(rdev, \u0026init_net)\nWARNING: net/wireless/core.c:1871 at cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871, CPU#1: kworker/u8:9/1160\nModules linked in:\nCPU: 1 UID: 0 PID: 1160 Comm: kworker/u8:9 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nWorkqueue: netns cleanup_net\nRIP: 0010:cfg80211_pernet_exit+0xd5/0x120 net/wireless/core.c:1871\nCode: e8 03 42 80 3c 20 00 74 08 4c 89 f7 e8 b4 ef 0e f7 4d 8b 36 49 81 fe 20 10 4a 90 74 12 e8 03 3d 9f f6 eb 85 e8 fc 3c 9f f6 90 \u003c0f\u003e 0b 90 eb cc e8 f1 3c 9f f6 eb 05 e8 ea 3c 9f f6 5b 41 5c 41 5e\nRSP: 0018:ffffc900057a78f0 EFLAGS: 00010293\nRAX: ffffffff8b287154 RBX: ffff88807ba72780 RCX: ffff8880213e8000\nRDX: 0000000000000000 RSI: 00000000ffffffef RDI: 0000000000000000\nRBP: 00000000ffffffef R08: ffffffff9024cc67 R09: 0000000000000000\nR10: fffff52000af4eb0 R11: fffffbfff204998d R12: dffffc0000000000\nR13: ffffffff904a1080 R14: ffff888144ed0008 R15: ffff888144ed0e20\nFS: 0000000000000000(0000) GS:ffff888124de6000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 00005642de0a8a70 CR3: 000000007a40c000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n ops_exit_list net/core/net_namespace.c:200 [inline]\n ops_undo_list+0x43d/0x8d0 net/core/net_namespace.c:253\n cleanup_net+0x572/0x810 net/core/net_namespace.c:706\n process_one_work kernel/workqueue.c:3387 [inline]\n process_scheduled_works+0xc3d/0x1630 kernel/workqueue.c:3470\n worker_thread+0xa47/0xfb0 kernel/workqueue.c:3551\n kthread+0x38b/0x480 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFixes: 36fbf1e52bd3 (\"net: rtnetlink: add linkprop commands to add and delete alternative ifnames\")\nReported-by: syzbot+74f338e09f1ef3ee6457@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/6a96219e.04428c52.29b18.0001.GAE@google.com/T/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20260901005550.2042357-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5a3f7a683aee56e1f15c9d53041f3236767eaae7", "tree": "6cb0613b9f4cf74a6070a2977c5fb07a19c6e954", "parents": [ "af602c7aa5fedc9be3043244017aef4f26c96b70" ], "author": { "name": "Jun Yang", "email": "littleddfu@gmail.com", "time": "Mon Aug 31 19:13:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:25:35 2026 -0700" }, "message": "net: bridge: mcast: don\u0027t truncate the port group walk on teardown\n\n__br_multicast_disable_port_ctx() and br_multicast_del_port() walk\nport-\u003emglist with hlist_for_each_entry_safe(). However,\nbr_multicast_find_del_pg() can also delete other entries from the same\nlist through br_multicast_fwd_src_remove() or __fwd_del_star_excl().\n\nIf such an entry is the iterator\u0027s saved next node, hlist_del_init()\nclears its -\u003enext and terminates the walk early. The reproducer triggers\nthis in both teardown walks, leaving port groups in the bridge mdb with\na dangling -\u003ekey.port after del_nbp() frees the port:\n\n BUG: KASAN: slab-use-after-free in __mdb_fill_info+0x1191/0x1320\n __mdb_fill_info+0x1191/0x1320\n br_mdb_dump+0x594/0xe40\n rtnl_mdb_dump+0x1cf/0x5d0\n\nUse hlist_del_init_rcu() to unlink the group while preserving -\u003enext.\nbr_multicast_del_pg() and the teardown walks run under\nbr-\u003emulticast_lock. The GC worker must acquire the same lock before\ndetaching the group for destruction, so the node remains alive while\nthe walk uses the preserved pointer.\n\nPreserving -\u003enext means a walk can now reach a group that an earlier\niteration already deleted as a side effect. That group is off mp-\u003eports,\nso br_multicast_find_del_pg() would fall through its port scan and hit\nthe trailing WARN_ON(1). Skip such groups at the top of that helper: a\nport group is put on port-\u003emglist when it is created and only unlinked\nwhen it is deleted, so hlist_unhashed() identifies exactly this case.\n\nFixes: b08123684bd5 (\"net: bridge: mcast: install S,G entries automatically based on reports\")\nCc: stable@vger.kernel.org\nSuggested-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831111330.199543-1-junvyyang@tencent.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "af602c7aa5fedc9be3043244017aef4f26c96b70", "tree": "1765282fb7828988c3d2e18fc8a4e040fee2a496", "parents": [ "544d85de4dc22c01badfd8cefa59829ce35c4858" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 20:30:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Sep 02 18:19:19 2026 -0700" }, "message": "bonding: do not clear curr_active_slave prematurely when releasing all slaves\n\nWhen releasing all slaves during bond destruction (all \u003d\u003d true),\n__bond_release_one() unconditionally clears bond-\u003ecurr_active_slave to\nNULL in every iteration.\n\nIf a backup slave is released before the active slave,\nbond_alb_deinit_slave() triggers rlb_teach_disabled_mac_on_primary(),\nwhich increments the active slave dev promiscuity counter and sets\nbond_info-\u003eprimary_is_promisc \u003d 1.\n\nBecause bond-\u003ecurr_active_slave was prematurely cleared to NULL when\nreleasing the backup slave, the subsequent iteration releasing the active\nslave evaluates oldcurrent as NULL, so bond_change_active_slave(bond, NULL)\nis skipped. Consequently, bond_alb_handle_active_change() is never called\nto decrement the promiscuity counter, permanently leaking promiscuous\nmode on the physical device after bond teardown.\n\nWhen oldcurrent \u003d\u003d slave, bond_change_active_slave(bond, NULL) already sets\nbond-\u003ecurr_active_slave to NULL. We only need to avoid selecting a new\nactive slave when all \u003d\u003d true. Replace the if (all) branch with\nif (!all \u0026\u0026 oldcurrent \u003d\u003d slave).\n\nFixes: 0896341a44bf (\"bonding: fix bond_release_all inconsistencies\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260831203042.164466-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "940de590b839f71d6dc846160534bf202401b8b7", "tree": "78525ca9a4261293fd0f604b925a12f016ec1962", "parents": [ "89a312991dc6e638a36adc43ccb91dbc25504c04", "2625480a1bf79c62ffb09aafdf61778e682da492" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 02 16:02:02 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Sep 02 16:02:02 2026 -0700" }, "message": "Merge tag \u0027hardening-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux\n\nPull hardening fix from Kees Cook:\n\n - Default randstruct off with rust for better allmodconfig coverage\n (Mark Brown)\n\n* tag \u0027hardening-v7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/kees/linux:\n hardening: Default randstruct off with rust for better allmodconfig support\n" }, { "commit": "7ac81e2d2240f2c57bd073b0733e0b2abca38e82", "tree": "f8becdfebbfa1c31fe32742c3b88a283b98911a5", "parents": [ "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84" ], "author": { "name": "Genjian Zhang", "email": "zhanggenjian@kylinos.cn", "time": "Fri Aug 07 23:57:15 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 17:01:13 2026 +0200" }, "message": "dm-ebs: fix incorrect device offset check in ebs_ctr()\n\n\u003coffset\u003e is a backing-device sector offset; ti-\u003elen is the virtual\ntarget length. Comparing them rejects valid tables, e.g.:\n\n dmsetup create ebs0 --table \"0 1048576 ebs /dev/sda 2097152 1 8\"\n -\u003e ebs: Invalid device offset sector (-EINVAL)\n\nDrop the check. Bounds against the backing device are already\nenforced later by device_area_is_invalid() via ebs_iterate_devices().\n\nCc: stable@vger.kernel.org\nFixes: d3c7b35c20d6 (\"dm: add emulated block size target\")\nSigned-off-by: Genjian Zhang \u003czhanggenjian@kylinos.cn\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "7d4d4f3b668d708d94f62ecdd33ac330a6fd8a84", "tree": "814282e8a747330133608e277d85efd5715873a4", "parents": [ "2ccb8878c149443c6acf628b438c9c942c20abb2" ], "author": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 16:36:26 2026 +0200" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Wed Sep 02 16:36:26 2026 +0200" }, "message": "dm-integrity: fix NULL pointer dereference when the \u0027R\u0027 flag is used\n\nIf the dm-integrity device has the SB_FLAG_DIRTY_BITMAP flag set and the\nuser activates the device in the \u0027R\u0027 mode, a crash in dm_integrity_resume\nhappens because the function attempts to read the journal containing the\nbitmap.\n\nThis patch makes dm-integrity skip any writes to the device in\ndm_integrity_resume if the device is activated in the \u0027R\u0027 mode.\n\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\nFixes: 468dfca38b1a (\"dm integrity: add a bitmap mode\")\nCc: stable@vger.kernel.org\n" }, { "commit": "544d85de4dc22c01badfd8cefa59829ce35c4858", "tree": "f89cbe4551c52a00f618587111faf2dae71686a7", "parents": [ "f695390ea63941a9e412bf1f3afe65ab245fc681" ], "author": { "name": "Chris Lew", "email": "christopher.lew@oss.qualcomm.com", "time": "Thu Aug 27 17:48:46 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 02 12:14:32 2026 +0100" }, "message": "net: qrtr: Send HELLO message on endpoint register\n\nHELLO is currently handled entirely by the name server (NS): it is\nsent once as a broadcast when the NS initializes, and again as a\nreply whenever the NS receives an inbound HELLO from a remote.\n\nSome remote QRTR endpoints (e.g. an external WLAN chipset attached\nover MHI) operate in a slave role: they only ever send a HELLO in\nresponse to one they receive, and never initiate. Since the host cannot\ntell in advance which remotes behave this way, if the host also only\nreplies, both sides wait on the other to speak first and no HELLO is\never exchanged, stalling further communication.\n\nTo fix this:\n- Transfer HELLO handshake ownership to the core layer. A HELLO is\n now sent once, per endpoint, at registration time.\n- Schedule a delayed work item on endpoint registration to send a\n HELLO once the name server is bound. The work reschedules itself\n with a 100ms backoff if the name server socket is not yet bound or\n if allocating the control packet fails, so a transient startup\n condition does not abandon the handshake permanently.\n- Enforce HELLO-first ordering by dropping non-HELLO packets and\n returning -EAGAIN until the HELLO is confirmed sent, using bool\n hello_sent guarded by ep_lock to make the gate check atomic with\n xmit().\n- Skip nodes with nid \u003d\u003d QRTR_EP_NID_AUTO in bcast_enqueue(), to avoid\n broadcasting control packets with QRTR_EP_NID_AUTO as the destination\n node ID.\n- Remove say_hello() from the name server\u0027s ctrl_cmd_hello() handler\n and from qrtr_ns_init(); the core layer is now the sole sender of\n the outbound HELLO. This removes the NS\u0027s reply-on-receive\n behaviour without a replacement.\n\nSigned-off-by: Chris Lew \u003cchristopher.lew@oss.qualcomm.com\u003e\nCo-developed-by: Deepak Kumar Singh \u003cdeepak.singh@oss.qualcomm.com\u003e\nSigned-off-by: Deepak Kumar Singh \u003cdeepak.singh@oss.qualcomm.com\u003e\nCo-developed-by: Pranav Mahesh Phansalkar \u003cpranav.phansalkar@oss.qualcomm.com\u003e\nSigned-off-by: Pranav Mahesh Phansalkar \u003cpranav.phansalkar@oss.qualcomm.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "f695390ea63941a9e412bf1f3afe65ab245fc681", "tree": "4916480f4c770fe841b600e2ebdbb923e2991c72", "parents": [ "70f3995830d3f1e79faa14eb0605914f778feca9" ], "author": { "name": "Sunil Goutham", "email": "sgoutham@marvell.com", "time": "Fri Aug 28 14:49:45 2026 +0530" }, "committer": { "name": "David S. Miller", "email": "davem@davemloft.net", "time": "Wed Sep 02 09:49:27 2026 +0100" }, "message": "octeontx2-af: Fix limiting SRIOV VF count logic\n\nWhen RVU PF0/AF\u0027s VFs are SDP instead of LBK, limiting the VF count\nbased on the LBK channel count is incorrect.\n\nApply LBK channel-based VF limits only when the VF device ID matches\nthe LBK RVU AFVF device.\n\nFixes: 9bd6caf33567 (\"octeontx2-af: Enable sriov on AF to create VFs\")\nSigned-off-by: Sunil Goutham \u003csgoutham@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nSigned-off-by: David S. Miller \u003cdavem@davemloft.net\u003e\n" }, { "commit": "70f3995830d3f1e79faa14eb0605914f778feca9", "tree": "258805c3c89124d24e0f55b3202e4a52dae51130", "parents": [ "b264d8422779d69febce914efc47a92a85cc382c" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 19:46:26 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 16:59:21 2026 -0700" }, "message": "bonding: alb: fix uninitialized transport header access in alb_determine_nd()\n\nalb_determine_nd() uses icmp6_hdr(skb) to inspect ICMPv6 headers.\nHowever, in xmit paths (e.g. packets sent via AF_PACKET / raw sockets\nor forwarded packets), skb-\u003etransport_header is not guaranteed to be\ninitialized. While pskb_network_may_pull() ensures the packet data is\nlinear starting from the network header, it does not set or adjust the\ntransport header offset.\n\nDereferencing icmp6_hdr(skb) can therefore access out-of-bounds memory.\n\nFetch the icmp6hdr directly after ipv6hdr following pskb_network_may_pull(),\nand reload ipv6hdr in case pskb_may_pull() reallocated skb-\u003ehead.\nAlso remove the unused bond argument from alb_determine_nd().\n\nFixes: 0da8aa00bfcf (\"net: bonding: Add support for IPV6 ns/na to balance-alb/balance-tlb mode\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260831194626.119371-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b264d8422779d69febce914efc47a92a85cc382c", "tree": "0b9193a691ddf1ee83a0d6ce612a7b7bb46e9ba1", "parents": [ "1d2929d0850fff683b8aff051275945e65f082c8" ], "author": { "name": "Aswin Karuvally", "email": "aswin@linux.ibm.com", "time": "Thu Aug 27 08:34:08 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Sep 01 16:55:04 2026 -0700" }, "message": "s390/ctcm: Prevent XID null dereference\n\nThe mpc_validate_xid() function sets grp-\u003esaved_xid2-\u003exid2_flag2 to 0x40\nto signal XID validation error. If peer XID is NULL or r/w channel\npairing mismatch happens, grp-\u003esaved_xid2 is never initialized. An\nattempt to set the flag in such case leads to NULL dereference.\n\nFix this by using the always available priv-\u003exid-\u003exid2_flag2 instead of\ngrp-\u003esaved_xid2-\u003exid2_flag2 for validation errors.\n\nFixes: 293d984f0e36 (\"ctcm: infrastructure for replaced ctc driver\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aswin Karuvally \u003caswin@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260827063408.2168914-1-aswin@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2625480a1bf79c62ffb09aafdf61778e682da492", "tree": "a5da694565264ddb176a7edb8261311645ea3141", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Tue Sep 01 23:50:02 2026 +0100" }, "committer": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Tue Sep 01 16:01:35 2026 -0700" }, "message": "hardening: Default randstruct off with rust for better allmodconfig support\n\nCurrently randstruct does not support rust so we have Kconfig dependencies\nwhich prevent rust being enabled when randstruct is. Unfortunately this\nprevents rust being enabled in allmodconfig, our standard coverage build.\nrandstruct gets turned on by default, then the dependency on !RANDSTRUCT\ncauses rust to get disabled.\n\nWork around this by disabling randstruct by default if we have a usable\nrust toolchain and rust support for the architecture, circular\ndependencies prevent us directly depending on !RUST. This means we might\nend up with a configuration that disables both rust and randstruct but\nhopefully it\u0027s more likely go give the expected result.\n\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\nAcked-by: Miguel Ojeda \u003cojeda@kernel.org\u003e\nLink: https://patch.msgid.link/20260901-rust-reverse-randstruct-dep-v4-1-3bfa19efe1fa@kernel.org\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\n" }, { "commit": "89a312991dc6e638a36adc43ccb91dbc25504c04", "tree": "0c5c6eb4c4213f6289a43c16d3bc1fc9bd5b6131", "parents": [ "9a58da80053f992b285b6b7bebc694b0f284c443", "4aa2c106aef4bf3dfd97c30842db0767b26e8428" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 13:37:14 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 13:37:14 2026 -0700" }, "message": "Merge tag \u0027cifs-fixes-7.3-rc2\u0027 of https://git.manguebit.org/linux\n\nPull smb client fixes from Paulo Alcantara:\n\n - Fixes for fallocate range operations (insert, collapse, zero, punch\n hole)\n\n The insert range implementation copied overlapping chunks in the\n wrong direction, corrupting file data on every server except Windows.\n\n Several related issues in the same area are also addressed — stale\n page cache and FS-Cache readback, an integer truncation on large\n files, missing RLIMIT_FSIZE validation and missing sparse file\n marking.\n\n - Data corruption fixes in the O_TRUNC open path: one where i_size was\n zeroed before the server confirmed the truncate and another where the\n lack of locking allowed concurrent buffered writes to be silently\n discarded\n\n - Heap overflow fixes in legacy SMB1 paths: one in extended attribute\n writes and one in POSIX ACL handling, both exploitable via\n unprivileged setxattr(2)\n\n - Fix for multiuser mount with krb5 failing because the username option\n was not propagated to new per-user connections\n\n - Fix for split debug message in __release_mid() after a printk\n conversion\n\n* tag \u0027cifs-fixes-7.3-rc2\u0027 of https://git.manguebit.org/linux:\n smb: client: reject SetEA requests that do not fit the request buffer\n smb: client: fix data corruption with concurrent writes and O_TRUNC\n cifs: don\u0027t update i_size in cifs_do_truncate without a cached handle\n smb: client: fix heap overflow in cifs_do_set_acl()\n smb: client: fix multiuser mount with krb5\n smb: client: transport: Fix debug printing in __release_mid()\n smb/client: invalidate fscache for fallocate range operations\n smb/client: fix stale page cache in insert/collapse range\n smb/client: fix integer truncation in collapse range\n smb/client: fix data corruption in emulated insert range\n smb/client: mark file sparse before emulating insert range\n smb/client: validate new EOF for zero range\n smb/client: validate new EOF for insert range\n cifs: add revalidation on FSCTL failure in smb2_duplicate_extents()\n" }, { "commit": "4a819ee5f2834330656d6ac168c4c8cf27fdeec2", "tree": "f0535f7116164ceeb4060e8be2eb23a687a66a63", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Mon Aug 31 22:07:10 2026 +0200" }, "committer": { "name": "Rafael J. Wysocki", "email": "rafael.j.wysocki@intel.com", "time": "Tue Sep 01 21:45:50 2026 +0200" }, "message": "ACPI: bus: Drop two fields from struct acpi_device_pnp\n\nThere are two fields in struct acpi_device_pnp, device_name and\ndevice_class, that were supposed to be populated and used by device\ndrivers, but they have never been used consistently and now they\nare only set for the bus object in acpi_set_pnp_ids() (and never\nread afterward).\n\nDrop them along with all of the associated symbols except for\nMAX_ACPI_CLASS_NAME_LEN and the acpi_device_class typedef that\nare used by the ACPI netlink messaging code. Move those two\ndefinitions closer to the struct acpi_bus_event that refers to\nthe acpi_device_class type.\n\nNo intentional functional impact.\n\nSigned-off-by: Rafael J. Wysocki \u003crafael.j.wysocki@intel.com\u003e\nReviewed-by: Hans de Goede \u003cjohannes.goede@oss.qualcomm.com\u003e\nReviewed-by: Andy Shevchenko \u003candriy.shevchenko@linux.intel.com\u003e\nLink: https://patch.msgid.link/6314925.lOV4Wx5bFT@rafael.j.wysocki\n" }, { "commit": "9a58da80053f992b285b6b7bebc694b0f284c443", "tree": "100bb5aa8acd494958dcbe23e2c9350d8b075224", "parents": [ "786262be6048deab760f68c8acc2c85607165894", "ba9572bc43d04d71ba52ae7f20645f1eafe86875" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 08:17:01 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Sep 01 08:17:01 2026 -0700" }, "message": "Merge tag \u0027ksmbd-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb\n\nPull smb server fixes from Namjae Jeon:\n\n - Prevent unintended data exposure by clearing pipe compound padding\n and the response buffer\n\n - Initialize missing fields in FS_OBJECT_ID_INFORMATION,\n FS_CONTROL_INFORMATION, and FS_POSIX_INFORMATION\n\n - Propagate DACL parsing and allocation failures so malformed security\n descriptors are rejected\n\n - Rate-limit errors for unmapped SIDs to prevent kernel log flooding\n\n - Drain multichannel sessions during LOGOFF, wake deferred locks and\n cancellable requests, and ensure cancellation callbacks run only once\n\n - Fix listener kthread reference handling and teardown ordering during\n netdevice events\n\n - Validate normalized-name and IPC share configuration response lengths\n\n - Update the KSMBD MAINTAINERS entry and add Paulo Alcantara as an\n SMBDIRECT co-maintainer\n\n* tag \u0027ksmbd-for-7.3-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/linkinjeon/smb:\n ksmbd: validate normalized name response length\n ksmbd: fix listener task lifetime on netdev events\n ksmbd: prevent out-of-bounds reads in share config responses\n ksmbd: rate limit unmapped SID errors\n ksmbd: propagate DACL parsing errors\n ksmbd: zero pipe read compound padding\n ksmbd: safely drain sessions during logoff\n MAINTAINERS: Update the KSMBD entry\n MAINTAINERS: Add Paulo Alcantara as an SMBDIRECT co-maintainer\n ksmbd: fill in FileSysIdentifier in FS_POSIX_INFORMATION\n ksmbd: initialize FileSystemControlFlags in FS_CONTROL_INFORMATION\n ksmbd: zero the FS_OBJECT_ID_INFORMATION buffer before filling it in\n" }, { "commit": "2ccb8878c149443c6acf628b438c9c942c20abb2", "tree": "eae9428c315a82427e72cb945f566615097a5af6", "parents": [ "18d80c77b4c7dd20699e81cedfbbff4e9d198f28" ], "author": { "name": "Ming-Hung Tsai", "email": "mtsai@redhat.com", "time": "Tue Aug 18 18:05:47 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 15:22:36 2026 +0200" }, "message": "dm cache: fix demotion stats in passthrough mode\n\nThe demotion counter is incremented per incoming write bio before the\ninvalidation begins, causing the demotion count to exceed the actual\nnumber of cached blocks when multiple bios target the same cached\nblock. Additionally, the counter is incremented unconditionally\nregardless of invalidation failure.\n\nReproduce steps:\n\n1. Create a cache device consisting of 512 cache entries\n\nmodprobe brd rd_size\u003d262144\ndmsetup create cmeta --table \"0 8192 linear /dev/ram0 0\"\ndmsetup create cdata --table \"0 65536 linear /dev/ram0 8192\"\ndmsetup create corig --table \"0 65536 linear /dev/ram0 262144\"\ndd if\u003d/dev/zero of\u003d/dev/mapper/cmeta bs\u003d4k count\u003d1 oflag\u003ddirect\ndmsetup create cache --table \"0 65536 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 writethrough smq 0\"\n\n2. Populate the cache, and record the number of cached blocks\n\nfio --name\u003dpopulate --filename\u003d/dev/mapper/cache --rw\u003drandwrite --bs\u003d4k \\\n--direct\u003d1 --ioengine\u003dlibaio --iodepth\u003d32 --io_size\u003d2048m\nnr_cached\u003d$(dmsetup status cache | awk \u0027{split($7, a, \"/\"); print a[1]}\u0027)\n\n3. Reload the cache into passthrough mode\n\ndmsetup suspend cache\ndmsetup reload cache --table \"0 65536 cache /dev/mapper/cmeta \\\n/dev/mapper/cdata /dev/mapper/corig 128 2 metadata2 passthrough smq 0\"\ndmsetup resume cache\n\n4. Write to the passthrough cache with multiple jobs to trigger\n multiple bios hitting the same cached block.\n\nfio --filename\u003d/dev/mapper/cache --name\u003dtest --rw\u003dwrite --bs\u003d4k \\\n--direct\u003d1 --ioengine\u003dlibaio --iodepth\u003d32 --numjobs\u003d4\n\n5. Check if demoted matches cached block count. These numbers should\n match but may differ due to overcounting per bio.\n\nnr_demoted\u003d$(dmsetup status cache | awk \u0027{print $12}\u0027)\necho \"$nr_cached, $nr_demoted\"\n\nFix by moving the demotion counter increment into invalidate_complete(),\ngated on the success flag.\n\nReported-by: Ben Marzinski \u003cbmarzins@redhat.com\u003e\nFixes: b29d4986d0da (\"dm cache: significant rework to leverage dm-bio-prison-v2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ming-Hung Tsai \u003cmtsai@redhat.com\u003e\nReviewed-by: Benjamin Marzinski \u003cbmarzins@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "1d2929d0850fff683b8aff051275945e65f082c8", "tree": "ef5b51214952daa7a588b0a1e7f1569d2e066c1b", "parents": [ "bc93419130bb70fabf6561e197054caae85c160c" ], "author": { "name": "Norbert Szetei", "email": "norbert@doyensec.com", "time": "Sat Aug 29 18:56:18 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 01 15:12:24 2026 +0200" }, "message": "net: psp: do not inherit the Rx association on clone\n\nsk-\u003epsp_assoc sits past sk_dontcopy_end, so sock_copy() copies it into\nevery socket accepted from a listener without taking a reference, while\ninet_sock_destruct() puts for every inet socket. psp_twsk_init() does\nrefcount_inc() for the timewait socket, so a child closing through\nTIME_WAIT cancels its own put and leaves the association with one\nreference and N timewait sockets holding the same pointer. Closing the\nlistener frees it, and the timewait timers then put freed memory.\n\nRejecting the association on a listening socket is not sufficient: a socket\ncan acquire one while established and then be turned back into a listener,\nbecause tcp_disconnect() leaves sk-\u003epsp_assoc in place.\n\n BUG: KASAN: slab-use-after-free in psp_twsk_assoc_free+0x6f/0xf0\n Write of size 4 at addr ffff888110f9255c by task swapper/7/0\n psp_twsk_assoc_free+0x6f/0xf0\n inet_twsk_put+0xda/0x1b0\n call_timer_fn+0x53/0x2e0\n __run_timers+0x764/0xa80\n Freed by task 99:\n kfree+0x1a7/0x500\n process_one_work+0x7ec/0x1100\n\nAn association carries a per-connection SPI and key, so a child must not\ninherit the parent\u0027s. Clear it on clone.\n\nFixes: 6b46ca260e22 (\"net: psp: add socket security association code\")\nCc: stable@vger.kernel.org\nAssisted-by: Claude:claude-opus-5\nSigned-off-by: Norbert Szetei \u003cnorbert@doyensec.com\u003e\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/BC10EB92-ABB3-41B2-AB16-266BEEBE18C0@doyensec.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "18d80c77b4c7dd20699e81cedfbbff4e9d198f28", "tree": "ccefe224444ca685314bc4c4a9b14ef8a7c649c4", "parents": [ "59e6f919d77d72ec79cbf171256f2f7819737580" ], "author": { "name": "Ben Cressey", "email": "ben@cressey.dev", "time": "Thu Aug 20 21:44:58 2026 +0000" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 13:45:10 2026 +0200" }, "message": "dm-integrity: fix infinite loop on discard with large tag size\n\nWhen integrity_metadata handles a discard, it fills a buffer with\nDISCARD_FILLER and writes it over the tags, max_blocks blocks at a\ntime. If the kmalloc fails, the buffer is the on-stack array\nchecksums_onstack and max_size is set to HASH_MAX_DIGESTSIZE. So if the\ntag size is larger than HASH_MAX_DIGESTSIZE, max_blocks is zero, bi_size\nis never decremented and the loop never terminates.\n\nFix this by using sizeof(checksums_onstack) as max_size. The array has\nMAX_TAG_SIZE bytes since commit b93b6643e9b5 (\"dm integrity: fix a\ncrash with unusually large tag size\"), so max_blocks is at least 1.\n\nFixes: 84597a44a9d8 (\"dm integrity: add optional discard support\")\nCc: stable@vger.kernel.org\nReviewed-by: Jose Fernandez (Anthropic) \u003cjose.fernandez@linux.dev\u003e\nSigned-off-by: Ben Cressey \u003cben@cressey.dev\u003e\nAssisted-by: Claude:unspecified\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "59e6f919d77d72ec79cbf171256f2f7819737580", "tree": "7210f5d05ea8f9d41befe87ca198ac06521a0d5b", "parents": [ "b2fd92f016e9d692fd3c8c08d0ee014e9212279d" ], "author": { "name": "Ben Cressey", "email": "ben@cressey.dev", "time": "Thu Aug 20 21:44:57 2026 +0000" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 13:44:42 2026 +0200" }, "message": "dm-integrity: fix buffer overflow with keyed discard\n\nSince commit 68c5c42567bc (\"dm-integrity: replace forgeable discard\nfiller with a keyed sector marker\"), integrity_metadata computes a\nchecksum for every discarded block into the \"checksums\" buffer.\nintegrity_sector_checksum always writes the whole digest. So if the tag\nsize is smaller than the digest size, the checksum of the last block\nthat fits into the buffer is written past the end of it. For example,\nwith hmac(sha256) and tag size 16, a 4MiB discard writes 16 bytes past\nthe kmalloc\u0027ed page.\n\nFix this by subtracting extra_space from the buffer size when computing\nmax_blocks, like we do for writes.\n\nFixes: 68c5c42567bc (\"dm-integrity: replace forgeable discard filler with a keyed sector marker\")\nReviewed-by: Jose Fernandez (Anthropic) \u003cjose.fernandez@linux.dev\u003e\nSigned-off-by: Ben Cressey \u003cben@cressey.dev\u003e\nAssisted-by: Claude:unspecified\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "b2fd92f016e9d692fd3c8c08d0ee014e9212279d", "tree": "265efaa4ec310d8355c4b69e66880aea3e15b6d3", "parents": [ "bc9781c0247de107876f32929f1637db93a42b34" ], "author": { "name": "Chen Cheng", "email": "chencheng@fnnas.com", "time": "Mon Aug 24 19:34:49 2026 +0800" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 13:32:50 2026 +0200" }, "message": "dm-integrity: require stable writes for internal hash modes\n\ndm-integrity direct, bitmap and inline internal-hash modes compute\nintegrity tags from the pages carried by the write bio. The lower data\nwrite also uses those pages, so the tag and the data write depend on the\nsame memory contents staying unchanged while writeback is in flight.\n\nWithout stable writes, a buffered writer can modify a writeback folio\nafter dm-integrity has submitted the data bio and before the lower device\nhas consumed the data. After a crash, this can leave data from the later\ncontents with a tag calculated from the earlier contents, causing\npermanent checksum failures on read.\n\nSet BLK_FEAT_STABLE_WRITES for internal-hash D, B and I modes so\nfilesystems wait for writeback folios to become stable before modifying\nthem again. Journal mode is left unchanged because it copies data into\nthe journal before computing and persisting the tag.\n\nTested using dm-delay over a virtio-blk test disk, dm-integrity\ninternal_hash:crc32c and no-journal ext4. The D and B reproducers both\nfailed with checksum errors before this change and completed with\nREAD_RC\u003d0 and zero mismatches after it.\n\nFixes: 7eada909bfd7 (\"dm: add integrity target\")\nCc: stable@vger.kernel.org\nReported-by: Sun Yangkai \u003csunyangkai@fygo.io\u003e\nLink: https://github.com/chencheng-fnnas/reproducer/blob/main/dm-integrity-writeback-race.py\nSigned-off-by: Chen Cheng \u003cchencheng@fnnas.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "bc9781c0247de107876f32929f1637db93a42b34", "tree": "53e181d92dfa3c9c1dc375131ab2b3ed2493acf5", "parents": [ "148845aa1921d95ef5dc851c76e6a284f6657df6" ], "author": { "name": "Benjamin Marzinski", "email": "bmarzins@redhat.com", "time": "Tue Aug 25 15:22:26 2026 -0400" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 13:32:37 2026 +0200" }, "message": "dm cache: fix issue with background work locking\n\ndm cache used a rw_semaphore for background_work_lock. Write locks on\nrw_semaphores have strict owner semantics, but there was no guarantee\nthat the process that locked background_work_lock was the same process\nthat unlocked it. This can be easily seen using a kernel compiled with\nCONFIG_DEBUG_RWSEMS. Given a dm cache device \u003ccache\u003e, run: \u0027dmsetup\nsuspend \u003ccache\u003e \u0026\u0026 dmsetup resume \u003ccache\u003e\u0027. This will trigger a kernel\nwarning:\n\nDEBUG_RWSEMS_WARN_ON((rwsem_owner(sem) !\u003d current) \u0026\u0026 !rwsem_test_oflags(sem, RWSEM_NONSPINNABLE))\n\ntriggered by cache_resume(). To fix this, switch from a rw_semaphore to\na spinlock and a wait queue. dm cache already has a wait queue and\nassociated counter, migration_wait and nr_allocated_migrations, that was\ngetting woken up when background work was getting completed, but wasn\u0027t\nactually used by anything. This is replaced by the background_work queue\nand counter.\n\nFixes: b29d4986d0da (\"dm cache: significant rework to leverage dm-bio-prison-v2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Benjamin Marzinski \u003cbmarzins@redhat.com\u003e\nReviewed-by: Matthew Sakai \u003cmsakai@redhat.com\u003e\nReviewed-by: Ming-Hung Tsai \u003cmtsai@redhat.com\u003e\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "148845aa1921d95ef5dc851c76e6a284f6657df6", "tree": "c49d72edd7503718aa93e03db26e88c5d767c72c", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Ben Cressey", "email": "ben@cressey.dev", "time": "Wed Aug 26 00:25:33 2026 +0000" }, "committer": { "name": "Mikulas Patocka", "email": "mpatocka@redhat.com", "time": "Tue Sep 01 13:24:50 2026 +0200" }, "message": "dm-crypt: fix a tiny race condition in crypt_dec_pending\n\ncrypt_dec_pending reads io-\u003eerror before calling atomic_dec_and_test.\nAnother context, for example crypt_endio called from an interrupt, may\nset io-\u003eerror and drop its reference between the read and the\ndecrement. crypt_dec_pending then drops the last reference and completes\nthe bio with the stale status - so a read that failed and was never\ndecrypted, or a write that failed, is reported as successful.\n\nThe read was placed before the decrement by commit b35f8caa0890 (\"dm\ncrypt: wait for endio to complete before destruction\"), because that\ncommit freed dm_crypt_io before calling bio_endio. This is no longer the\ncase, dm_crypt_io lives in the per-bio data now.\n\nRead io-\u003eerror after atomic_dec_and_test instead. atomic_dec_and_test is\nfully ordered, so no additional barrier is needed.\n\nFixes: b35f8caa0890 (\"dm crypt: wait for endio to complete before destruction\")\nCc: stable@vger.kernel.org\nReviewed-by: Jose Fernandez (Anthropic) \u003cjose.fernandez@linux.dev\u003e\nSigned-off-by: Ben Cressey \u003cben@cressey.dev\u003e\nAssisted-by: Claude:unspecified\nSigned-off-by: Mikulas Patocka \u003cmpatocka@redhat.com\u003e\n" }, { "commit": "98d23edcd41432286cf03672252507a841323c8c", "tree": "88c36bda510252a5927aa7a572cda4785d953eff", "parents": [ "33123ff9cbcb35640f56efb8ede1d6f0d97376fd" ], "author": { "name": "Harald Freudenberger", "email": "freude@linux.ibm.com", "time": "Tue Aug 25 18:01:54 2026 +0200" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Tue Sep 01 12:44:48 2026 +0200" }, "message": "s390/zcrypt: Fix uninitialized padding in CRT key structure\n\nThe zcrypt_type6_crt_key() function leaves padding bytes uninitialized\nbetween key components and the modulus in the CCA CRT key token. These\npadding bytes are sent to the crypto card, potentially leaking kernel\nmemory contents.\n\nThe initial memset() only zeros fixed structure fields, not the\nflexible array member key_parts[] where the padding resides. While key\ncomponents are properly copied from userspace, the calculated pad_len\nbytes between them remain uninitialized.\n\nFix by explicitly zeroing the padding bytes after copying the CRT key\ncomponents.\n\nSigned-off-by: Harald Freudenberger \u003cfreude@linux.ibm.com\u003e\nReviewed-by: Finn Callies \u003cfcallies@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "33123ff9cbcb35640f56efb8ede1d6f0d97376fd", "tree": "0c3be0741ba79f4bee6cddcd1665cad3760921be", "parents": [ "12373ea918a0e72483662095686556eea21d67bc" ], "author": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Thu Aug 27 12:28:32 2026 +0200" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Tue Sep 01 12:44:48 2026 +0200" }, "message": "s390/mm: Simplify crst_table_upgrade()\n\nIn case of an upgrade from four to five level page tables, and a failing\npgd allocation, the exit path of crst_table_upgrade() would incorrectly\ndereference the p4d NULL pointer via pagetable_dtor().\n\nAddress this by reworking crst_table_upgrade(), which basically is a\nrevert of [1]. Take into account that GFP_KERNEL order-2 allocation\nfailures are very unlikely. Therefore keep the code as simple as\npossible:\n\nIn case of an upgrade from three to five levels, and an allocation\nfailure of the fifth page table level, keep the upgrade to four levels\ninstead of reverting back to three levels. This allows to keep error\nhandling minimal.\n\n[1] commit 31932757c612 (\"s390/mm: optimize page table upgrade routine\")\n\nReviewed-by: Alexander Gordeev \u003cagordeev@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "12373ea918a0e72483662095686556eea21d67bc", "tree": "37b5ddf35973b44a2ac97d8efa8769067238284f", "parents": [ "d76181dfabdaa720703167393704efacba343442" ], "author": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Wed Aug 19 12:31:10 2026 +0200" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Tue Sep 01 12:44:48 2026 +0200" }, "message": "s390/boot: Bound command line facility ranges\n\nThe facilities and debug-alternative command line parsers iterate over\ninclusive numeric ranges. If a range ends at ULONG_MAX, incrementing the\ncurrent value wraps to zero and the loop never terminates. Large finite\nout-of-range values also cause unnecessary early boot iterations even\nthough the bitmap helpers ignore them.\n\nStop each loop at the size of the bitmap it modifies. This preserves all\nmeaningful range values while guaranteeing termination.\n\nReviewed-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "d76181dfabdaa720703167393704efacba343442", "tree": "88112616444020a7196c1875089efab8bbdcb8a3", "parents": [ "a0c798ed4103316c23938bdf625af364fbd38016" ], "author": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Wed Aug 19 12:30:33 2026 +0200" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Tue Sep 01 12:44:48 2026 +0200" }, "message": "s390/boot: Avoid IPL parameter append past command line\n\nA command line may occupy all but the terminating byte of\nCOMMAND_LINE_SIZE. In that case append_ipl_block_parm() passes a zero size\nto the IPL parameter conversion helpers and points the destination one\nbyte past early_command_line. The helpers subtract one from the unsigned\nsize and write the converted parameter outside the command line buffer.\n\nConvert the IPL parameter in the command line parsing buffer first. A\nparameter beginning with \u0027\u003d\u0027 can then replace the existing command line\nregardless of its length, while other parameters are appended only when\nspace remains.\n\nFixes: 5ecb2da660ab (\"s390: support command lines longer than 896 bytes\")\nReviewed-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "a0c798ed4103316c23938bdf625af364fbd38016", "tree": "bf9c3bdaad97625fc88e052b772f6f06fbbe4b05", "parents": [ "bb06e5a2a031c89b1f1f60ff45ce80f8e4f6ee56" ], "author": { "name": "Vasily Gorbik", "email": "gor@linux.ibm.com", "time": "Wed Aug 19 12:30:05 2026 +0200" }, "committer": { "name": "Heiko Carstens", "email": "hca@linux.ibm.com", "time": "Tue Sep 01 12:44:47 2026 +0200" }, "message": "s390/boot: Fix physical memory search range\n\nsearch_mem_end() calculates the number of 1MB blocks with a signed int\nliteral. CONFIG_MAX_PHYSMEM_BITS values of 51 and above either overflow\nthe signed int or shift beyond its width. This produces an invalid search\nrange when the binary-search memory detection fallback is used.\n\nUse an unsigned long literal so the full supported physical address range\nis represented.\n\nFixes: 54c57795e848 (\"s390/mem_detect: replace tprot loop with binary search\")\nReviewed-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\nSigned-off-by: Vasily Gorbik \u003cgor@linux.ibm.com\u003e\nSigned-off-by: Heiko Carstens \u003chca@linux.ibm.com\u003e\n" }, { "commit": "bc93419130bb70fabf6561e197054caae85c160c", "tree": "5dfea030a3d8ccbbbed068c81eaa41bee6e0382a", "parents": [ "c037915f80c4db47f7d061d68e703ffd551b1a34" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Aug 31 08:10:27 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 01 12:26:52 2026 +0200" }, "message": "net: bonding: annotate lockless writes with WRITE_ONCE()\n\nSeveral fields in bonding are read locklessly using READ_ONCE()\n(or ACCESS_ONCE() previously) but have corresponding writes that\ndo not use WRITE_ONCE().\n\nAdd WRITE_ONCE() annotations to:\n- bond-\u003esend_peer_notif decrements in bond_peer_notify_may_events()\n and reset in bond_close().\n- bond-\u003eslave_cnt increments and decrements in bond_enslave() and\n __bond_release_one().\n- bond-\u003erecv_probe updates in bond_open(), bond_option_arp_interval_set()\n and rlb_initialize().\n- slaves-\u003ecount decrement in bond_skip_slave().\n\nFixes: 4d97480b1806 (\"bonding: use local function pointer of bond-\u003erecv_probe in bond_handle_frame\")\nFixes: 9a72c2da690d (\"bonding: fix div by zero while enslaving and transmitting\")\nFixes: ee6377147409 (\"bonding: Simplify the xmit function for modes that use xmit_hash\")\nFixes: 429208aab9db (\"net: bonding: add the READ_ONCE/WRITE_ONCE for outside lock accessing\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nReviewed-by: Xuanqiang Luo\u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260831081027.3209554-1-edumazet@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c037915f80c4db47f7d061d68e703ffd551b1a34", "tree": "3d6b3e8192c6ff28a0b65dbe9f9a45d6c9dea03a", "parents": [ "73e594c19b4f815d8343461cec7074c4713bbde7" ], "author": { "name": "Kaiwen Shi", "email": "skwkevin@mail.ustc.edu.cn", "time": "Sun Aug 30 07:05:51 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 01 11:12:39 2026 +0200" }, "message": "mac802154: fix data race and NULL deref on local-\u003eassoc_dev\n\nlocal-\u003eassoc_dev is shared between the association path and the\nassociation-response worker without common synchronization.\n\nmac802154_perform_association() stores the coordinator pointer and waits\nfor a response. Its timeout and error paths clear the pointer and return\nto mac802154_associate(), which may then free the coordinator object.\nMeanwhile, mac802154_rx_mac_cmd_worker() may observe the associating bit\nand enter mac802154_process_association_resp(), which dereferences\nassoc_dev.\n\nThe worker\u0027s bit test and the handler\u0027s pointer dereference are not\natomic with respect to cleanup. Cleanup can clear assoc_dev between them,\ncausing a NULL dereference, or free the coordinator while the response\nhandler still uses the pointer.\n\nThe recorded result is exposed to the same window. assoc_status and\nassoc_addr are written by the handler but read by the association path\nwhile the associating bit is still set, so a second response for the same\nrequest - a malicious one, for instance - can replace them between those\nreads and leave the caller with an incoherent status and address pair.\n\nThe response handler only needs the coordinator extended address.\nReplace assoc_dev with a cached address, removing the pointer lifetime\ndependency. Protect the cached address and the associating bit with a\ndedicated spinlock. A READ_ONCE()/WRITE_ONCE() pair would not guarantee\nan atomic __le64 access on all 32-bit architectures.\n\nwpan_dev-\u003eassociation_lock cannot be reused here: nl802154_associate()\nholds it across rdev_associate(), hence for the whole of\nmac802154_perform_association() including the wait for the response.\nA response handler taking that lock would only get it once the\nassociation has already given up.\n\nReset the completion, publish the cached address, and set the associating\nbit while holding the lock. The response handler takes the lock, rechecks\nthe bit and the cached address, records the response, clears the bit, and\nonly then completes the waiter. Thus cleanup cannot pass the handler\nbetween its state check and completion, and the cached 64-bit value\ncannot tear.\n\nThe handler clears the bit before completing, not the woken waiter:\notherwise complete() is issued under the lock and a second (e.g.\nmalicious) response can reacquire it before the waiter and replace the\nresult. So a wait that returns success implies the bit is already clear,\nand the success and negative-response paths return directly. The\ntransmit-error and timeout paths still clear it under assoc_lock, which\nserializes any racing response against the cleanup while the call returns\nthe error it already selected. Both paths snapshot assoc_status and\nassoc_addr under the same lock.\n\nBoth users run in process context, so a plain spinlock is sufficient.\nThe lock is not held while waiting for the completion.\n\nSuggested-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nSuggested-by: Xuanqiang Luo \u003cxuanqiang.luo@linux.dev\u003e\nFixes: fefd19807fe9 (\"mac802154: Handle associating\")\nCc: stable@vger.kernel.org\nSigned-off-by: Kaiwen Shi \u003cskwkevin@mail.ustc.edu.cn\u003e\nReviewed-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Miquel Raynal \u003cmiquel.raynal@bootlin.com\u003e\nLink: https://patch.msgid.link/20260829230551.1787432-1-skwkevin@mail.ustc.edu.cn\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "73e594c19b4f815d8343461cec7074c4713bbde7", "tree": "52d80cc5e826dd20450733ef03d70b013467eeaf", "parents": [ "545b63503c696c4ce0663b3fcd37f41169aec1eb" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Sun Aug 30 18:09:12 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Sep 01 10:42:56 2026 +0200" }, "message": "af_packet: Don\u0027t cast tpacket_hdr.tp_len to int in tpacket_parse_header().\n\nsyzbot reported BUG() in sock_sendmsg_nosec(). [0]\n\nThe problem is that tpacket_parse_header() casts user-provided\ntpacket_hdr.tp_len, which is u32, to int.\n\nIf the length is larger than INT_MAX, the following condition\nin tpacket_parse_header() passes,\n\n if (unlikely(tp_len \u003e size_max))\n\nand any negative value can be returned to the caller, up to\nsock_sendmsg_nosec().\n\nThe repro set tpacket_hdr.tp_len to 0xfffffdef, which is cast\nto -EIOCBQUEUED (-529), triggering BUG() in sock_sendmsg_nosec().\n\n *(uint64_t*)0x200000000008 \u003d 0xfffffdef;\n ...\n syscall(__NR_write, /*fd\u003d*/r[0], /*buf\u003d*/0x200000000000ul, /*count\u003d*/1ul);\n\nLet\u0027s define the local tp_len as u32 in tpacket_parse_header().\n\n[0]:\nkernel BUG at net/socket.c:803!\nOops: invalid opcode: 0000 [#1] SMP KASAN PTI\nCPU: 0 UID: 0 PID: 5628 Comm: syz-executor176 Not tainted syzkaller #0 PREEMPT(full)\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/24/2026\nRIP: 0010:sock_sendmsg_nosec+0x145/0x180 net/socket.c:803\nCode: 06 67 48 0f b9 3a eb 95 e8 e8 3a 22 f8 48 89 df 4c 89 f6 4c 89 e2 4d 89 fb 2e e8 32 a5 5c 16 e9 51 ff ff ff e8 cc 3a 22 f8 90 \u003c0f\u003e 0b e8 c4 3a 22 f8 48 83 c3 18 48 89 d8 48 c1 e8 03 42 80 3c 28\nRSP: 0018:ffffc90003aefb48 EFLAGS: 00010293\nRAX: ffffffff89a578d4 RBX: ffff8880764c67c0 RCX: ffff88807fb23e80\nRDX: 0000000000000000 RSI: 00000000fffffdef RDI: 00000000fffffdef\nRBP: 00000000fffffdef R08: ffffc90003aef747 R09: 1ffff9200075dee8\nR10: dffffc0000000000 R11: fffff5200075dee9 R12: 0000000000000001\nR13: dffffc0000000000 R14: ffffc90003aefbc0 R15: ffffffff8aac4310\nFS: 000055559101b400(0000) GS:ffff888124ce0000(0000) knlGS:0000000000000000\nCS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\nCR2: 0000200000000210 CR3: 0000000073dca000 CR4: 00000000003526f0\nCall Trace:\n \u003cTASK\u003e\n __sock_sendmsg net/socket.c:815 [inline]\n sock_write_iter+0x2de/0x3e0 net/socket.c:1266\n new_sync_write fs/read_write.c:595 [inline]\n vfs_write+0x612/0xba0 fs/read_write.c:687\n ksys_write+0x150/0x270 fs/read_write.c:739\n do_syscall_x64 arch/x86/entry/syscall_64.c:61 [inline]\n do_syscall_64+0x166/0x520 arch/x86/entry/syscall_64.c:84\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\nRIP: 0033:0x7f173130ecb9\nCode: c0 79 93 eb d5 48 8d 7c 1d 00 eb 99 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 \u003c48\u003e 3d 01 f0 ff ff 73 01 c3 48 c7 c1 d8 ff ff ff f7 d8 64 89 01 48\nRSP: 002b:00007ffd67e44248 EFLAGS: 00000246 ORIG_RAX: 0000000000000001\nRAX: ffffffffffffffda RBX: 0000200000000000 RCX: 00007f173130ecb9\nRDX: 0000000000000001 RSI: 0000200000000000 RDI: 0000000000000003\nRBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 00007ffd67e44388\nR13: 0000000000000002 R14: 00002000000000c0 R15: 0000000000000002\n \u003c/TASK\u003e\n\nFixes: 69e3c75f4d54 (\"net: TX_RING and packet mmap\")\nReported-by: syzbot+73df3f89e1e13089e466@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/6a946ffa.1d9ded08.62e62.0123.GAE@google.com/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260830180915.260225-1-kuniyu@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "786262be6048deab760f68c8acc2c85607165894", "tree": "c32764601cbf7e70c93a20712a081d90d9ba6b64", "parents": [ "abdf623ddb75b24659018d3952d8f61937306ae5", "68c90773f40f91f48a557e9fa65e2a72cebc58df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 20:10:39 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 20:10:39 2026 -0700" }, "message": "Merge tag \u0027edac_updates_for_v7.3_rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras\n\nPull forgotten EDAC updates from Borislav Petkov:\n \"Somewhat belated (and forgotten :-\\) EDAC updates lineup for v7.3:\n\n - Mark the mpc85xx and ThunderX EDAC drivers as orphaned due to lack\n of access to hardware\n\n - Remove the unused fake error injection interface from the EDAC\n debugfs code due to potential races between logging a fake and a\n real hw error\n\n - edac_mc_sysfs: Use sysfs_emit_at() for proper bounds checking\n\n - Remove Mark Gross from maintainer entries and move him to CREDITS\n\n - Load the AMD address translation library only on systems which can\n actually make use of it (have ECC memory) instead of on every AMD\n Zen system out there\n\n - In edac_altera, detect the SoC variant using the ECC manager\u0027s\n compatible string instead of the build architecture to select the\n correct interrupt layout, and remove leftover architecture-specific\n ifdeffery from the double-bit error handling path\n\n - Add a new reviewer for the Xilinx EDAC drivers\n\n - Unify address translation logic in Intel client EDAC drivers igen6\n and ie31200 along with detecting memory controller counts at boot\n time instead of relying on hardcoded, platform specific numbers.\n Also, fix a bunch of issues in them; work by Qiuxu Zhuo\n\n - Add support for a new Intel processor platform Starfire which is a\n derivative of Panther Lake SoCs\n\n - The usual cleanups and fixlets all over\"\n\n* tag \u0027edac_updates_for_v7.3_rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/ras/ras: (24 commits)\n EDAC/thunderx: Orphan it\n EDAC/device_sysfs: Cleanup around edac_device_ctl_poll_msec_store()\n EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n EDAC/igen6: Add Intel Starfire SoCs support\n EDAC/igen6: Refactor address translation logic\n EDAC/igen6: Remove redundant resource configuration tables\n EDAC/igen6: Detect present memory controllers at runtime\n EDAC/igen6: Simplify compute die ID comments\n EDAC/igen6: Remove unnecessary XOR on the zero-valued interleave bit\n EDAC/igen6: Fix Raptor Lake-P logged error address\n EDAC/igen6: Fix channel address decode for non-hash mode\n EDAC/igen6: Fix channel selection hash\n EDAC/igen6: Fix interleave boundary condition\n EDAC/ie31200: Decouple DIMM width decoding from enum order\n RAS/AMD/ATL: Remove conditional return with no effect\n EDAC: Remove redundant dev_err()\n MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer\n EDAC/altera: Remove remaining CONFIG_64BIT ifdefs in the DB-error path\n EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout\n RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed\n ...\n" }, { "commit": "545b63503c696c4ce0663b3fcd37f41169aec1eb", "tree": "ff8a94cba5563bd55941754592c706af50b7a1d5", "parents": [ "975b5b067f525a1b1338c4a3bee1c46545801518" ], "author": { "name": "Koichiro Den", "email": "den@valinux.co.jp", "time": "Mon Aug 31 00:16:17 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 20:09:35 2026 -0700" }, "message": "net: ntb_netdev: Fix statistics races\n\nntb_netdev updates shared net_device stats from per-QP RX and TX\ncallbacks. Once multiple queues are enabled, concurrent updates can be\nlost.\n\nUse per-CPU tstats for packet and byte counters and DEV_STATS_INC() for\nless frequent drop and error counters. Callbacks can run synchronously\nin the xmit path or asynchronously from a tasklet or the memcpy kthread.\nPin TX updates against migration in the kthread path. Use the IRQ-safe\nu64_stats helpers because netpoll can invoke the synchronous path with\nIRQs disabled.\n\nLet the core manage tstats while keeping transport teardown after\nunregister_netdev(), outside RTNL. RCU lets unregister wait for TX\ncompletions already updating stats, while later completions only consume\nthe skb and skip accounting and queue wake.\n\nFixes: 24d9e73c7e00 (\"net: ntb_netdev: Support ethtool channels for multi-queue\")\nCc: stable@vger.kernel.org\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nSigned-off-by: Koichiro Den \u003cden@valinux.co.jp\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260830151617.3546585-1-den@valinux.co.jp\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "975b5b067f525a1b1338c4a3bee1c46545801518", "tree": "a6e8a6e69172641dea1c124a0b1c1f982a686318", "parents": [ "81c600c26302a27852ed8b19c5f2f647ea3555c9" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 14:17:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 20:04:37 2026 -0700" }, "message": "ipv6: sr: restore network header before routing and forwarding\n\nipv6_srh_rcv() runs with skb-\u003edata at the Segment Routing Header (SRH)\nwhile skb_network_header() points at the IPv6 header.\n\nWhen segments_left \u003e 0, ipv6_srh_rcv() previously restored the skb-\u003edata\nposition by pushing sizeof(struct ipv6hdr), assuming the SRH immediately\nfollowed the fixed IPv6 header. If another extension header (such as a\nHop-by-Hop options header) precedes the SRH, skb_network_offset()\nremained negative.\n\nThis led to two problems:\n1. During ip6_route_input(), fib6_rules_early_flow_dissect() invokes\n __skb_flow_dissect() which passes the negative skb_network_offset()\n to flow dissection, breaking BPF and C flow dissector logic.\n2. If forwarded via ip6_forward() or redirected via act_mirred, downstream\n handlers (like sch_fragment() or neighbour output) pass the negative\n offset as an unsigned length, triggering OOB memcpy or buffer overflows.\n\nFix this by pushing -skb_network_offset(skb) before routing, ensuring\nskb_network_offset(skb) is 0 for route lookup / flow dissection as well as\ndownstream forwarding. On the loopback path, pull skb_transport_offset(skb)\nto restore skb-\u003edata to the SRH before looping back.\n\nFixes: 1ababeba4a21 (\"ipv6: implement dataplane support for rthdr type 4 (Segment Routing Header)\")\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nReported-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nReported-by: Fourie Zhang \u003cfouriezhang@tencent.com\u003e\nCloses: https://lore.kernel.org/netdev/20260817104128.22681-1-juny24602@gmail.com/\nCloses: https://lore.kernel.org/netdev/20260827092345.2301937-1-fouriezhang@tencent.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828141727.2372570-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "81c600c26302a27852ed8b19c5f2f647ea3555c9", "tree": "161db08e388efe84985269b35c60db07761c2885", "parents": [ "b3b76e9f4f2476f1135b2ba7743a821db4a0df4b" ], "author": { "name": "David Laight", "email": "david.laight.linux@gmail.com", "time": "Sat Aug 29 12:58:12 2026 +0100" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 20:02:36 2026 -0700" }, "message": "tipc: Dont send random pad bytes in RESET/ACTIVATE messages\n\nThe interface name is passed in a fixed length (TIPC_MAX_IF_NAME) buffer.\nReplace the strcpy(data, l-\u003eif_name) with memcpy() so that the\npad bytes are actually written (l-\u003eif_name[] is zero padded)\nrather than sending random bytes from the skb to the remote system.\n\nReplace two other strcpy() with strscpy().\n\nFixes: e74a386d70c7 (\"tipc: remove pre-allocated message header in link struct\")\nSigned-off-by: David Laight \u003cdavid.laight.linux@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260829115813.188600-1-david.laight.linux@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b3b76e9f4f2476f1135b2ba7743a821db4a0df4b", "tree": "b7edca487c62c28a5018f2c18b271da6d8abb2f6", "parents": [ "f88bbbbe96d6d2ba4cca8af0c47907ed27de2863" ], "author": { "name": "Tung Nguyen", "email": "tung.quang.nguyen@est.tech", "time": "Thu Aug 27 18:13:46 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 20:01:49 2026 -0700" }, "message": "tipc: fix NULL deref in tipc_named_node_up() on empty publication list\n\nUser-space applications can bind a large number of service addresses to\none or more sockets. Each binding of a local-scope service address inserts\none entry (publication) into the TIPC name table. If the number of these\npublications exceeds TIPC_MAX_PUBL (65535), protocol service types\n(such as node state and link state) are no longer inserted into the name\ntable. This causes two issues:\n\n1. User-space applications subscribing to node or link up/down events\n stop receiving notifications.\n\n2. A NULL pointer dereference can occur:\n\n BUG: kernel NULL pointer dereference, address: 00000000000000d0\n ...\n CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.2.0-rc4-default+ #5 PREEMPT(full)\n ...\n RIP: 0010:tipc_named_node_up (./include/linux/skbuff.h:2251 net/tipc/name_distr.c:195 net/tipc/name_distr.c:221)\n ...\n Call Trace:\n \u003cIRQ\u003e\n tipc_node_write_unlock (net/tipc/node.c:428)\n tipc_rcv (net/tipc/node.c:934 net/tipc/node.c:2189)\n tipc_udp_recv (net/tipc/udp_media.c:389)\n\n Thread 1 (tipc_net_finalize) | Thread 2 (named_distribute)\n -----------------------------|-----------------------------\n | ...\n | list_for_each_entry(publ, pls, binding_node) {\n | ...\n | __skb_queue_tail(list, skb);\n | ...\n | }\n | ...\n | hdr \u003d buf_msg(skb_peek_tail(list));\n ... |\n tipc_nametbl_publish(); |\n\n If \u0027tipc_nametbl_publish()\u0027 (Thread 1) fails because the number of\n local publications reaches TIPC_MAX_PUBL, list (Thread 2) will be empty. As a\n result, NULL is passed to \u0027buf_msg()\u0027, leading to a NULL pointer dereference.\n\nFix these issues by allowing protocol service types (node state, link state,\nand topology server) to be inserted into the name table unconditionally.\nThis ensures that users subscribing to these types always receive\nnotifications. In addition, the maximum number of local user publications is\nreduced to (TIPC_MAX_PUBL - 1). This ensures that the maximum bulk size\ncalculated in tipc_link_set_queue_limits() remains valid.\n\nFixes: a5e7ac5ce134 (\"tipc: fix regression bug where node events are not being generated\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nTested-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nSigned-off-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260827111418.164957-1-tung.quang.nguyen@est.tech\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f88bbbbe96d6d2ba4cca8af0c47907ed27de2863", "tree": "7ae25381740632d47fa4d7de3f2aa9ac769c7a4e", "parents": [ "97cc84dad1d7f68a36b71b69b361d88482707673", "c923c14942b164cfc2c1efa4e6324214f2fc248a" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:33 2026 -0700" }, "message": "Merge branch \u0027mitigate-a-side-channel-in-routing-exception-caches\u0027\n\nIdo Schimmel says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nMitigate a side channel in routing exception caches\n\nWhen an ICMP error that quotes a UDP packet is locally delivered, the\nkernel only creates a routing exception if the quoted packet matches\na socket. This allows an off-path attacker to conduct a side-channel\nattack on the routing exception caches in order to discover the\nephemeral ports used by connected UDP sockets.\n\nPrevious mitigations tried to make it harder for attackers to find hash\ncollisions in these caches and make the eviction of exceptions less\npredictable. Amit Klein and Noam Caspi demonstrated that both of these\nmitigations can be bypassed.\n\nThis patchset tries to mitigate such attacks by always creating an\nexception, even before trying to find a matching socket. The exception\nis created by the same helpers that are used when the quoted packet did\nnot originate from a socket, so that guesses (right or wrong) from an\noff-path attacker always result in an exception being created or updated\nin the cache that the attacker can observe.\n\nNote that this mitigation does not make it easier for attackers to fill\nthese caches, since they can already create exceptions with little to no\nvalidation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nIn the good case (matched socket) this comes at the cost of an extra\nroute lookup, as the exception is created before the one performed by\nthe socket path. When the two lookups resolve to different nexthops,\nan exception is created in the cache of each.\n\nPatch #1 fixes a pre-existing bug in the handling of ICMPv6 Redirect\nMessage packets. Discovered while writing the selftest.\n\nPatch #2 creates an exception from the IPv4 UDP code even before socket\nmatching. Other socket types do not need this: raw sockets have no\nports, and for TCP the ICMP error is discarded unless the quoted\nsequence number is in window.\n\nPatch #3 does the same for IPv6.\n\nPatch #4 adds a selftest.\n\nv1: https://lore.kernel.org/netdev/20260826143735.1819315-1-idosch@nvidia.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260828192344.2596928-1-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c923c14942b164cfc2c1efa4e6324214f2fc248a", "tree": "7ae25381740632d47fa4d7de3f2aa9ac769c7a4e", "parents": [ "ac76cab50e899a7346408b8d3c3a4192c2eefb9f" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Fri Aug 28 22:23:44 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:31 2026 -0700" }, "message": "selftests: net: Add exception cache tests\n\nAdd a test for the IPv4 and IPv6 exception caches, covering the\nexceptions that are created in response to ICMP errors quoting a UDP\npacket.\n\nThe topology consists of a host (h1) that reaches a remote host (h2)\nvia a router (r1), with a second router (r2) attached to the segment\nshared by h1 and r1. UDP packets are injected using a packet socket, so\nthat an ICMP error quoting them is only matched to a socket when one was\nopened separately with the same source port. PMTU errors are provoked by\nlowering the MTU of the far end of the path and redirects by pointing\nr1\u0027s route towards h2 back over the segment it received the packet from.\n\nThe following is tested for both address families and for both PMTU and\nredirect exceptions:\n\n* An error that is not matched to a socket creates an exception that\n carries the new MTU or gateway.\n* An error that is matched to a socket creates the same exception.\n\nThe PMTU tests further verify that a lower PMTU replaces the one stored\nin the exception whereas a higher one does not, and that a socket which\ndisabled PMTU discovery using IP{,V6}_PMTUDISC_OMIT gets the same\nexception as the other cases.\n\nWithout \"ipv4: udp: Create exceptions before socket matching\" and \"ipv6:\nudp: Create exceptions before socket matching\", the tests that do not\nopen a socket fail:\n\n # ./exception_cache.sh\n TEST: IPv4: PMTU: exception without a matching socket [FAIL]\n No socket: exception does not carry an MTU of 1400\n TEST: IPv6: PMTU: exception without a matching socket [FAIL]\n No socket: exception does not carry an MTU of 1400\n TEST: IPv4: PMTU: exception with a matching socket [ OK ]\n TEST: IPv6: PMTU: exception with a matching socket [ OK ]\n TEST: IPv4: PMTU: exception with a socket ignoring it [FAIL]\n PMTU discovery disabled: exception does not carry an MTU of 1400\n TEST: IPv6: PMTU: exception with a socket ignoring it [FAIL]\n PMTU discovery disabled: exception does not carry an MTU of 1400\n TEST: IPv4: Redirect: exception without a matching socket [FAIL]\n No socket: exception does not carry the new gateway\n TEST: IPv6: Redirect: exception without a matching socket [FAIL]\n No socket: exception does not carry the new gateway\n TEST: IPv4: Redirect: exception with a matching socket [ OK ]\n TEST: IPv6: Redirect: exception with a matching socket [ OK ]\n\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828192344.2596928-5-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ac76cab50e899a7346408b8d3c3a4192c2eefb9f", "tree": "0cfc143c971b4079e13dac6380188d2958906789", "parents": [ "4c3499f79f8c7e8561266bcc220a18538cec0458" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Fri Aug 28 22:23:43 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:30 2026 -0700" }, "message": "ipv6: udp: Create exceptions before socket matching\n\nCurrently, when ICMPv6 Packet Too Big and Redirect Message packets are\nlocally delivered and quote a UDP packet, an exception is only created\nin the IPv6 exception cache if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the exception cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 4785305c05b2 (\"ipv6: use siphash in rt6_exception_hash()\") and\ncommit a00df2caffed (\"ipv6: make exception cache less predictible\") tried\nto mitigate such attacks by making it harder for attackers to discover\nhash collisions in the exception cache and by randomizing the number of\nexceptions a hash bucket can hold, respectively. Unfortunately, both of\nthe mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating an exception, even\nbefore trying to find a matching socket. Do that by calling\nip6_update_pmtu() and ip6_redirect(), the helpers used when the quoted\npacket did not originate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in an exception being created or updated in the cache that\nthe attacker can observe.\n\nPass the ifindex of the ingress device and the default uid, in a similar\nfashion to icmpv6_err(). Unlike IPv4, an oif of 0 would not match any\nnexthop in ip6_redirect_nh_match() and no exception would be created in\nresponse to a Redirect Message.\n\nNote that this does not allow attackers to create exceptions that they\ncould not create before, as both helpers can already be reached with\nlittle to no validation. For example, by sending an ICMPv6 error that\nquotes an ICMPv6 Echo Reply or one that quotes a UDP source port that\nmatches a wildcard socket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ip6_sk_update_pmtu() /\nip6_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the exception cache of the nexthop resolved by the no socket helpers\nand another in the exception cache of the nexthop used by the socket.\n\nFixes: 2b760fcf5cfb (\"ipv6: hook up exception table to store dst cache\")\nCc: stable@vger.kernel.org\nReported-by: Amit Klein \u003caksecurity@gmail.com\u003e\nReported-by: Noam Caspi \u003cnoam.caspi@mail.huji.ac.il\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260828192344.2596928-4-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4c3499f79f8c7e8561266bcc220a18538cec0458", "tree": "9d9bee62a3661bccc058a979c3b91c7e9e04a03d", "parents": [ "cd51b74bdd0b75aedf255dc67306a16dd057f7ee" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Fri Aug 28 22:23:42 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:30 2026 -0700" }, "message": "ipv4: udp: Create exceptions before socket matching\n\nCurrently, when ICMP Fragmentation Needed and Redirect Message packets\nare locally delivered and quote a UDP packet, a FIB nexthop exception\n(FNHE) is only created if the kernel can match the UDP packet to an\nexisting socket.\n\nThis behavior allows off-path attackers to conduct a side-channel attack\non the FNHE cache in order to discover the ephemeral port used by a\nconnected UDP socket.\n\nCommit 6457378fe796 (\"ipv4: use siphash instead of Jenkins in\nfnhe_hashfun()\") and commit 67d6d681e15b (\"ipv4: make exception cache\nless predictible\") tried to mitigate such attacks by making it harder\nfor attackers to discover hash collisions in the FNHE cache and by\nrandomizing the number of exceptions a hash bucket can hold,\nrespectively. Unfortunately, both of the mitigations can be bypassed.\n\nInstead, mitigate such attacks by always creating a FNHE, even before\ntrying to find a matching socket. Do that by calling ipv4_update_pmtu()\nand ipv4_redirect(), the helpers used when the quoted packet did not\noriginate from a socket.\n\nThis means that guesses (right or wrong) from an off-path attacker will\nalways result in a FNHE being created or updated in the cache that the\nattacker can observe.\n\nPass an oif of 0, in a similar fashion to icmp_err(). This is also the\noif used by the socket path for sockets that are not bound to a device.\n\nNote that this does not allow attackers to create FNHEs that they could\nnot create before, as both helpers can already be reached with little to\nno validation. For example, by sending an ICMP error that quotes an ICMP\nEcho Reply or one that quotes a UDP source port that matches a wildcard\nsocket.\n\nAlso note that in the good case (matched socket) the above scheme comes\nat the cost of an extra route lookup, as the no socket helpers perform\ntheir own lookup before the one performed by ipv4_sk_update_pmtu() /\nipv4_sk_redirect(). When the two resolve to different nexthops, it also\nresults in two exceptions being created for the same destination IP. One\nin the FNHE cache of the nexthop resolved by the no socket helpers and\nanother in the FNHE cache of the nexthop used by the socket.\n\nFixes: 4895c771c7f0 (\"ipv4: Add FIB nexthop exceptions.\")\nCc: stable@vger.kernel.org\nReported-by: Amit Klein \u003caksecurity@gmail.com\u003e\nReported-by: Noam Caspi \u003cnoam.caspi@mail.huji.ac.il\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nLink: https://patch.msgid.link/20260828192344.2596928-3-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cd51b74bdd0b75aedf255dc67306a16dd057f7ee", "tree": "49b2825c37ff24f1211417cda5233d55f86a643b", "parents": [ "97cc84dad1d7f68a36b71b69b361d88482707673" ], "author": { "name": "Ido Schimmel", "email": "idosch@nvidia.com", "time": "Fri Aug 28 22:23:41 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 19:56:30 2026 -0700" }, "message": "ipv6: Fix redirect exception creation for UDP/RAW sockets\n\nWhen an ICMP Redirect Message is matched to a socket, both IPv4 and IPv6\nverify that the source IP of the ICMP packet is the current gateway for\nthe quoted packet. Both also pass the socket\u0027s bound device as the\nexpected nexthop device.\n\nThe difference is that IPv4 treats \"oif\u003d0\" as \"any\", whereas IPv6 always\nrequires an exact match (see ip6_redirect_nh_match()), since the gateway\naddress is usually a link-local address.\n\nTherefore, when an IPv6 UDP/RAW socket is not bound to a device, the\nabove verification fails and an exception is not created. This also\nhappens when the socket is bound to a VRF, as l3mdev_update_flow()\nresets the oif to 0.\n\nFix this by passing the ifindex of the ingress device as the expected\nnexthop device. This is consistent with the existing callers of\nip6_redirect(). Note that for ICMPv6 Redirect Message packets the VRF\ndriver does not reset skb-\u003edev to the VRF device, so skb-\u003edev is\ncorrect, even when it is a VRF port.\n\nFixes: b55b76b22144 (\"ipv6:introduce function to find route for redirect\")\nCc: stable@vger.kernel.org\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nSigned-off-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828192344.2596928-2-idosch@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "68c90773f40f91f48a557e9fa65e2a72cebc58df", "tree": "547356a51c865863718744096e1a3bb785bb5255", "parents": [ "d6eac3868143568cc68ab3cc4817227f4af115d3", "1713cc6b0e1904cf2c2b477ff25faf163c43cbdf", "0c4775d3a756b923c815327dc585ee167057ed52" ], "author": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Mon Aug 31 19:29:47 2026 -0700" }, "committer": { "name": "Borislav Petkov (AMD)", "email": "bp@alien8.de", "time": "Mon Aug 31 19:29:47 2026 -0700" }, "message": "Merge remote-tracking branches \u0027ras/edac-misc\u0027, \u0027ras/edac-drivers\u0027 and \u0027ras/edac-amd-atl\u0027 into edac-updates\n\n* ras/edac-misc:\n EDAC/thunderx: Orphan it\n EDAC/device_sysfs: Cleanup around edac_device_ctl_poll_msec_store()\n EDAC/device_sysfs: Use kstrtouint() for poll_msec to prevent truncation\n MAINTAINERS: Add Radhey Shyam Pandey as Xilinx EDAC reviewer\n MAINTAINERS: Remove Mark Gross from relevant entries\n EDAC/sysfs: Use sysfs_emit_at() in dimmdev_location_show()\n EDAC/mpc85xx: Orphan it\n\n* ras/edac-drivers:\n EDAC/igen6: Add Intel Starfire SoCs support\n EDAC/igen6: Refactor address translation logic\n EDAC/igen6: Remove redundant resource configuration tables\n EDAC/igen6: Detect present memory controllers at runtime\n EDAC/igen6: Simplify compute die ID comments\n EDAC/igen6: Remove unnecessary XOR on the zero-valued interleave bit\n EDAC/igen6: Fix Raptor Lake-P logged error address\n EDAC/igen6: Fix channel address decode for non-hash mode\n EDAC/igen6: Fix channel selection hash\n EDAC/igen6: Fix interleave boundary condition\n EDAC/ie31200: Decouple DIMM width decoding from enum order\n EDAC: Remove redundant dev_err()\n EDAC/altera: Remove remaining CONFIG_64BIT ifdefs in the DB-error path\n EDAC/altera: Use ECC manager compatible to select A10/S10 IRQ layout\n\n* ras/edac-amd-atl:\n RAS/AMD/ATL: Remove conditional return with no effect\n RAS/AMD/ATL, EDAC/amd64: Only load ATL when needed\n EDAC/debugfs: Remove the fake_inject debugfs interface\n\nSigned-off-by: Borislav Petkov (AMD) \u003cbp@alien8.de\u003e\n" }, { "commit": "97cc84dad1d7f68a36b71b69b361d88482707673", "tree": "25723314c23674d5846d200da11d3cb51120f231", "parents": [ "ec12bdd56861b305ba4fa9da50729bd32e5a927f" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 10:37:31 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:56:52 2026 -0700" }, "message": "ip6_gre: check tunnel info before xmit in ip6gre_tunnel_xmit\n\nShuangpeng Bai reported a KASAN slab-use-after-free in\nip6gre_tunnel_xmit().\n\nThe precise KASAN bug was caused by ip6_tnl_xmit() consuming the\nskb during headroom expansion and returning an error, while\nip6gre_tunnel_xmit() still held the stale pointer and called\nskb_tunnel_info_txcheck(skb) at tx_err. That specific bug was fixed by\ncommit 87f21b59ddc6 (\"ip6_tunnel: use skb_cow_head() in ip6_tnl_xmit()\").\n\nHowever, calling skb_tunnel_info_txcheck(skb) at the tx_err label\nafter the transmission attempt remains problematic:\n\nDownstream helpers like ip6_tnl_xmit() call skb_scrub_packet(),\nwhich drops the skb\u0027s metadata_dst before transmission. If an error\noccurs later during transmit, inspecting skb at tx_err sees a scrubbed\ndst and misclassifies tx_errors vs tx_dropped.\n\nCommit e5f7e211b6aa (\"ip6gre: avoid tx_error when sending MLD/DAD on\nexternal tunnels\") already handled this correctly in\nip6erspan_tunnel_xmit() by checking and caching tun_info before\ntransmit.\n\nAlign ip6gre_tunnel_xmit() with ip6erspan_tunnel_xmit() by caching\ntun_info before xmit and checking it at tx_err.\n\nFixes: e5f7e211b6aa (\"ip6gre: avoid tx_error when sending MLD/DAD on external tunnels\")\nReported-by: Shuangpeng Bai \u003cshuangpeng.kernel@gmail.com\u003e\nCloses: https://lore.kernel.org/netdev/20260819062224.3197349-1-shuangpeng.kernel@gmail.com/\nCc: Davide Caratti \u003cdcaratti@redhat.com\u003e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828103731.1951815-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ec12bdd56861b305ba4fa9da50729bd32e5a927f", "tree": "e1f30e3d1d3a8d41f3db9a1e36b6c06543b9929e", "parents": [ "d8d4d1cf40d541a5d7cc3b15d57e42d0815c7d53", "b4cf4a092a7bdaa62acca39c28f386b6d1674968" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:47 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:48 2026 -0700" }, "message": "Merge branch \u0027ipv6-mcast-rcu-and-timer-fixes\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nipv6: mcast: RCU and timer fixes\n\nThis series addresses several RCU synchronization and timer calculation\nissues identified in IPv6 multicast (MLD) handling within net/ipv6/mcast.c\nwhile I was working on fixing a syzbot report in net/ipv4/icmp.c.\n\nPatch 1 fixes an RCU reader diversion in ip6_mc_del1_src() where mutating\npsf-\u003esf_next to insert an unlinked source node into the tombstone list\ndiverted concurrent lockless readers (e.g. ipv6_chk_mcast_addr()) into\npmc-\u003emca_tomb, causing them to miss remaining active sources.\n\nPatch 2 converts ip6_mc_source() to use copy-on-write RCU updates.\nPreviously, source additions and deletions modified the socket\u0027s\npsl-\u003esl_addr array in-place, causing concurrent lockless readers in\ninet6_mc_check() (UDP/RAW receive path) to observe torn 16-byte IPv6\naddresses or duplicated/missed sources.\n\nPatch 3 fixes delay calculation in igmp6_join_group() when canceling an\nexisting delayed work, preventing unsigned jiffies underflows when the\ntimer has already expired and clamping the delay to the unsolicited report\ninterval.\n\nPatch 4 ensures rcu_assign_pointer() is consistently used for __rcu list\nupdates in __ipv6_dev_mc_dec(), ipv6_sock_mc_drop(), __ipv6_sock_mc_close(),\nand related helpers.\n\nPatch 5 switches igmp6_mc_seq_show() to use jiffies_delta_to_clock_t()\nwith a signed long delta, preventing underflows in /proc/net/igmp6 timer\nduration reporting.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260828084531.1826790-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b4cf4a092a7bdaa62acca39c28f386b6d1674968", "tree": "e1f30e3d1d3a8d41f3db9a1e36b6c06543b9929e", "parents": [ "0c8f56c583c3250408367880c98e4d6fbc929315" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 08:45:31 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:46 2026 -0700" }, "message": "ipv6: mcast: use jiffies_delta_to_clock_t() in igmp6_mc_seq_show()\n\nIf a multicast group timer has expired but the delayed work has\nnot yet run to clear MAF_TIMER_RUNNING, expires - jiffies produces\na negative value.\n\nBecause unsigned arithmetic was used with jiffies_to_clock_t(),\nexpires - jiffies underflows to a huge value and reports invalid\ntimer durations in /proc/net/igmp6.\n\nUse jiffies_delta_to_clock_t() with a signed long delta to properly\ncap expired deltas to 0, matching IPv4 igmp_mc_seq_show() and commit\na399a8053164 (\"time: jiffies_delta_to_clock_t() helper to the rescue\").\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828084531.1826790-6-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0c8f56c583c3250408367880c98e4d6fbc929315", "tree": "2551249656cd92e96ced54144878b7e41ac9ae88", "parents": [ "75fa9caeb8aaba19c2463dee0b0a1e09d39c04af" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 08:45:30 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:46 2026 -0700" }, "message": "ipv6: mcast: use rcu_assign_pointer() for __rcu list updates\n\nSeveral places in net/ipv6/mcast.c update RCU-protected lists\n(np-\u003eipv6_mc_list, idev-\u003emc_list, idev-\u003emc_tomb) using direct pointer\nassignments instead of rcu_assign_pointer():\n\n1. In __ipv6_dev_mc_dec(), unlinking a group from idev-\u003emc_list did:\n *map \u003d ma-\u003enext;\n without rcu_assign_pointer() while concurrent readers traverse\n idev-\u003emc_list locklessly under rcu_read_lock().\n2. In ipv6_sock_mc_drop() and __ipv6_sock_mc_close(), unlinking a group\n from np-\u003eipv6_mc_list directly assigned *lnk \u003d mc_lst-\u003enext and\n np-\u003eipv6_mc_list \u003d mc_lst-\u003enext without rcu_assign_pointer(), racing\n with lockless readers in inet6_mc_check().\n3. In __ipv6_sock_mc_join(), mc_lst-\u003enext was initialized to\n np-\u003eipv6_mc_list via raw assignment before publishing mc_lst.\n4. In mld_del_delrec() and __ipv6_dev_mc_inc(), __rcu source pointers\n passed into rcu_assign_pointer() lacked explicit dereference helpers.\n\nFix these by consistently using rcu_assign_pointer() along with\nmc_dereference() / sock_dereference().\n\nFixes: 456b61bca8ee (\"ipv6: mcast: RCU conversion\")\nFixes: 88e2ca308094 (\"mld: convert ifmcaddr6 to RCU\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Taehee Yoo \u003cap420073@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828084531.1826790-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75fa9caeb8aaba19c2463dee0b0a1e09d39c04af", "tree": "20ea9f1422a3b7266373639c6f63d9dd668f5433", "parents": [ "c073d1b070f171d206b19c98d71739a97f15b3f1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 08:45:29 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:46 2026 -0700" }, "message": "ipv6: mcast: fix delay calculation in igmp6_join_group()\n\nWhen joining a multicast group, if a report work is already pending\n(e.g. scheduled by a query or a previous join), igmp6_join_group()\ncancels the delayed work and recalculates the delay:\n\n\tif (cancel_delayed_work(\u0026ma-\u003emca_work)) {\n\t\trefcount_dec(\u0026ma-\u003emca_refcnt);\n\t\tdelay \u003d ma-\u003emca_work.timer.expires - jiffies;\n\t}\n\nUnlike igmp6_group_queried(), igmp6_join_group() did not check\nif delay \u003e\u003d interval. This leads to two issues:\n\n1. If the timer has already expired (timer.expires \u003c\u003d jiffies), the\n stale expiry is reused by mod_delayed_work(), causing the second\n unsolicited report to fire on the very next tick without a\n randomized delay.\n2. If the timer was originally armed by a query with a large\n maximum response delay, delay could exceed\n unsolicited_report_interval(ma-\u003eidev).\n\nFix this by initializing delay to unsolicited_report_interval(ma-\u003eidev)\nand re-randomizing it with get_random_u32_below(interval) when\ndelay \u003e\u003d interval, mirroring the logic in igmp6_group_queried().\n\nFixes: 2d9a93b4902b (\"mld: convert from timer to delayed work\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Taehee Yoo \u003cap420073@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nLink: https://patch.msgid.link/20260828084531.1826790-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c073d1b070f171d206b19c98d71739a97f15b3f1", "tree": "087b1876144b9b374909096134cf85df5c1d1543", "parents": [ "93b49239840b91313adbd77b8b52993eff2d08c1" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 08:45:28 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:45 2026 -0700" }, "message": "ipv6: mcast: use copy-on-write RCU updates in ip6_mc_source()\n\npmc-\u003esflist is read locklessly under rcu_read_lock() by\ninet6_mc_check() during packet reception in the UDP and RAW\nmulticast receive paths.\n\nip6_mc_source() mutated psl-\u003esl_addr and psl-\u003esl_count in-place\nwhen adding or removing a source filter. Additionally, when expanding\nthe filter buffer, newpsl was published via rcu_assign_pointer()\nbefore writing the new source into the array.\n\nBecause 16-byte struct in6_addr writes are not atomic and array\nshifting is not synchronized with RCU readers, concurrent readers in\ninet6_mc_check() could read torn IPv6 addresses or observe\nduplicated/missed source entries.\n\nFix this by switching ip6_mc_source() to copy-on-write RCU updates:\nallocate and fully populate newpsl before publishing it via\nrcu_assign_pointer(), and reclaim the old filter via kfree_rcu(),\nmatching ip6_mc_msfilter().\n\nAlso remove the now unused IP6_SFBLOCK macro.\n\nFixes: 882ba1f73c06 (\"mld: convert ipv6_mc_socklist-\u003esflist to RCU\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Taehee Yoo \u003cap420073@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828084531.1826790-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "93b49239840b91313adbd77b8b52993eff2d08c1", "tree": "73bfbbe6130e257ba47c9f63bbb29ac0b1c96eac", "parents": [ "d8d4d1cf40d541a5d7cc3b15d57e42d0815c7d53" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Fri Aug 28 08:45:27 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:54:45 2026 -0700" }, "message": "ipv6: mcast: fix RCU list diversion in ip6_mc_del1_src()\n\nWhen removing a source filter whose count reaches zero, ip6_mc_del1_src()\nunlinks psf from pmc-\u003emca_sources. If the filter was previously active,\nthe code moved psf directly into pmc-\u003emca_tomb by updating psf-\u003esf_next.\n\nBecause pmc-\u003emca_sources is traversed locklessly under RCU (e.g. by\nipv6_chk_mcast_addr()), mutating psf-\u003esf_next before a grace period\nelapses diverts concurrent readers to the tombstone list. Consequently,\nreaders miss remaining active sources in pmc-\u003emca_sources and improperly\nexamine deleted tombstone entries.\n\nFix this by allocating a new tombstone node for pmc-\u003emca_tomb (as done\nin sf_setstate()) and retiring the original psf via kfree_rcu().\n\nFixes: 4b200e398953 (\"mld: convert ip6_sf_list to RCU\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Taehee Yoo \u003cap420073@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260828084531.1826790-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d8d4d1cf40d541a5d7cc3b15d57e42d0815c7d53", "tree": "8eca0c729932da9c8ad19e9ee3d28c687a6ba40a", "parents": [ "9feb069e5ed03582fbf6272539f1caa2a17dc6d5" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Fri Aug 28 15:32:37 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:36:56 2026 -0700" }, "message": "ppp: ppp_synctty: simplify tty disc_data access\n\nApply the same simplification as the preceding ppp_async change.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: syzbot+b503105c2410c3433459@syzkaller.appspotmail.com\nCloses: https://syzbot.org/bug?extid\u003db503105c2410c3433459\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260828073245.126804-2-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9feb069e5ed03582fbf6272539f1caa2a17dc6d5", "tree": "c35921943ea82f6861afd807e1d62345a7e483c6", "parents": [ "2987ee196c88dbde0463dc87d5fb209c684e34a2" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Fri Aug 28 15:32:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:36:56 2026 -0700" }, "message": "ppp: ppp_async: simplify tty disc_data access\n\ntty_ldisc_hangup() invokes the hangup callback while holding only a read\nlock on tty-\u003eldisc_sem, so it can run concurrently with other line\ndiscipline callbacks. This currently forces async PPP to maintain\nseparate lifetime protection around tty-\u003edisc_data.\n\nLine discipline close is called under the write lock during hangup\nprocessing. Remove the hangup callback and rely on close for teardown,\nas done for SLIP by commit 23c53269f2ba (\"slip: remove slip_hangup() to\nfix use-after-free in slip_receive_buf()\"). This serializes teardown\nwith all other line discipline operations.\n\ndisc_data_lock, refcount and completion are redundant with that\nserialization. Remove them and access tty-\u003edisc_data directly.\n\nThis also eliminates a lockdep warning reported by syzbot. The warning\ndoes not indicate a real deadlock because the write side runs only in\nprocess context with hardirqs disabled.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nReported-by: syzbot+8e808eb853386f575d86@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/all/0000000000002fbad30611e25849@google.com/\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260828073245.126804-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2987ee196c88dbde0463dc87d5fb209c684e34a2", "tree": "ad6c96e08cefa0361bd5f3bc9093118b26d45a91", "parents": [ "1ea9fff22bf6107b421d2978e097865f73714382" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Thu Aug 27 16:06:56 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:22:03 2026 -0700" }, "message": "igmp: convert struct ip_sf_list to RCU\n\nCommit 23d2b94043ca (\"igmp: Add ip_mc_list lock in ip_check_mc_rcu\")\nadded spin_lock_bh(\u0026im-\u003elock) to ip_check_mc_rcu() to prevent a\nuse-after-free while iterating im-\u003esources during concurrent deletions.\n\nHowever, ip_check_mc_rcu() is called from RCU read-side critical\nsections in packet receive and route lookup fast paths (e.g.\n__mkroute_output(), ip_route_input_rcu(), and __udp4_lib_rcv()).\n\nWhen igmpv3_send_cr() or igmpv3_send_report() holds \u0026pmc-\u003elock and\ncalls add_grec() -\u003e igmpv3_newpack() -\u003e ip_route_output_ports(),\nan XFRM policy matching a multicast destination triggers\nxfrm_tmpl_resolve_one() -\u003e xfrm4_get_saddr() -\u003e __mkroute_output() -\u003e\nip_check_mc_rcu(). This attempts to acquire \u0026im-\u003elock while \u0026pmc-\u003elock\nis already held on the same CPU, triggering a lockdep recursive locking\nwarning / deadlock.\n\nFix this by converting IPv4 struct ip_sf_list to RCU, mirroring the\nIPv6 implementation in net/ipv6/mcast.c:\n\n1. Add struct rcu_head to struct ip_sf_list and annotate sf_next,\n sources, and tomb as __rcu pointers.\n2. Use rcu_assign_pointer() and kfree_rcu() for list updates and\n deletions.\n3. Remove spin_lock_bh(\u0026im-\u003elock) from ip_check_mc_rcu() and traverse\n im-\u003esources locklessly with for_each_psf_rcu(), reading and writing\n counter fields with READ_ONCE() and WRITE_ONCE().\n\nNote: RCU conversion of /proc/net/mcfilter will be done in a\nseparate patch.\n\nFixes: 23d2b94043ca (\"igmp: Add ip_mc_list lock in ip_check_mc_rcu\")\nReported-by: syzbot+3d99fb01bcd740f2fc1e@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d3d99fb01bcd740f2fc1e\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260827160656.903003-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1ea9fff22bf6107b421d2978e097865f73714382", "tree": "bb63d23684eeb363719b2c9344552ed8d79d5838", "parents": [ "fee10655709c5c597e8e9f722f3035d9ea31ff3a", "2deb76c21b81e42b3282224f7dd2046fe73fd1e0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:12:02 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:12:03 2026 -0700" }, "message": "Merge tag \u0027for-net-2026-08-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth\n\nLuiz Augusto von Dentz says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nbluetooth pull request for net:\n\nCore:\n\n - hci_core: Fix race condition during device registration\n - L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n - L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n - L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM\n\nDrivers:\n\n - hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()\n - btintel_pcie: Clear automask on spurious interrupts\n - btintel: validate version TLV value lengths\n - btintel: bound firmware ID by TLV length\n - btintel: propagate version TLV parsing errors\n\n* tag \u0027for-net-2026-08-31\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/bluetooth/bluetooth:\n Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()\n Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM\n Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n Bluetooth: hci_core: Fix race condition during device registration\n Bluetooth: btintel: propagate version TLV parsing errors\n Bluetooth: btintel: bound firmware ID by TLV length\n Bluetooth: btintel: validate version TLV value lengths\n Bluetooth: btintel_pcie: Clear automask on spurious interrupts\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260831181837.946230-1-luiz.dentz@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fee10655709c5c597e8e9f722f3035d9ea31ff3a", "tree": "28fb13741546d7c91e8b6f8d86977b6aa959edc7", "parents": [ "9d0f206eb38dbf9e56f94285dcf5138146bde89c" ], "author": { "name": "Aohan Mei", "email": "henrymei@tencent.com", "time": "Wed Aug 26 10:51:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 17:02:56 2026 -0700" }, "message": "net/sched: cls_flower: validate mask pointer after nla_next()\n\nfl_set_enc_opt() iterates the key\u0027s nested tunnel-option attributes\nwith nla_for_each_attr() while advancing a single mask pointer via\nnla_next() at the bottom of each loop, so the mask cursor is driven\nby the number of key attributes rather than by the mask\u0027s own\nattributes. The nla_ok() added by commit c96adff956191 (\"cls_flower:\ncall nla_ok() before nla_next()\") only validates the mask pointer\nthat was just consumed; the pointer produced by nla_next() is used by\nthe next iteration (fl_set_geneve_opt() and siblings) without any\nvalidation.\n\nThe mask\u0027s nested attributes are validated with NL_VALIDATE_LIBERAL,\nwhich merely warns on trailing bytes that do not form a complete\nattribute. A mask carrying one valid attribute plus 1-3 residue\nbytes (or a non-aligned attribute length making msk_depth negative)\ntherefore reaches the next iteration with msk_depth !\u003d 0, so neither\nthe !msk_depth check in fl_set_enc_opt() nor the !depth check in the\nper-type helpers fires. nla_type() then reads past the mask payload\nand nla_parse_nested_deprecated() iterates with an nla_len taken\nfrom those bytes, reading well beyond the mask attribute (KASAN:\nslab-out-of-bounds read in __nla_validate_parse from fl_change()).\n\nValidate the advanced mask pointer as well: when the mask is not\nlegitimately exhausted (msk_depth !\u003d 0) and the new pointer fails\nnla_ok(), reject the filter with -EINVAL. An exactly exhausted mask\nstill skips the check, preserving exact-match behaviour for the\nremaining key attributes.\n\nFixes: c96adff95619 (\"cls_flower: call nla_ok() before nla_next()\")\nReported-by: TencentOS Corvus AI \u003ccorvus@tencent.com\u003e\nCc: stable@vger.kernel.org\nSigned-off-by: Aohan Mei \u003chenrymei@tencent.com\u003e\nLink: https://patch.msgid.link/20260826025123.62758-1-ljp1205831794@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9d0f206eb38dbf9e56f94285dcf5138146bde89c", "tree": "ee938ff92375734a3b82ed52b1f1947037b1720b", "parents": [ "dc0df5a0c62ccea1d0e08d39a4dc9064de81d411", "ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:50:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:50:58 2026 -0700" }, "message": "Merge branch \u0027vsock-validate-packet-sources-after-bound-lookup-fallback\u0027\n\nDaehyeon Ko says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvsock: validate packet sources after bound lookup fallback\n\nBoth virtio and VMCI look up connected sockets by the full tuple before\nfalling back to a destination-only bound lookup. The fallback can select a\nnon-listening socket without validating the packet source.\n\nV2 covered only the virtio path. Following Stefano\u0027s review, this series\nmoves the source and transport validation into a documented AF_VSOCK helper\nand uses it for both virtio and VMCI. The VMCI patch checks both its\nbottom-half and deferred workqueue receive paths.\n\nV4 preserves VMCI\u0027s existing RST behavior when source validation fails.\nThe reset is addressed from the received packet so that a bound but\nnon-listening or concurrently closed socket still notifies the sender,\nwithout directing the reset to a connected socket\u0027s stored peer.\n\nThe v3 regression was reproduced in three x86_64 KASAN boots: a REQUEST to\na bound but non-listening socket returned VMCI_ERROR_NO_ACCESS but no RST\narrived within one second. With v4, the sending context received the\nexpected RST in all three boots. The original VMCI source-validation oracle\nalso passed in three v4 boots: a matched RST reset the pending socket while\na mismatched-context RST left it pending. No KASAN report occurred.\n\nPatch 1 is unchanged from v3 (identical stable patch-id) and carries\nBobby\u0027s Reviewed-by for that revision. Its v3 validation covered the\ncross-UID injection oracle, local CID aliases, selected VSOCK selftests,\nand W\u003d1 changed-object builds under allmodconfig and allyesconfig.\n\nThe current-tree guest-CID vhost probe could not be rerun because the test\nuser lacks access to /dev/vhost-vsock.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260826003929.966160-1-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ad9a7da3fa39c2d616ec0dd3cf6e30531d032fe7", "tree": "ee938ff92375734a3b82ed52b1f1947037b1720b", "parents": [ "dee44f41f206becb41c492899c1996cfd7f82a1b" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Wed Aug 26 09:39:28 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:50:54 2026 -0700" }, "message": "vsock/vmci: validate packet source for connected sockets\n\nvmci_transport_recv_stream_cb() looks up sockets first by the full source\nand destination tuple, then by destination only in the bound table. The\nfallback can select a non-listening socket without checking whether the\npacket came from its stored peer.\n\nThis was reproduced with two VMCI contexts. A RST from the context not\nstored in a TCP_SYN_SENT socket reset that socket after it was selected by\nthe destination-only lookup.\n\nVMCI can process notification packets in bottom-half context when the\nsocket is not owned by user context, or defer packets to a workqueue. Use\nvsock_check_source() after taking the socket lock in the bottom-half path,\nand recheck after lock_sock() in the workqueue path. Listening sockets\ncontinue to accept packets from any source.\n\nReply with a RST addressed from the received packet before dropping a\nsource that fails validation. This preserves the existing reset behavior\nfor bound non-listening and concurrently closed sockets without directing\nthe reset to a connected socket\u0027s stored peer.\n\nFixes: d021c344051a (\"VSOCK: Introduce VM Sockets\")\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/netdev/20260814121255.6B5001F000E9@smtp.kernel.org/\nCc: stable@vger.kernel.org\nSuggested-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nReviewed-by: Vishnu Dasa \u003cvishnu.dasa@broadcom.com\u003e\nLink: https://patch.msgid.link/20260826003929.966160-3-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dee44f41f206becb41c492899c1996cfd7f82a1b", "tree": "936bbad769e11249ec494b6752d59ac4b4136e64", "parents": [ "dc0df5a0c62ccea1d0e08d39a4dc9064de81d411" ], "author": { "name": "Daehyeon Ko", "email": "4ncienth@gmail.com", "time": "Wed Aug 26 09:39:27 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:50:54 2026 -0700" }, "message": "vsock/virtio: validate packet source for connected sockets\n\nvirtio_transport_recv_pkt() looks up sockets first by the full source and\ndestination tuple, then by destination only in the bound table. The\nfallback is needed for listening and connecting sockets, but sockets remain\nin the bound table after connect(), so it can also return a non-listening\nsocket.\n\nThe fallback does not validate the source address. In TCP_SYN_SENT, a\nRESPONSE from an unrelated source can transition the victim socket to\nTCP_ESTABLISHED while its stored remote address remains unchanged.\nSubsequent RW packets from that source are delivered through the same\ndestination-only fallback.\n\nThis was reproduced with capability-empty processes under different UIDs.\nThe attacker discovered the target tuple through unprivileged AF_VSOCK\nsock_diag and caused the victim socket to read 16 attacker-chosen bytes;\nthe intended peer-side socket read 0 of those 16 bytes.\n\nAdd vsock_check_source() to validate the transport, source port and source\nCID against the peer stored in a non-listening socket. The local transport\nis the CID exception because its packets are generated internally with\nVMADDR_CID_LOCAL as their source, including connections using CID aliases.\n\nUse the helper after lock_sock() in the virtio receive path.\n\nFixes: 06a8fc78367d (\"VSOCK: Introduce virtio_vsock_common.ko\")\nCloses: https://lore.kernel.org/netdev/20260813121236.2328599-1-4ncienth@gmail.com/\nCc: stable@vger.kernel.org\nSuggested-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nSigned-off-by: Daehyeon Ko \u003c4ncienth@gmail.com\u003e\nLink: https://patch.msgid.link/20260826003929.966160-2-4ncienth@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dc0df5a0c62ccea1d0e08d39a4dc9064de81d411", "tree": "57bcb7fbff7bd90189202abff27e8c2b5b63f05c", "parents": [ "7b120a771943ffc3cbce787daecdd23eccb0505f" ], "author": { "name": "Florian Schauer", "email": "florian@schauer.to", "time": "Fri Aug 28 08:08:22 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:24:51 2026 -0700" }, "message": "page_pool: keep frag_offset aligned for odd-sized requests\n\npage_pool_alloc_frag_netmem() rounds the requested fragment size with\n\n\tsize \u003d ALIGN(size, dma_get_cache_alignment());\n\ndma_get_cache_alignment() returns 1 unless the architecture defines\nARCH_DMA_MINALIGN, which DMA-coherent architectures such as x86 do not.\nThere the ALIGN() is a no-op and pool-\u003efrag_offset advances by the raw,\nunrounded size.\n\nA single caller asking for an odd size then leaves frag_offset misaligned\nfor every fragment carved out of that page afterwards. The pool is shared,\nso the damage is not confined to the caller that caused it.\n\nThe per-cpu system_page_pool used by generic XDP hits this.\nskb_pp_cow_data() allocates its fragments with the raw packet length:\n\n\tsize \u003d min_t(u32, len, PAGE_SIZE);\n\ttruesize \u003d size;\n\tpage \u003d page_pool_dev_alloc(pool, \u0026page_off, \u0026truesize);\n\nleaving frag_offset odd for whatever is carved out of that page next. Its\nown head allocation is already aligned -- SKB_HEAD_ALIGN(size) plus the\nXDP_PACKET_HEADROOM its callers pass -- so it is a later user of the shared\npool that pays: page_pool_dev_alloc_va() returns a misaligned buffer,\nnapi_build_skb() installs it as skb-\u003ehead, and skb_shinfo(skb) \u003d\u003d\nskb-\u003ehead + skb-\u003eend is misaligned with it.\n\nskb_shinfo()-\u003edataref is a 4-byte atomic_t at offset 0x20, so the\natomic_inc() in __skb_clone() straddles a cache line. On x86 with split\nlock detection -- fatal for kernel split locks by default -- this panics\nthe machine:\n\n Oops: Split lock detected\n RIP: 0010:skb_clone+0x154/0x1e0\n Call Trace:\n \u003cIRQ\u003e\n raw_local_deliver+0x1ed/0x2c0\n ip_protocol_deliver_rcu+0x54/0x1c0\n ip_local_deliver_finish+0x85/0x100\n ip_local_deliver+0x67/0x100\n __netif_receive_skb_one_core+0x85/0xa0\n process_backlog+0x87/0x130\n\nReproduced by attaching any generic-mode XDP program to loopback and\nopening a RAW IPPROTO_UDP socket, which makes raw_local_deliver() clone\nevery locally delivered UDP packet; ordinary DNS traffic then triggers it,\nroughly once per 2500 clones. Observed on 6.12.101 and 7.1.8.\n\nTracing page_pool_alloc_frag_netmem() over one such run shows the\namplification -- two odd-sized requests, nine misaligned offsets:\n\n requested size \u0026 7: 0: 17035 5: 1 7: 1\n frag_offset \u0026 7: 0: 17028 3: 1 4: 1 5: 1 6: 1 7: 5\n\nand skb_pp_cow_data() returning heads that were aligned on entry:\n\n head 0xffff8f4c86aeac00 -\u003e 0xffff8f4c53a9a9c4 (\u00267\u003d4)\n head 0xffff8f4d6a8a42c0 -\u003e 0xffff8f4c4f7b7a45 (\u00267\u003d5)\n\nRound the fragment size up to at least the alignment struct skb_shared_info\nrequires, so fragments are always suitably aligned for the objects callers\nbuild on them. Architectures needing a larger DMA alignment keep it.\n\nThis also makes the remainder computed in page_pool_alloc_netmem(),\n\n\t*size \u003d max_size - *offset;\n\naligned, since max_size is a power of two -- which fixes the matching\nmisalignment of skb-\u003eend.\n\nVerified with a controlled A/B under QEMU/KVM: same tree, same config,\nsame compiler, same rootfs and identical traffic, differing only by this\npatch. A SEC(\"xdp.frags\") XDP_PASS program on lo plus UDP datagrams\nlarger than max_head_size drives skb_pp_cow_data()\u0027s fragment loop, which\npasses raw packet lengths to the pool. Measured at the return of\nskb_pp_cow_data():\n\n unpatched patched\n skb_pp_cow_data calls 40800 40800\n misaligned skb-\u003ehead 1120 0\n dataref at line offset \u003e60 80 0\n\nThe last row counts the accesses that actually fault:\nskb_shinfo()-\u003edataref sits at head+end+0x20 and is a 4-byte atomic, so\n`lock incl` splits a 64-byte cache line only when that address lands at\noffset 61..63. All 80 occurrences were at offset 61; the panic reported\nabove was at offset 62. Eliminating the misalignment removes every one\nof them.\n\nSame class of bug as commit 3bed3cc4156e (\"net: Do not allocate page\nfragments that are not skb aligned\"), which fixed the older\nnetdev_alloc_frag()/napi_alloc_frag() allocators.\n\nFixes: 53e0961da1c7 (\"page_pool: add frag page recycling support in page pool\")\nCc: stable@vger.kernel.org\nSigned-off-by: Florian Schauer \u003cflorian@schauer.to\u003e\nAcked-by: Jesper Dangaard Brouer \u003chawk@kernel.org\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260828060822.2628276-1-florian@schauer.to\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7b120a771943ffc3cbce787daecdd23eccb0505f", "tree": "861499100c41e04fe995c1427169a43b3f0d3a81", "parents": [ "d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Aug 25 04:10:52 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:07:33 2026 -0700" }, "message": "selftests: tc-testing: add u32 node ID pool exhaustion test\n\nAdd a tdc test case that fills the u32 node ID space with 4095\nauto-generated handles, then attempts to add a 4096th. On the fixed\nkernel the 4096th filter is rejected with ENOSPC (exit 2). On the\nunfixed kernel it silently succeeds with a duplicate handle.\n\nThe setup pipes the 4095 add commands directly into `tc -b -` inside a\nsingle bash -c (matching the existing test id 1234 pattern), avoiding\nany temp file.\n\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260825081052.133898-2-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d7e7e98d23f42a92d9ab7e36302bd96bd9b33b5f", "tree": "27ce6c49361dc93e11a27061ef0c6e1ed0cad554", "parents": [ "f05f0d85cd025aa87fede7577f69f23d2536f294" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Aug 25 04:10:51 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:07:33 2026 -0700" }, "message": "net/sched: cls_u32: fix duplicate handle when node ID pool is exhausted\n\ngen_new_kid() falls back to returning max (htid | 0xFFF) when both\nidr_alloc_u32() ranges are full, instead of reporting an error.\nu32_change() trusts that value and inserts a new knode with a handle\nthat is already live in the hash table, breaking handle uniqueness\nwithin the table\u0027s node ID space.\n\nThe handle was never reserved in ht-\u003ehandle_idr, so every later error\npath that does idr_remove(\u0026ht-\u003ehandle_idr, handle) removes the\nreservation of a different, live knode, which is then reused — one\nfailed add compounds into further duplicates.\n\nThe 4095 limit is per (table, bucket) — ht-\u003ehandle_idr is per hash\ntable and the range is derived from htid (bucketid), so a table with\ndivisor 256 can legitimately hold 256*4095 knodes.\n\nThe sibling helper gen_new_htid() has the same silent in-band failure:\nit returns 0 when the tp_c handle pool (1..0x7FF) is full, and\nu32_init() publishes the root hash table with handle 0 without\nchecking. Two root tables with handle 0 alias in u32_lookup_ht(),\nallowing cross-tcf_proto knode add/lookup/delete. Add the same\nexhaustion check that the divisor path already has.\n\nReturn an error so u32_change() fails with ENOSPC/ENOMEM when the\nnode ID space is exhausted, and so u32_init() fails with -ENOMEM\nwhen the hash table ID space is exhausted. The extack message\ndistinguishes pool exhaustion (-ENOSPC) from a transient allocation\nfailure (-ENOMEM).\n\nConditions to recreate the bug:\n- CONFIG_NET_SCHED\u003dy, CONFIG_CLS_U32\u003dy (or \u003dm with module loaded)\n- Create a clsact qdisc on a device, then add 4095 u32 filters with\n auto-generated handles to fill the node ID space for the root hash\n table (single bucket). The 4096th auto-handle filter add triggers\n the duplicate handle (fh 800::fff reused). Reachable at Level 2\n (unshare -Urn, namespace-local CAP_NET_ADMIN).\n- For gen_new_htid: create 2047 u32 proto entries on the same block\n to fill the tp_c handle pool, then create one more. The root table\n gets handle 0 and aliases with other handle-0 root tables.\n\nFixes: 7801db8aec95 (\"net_sched: avoid generating same handle for u32 filters\")\nReported-by: vega@nebusec.ai\nTested-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260825081052.133898-1-jhs@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f05f0d85cd025aa87fede7577f69f23d2536f294", "tree": "69f7f431d15a5c17299b29af846db17b2a6994ca", "parents": [ "fa5acd038ea657ad5033713d6916214cbd349151", "3cc2aa96b97184abd6fc106aac626ddf14389813" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:22 2026 -0700" }, "message": "Merge branch \u0027fix-to-possible-skb-leak-due-to-race-condtion-in-tx-path\u0027\n\nSelvamani Rajagopal says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nFix to possible skb leak due to race condtion in tx path\n\nNow the traffic is handled in threaded IRQ, and the\ndisable_traffic flag is checked before handling the\ndata, new race condition is exposed, in which\nbuffer may leak, if threaded IRQ interrupts the\ntrasmit path midway.\n\nWith this change, disable_traffic and waiting_tx_skb\npointer are protected by spin lock/unlock pair.\n\nThis is highlighted in Sashiko review\nhttps://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260611-level-trigger-v5-0-4533a9e85ce2%40onsemi.com\n\nAlso on buffer overrun condition, probably due to loss of\nSPI data chunks, receive path doesn\u0027t see the expected\ndata chunk with end_valid bit set. As a result, driver\nkeeps adding data chunks to the skb before running out\nof space and kernel panic is seen.\n\nWith this change, before adding data to the skb, if there\nis no space, skb is freed and driver starts looking for\nnew frame by looking for a data chunk with start_valid\nbit set.\n\n[ 705.405490] skbuff: skb_over_panic: text:ffffffd2eb72a264 len:1600 put:64 head:ffffff804e5cdc40 data:ffffff804e5cdc80 tail:0x680 end:0x640 dev:eth1\n[ 705.405569] ------------[ cut here ]------------\n[ 705.405575] kernel BUG at net/core/skbuff.c:214!\n[ 705.405589] Internal error: Oops - BUG: 00000000f2000800 [#1] SMP\n\n[ 6703.427690] Call trace:\n[ 705.925157] skb_panic+0x58/0x68 (P)\n[ 705.928726] skb_put+0x74/0x80\n[ 705.931772] oa_tc6_update_rx_skb+0x44/0x98 [oa_tc6_mod]\n[ 705.937084] oa_tc6_macphy_threaded_irq+0x3f4/0x900 [oa_tc6_mod]\n[ 705.943084] irq_thread_fn+0x34/0xb8\n[ 705.946654] irq_thread+0x1a0/0x300\n[ 705.950134] kthread+0x138/0x150\n[ 705.953356] ret_from_fork+0x10/0x20\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260824-fix-race-condition-and-crash-v7-0-4323279b18f2@onsemi.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3cc2aa96b97184abd6fc106aac626ddf14389813", "tree": "69f7f431d15a5c17299b29af846db17b2a6994ca", "parents": [ "349c366365876b7f67120827a0deb44899f59303" ], "author": { "name": "Selvamani Rajagopal", "email": "Selvamani.Rajagopal@onsemi.com", "time": "Mon Aug 24 14:58:01 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:21 2026 -0700" }, "message": "net: ethernet: oa_tc6: Fix for the wrong data type\n\nInadvertently bool data type is used where int is supposed to\nbe used. This might turn a negative error code into true or\nfalse and sign of the return code would be lost.\n\nFixes: 8f9bf857e43b (\"net: ethernet: oa_tc6: implement internal PHY initialization\")\nSigned-off-by: Selvamani Rajagopal \u003cSelvamani.Rajagopal@onsemi.com\u003e\nLink: https://patch.msgid.link/20260824-fix-race-condition-and-crash-v7-4-4323279b18f2@onsemi.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "349c366365876b7f67120827a0deb44899f59303", "tree": "51a53fbece514c5cd91df9096c5dbf26b705e2e1", "parents": [ "172c974113bffe5723b80b1acac17593bb50513c" ], "author": { "name": "Selvamani Rajagopal", "email": "Selvamani.Rajagopal@onsemi.com", "time": "Mon Aug 24 14:58:00 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:21 2026 -0700" }, "message": "net: ethernet: oa_tc6: Disable tx queues on fatal error\n\nPreviously, TX queue interface was stopped when\ndisable_traffic flag was set, which would indicate fatal\nerror. It is more appropriate to disable the queue as,\nunless driver is unloaded and reloaded, there is no recovery\nafter disable_traffic is set.\n\nQueues may be re-enabled inadvertently by other layers.\nIntention of disable_traffic is only to stop the traffic\nfrom flowing on fatal error.\n\nFixes: b542d13fab0f (\"net: ethernet: oa_tc6: Interrupt is active low, level triggered.\")\nSigned-off-by: Selvamani Rajagopal \u003cSelvamani.Rajagopal@onsemi.com\u003e\nLink: https://patch.msgid.link/20260824-fix-race-condition-and-crash-v7-3-4323279b18f2@onsemi.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "172c974113bffe5723b80b1acac17593bb50513c", "tree": "37c7061cf9e98ed9435212080a4649b5f7613884", "parents": [ "5443d9c4f55d46634b95432e1e8a40b824019bbb" ], "author": { "name": "Selvamani Rajagopal", "email": "Selvamani.Rajagopal@onsemi.com", "time": "Mon Aug 24 14:57:59 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:20 2026 -0700" }, "message": "net: ethernet: oa_tc6: Improve the error recovery\n\nWhen oversubscribed traffic causes lot of buffer overflow errors,\nprobably due to loss of data chunks, driver fails to find a\ndata chunk with end_valid bit set, before it runs out of sk buffer\nspace. As a result, assert is seen during skb_put.\n\nNow, check is made if skb buffer has enough tailroom for the\nincoming data before accepting. If there is no room, current\nframe is abandoned and it will start looking for a data chunk\nwith start_valid bit, that is a new frame.\n\nSK buffer allocation error is considered as recoverable error.\n\nrx_buf_overflow flag is too specific and no longer the only\ncondition this flag is used for. Therefore it is renamed as\nwait_until_start_valid. This is more appropriate as this flag\nis used to look for the next data chunk with SV bit set, after\nfailures like buffer overflow, buffer allocation failure, skb pointer\nvalidity besides buffer overflow error.\n\nNot writing to status0 if it reads 0.\n\nFixes: d70a0d8f2f2d (\"net: ethernet: oa_tc6: implement receive path to receive rx ethernet frames\")\nSigned-off-by: Selvamani Rajagopal \u003cSelvamani.Rajagopal@onsemi.com\u003e\nLink: https://patch.msgid.link/20260824-fix-race-condition-and-crash-v7-2-4323279b18f2@onsemi.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5443d9c4f55d46634b95432e1e8a40b824019bbb", "tree": "17cab2296d342a79a811da5441363ae1a765ba41", "parents": [ "fa5acd038ea657ad5033713d6916214cbd349151" ], "author": { "name": "Selvamani Rajagopal", "email": "Selvamani.Rajagopal@onsemi.com", "time": "Mon Aug 24 14:57:58 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 16:03:20 2026 -0700" }, "message": "net: ethernet: oa_tc6: Protect skb pointer used by two different kernel instances\n\nThreaded IRQ uses waiting_tx_skb. Transmit path also uses this pointer\nwithout any mutual exclusion protection. As a result, it might leak skb\nbuffer, particularly if threaded IRQ sets disable_traffic true after\nstart_xmit already checked and found that disable_traffic being false,\nif they happen to run on different cores.\n\nOn fatal error, where disable_traffic is set, transmit function drops the\npacket and return NETDEV_TX_OK. Due to this change, skb_linearize call\nis moved up to the beginning of the transmit function.\n\nSince skb buffer may be freed from different contexts, dev_kfree_skb_any\nis used to free skb buffer now, replacing one of the kfree_skb call.\n\noa_tc6_exit disables the irq before setting disable_traffic true.\n\nFixes: b542d13fab0f (\"net: ethernet: oa_tc6: Interrupt is active low, level triggered.\")\nSigned-off-by: Selvamani Rajagopal \u003cSelvamani.Rajagopal@onsemi.com\u003e\nLink: https://patch.msgid.link/20260824-fix-race-condition-and-crash-v7-1-4323279b18f2@onsemi.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fa5acd038ea657ad5033713d6916214cbd349151", "tree": "5dc490ec3c6b6ee99e812467703f17596671a85d", "parents": [ "1376afc7660bad2a1a5ee0876898312a486cf8bd" ], "author": { "name": "Bryam Vargas", "email": "hexlabsecurity@proton.me", "time": "Fri Aug 28 14:07:47 2026 -0500" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Aug 31 15:51:22 2026 -0700" }, "message": "net/iucv: fix the recvmsg window update\n\niucv_sock_recvmsg() sends the HiperSockets-only AF_IUCV_FLAG_WIN without\ntesting the transport, so on a classic z/VM socket iucv_send_ctrl() sizes\nthe skb through a NULL iucv-\u003ehs_dev. SO_MSGLIMIT accepts 1, so msglimit / 2\nis zero and one recvmsg() on its own socket is enough for an unprivileged\nprocess to take a spurious disconnect.\n\nIt also calls iucv_send_ctrl() under spin_lock_bh(\u0026message_q.lock), which\nallocates GFP_KERNEL inside a section the code treats as atomic. Sending\noutside that lock lets two recvmsg() reach afiucv_hs_send() at once, where\nmsg_recv is sampled for the advertised window and subtracted after\ndev_queue_xmit() -- and sendmsg reaches that counter under lock_sock()\nwhile recvmsg holds no socket lock, so both can subtract the same value,\nthe counter goes negative and the credit reaches the peer twice.\n\nTest the transport, claim the credit with atomic_xchg() after the last\nerror exit and hand it back if the transmit fails, and send once the lock\nis dropped.\n\nFixes: 3881ac441f64 (\"af_iucv: add HiperSockets transport\")\nFixes: 238965b71b96 (\"net/af_iucv: build proper skbs for HiperTransport\")\nCc: stable@vger.kernel.org\nTested-by: Aswin Karuvally \u003caswin@linux.ibm.com\u003e\nSigned-off-by: Bryam Vargas \u003chexlabsecurity@proton.me\u003e\nReviewed-by: Alexandra Winter \u003cwintera@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20260828-b4-disp-33fac0ed-v3-1-e6d061880ee0@proton.me\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "abdf623ddb75b24659018d3952d8f61937306ae5", "tree": "b8a9cf22a71ed06e06de944ee4f91c0ad0086259", "parents": [ "c3b510de420d70def08190083d388e0873c1aa84", "93e257938aa67a6c957217db94091d9d9e5d403f" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 14:38:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 14:38:40 2026 -0700" }, "message": "Merge tag \u0027wq-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq\n\nPull workqueue fixes from Tejun Heo:\n\n - An unbound worker pool could be freed while still reachable through\n the pending-activation list, leading to a use-after-free. Unlink\n before dropping the reference\n\n - On PREEMPT_RT, the BH workqueue kick raised softirqs from preemptible\n context, tripping a lockdep assertion and possibly losing\n concurrently raised softirq bits\n\n - Draining BH work off a dead CPU nests two pools\u0027 callback locks,\n which lockdep misreported as recursive locking. The nesting cannot\n deadlock. Annotate it\n\n - Reject watchdog thresholds that overflow the conversion to jiffies\n\n - Make the drgn workqueue dump script work again on kernels and vmcores\n from before the workqueue attrs field rename\n\n* tag \u0027wq-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/wq:\n tools/workqueue/wq_dump.py: Support backward compatibility for wq-\u003eattrs rename\n workqueue: reject watchdog thresholds that overflow jiffies\n workqueue: Fix unbound pool lifetime for pending pwqs\n workqueue: Use raise_softirq() to trigger softirq in irq_work handler\n workqueue: Annotate cb_lock nesting when draining a dead BH pool\n" }, { "commit": "c3b510de420d70def08190083d388e0873c1aa84", "tree": "1d0d579d44f65ef86cb39ff509ff3a82693ed4d4", "parents": [ "bf1079577a116f0685e7025b9ee2547345ee1c63", "3f4b7d1a49c5c826f3be9b684313eea5b83ac232" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 14:20:32 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 14:20:32 2026 -0700" }, "message": "Merge tag \u0027cgroup-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup\n\nPull cgroup fixes from Tejun Heo:\n\n - After cgroup.kill was written to a cgroup, every child cloned into it\n with CLONE_INTO_CGROUP was spuriously killed because the fork path\n snapshotted the kill counter before resolving the target cgroup\n\n - Releasing an isolated cpuset partition dropped the isolation of CPUs\n isolated on the kernel command line\n\n - Selftest and documentation fixes\n\n* tag \u0027cgroup-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/cgroup:\n selftests/cgroup: test clone3() into a previously killed cgroup\n cgroup: fix spurious SIGKILL of CLONE_INTO_CGROUP children\n selftests/cgroup: Add test for preserving boot-isolated CPUs\n cgroup/cpuset: Preserve boot-isolated CPUs on partition release\n selftests/cgroup: Drop invalid boot isolation comparison\n docs: cgroup-v2: fix misc.events key format description\n selftests/cgroup: Fix cg_run_in_subcgroups ignoring arg parameter\n selftests/cgroup: set the test plan after the setup checks\n" }, { "commit": "93e257938aa67a6c957217db94091d9d9e5d403f", "tree": "bd7bb053c63b166ce0e1ea3fd394f6b04643853a", "parents": [ "068c35b5d0546c8625b3d7c61910f73775cf1216" ], "author": { "name": "Aaron Tomlin", "email": "atomlin@atomlin.com", "time": "Mon Aug 31 14:15:53 2026 -0400" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Aug 31 10:17:08 2026 -1000" }, "message": "tools/workqueue/wq_dump.py: Support backward compatibility for wq-\u003eattrs rename\n\nCommit 464e454e1cb4 (\"workqueue: rename wq-\u003eunbound_attrs to wq-\u003eattrs\")\nrenamed wq-\u003eunbound_attrs to wq-\u003eattrs. When running wq_dump.py against\nolder running kernels or vmcores where struct workqueue_struct still\ncontains unbound_attrs, drgn raises an AttributeError.\n\nAdd a wq_attrs() helper to allow wq_dump.py to inspect both older and newer\nkernel versions seamlessly.\n\nFixes: 464e454e1cb4 (\"workqueue: rename wq-\u003eunbound_attrs to wq-\u003eattrs\")\nSigned-off-by: Aaron Tomlin \u003catomlin@atomlin.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "bf1079577a116f0685e7025b9ee2547345ee1c63", "tree": "3f1895f7119f66933ef998cad8b113e75efcc706", "parents": [ "a7f25dc23ff6d238ed70e8a3a8a3792cde3bcc68", "068e5a0bc57e57d24cbf38def29cc5fb4db9a0df" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 13:13:35 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 13:13:35 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n\n - The task ownership check in the dispatch queue move operation raced\n against the task exiting or moving to a different sub-scheduler,\n spuriously triggering scheduler aborts. Fix by moving the check under\n the queue lock\n\n - The cgroup bandwidth change callback runs in a sleepable context but\n sleepable implementations were rejected at load time. Allow them and\n add a marker so userspace can detect the capability\n\n - Sync tooling headers with the scx repo for accumulated compatibility\n improvements\n\n - Example scheduler fixes: ignored timer re-arm failures and vtime\n credit loss on cgroup migration\n\n - Documentation and comment fixes\n\n* tag \u0027sched_ext-for-7.3-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:\n sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc\n sched_ext: Fix several comment issues\n sched_ext: Check bpf_timer_start return values in scx_qmap\n sched_ext: Fix vtime delta loss in scx_flatcg cgroup migration\n sched_ext: Fix timer pinning and return value in scx_central\n docs/sched_ext: document that cgroup CPU knobs are scheduler-dependent\n sched_ext: Fix spurious aborts in scx_bpf_dsq_move() on ownership change races\n sched_ext: Sync common and compat headers from the scx repo\n sched_ext: Sync tools autogen enum headers from the scx repo\n Docs/admin-guide/cgroup-v2: document BPF scheduler callbacks for cpu.max and cpu.idle\n sched_ext: Fix nonexistent field in sched-ext.rst example\n sched_ext: Allow ops.cgroup_set_bandwidth() to be sleepable\n" }, { "commit": "77d499e61d36e883a6ad1f10afe05f556aa7e0cc", "tree": "9859df4c0872816cfff2704374576877570917be", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935" ], "author": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Fri Aug 14 16:35:18 2026 -0400" }, "committer": { "name": "Paul Moore", "email": "paul@paul-moore.com", "time": "Mon Aug 31 14:09:27 2026 -0400" }, "message": "selinux: fix BPF token permission checks\n\nAvoid multiple lookups of the bpffs creator SID using the token\u0027s file\ndescriptor when the same information can be found via the resolved\npath/dentry (in selinux_bpf_token_create()) or the token itself (in\nselinux_bpf_map_create() and selinux_bpf_prog_load()). Not only does\nthis simplify the code, it avoids potential TOCTOU issues if the user\nchanges the token file descriptor passed into the kernel.\n\nCc: stable@vger.kernel.org\nFixes: 5473a722f782 (\"selinux: add support for BPF token access control\")\nReviewed-by: Stephen Smalley \u003cstephen.smalley.work@gmail.com\u003e\nTested-by: Stephen Smalley \u003cstephen.smalley.work@gmail.com\u003e\nSigned-off-by: Paul Moore \u003cpaul@paul-moore.com\u003e\n" }, { "commit": "2deb76c21b81e42b3282224f7dd2046fe73fd1e0", "tree": "75e290badc61ce53782cd64087cf2f8d53572aa7", "parents": [ "0d77683237270702fa93489ca759c89b4e970554" ], "author": { "name": "Gongwei Li", "email": "ligongwei@kylinos.cn", "time": "Tue Aug 25 10:01:45 2026 +0800" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 14:05:27 2026 -0400" }, "message": "Bluetooth: hci_mrvl: Fix wrong return value check of wait_on_bit_timeout()\n\nwait_on_bit_timeout() returns 0 if the bit was cleared, -EINTR if the\nprocess received a signal and the mode permitted wake up on that signal,\nor -EAGAIN if the timeout elapsed. It never returns 1.\n\nHence the check \"err \u003d\u003d 1\" in mrvl_load_firmware() is dead code: when\nthe waiting task is interrupted by a signal (-EINTR), the code falls\ninto the \"else if (err)\" branch and misreports it as \"Firmware request\ntimeout\" with -ETIMEDOUT instead of propagating -EINTR.\n\nFix this by testing for -EINTR so that an interrupted firmware load is\nproperly detected and reported.\n\nFixes: 162f812f23ba (\"Bluetooth: hci_uart: Add Marvell support\")\nSigned-off-by: Gongwei Li \u003cligongwei@kylinos.cn\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "0d77683237270702fa93489ca759c89b4e970554", "tree": "b7391b40be80a82ce9f3d9124df6e0dbc62a60e6", "parents": [ "56c2b5831d39dc84aad2573dc3e197af1a872a05" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sun Aug 30 15:04:02 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:59:45 2026 -0400" }, "message": "Bluetooth: L2CAP: clear FLAG_DEFER_SETUP only for same PID/PSM\n\nl2cap_ecred_defer_connect() clears FLAG_DEFER_SETUP also for channels\nwith different PID/PSM, which will not be added to the same\nECRED_CONN_REQ in any case. Consequently, only one ECRED connection\ngroup can work at a time although it appears intended they would be\nseparate for each PID/PSM combination.\n\nFix by clearing FLAG_DEFER_SETUP only for the connections that could be\nadded in the request. Retain test_bit(FLAG_DEFER_SETUP) before calling\nget_peer_pid as it may be NULL otherwise.\n\nFixes: da49b602f7f7 (\"Bluetooth: L2CAP: Use DEFER_SETUP to group ECRED connections\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "56c2b5831d39dc84aad2573dc3e197af1a872a05", "tree": "07639278a838eb04473350bf28436c3fa128073f", "parents": [ "4ef05db5b08b176a551b4a6287372045998806b0" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sun Aug 30 15:04:01 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:57:52 2026 -0400" }, "message": "Bluetooth: L2CAP: fix out-of-bounds write in l2cap_ecred_connect\n\nl2cap_chan_connect() tries to ensure there are no more than\nL2CAP_ECRED_CONN_SCID_MAX pending ECRED channels, so they fit in the\nsame L2CAP_ECRED_CONN_REQ that l2cap_ecred_connect() constructs.\n\nHowever, the check only counts deferred channels. If 6 L2CAP sockets\nare connected at the same time in order DDDDND (D\u003ddeferred,\nN\u003dnon-deferred), the last can bump the total to max+1. It results to\none __le16 written out of bounds of the scid array, and an invalid\nECRED_CONN_REQ being sent.\n\nFix by leaving room for the non-deferred pending ECRED channels in the\ncounting in l2cap_chan_connect(), so the limit can\u0027t be exceeded.\n\nMove counting under same critical section where the channel is added.\nAlthough race conditions involving this appear unreachable, it\u0027s easier\nto see.\n\nAlso add WARN_ON_ONCE check in l2cap_ecred_defer_connect() to make this\nless brittle.\n\nFixes: da49b602f7f7 (\"Bluetooth: L2CAP: Use DEFER_SETUP to group ECRED connections\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "4ef05db5b08b176a551b4a6287372045998806b0", "tree": "6c4439d11f44d53bf2f84486183ba8cfb223fb4d", "parents": [ "57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18" ], "author": { "name": "Pauli Virtanen", "email": "pav@iki.fi", "time": "Sun Aug 30 20:11:36 2026 +0300" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:53:32 2026 -0400" }, "message": "Bluetooth: L2CAP: fix chan mode for LE_CONN_REQ + EXT_FLOWCTL pchan\n\nl2cap_new_connection() sets default value of channel mode to match the\nparent channel. l2cap_le_connect_req() left this at the default, and\ncreated L2CAP_MODE_EXT_FLOWCTL channels if listening pchan has that\nmode. This causes FLAG_DEFER_SETUP channels to reply to\nL2CAP_LE_CONN_REQ with L2CAP_ECRED_CONN_RSP, which is incorrect.\n\nIt can also result to stack OOB write (of l2cap_alloc_cid determined\nvalues) in l2cap_ecred_rsp_defer(), as l2cap_le_connect_req() does not\nlimit maximum number of deferred channels or check for duplicate ident.\n\nFix by setting chan-\u003emode correctly in l2cap_le_connect_req().\n\nAlso check channel mode in l2cap_ecred_rsp_defer(), and do WARN_ON_ONCE\ninstead of OOB write to make it less brittle.\n\nFixes: 15f02b910562 (\"Bluetooth: L2CAP: Add initial code for Enhanced Credit Based Mode\")\nSigned-off-by: Pauli Virtanen \u003cpav@iki.fi\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "57938bbdb9bf7fd41cbd5cd509ec10c4b22bec18", "tree": "71641bb441c983a62c4d59c7e414ff94347858b3", "parents": [ "3a74624b5deae7f5e2b98e638687fbf9594a9781" ], "author": { "name": "Aleksandr Nogikh", "email": "nogikh@google.com", "time": "Fri Aug 28 08:55:09 2026 +0000" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:52:54 2026 -0400" }, "message": "Bluetooth: hci_core: Fix race condition during device registration\n\nIn hci_register_dev(), the power_on work item is queued to\nhdev-\u003ereq_workqueue before initializing hdev-\u003eadv_monitors_idr and\nregistering the MSFT extension via msft_register(). For devices marked with\nquirks such as HCI_QUIRK_RAW_DEVICE, the HCI_UNCONFIGURED flag is set on\nthe device. When the power_on work item runs concurrently on another CPU,\nhci_power_on() detects that the device is unconfigured and immediately\ninvokes hci_dev_do_close(), which calls msft_do_close().\n\nConcurrently, msft_register() allocates the msft structure and exposes it\nto hdev-\u003emsft_data prior to calling mutex_init(\u0026msft-\u003efilter_lock). If\nmsft_do_close() executes while hdev-\u003emsft_data is already assigned but the\nmutex has not yet been initialized, mutex_lock(\u0026msft-\u003efilter_lock) operates\non an uninitialized mutex, triggering a DEBUG_LOCKS warning:\n\nDEBUG_LOCKS_WARN_ON(lock-\u003emagic !\u003d lock)\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock_common\nkernel/locking/mutex.c:625 [inline]\nWARNING: kernel/locking/mutex.c:625 at __mutex_lock+0x12d8/0x1550\nkernel/locking/mutex.c:821\n...\nCall Trace:\n \u003cTASK\u003e\n msft_do_close+0x308/0x7b0 net/bluetooth/msft.c:693\n hci_dev_close_sync+0x86b/0x10a0 net/bluetooth/hci_sync.c:5522\n hci_dev_do_close net/bluetooth/hci_core.c:499 [inline]\n hci_power_on+0x32c/0x750 net/bluetooth/hci_core.c:937\n process_one_work kernel/workqueue.c:3322 [inline]\n process_scheduled_works+0xa8e/0x14e0 kernel/workqueue.c:3405\n worker_thread+0x92d/0xe10 kernel/workqueue.c:3486\n kthread+0x388/0x470 kernel/kthread.c:436\n ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n \u003c/TASK\u003e\n\nFix this by moving the queue_work() call in hci_register_dev() to after\nidr_init(\u0026hdev-\u003eadv_monitors_idr) and msft_register(hdev) so that device\nstructures and extensions are fully initialized before asynchronous tasks\ncan access them. Additionally, assign hdev-\u003emsft_data in msft_register()\nonly after mutex_init(\u0026msft-\u003efilter_lock) has completed.\n\nFixes: 9e14606d8f38 (\"Bluetooth: msft: Extended monitor tracking by address filter\")\nAssisted-by: Gemini:gemini-3.7-flash Gemini:gemini-3.1-pro-preview syzbot\nReported-by: syzbot+14ce1b05b7d5a989abbe@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d14ce1b05b7d5a989abbe\nLink: https://syzkaller.appspot.com/ai_job?id\u003d2bc9e8aa-ca6d-43e2-be2c-fd5d9f649d7e\nSigned-off-by: Aleksandr Nogikh \u003cnogikh@google.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "a7f25dc23ff6d238ed70e8a3a8a3792cde3bcc68", "tree": "6ccd3c24672cd33db3585ee2c1b20a3df4ccf244", "parents": [ "cee9395acd8043be0644b25c34bfa86623f2b935", "412f89fb3988a344175899776c8bc7073524ad84" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 10:45:40 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Mon Aug 31 10:45:40 2026 -0700" }, "message": "Merge tag \u0027xfs-fixes-7.3-rc2\u0027 of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux\n\nPull xfs fixes from Carlos Maiolino:\n \"This contains a few fixes for the zoned storage support, a possible\n deadlock vector fix, some code refactoring patches and a quota evasion\n fix on XFS while exporting it via NFS.\n\n Please note that for the quota evasion fix, a couple patches for the\n capability subsystem are included in the pull request. Those have been\n ack\u0027ed by the respective maintainer which also agreed to have them\n going through the xfs tree.\n\n This also includes a patch for the quota subsystem to stop issuing\n audit messages during quota enforcing. Quota maintainer also ack\u0027ed\n and agreed with this going through xfs tree\"\n\n* tag \u0027xfs-fixes-7.3-rc2\u0027 of gitolite.kernel.org:/pub/scm/fs/xfs/xfs-linux:\n capability: unexport has_capability_noaudit\n xfs: replace ns_capable_noaudit\n quota: Don\u0027t issue audit messages on quota enforcing\n capability: Add new capable_noaudit\n xfs: fix capability check in xfs\n xfs: restore bi_bdev in xfs_zone_gc_write_chunk\n xfs: split ioend handling into a separate source file\n xfs: factor out a xfs_iomap_set_anon_write helper\n xfs: fix zoned write iomap flags assignments\n xfs: fix racy open zone caching\n xfs: handle NULL open_zone for merged ioends in xfs_ioend_put_open_zones\n xfs: use inode_init_always_gfp with __GFP_NOFAIL in xfs_inode_alloc\n xfs: remove kmem_to_page()\n xfs: don\u0027t flush and invalidate internal RT device twice in xfs_shutdown_devices\n xfs: split an assert in xfs_trans_log_buf\n xfs: don\u0027t hold buffer locks across sync transaction commit in xfs_sync_sb_buf\n" }, { "commit": "3a74624b5deae7f5e2b98e638687fbf9594a9781", "tree": "74e7eb3cea0f7f316533f75ecf2d59d10be269b3", "parents": [ "ac8aa9e0ec93a12a60230066f199f49c3b9aac3d" ], "author": { "name": "Laxman Acharya Padhya", "email": "acharyalaxman8848@gmail.com", "time": "Mon Aug 31 15:44:23 2026 +0545" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:40:59 2026 -0400" }, "message": "Bluetooth: btintel: propagate version TLV parsing errors\n\nbtintel_read_version_tlv() ignores the parser return value, so setup\ncontinues with partially initialized version data after a malformed TLV\ncauses parsing to stop.\n\nReturn the parser error to the caller so an invalid response fails setup\ninstead of being treated as successful. Keep this behavioral change\nseparate from the bounds checks so it can be reverted independently if\nan existing controller sends malformed data.\n\nSigned-off-by: Laxman Acharya Padhya \u003cacharyalaxman8848@gmail.com\u003e\nReviewed-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nTested-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "ac8aa9e0ec93a12a60230066f199f49c3b9aac3d", "tree": "3595cad3fe572d6e2f7cfe5e995a4d58a8cc2cfd", "parents": [ "a086c0892969bf8a0151b0f12bd14a68827c88b2" ], "author": { "name": "Laxman Acharya Padhya", "email": "acharyalaxman8848@gmail.com", "time": "Mon Aug 31 15:44:22 2026 +0545" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:39:11 2026 -0400" }, "message": "Bluetooth: btintel: bound firmware ID by TLV length\n\nThe firmware ID is treated as a NUL-terminated string even though the\nTLV length is its only boundary. If the value does not contain a NUL\nterminator, snprintf() can read beyond the received response.\n\nLimit the conversion to the advertised TLV value length.\n\nFixes: 164c62f958f8 (\"Bluetooth: btintel: Add firmware ID to firmware name\")\nReviewed-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nSigned-off-by: Laxman Acharya Padhya \u003cacharyalaxman8848@gmail.com\u003e\nTested-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "a086c0892969bf8a0151b0f12bd14a68827c88b2", "tree": "cfaaa3672926761076e972d4055605ba9d4ad018", "parents": [ "ea2ee8b222306208d2b094d1a11894da6c106d42" ], "author": { "name": "Laxman Acharya Padhya", "email": "acharyalaxman8848@gmail.com", "time": "Mon Aug 31 15:44:21 2026 +0545" }, "committer": { "name": "Luiz Augusto von Dentz", "email": "luiz.von.dentz@intel.com", "time": "Mon Aug 31 13:35:26 2026 -0400" }, "message": "Bluetooth: btintel: validate version TLV value lengths\n\nbtintel_parse_version_tlv() verifies that a complete TLV is present in\nthe response, but it does not ensure that the value is long enough for\nthe specific TLV type. A short value can therefore cause an\nout-of-bounds read through get_unaligned_le16(), get_unaligned_le32(),\nor memcpy().\n\nReject values shorter than the minimum required by each known TLV type.\nAlso reject responses that do not contain the Command Complete Status\nfield.\n\nFixes: 57375beef71a (\"Bluetooth: btintel: Add infrastructure to read controller information\")\nReviewed-by: Ali Ahmet Memis \u003cali@iusegentoo.com\u003e\nSigned-off-by: Laxman Acharya Padhya \u003cacharyalaxman8848@gmail.com\u003e\nTested-by: Kiran K \u003ckiran.k@intel.com\u003e\nSigned-off-by: Luiz Augusto von Dentz \u003cluiz.von.dentz@intel.com\u003e\n" }, { "commit": "068c35b5d0546c8625b3d7c61910f73775cf1216", "tree": "68550bc15545b7ab677c676ef280300a55f4eef0", "parents": [ "cf9c8aaea0d47410df8708bec195889f3a85cd3c" ], "author": { "name": "Jiacheng Xu", "email": "stitch@zju.edu.cn", "time": "Tue Aug 25 15:03:15 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Aug 31 07:31:46 2026 -1000" }, "message": "workqueue: reject watchdog thresholds that overflow jiffies\n\nThe watchdog threshold is supplied in seconds but is multiplied by HZ\nbefore being used as a jiffies interval. Reject values that exceed\nMAX_JIFFY_OFFSET / HZ so the multiplication cannot wrap and the\ntime_after() comparisons remain within their supported range.\n\nThe check is performed before changing the threshold or watchdog timer.\nZero remains the value used to disable the watchdog.\n\nFixes: 82607adcf9cdf (\"workqueue: implement lockup detector\")\nSigned-off-by: Jiacheng Xu \u003cstitch@zju.edu.cn\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "068e5a0bc57e57d24cbf38def29cc5fb4db9a0df", "tree": "3e47ef9448d7370fe2220691efb9e0ff6dce2c93", "parents": [ "4881a13521886076e8d6d677f274320dcf66fea4" ], "author": { "name": "Liang Luo", "email": "luoliang@kylinos.cn", "time": "Tue Aug 25 13:50:53 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Mon Aug 31 07:28:04 2026 -1000" }, "message": "sched_ext: Fix missing @slice and @vtime descriptions in finish_dispatch() kernel-doc\n\nCommit 13f1eae3b662 (\"sched_ext: Synchronize slice and dsq_vtime\nwrites\") added the slice and vtime parameters to finish_dispatch() but\ndid not update its kernel-doc, which produces warnings:\n\n Warning: function parameter \u0027slice\u0027 not described in \u0027finish_dispatch\u0027\n Warning: function parameter \u0027vtime\u0027 not described in \u0027finish_dispatch\u0027\n\nDescribe both parameters using the same wording as\ndispatch_to_local_dsq(), which receives the same values.\n\nSigned-off-by: Liang Luo \u003cluoliang@kylinos.cn\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" } ], "next": "ea2ee8b222306208d2b094d1a11894da6c106d42" }