)]}' { "log": [ { "commit": "b515dc54795ef370be3cb396e7c12ad91686b6d1", "tree": "63bdb841080d030c74616a54317e187dbd910605", "parents": [ "af2e7bf9832f6f2b6abf60588a0af02f0e135438" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Fri Jul 24 09:25:00 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 15:58:05 2026 +0200" }, "message": "net: ip6_tunnel: use tunnel parameters for fill_forward_path route lookup\n\nReuse the flowi6 template t-\u003efl.u.ip6 built by ip6_tnl_link_config() in\nip6_tnl_fill_forward_path(), aligning the fast-path route lookup with\nthe slow path in ipxip6_tnl_xmit(). This automatically inherits the\ncorrect conditional FLOWLABEL masking based on the\nIP6_TNL_F_USE_ORIG_FLOWLABEL flag.\n\nReturn -EOPNOTSUPP when IP6_TNL_F_USE_ORIG_TCLASS,\nIP6_TNL_F_USE_ORIG_FLOWLABEL or IP6_TNL_F_USE_ORIG_FWMARK is set,\nor for collect_md tunnels, since fill_forward_path has no access to\nthe original skb and cannot recover the per-packet traffic class,\nflowlabel, mark or tunnel destination needed for the route lookup.\n\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260724-ip6ip6-route-lookup-fill_forward_path-v3-1-7b7991538614@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "af2e7bf9832f6f2b6abf60588a0af02f0e135438", "tree": "a3a9c71cd5bc9848f2cde7d7c6864313df7ecbed", "parents": [ "72207e1b15d4b9d28a3cbf1ed8f6dcb43bcf2617", "871657dc6996ec7e6b90a87369d52a4a59f22753" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 15:35:14 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 15:35:14 2026 +0200" }, "message": "Merge branch \u0027xdp-metadata-support-for-dq-rda\u0027\n\nJoshua Washington says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nXDP metadata support for DQ RDA\n\nThis small series enables XDP metadata support in DQ RDA mode. While\nspace is reserved in the headroom for metadata and the DQ queue format\nsupports the xmo_rx_timestamp metadata operation, support for adjusting\nthe metadata and passing metadata along to SKBs was not actually\nimplemented.\n\nv2: https://lore.kernel.org/netdev/20260318192450.3400774-1-joshwash@google.com/\nv1: https://lore.kernel.org/netdev/20260316230434.1398828-1-joshwash@google.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722221634.186886-1-joshwash@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "871657dc6996ec7e6b90a87369d52a4a59f22753", "tree": "a3a9c71cd5bc9848f2cde7d7c6864313df7ecbed", "parents": [ "11492872341100afefc2b923b4012743c78f5284" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Wed Jul 22 15:16:34 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 15:35:13 2026 +0200" }, "message": "gve: add XDP metadata support for DQ RDA\n\nCommit 1b42e07af1ee (\"gve: Add Rx HWTS metadata to AF_XDP ZC mode\")\nexposes support for the XDP RX timestamping metadata operation in the DQ\nRDA mode. While the operation works on its own, the intent was to enable\nXDP metadata support for the queue format as a whole along with it.\nCurrently bpf_xdp_adjust_meta fails because meta_valid is set to false.\nThis change updates xdp_buff preparation to set meta_valid to true, so\nmetadata can be fully used by XDP programs.\n\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nLink: https://patch.msgid.link/20260722221634.186886-3-joshwash@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "11492872341100afefc2b923b4012743c78f5284", "tree": "cc352cd71744d42905b466d6593d5f8e9d918471", "parents": [ "72207e1b15d4b9d28a3cbf1ed8f6dcb43bcf2617" ], "author": { "name": "Joshua Washington", "email": "joshwash@google.com", "time": "Wed Jul 22 15:16:33 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 15:35:13 2026 +0200" }, "message": "gve: use xdp_build_skb methods for XDP_PASS case\n\nNewer common methods have been introduced to construct SKBs in the\nevent of XDP_PASS because many drivers replicated very similar\nfunctionality. Update GVE to use these common methods for copy mode and\nzero-copy mode.\n\nReviewed-by: Harshitha Ramamurthy \u003chramamurthy@google.com\u003e\nReviewed-by: Jordan Rhee \u003cjordanrhee@google.com\u003e\nSigned-off-by: Joshua Washington \u003cjoshwash@google.com\u003e\nReviewed-by: Larysa Zaremba \u003clarysa.zaremba@intel.com\u003e\nLink: https://patch.msgid.link/20260722221634.186886-2-joshwash@google.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "72207e1b15d4b9d28a3cbf1ed8f6dcb43bcf2617", "tree": "bfbbf25bdc3afa0c3af7d5b0797b53d710000e3a", "parents": [ "a50eba1e778ad4da5b6f9ddbbf57dabbea59bc05" ], "author": { "name": "Hariprasad Kelam", "email": "hkelam@marvell.com", "time": "Tue Jul 21 12:33:03 2026 +0530" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Jul 28 10:53:35 2026 +0200" }, "message": "octeontx2-af: npc: Warn on NPC_IPSEC_SPI key overlap\n\nWhen scanning the MKEX profile to determine supported NPC features, warn\nif the SPI extraction field overlaps with other key fields. AH and ESP\nmay legitimately use the same key offset for SPI, so continue to\nadvertise NPC_IPSEC_SPI via npc_is_field_present() instead of treating\nthe overlap as a hard failure.\n\nSigned-off-by: Hariprasad Kelam \u003chkelam@marvell.com\u003e\nSigned-off-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20260721070303.986740-1-rkannoth@marvell.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a50eba1e778ad4da5b6f9ddbbf57dabbea59bc05", "tree": "ae5c891ac5ad637d4c2e4d0f89e148d88292362b", "parents": [ "0b7763e3a0ec1cb4b9fd749e29377083ba93d392" ], "author": { "name": "Paulo Alcantara", "email": "pc@manguebit.org", "time": "Wed Jul 22 18:28:37 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:25:36 2026 -0700" }, "message": "net: dns_resolver: allow shorter names in dns_query()\n\nCustomer reported a problem with mounting CIFS shares where the server\nhostname was 2 chars long. Turned out that the CIFS client wasn\u0027t\nable to resolve NetBIOS names shorter than 3 chars.\n\nFix this by allowing a minimum of one character per hostname in\ndns_query().\n\nReproducer with samba server:\n\n # \u0027ab\u0027 and \u0027srv\u0027 hotnames resolve to same ip address\n $ ssh srv ln -s \u0027msdfs:\\\\ab\\\\share\u0027 /home/shares/dfs/link1\n $ mount.cifs //srv/dfs/link1 /mnt -o ... [EINVAL]\n\nReported-by: Pierguido Lambri \u003cplambri@redhat.com\u003e\nSigned-off-by: Paulo Alcantara \u003cpc@manguebit.org\u003e\nAcked-by: David Howells \u003cdhowells@redhat.com\u003e\nAcked-by: Frank Sorenson \u003csorenson@redhat.com\u003e\nLink: https://patch.msgid.link/20260722-net-dns_resolver-v1-1-c3385898ccf9@manguebit.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0b7763e3a0ec1cb4b9fd749e29377083ba93d392", "tree": "481fa72a72485d10022493a30dd0468c7d1b01e2", "parents": [ "defbb6534ff3a3b91607a842afc72edc1000d447" ], "author": { "name": "Yael Chemla", "email": "ychemla@nvidia.com", "time": "Thu Jul 23 10:04:27 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:22:18 2026 -0700" }, "message": "net/mlx5: E-Switch, defer fwd2vport egress ACL allocation\n\nOn every VF/SF vport enable, esw_acl_egress_ofld_setup() allocates an\negress ACL flow table and a fwd_grp whenever the device supports\negress_acl_forward_to_vport. The only consumer of that group is the\nactive/passive fwd2vport rule installed when two representor netdevs\nare bonded - a path that almost never fires. As a result, hosts with\nmany VFs/SFs pay a per-vport flow table and flow group cost for a\nfeature most ports never use.\n\nDefer the flow table and fwd_grp creation to the moment they are\nactually needed, when mlx5e_rep_esw_bond_netevent() drives\nmlx5_esw_acl_egress_vport_bond() for the passive vport:\n\n- esw_acl_egress_ofld_setup() now returns early unless\n prio_tag_required is set. When prio_tag_required is set the\n flow table is still allocated eagerly for the VLAN pop rule, and\n its size is grown by one when fwd2vport is supported so the lazy\n fwd_grp can later be added without re-creating the table. Only\n the VLAN group is built up-front.\n\n- A new helper, esw_acl_egress_ofld_fwd2vport_setup(), allocates\n the egress ACL flow table (size 1) and the fwd_grp on demand,\n and rolls back the flow table if group creation fails and the\n helper had just allocated it. Existing cleanup paths\n (esw_acl_egress_ofld_cleanup() -\u003e *_groups_destroy() /\n *_table_destroy()) already tolerate NULL fields, so vport\n disable continues to free everything that was actually\n allocated.\n\n- mlx5_esw_acl_egress_vport_bond() calls the helper for the\n passive vport before installing the fwd2vport rule. The active\n vport does not need the flow table on its own: with a NULL\n fwd_dest, esw_acl_egress_ofld_rules_create() is a no-op unless\n prio_tag_required is set, in which case the eager path already\n built the table.\n\nmlx5_esw_acl_egress_vport_bond() and mlx5_esw_acl_egress_vport_unbond()\nnow take esw-\u003estate_lock for the duration of the operation, because\nthey may mutate vport-\u003eegress.acl, which is also written by the vport\nenable/disable path under the same lock.\n\nSigned-off-by: Yael Chemla \u003cychemla@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260723070427.1861502-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "defbb6534ff3a3b91607a842afc72edc1000d447", "tree": "275485b10a93b13a9a95ece12c066e32904ba2c6", "parents": [ "e4213520e9769ae8fc2814e778617b49d1ac0c7f" ], "author": { "name": "Dragos Tatulea", "email": "dtatulea@nvidia.com", "time": "Thu Jul 23 10:28:29 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:20:55 2026 -0700" }, "message": "net/mlx5e: SHAMPO, Remove dead CWR handling in GRO header update\n\nmlx5e_shampo_update_ipv{4,6}_tcp_hdr() runs only from the\ngro_count \u003e 1 path in mlx5e_shampo_flush_skb(). HW-GRO flushes the\ncurrent session on a CWR packet and delivers it as a single-segment\nskb via napi_gro_receive(), so the aggregated (gro_count \u003e 1) skb\nnever carries a CWR-set TCP header.\n\nThis patch drops the unreachable branch. Discussion context:\nhttps://lore.kernel.org/all/8b610e49-ff64-497e-8712-588b2228df02@nvidia.com/\n\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Dragos Tatulea \u003cdtatulea@nvidia.com\u003e\nCc: Chia-Yu Chang \u003cchia-yu.chang@nokia-bell-labs.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260723072829.1864366-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e4213520e9769ae8fc2814e778617b49d1ac0c7f", "tree": "27c5113aeb7cad986c405052154222595431fd54", "parents": [ "41ff498d3392113f7aa2bff5762dc7c772b5eca7" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Thu Jul 23 11:17:43 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:20:33 2026 -0700" }, "message": "net/mlx5e: Remove _once from PCI heuristic debug print\n\nThe _once rate-limiting in slow_pci_heuristic() is unnecessary because\nthis function only runs during probe.\n\nWorse, it interacts poorly with dynamic debug: if the first probe\nhappens before dynamic debug is enabled for this callsite, the _once\nflag is permanently consumed and the message becomes unreachable without\nreloading the module.\nAdditionally, only the first probed device values were printable in case\nof multiple devices.\n\nReplace with mlx5_core_dbg() which allows enabling the print via dynamic\ndebug at any time and observing it on the next probe.\n\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nReviewed-by: Alex Lazar \u003calazar@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260723081743.1868357-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "41ff498d3392113f7aa2bff5762dc7c772b5eca7", "tree": "c16aacb14cba5531383fd9b5d61f5e42878eba46", "parents": [ "8fe79aa2f1d616b6adfc14d1bcf3db5df5ba0344" ], "author": { "name": "Tariq Toukan", "email": "tariqt@nvidia.com", "time": "Thu Jul 23 12:44:52 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:19:30 2026 -0700" }, "message": "net/mlx5e: Fix indentation in mlx5e_free_mpwqe_rq_drop_page()\n\nRemove a stray leading space before __free_pages() call.\n\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202607142323.qm25Crps-lkp@intel.com/\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nLink: https://patch.msgid.link/20260723094452.1888786-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8fe79aa2f1d616b6adfc14d1bcf3db5df5ba0344", "tree": "3f25a6bc06a01087ba673aae0376df45f869a0a3", "parents": [ "fdd9ed67e5ca5c52d2a85c3cd96115ee42098a14" ], "author": { "name": "Alice Mikityanska", "email": "alice@isovalent.com", "time": "Thu Jul 23 17:02:41 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:04:44 2026 -0700" }, "message": "selftests: net: Add a missing config option\n\nCommit 5cb53743e1ff (\"selftests: net: Add a test for BIG TCP in UDP\ntunnels\") used iptables match comment, which was missed from the CI\nkernel config. Add the missing config option.\n\nSigned-off-by: Alice Mikityanska \u003calice@isovalent.com\u003e\nReviewed-by: Matthieu Baerts \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260723140241.132120-1-alice.kernel@fastmail.im\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fdd9ed67e5ca5c52d2a85c3cd96115ee42098a14", "tree": "ab6895829b3dcf8a4005e0d76fae34e6adc38fe4", "parents": [ "e019f2198db810b93140458fc9b162722f80c689", "c82ff94592fb68f529afe63ca7f5ddb7dae4ba83" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:03:27 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:03:27 2026 -0700" }, "message": "Merge branch \u0027docs-netdev-a-couple-of-updates\u0027\n\nPaolo Abeni says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndocs: netdev: a couple of updates\n\nExplicitly covers a couple of relevant spots currently left out in the\ndark. Likely the first one was too obvious to ever spell out loud and\nthe latter too new.\n\nBoth cases are increasingly relevant, at least to me.\n\nKeep the update in the netdev subsystem, as others may have slightly\ndifferent preferences.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1784884817.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c82ff94592fb68f529afe63ca7f5ddb7dae4ba83", "tree": "ab6895829b3dcf8a4005e0d76fae34e6adc38fe4", "parents": [ "7d394ab234f744404f340638b02e9883c2d8be77" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 24 11:24:05 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:03:26 2026 -0700" }, "message": "docs: netdev: clarify expected interactions with LLMs\n\nThe official documentation has not captured yet the current impact of\nAI-generated reviews on the patch process.\n\nExplicitly state the status quo and expectations.\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/83360de7addb13a3b5f4d5e722148f248fdb2ae0.1784884817.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7d394ab234f744404f340638b02e9883c2d8be77", "tree": "0f0ff85212855addea8be320343e24fe442cd8d2", "parents": [ "e019f2198db810b93140458fc9b162722f80c689" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Fri Jul 24 11:24:04 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:03:25 2026 -0700" }, "message": "docs: netdev: clarify handling of idle patches\n\nOff-list pings are very bad, but unfortunately too common. Explicitly\nstate that, so that at least LLMs could learn it.\n\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReviewed-by: Nicolai Buchwitz \u003cnb@tipi-net.de\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/38b75373f813354ad0ee8bfde12ae5a42e9a11b6.1784884817.git.pabeni@redhat.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e019f2198db810b93140458fc9b162722f80c689", "tree": "bb76aa02680485c0af1cc0ccc7516391bfd45031", "parents": [ "d5990d2a8689ab35c36aa500bac33226f7a86f00", "cca2780b61947fd27ec621541edd0902e193a609" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:00:07 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 18:00:07 2026 -0700" }, "message": "Merge tag \u0027nf-next-26-07-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter/IPVS updates for net-next\n\nThe following patchset contains Netfilter/IPVS updates for net-next,\njust a small batch with accumulated pending updates:\n\n1) In IPVS, use system_dfl_long_wq instead of system_long_wq, from\n Ismael Luceno.\n\n2) Add missing .checkentry in xt_tcpmss for IPv6, this is a follow up\n to a recent harderning, from Florian Westphal.\n\n3) Address a sashiko report in the NAT SIP helper, from Florian Westphal.\n\n4) Tear down flow entries with stale routes using the GC, this is to\n detect route updates when hardware offload is enabled.\n\n5) Pass master conntrack as parameter to functions instead of using\n exp-\u003emaster as preparation work to turn exp-\u003emaster into a cookie.\n\n6) Move expectation event_mask to the nf_conntrack_expect object,\n again as preparation work to turn exp-\u003emaster into a cookie.\n\n7) In IPVS, use kzalloc_obj{s}() typesafe allocations, from Subasri S.\n\n* tag \u0027nf-next-26-07-24\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:\n ipvs: use type-safe allocation helpers in ip_vs_rht_alloc\n netfilter: nf_conntrack_expect: store event cache in expectation\n netfilter: conntrack_helper: pass master conntrack to helper functions\n netfilter: flowtable: tear down flow entries with stale dst from GC\n netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n netfilter: xt_tcpmss: extend checkentry to ipv6\n ipvs: Move defense_work and est_reload_work to system_dfl_long_wq\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260724104932.437729-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d5990d2a8689ab35c36aa500bac33226f7a86f00", "tree": "89cb4eeea61971a139487fd120655d560e973011", "parents": [ "6a11e8106259d5f2cc1ba9f07c46bca9f9fea111", "6d548d0fc16058d3c24b9125f43b56cf5369b0d6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:47 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:47 2026 -0700" }, "message": "Merge branch \u0027net-hsr-prp-redbox-prp-san-support\u0027\n\nXin Xie says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: hsr: PRP RedBox (PRP-SAN) support\n\nThis series adds PRP RedBox support to the hsr driver: a PRP node that\nproxies one or more SANs sitting behind an interlink port (IEC 62439-3,\nPRP-SAN). HSR-SAN has been supported since commit 5055cccfc2d1 (\"net: hsr:\nProvide RedBox support (HSR-SAN)\"); this extends the equivalent capability\nto PRP, reusing the existing protocol-neutral proxy machinery\n(proxy_node_db, hsr_proxy_announce(), hsr_prune_proxy_nodes()).\n\nA SAN behind the interlink does bidirectional unicast with peers on the PRP\nnetwork, its source MAC is preserved on the wire, the PRP RCT is correct,\nand the RedBox announces each proxied SAN with the RedBox-MAC TLV (Type 30)\nin its supervision frames.\n\nThe series is bisect-safe: the datapath, duplicate discard and supervision\nsupport are added first; the rtnetlink rejection of \"type hsr ... interlink\n\u003cdev\u003e proto 1\" is removed only in patch 3, once the feature is complete.\n\nDesign notes:\n\n - prp_drop_frame() does not walk the node tables. The destination\n classification (PRP-network node vs proxied SAN) is resolved once per\n frame in fill_frame_info() and cached in struct hsr_frame_info, so the\n per egress-port drop decision is O(1) in the softIRQ path. The\n classification is gated on PRP RedBox devices (prot_version \u003d\u003d PRP_V1 \u0026\u0026\n hsr-\u003eredbox), so HSR RedBox traffic is not affected.\n\n - The LAN A/B duplicate test is factored into prp_is_lan_dup() so the new\n PRP interlink rules in prp_drop_frame() do not change hsr_drop_frame()\n behaviour, including the NETIF_F_HW_HSR_FWD path. This is software PRP\n RedBox only; it adds no new hardware-offload contract.\n\n - The supervision emitter uses pre-reserved tailroom (hsr_init_skb() +\n skb_put()) on the existing GFP_ATOMIC path; no skb_linearize() or\n pskb_expand_head(). The RedBox-MAC TLV is followed by an explicit EOT\n (Type 0, Length 0); padding via skb_put_padto(ETH_ZLEN) and the 6-byte\n PRP RCT remain at the absolute tail of the egress frame.\n\n - The hsr_get_node() hsr_ethhdr length guard is relaxed only for PRP\n supervision frames (prot_version \u003d\u003d PRP_V1 \u0026\u0026 ETH_P_PRP \u0026\u0026 is_sup), which\n are untagged with mac_len \u003d\u003d ETH_HLEN. HSR (ETH_P_HSR) supervision is\n front-tagged and keeps the original length requirement, so HSR\n malformed-frame filtering is unchanged.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260717201457.54-1-xiexinet@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6d548d0fc16058d3c24b9125f43b56cf5369b0d6", "tree": "89cb4eeea61971a139487fd120655d560e973011", "parents": [ "85abc2db7ba3b5dfd35a037ef3d6135a99b00508" ], "author": { "name": "Xin Xie", "email": "xiexinet@gmail.com", "time": "Fri Jul 17 22:14:57 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:41 2026 -0700" }, "message": "selftests: net: hsr: add PRP RedBox test\n\nAdd a kselftest that builds a PRP RedBox (interlink) with a SAN behind the\ninterlink and a peer DANP, and checks bidirectional unicast across the\ninterlink, preservation of the SAN source MAC on the PRP network, and that\nthe proxy-announce supervision frame carries the RedBox-MAC TLV (Type 30)\nterminated by an EOT marker. It reuses the hsr_common.sh / lib.sh helpers\nand skips cleanly on a kernel or iproute2 without PRP interlink support.\n\nThe background ping is killed by its exact PID: ip netns exec does not\nisolate the PID namespace, so a pattern-based pkill could hit unrelated\nprocesses on the host.\n\nSigned-off-by: Xin Xie \u003cxiexinet@gmail.com\u003e\nLink: https://patch.msgid.link/20260717201457.54-5-xiexinet@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "85abc2db7ba3b5dfd35a037ef3d6135a99b00508", "tree": "f0b5e257a1c587499cf92b6dc8c70fd1e2c464c7", "parents": [ "852c6a8d7cbe359fff3ee439f4b908231253dc3d" ], "author": { "name": "Xin Xie", "email": "xiexinet@gmail.com", "time": "Fri Jul 17 22:14:56 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:41 2026 -0700" }, "message": "net: hsr: allow PRP RedBox (interlink) creation\n\nWith the PRP interlink datapath, duplicate discard and supervision support\nin place, a PRP device can act as a RedBox. Remove the rtnetlink rejection\nof \"type hsr ... interlink \u003cdev\u003e proto 1\"; the feature is implemented\nunconditionally by the preceding patches.\n\nSigned-off-by: Xin Xie \u003cxiexinet@gmail.com\u003e\nLink: https://patch.msgid.link/20260717201457.54-4-xiexinet@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "852c6a8d7cbe359fff3ee439f4b908231253dc3d", "tree": "06b5a6480b9854751e916d8d0eae392b93a0cbdb", "parents": [ "841afc9143ee340818a4a9cf191f4e894a43c750" ], "author": { "name": "Xin Xie", "email": "xiexinet@gmail.com", "time": "Fri Jul 17 22:14:55 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:40 2026 -0700" }, "message": "net: hsr: emit RedBox-MAC TLV in PRP RedBox supervision frames\n\nA PRP RedBox must announce the SANs it proxies so peers populate their\nproxy node tables. The proxy-announce machinery (hsr_proxy_announce(),\narmed via hsr-\u003eredbox) already iterates proxy_node_db under RCU and calls\nsend_sv_frame() once per SAN, but the PRP sender emitted neither the\nannounced SAN MAC nor the RedBox-MAC TLV that IEC 62439-3 requires.\n\nExtend send_prp_supervision_frame() so that, for a proxy-announce\n(identified by the interlink port, an O(1) test), the frame carries the\nproxied SAN MAC as MacAddressA followed by the RedBox-MAC TLV (Type 30)\nand an explicit End-of-TLV marker before padding.\n\nhsr_get_node() must also accept the reinjected proxy-announce: a PRP\nsupervision frame is an untagged ETH_P_PRP frame (mac_len \u003d\u003d ETH_HLEN, the\nRCT is appended only on egress) sourced from macaddress_redbox, which is\nnever learned from data. Exempt only PRP supervision frames from the\nhsr_ethhdr length guard; HSR (ETH_P_HSR) supervision is front-tagged and\nkeeps the original guard, so HSR malformed-frame filtering is unchanged.\n\nAlso align macaddress_redbox so that ether_addr_copy() and\nether_addr_equal() on it are safe on architectures without efficient\nunaligned access.\n\nSigned-off-by: Xin Xie \u003cxiexinet@gmail.com\u003e\nLink: https://patch.msgid.link/20260717201457.54-3-xiexinet@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "841afc9143ee340818a4a9cf191f4e894a43c750", "tree": "23d583ada561efe6c18f9e595ff67141a151b3d3", "parents": [ "6a11e8106259d5f2cc1ba9f07c46bca9f9fea111" ], "author": { "name": "Xin Xie", "email": "xiexinet@gmail.com", "time": "Fri Jul 17 22:14:54 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 17:46:40 2026 -0700" }, "message": "net: hsr: add PRP interlink (RedBox) datapath and duplicate discard\n\nA PRP RedBox proxies SANs that sit behind an interlink port: their frames\nmust reach the PRP network with the SAN source MAC preserved, and PRP\nunicast must be steered between the LAN and the SAN segment correctly.\n\nAdd the PRP interlink forwarding rules to prp_drop_frame() and give RedBox\nnodes a second duplicate-discard slot so the two LAN copies of a frame\ndestined to a SAN collapse to a single delivery out the interlink.\n\nThe destination classification (is the unicast DA a PRP-network node or a\nproxied SAN) is resolved once per frame in fill_frame_info(), gated to PRP\nRedBox devices, and cached in struct hsr_frame_info, so prp_drop_frame()\nstays O(1) and does not walk the node tables for every candidate egress\nport in the softIRQ path. HSR RedBox frame classification is untouched.\n\nFactor the LAN A/B duplicate test into prp_is_lan_dup() so the new PRP\ninterlink rules do not change hsr_drop_frame() behaviour, including the\nNETIF_F_HW_HSR_FWD path which keeps using the LAN-duplicate test only.\n\nPublish the RedBox state before the first hsr_add_port(): the slave and\ninterlink rx handlers are live from hsr_add_port() on and rtnl does not\nstop softirq processing, so a frame could otherwise be handled while\nhsr-\u003eredbox is still false. hsr_add_node() sizes each node\u0027s per-port\nsequence state from hsr-\u003eredbox; a node learned in that window would get\na single-port sequence block, breaking the interlink duplicate discard\n(WARN_ON_ONCE plus duplicate delivery to the SAN) and letting the\nsupervision sequence-block merge read beyond the source node\u0027s allocated\nsequence bitmap. Publishing the flag before any port exists makes the\nper-node sizing uniform by construction. This is safe: the proxy\nannounce timer is only armed from hsr_check_announce() once the master\nis running, the packet-path readers of hsr-\u003eredbox tolerate an empty\nproxy node database and an absent interlink port, and the\nprune_proxy_timer is still armed only after the interlink port has been\nattached successfully.\n\nAdditionally bound the supervision sequence-block merge by the smaller\nof the two nodes\u0027 seq_port_cnt as defense in depth against mismatched\nnode sizes.\n\nSigned-off-by: Xin Xie \u003cxiexinet@gmail.com\u003e\nLink: https://patch.msgid.link/20260717201457.54-2-xiexinet@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a11e8106259d5f2cc1ba9f07c46bca9f9fea111", "tree": "bb3ac9689ece32aaeb01c2ad5163199b12b55a62", "parents": [ "edc84a9396acf1a0e78c46230dd0bcee1b84ac53", "18bf0ac84334aac237ecf14a8c427866109fb8c9" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:34:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:34:13 2026 -0700" }, "message": "Merge branch \u0027net-enetc-cleanups-and-improvements\u0027\n\nWei Fang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: enetc: cleanups and improvements\n\nThe first group of patches (1, 2, 5-7) eliminates code duplication\nbetween the ENETC v1 and v4 drivers. Since both hardware generations\nshare identical register layouts for MAC promiscuous mode, MAC hash\nfilters, and VLAN promiscuous mode - differing only in register address\noffsets - common helper functions are extracted into enetc_pf_common.c\nand shared by both drivers.\n\nPatch 3 converts ndo_set_rx_mode() to ndo_set_rx_mode_async(), removing\nthe dedicated workqueue that was previously needed to defer MAC address\nlist updates to a sleepable context.\n\nPatch 4 replaces counter-based MAFT entry tracking with a bitmap, which\nkeeps hardware and software state in sync and avoids partial failures\nduring entry allocation.\n\nPatches 8 and 9 fix phylink-related issues: removing invalid code from\nenetc4_pl_mac_link_up() and properly differentiating phylink capabilities\nbetween pseudo-MAC and standalone MAC.\n\nThe remaining patches (10-14) are minor cleanups: removing a redundant\nVLAN promiscuous mode initialization in probe, using the PCI device name\nfor the debugfs directory, simplifying port speed configuration, removing\na redundant num_vsi field, using alloc_etherdev_mqs() for the VF driver,\nand using kzalloc_flex() for a flexible array allocation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260720014317.1059359-1-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "18bf0ac84334aac237ecf14a8c427866109fb8c9", "tree": "bb3ac9689ece32aaeb01c2ad5163199b12b55a62", "parents": [ "f0c1f31afd97abcdaa70d78ac556bad84fc41871" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:16 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:55 2026 -0700" }, "message": "net: enetc: use kzalloc_flex() for enetc_psfp_gate allocation\n\nReplace the open-coded struct_size() + kzalloc() pattern with the\nkzalloc_flex() helper when allocating struct enetc_psfp_gate. This\nremoves the intermediate entries_size local variable and makes the\nallocation site more concise.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-15-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f0c1f31afd97abcdaa70d78ac556bad84fc41871", "tree": "912dc6e33f75c35321219d230503125fc03c9a3a", "parents": [ "75b136cf0f6faca1d183f5c0be7a1773d11bfbc3" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:15 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:55 2026 -0700" }, "message": "net: enetc: use alloc_etherdev_mqs() to create netdev for VF driver\n\nThe VF driver uses alloc_etherdev_mq() with ENETC_MAX_NUM_TXQS as the\nqueue count, which forces the TX and RX queue counts to be equal and\nuses a compile-time constant rather than the actual hardware capability.\n\nAfter enetc_get_si_caps() is called, si-\u003enum_tx_rings and\nsi-\u003enum_rx_rings reflect the actual number of rings assigned to the VF\nby the PF. For the ENETC VF on LS1028A and the upcoming i.MX95/94, their\nSoCs have no more than 6 CPUs, and the number of TX/RX rings allocated\nto the VF is less than 8.\n\nTherefore, switch to alloc_etherdev_mqs() so that the TX and RX queue\ncounts are set independently, each capped at ENETC_MAX_NUM_TXQS, based\non the actual number of rings assigned to the VF by the PF.\n\nNote that if future SoCs have more than 6 CPUs and more than 6 RX rings\nallocated to VFs, the size of the int_vector array in struct\nenetc_ndev_priv will need to be modified. Similarly, if more than 8 TX\nrings are allocated to each int_vector, ENETC_MAX_NUM_TXQS will also\nneed to be modified.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-14-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75b136cf0f6faca1d183f5c0be7a1773d11bfbc3", "tree": "f76cd95d4115a7e63f5f489ee096a8da3d457f18", "parents": [ "ba07e3bef1b5b26760ecf467924fb905d2bc330b" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:14 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: remove redundant num_vsi field from enetc_port_caps\n\nThe num_vsi field in struct enetc_port_caps is populated by reading the\nNUM_VSI field of the ECAPR1 register, which reports the number of VSIs\nsupported by the ENETC4 port. When CONFIG_PCI_IOV is enabled, this value\nalways matches pf-\u003etotal_vfs, which is obtained from the read-only\nPCI_SRIOV_TOTAL_VF register via pci_sriov_get_totalvfs() during probe.\nBoth ECAPR1[NUM_VSI] and PCI_SRIOV_TOTAL_VF are derived from the same\nIERB register EaVFRIDAR[NUM_VF] (a 4-bit field), so they are guaranteed\nto be equal. When CONFIG_PCI_IOV is disabled, pci_sriov_get_totalvfs()\nreturns 0, but this is benign since pci_enable_sriov() is also stubbed\nto return -ENODEV, so no VF can be created, and enetc4_enable_all_si()\nonly enables the PF SI (PSI).\n\nSince pf-\u003etotal_vfs already reflects the number of VFs that can actually\nbe used, and is the established convention in the sibling FSL_ENETC PF\ndriver, there is no need to read and cache num_vsi separately in the port\ncapabilities structure. Remove the num_vsi field from enetc_port_caps,\nand replace all uses of pf-\u003ecaps.num_vsi with pf-\u003etotal_vfs in the ring\nallocation, SI enable, and debugfs code paths. Note that in the MSI-X\nconfiguration, it is still necessary to obtain the actual number of VSIs\nfrom ECAPR1.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-13-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ba07e3bef1b5b26760ecf467924fb905d2bc330b", "tree": "badb6d2ad12fcd08c594b4e1c433b23b61da79c4", "parents": [ "f7c6dcd6444b745fe3df3d3f468c61e7fb8cb8c9" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:13 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: move enetc_set_si_vlan_promisc() to enetc_pf_common.c\n\nThe PSIPVMR in ENETC v4 has the same bit layout and functionality as the\nPSIPVMR register in ENETC v1: bit n (n \u003c\u003d 15) controls VLAN promiscuous\nmode for SI n. The only difference between the two hardware generations\nis the register address offset.\n\nSince the register functionality is identical, the VLAN promiscuous mode\nsetting code can be shared between ENETC v1 and v4 drivers.\n\nMove enetc_set_si_vlan_promisc() from enetc_pf.c to enetc_pf_common.c\nand export it so that it can be shared between the two drivers. Add a\nrevision check using is_enetc_rev1() to select the correct register\noffset (ENETC_PSIPVMR for v1 and ENETC4_PSIPVMR for v4) while keeping\nthe same logic.\n\nRemove the v4-specific enetc4_pf_set_si_vlan_promisc() from enetc4_pf.c\nand replace its call site with the new common enetc_set_si_vlan_promisc()\nto eliminate code duplication.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-12-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f7c6dcd6444b745fe3df3d3f468c61e7fb8cb8c9", "tree": "09174d87ded13bf349f40330e97f9036d676c498", "parents": [ "75e134261f6124c44b6dd32d7ba8e57af53a4419" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:12 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: refactor SI VLAN promiscuous mode configuration\n\nRemove the enetc_set_vlan_promisc(), enetc_enable_si_vlan_promisc() and\nenetc_disable_si_vlan_promisc() functions, and introduce a new unified\nfunction enetc_set_si_vlan_promisc() to enable or disable VLAN\npromiscuous mode for a specific SI. This simplifies the logic and makes\nthe interface more straightforward. The vlan_promisc_simap field in\nstruct enetc_pf is no longer needed to track the current state.\n\nAs ENETC V4 only changes the address offset of PSIPVMR register compared\nto V1 without any functional difference, enetc_set_si_vlan_promisc() can\nbe moved to enetc_pf_common.c in the future with minor adjustments to be\nreused by the ENETC V4 driver\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-11-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "75e134261f6124c44b6dd32d7ba8e57af53a4419", "tree": "821f1686a9bdac73d4853ae87aac6d3d0f608932", "parents": [ "59bb3d62489ce08d45dac2b7ec7b8f99a7b2040b" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:11 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: open-code enetc4_set_default_si_vlan_promisc()\n\nThe function enetc4_set_default_si_vlan_promisc() is only called once,\nfrom enetc4_configure_port_si(). Open-code the loop at the call site\nand remove the single-use wrapper.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-10-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "59bb3d62489ce08d45dac2b7ec7b8f99a7b2040b", "tree": "bd1f7c1c500ca675a26a7978eb509faaaef3c5a6", "parents": [ "7c9a6ae0edb2975d6491fbbc1a08007a89e4efd9" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:10 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: remove invalid code from enetc4_pl_mac_link_up()\n\nWhen adding phylink MAC operations support to the NETC switch driver,\nRussell King pointed out several pieces of invalid logic in the\n.mac_link_up() implementation (see [1] and [2]):\n\n1) Half-duplex backpressure is not supported by the kernel, Ethernet\n relies on packet dropping for congestion management.\n\n2) phylink_autoneg_inband() is unnecessary, as RGMII in-band status is\n not supported.\n\n3) TX and RX pause are disabled in half-duplex mode, so there is no\n need to override them in .mac_link_up().\n\nThe same invalid logic is also present in enetc4_pl_mac_link_up(), so\nremove the invalid code from it.\n\nGiven enetc4_set_hd_flow_control() is removed, pf-\u003ecaps.half_duplex has\nalso become useless and should therefore be removed as well.\n\nLink: https://lore.kernel.org/imx/acEIQqI-_oyCym8O@shell.armlinux.org.uk/ # 1\nLink: https://lore.kernel.org/imx/acEFwqmAvWls_9Ef@shell.armlinux.org.uk/ # 2\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-9-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c9a6ae0edb2975d6491fbbc1a08007a89e4efd9", "tree": "4f84e4a876ed389ba49933737211e016f273da8c", "parents": [ "c969fbc01d9ea95623e82eac396d8838bba4da07" ], "author": { "name": "Claudiu Manoil", "email": "claudiu.manoil@nxp.com", "time": "Mon Jul 20 09:43:09 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:54 2026 -0700" }, "message": "net: enetc: differentiate phylink capabilities for pseudo-MAC and standalone MAC\n\nThe ENETC pseudo-MACs are proprietary internal links that do not\nimplement any standard MII interface, so restrict their supported PHY\ninterface modes to PHY_INTERFACE_MODE_INTERNAL only.\n\nSince pseudo-MACs can operate at any speed between 10Mbps and 25Gbps\nin multiples of 10Mbps, set their MAC capabilities to cover the full\nrange of standard full-duplex speeds: 10/100/1000/2500/5000/10000/\n20000/25000 Mbps.\n\nFor standalone ENETC (v4), expand the supported interface modes to\ninclude 10GBASER in addition to the existing RGMII, SGMII, 1000BASEX,\n2500BASEX and USXGMII modes, with MAC capabilities up to 10G. MAC_1000\nis replaced with MAC_1000FD to explicitly exclude 1000M half-duplex,\nwhich is not supported.\n\nNote that 10GBASE-R mode of ENETC v4 has not supported yet, the current\npatch adds PHY_INTERFACE_MODE_10GBASER simply as preparation for the\nupcoming support of the 10GBASE-R mode.\n\nSigned-off-by: Claudiu Manoil \u003cclaudiu.manoil@nxp.com\u003e\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-8-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c969fbc01d9ea95623e82eac396d8838bba4da07", "tree": "952d999aaea4fa88cc80fddf26a78daad0f5d81b", "parents": [ "9db43e6f35db54f35742e23143cdd7251f952bfd" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:08 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: simplify enetc4_set_port_speed()\n\nSince phylink may pass SPEED_UNKNOWN to mac_link_up, handle it\nexplicitly by defaulting to SPEED_10, then replace the switch statement\nwith a direct call to PCR_PSPEED_VAL(). Also update PCR_PSPEED_VAL() to\nuse FIELD_PREP() for proper field masking instead of an open-coded shift.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-7-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9db43e6f35db54f35742e23143cdd7251f952bfd", "tree": "1fe17f9e483ac2822de3d8012a243061c599c0e0", "parents": [ "6228fc9c2bbe224a376c77e309bcf90158e0595c" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:07 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: use PCI device name for debugfs directory\n\nenetc_create_debugfs() is called right after register_netdev(), at which\npoint ndev-\u003ename still holds the format \"eth%d\" (e.g., eth0) rather than\nthe final assigned name (e.g., via udev rules).\n\nUse pci_name() instead of netdev_name() to name the debugfs directory.\nThe PCI device name is unique, stable, and available from the start,\nmaking it a more reliable identifier for the debugfs entry. Therefore,\nthe observable debugfs path from something like\n/sys/kernel/debug/eth0/mac_filter to a PCI BDF-style path such as\n/sys/kernel/debug/0002:00:00.0/mac_filter.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-6-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6228fc9c2bbe224a376c77e309bcf90158e0595c", "tree": "12e4b306b090618ce8fe83ad14ed1bb2d3e18b4d", "parents": [ "debf0c7a34fab2c4c47fc257a97a145543b6d3aa" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:06 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: improve MAFT entry management with bitmap tracking\n\nReplace the counter-based MAFT entry tracking (num_mfe/mac_filter_num)\nwith a bitmap (maft_eid_bitmap) stored in struct ntmp_user, which is a\nmore appropriate place for NTMP resource management.\n\nThe bitmap approach brings two improvements. First, the entry deletion\nin enetc4_pf_clear_maft_entries() now checks the return value of\nntmp_maft_delete_entry() and only clears the corresponding bit on\nsuccess, keeping hardware and software state in sync. Previously, the\ncounter was reset unconditionally regardless of whether the hardware\ndeletion actually succeeded.\n\nSecond, entry allocation in enetc4_pf_add_maft_entries() uses\nntmp_lookup_free_eid() to find available IDs dynamically, with an\nupfront capacity check via bitmap_weight() to avoid partial failures.\n\nThe MAFT entry count is moved into ntmp_user.maft_num_entries and\ninitialized once during enetc4_init_ntmp_user(). Helper functions\nenetc4_ntmp_bitmap_init() and enetc4_ntmp_bitmap_free() manage the\nbitmap lifetime. The debugfs show function is updated accordingly to\niterate over set bits under rtnl_lock().\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-5-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "debf0c7a34fab2c4c47fc257a97a145543b6d3aa", "tree": "304a6b58e236132af6deac515f05cb584f35c2e8", "parents": [ "0ce10770963e7b4bf252fe0f0283326504bcbb36" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: convert ndo_set_rx_mode() to ndo_set_rx_mode_async()\n\nThe current ndo_set_rx_mode() is called under netif_addr_lock spinlock\nwith BHs disabled, which prevents drivers from sleeping. To work around\nthis limitation, the enetc driver uses a dedicated workqueue to defer\nMAC address list updates to a sleepable context.\n\nSince commit 3554b4345d85 (\"net: introduce ndo_set_rx_mode_async and\nnetdev_rx_mode_work\") introduced the ndo_set_rx_mode_async() callback,\ndrivers can now handle address list updates directly in a sleepable\ncontext.\n\nTherefore, convert the enetc driver to use ndo_set_rx_mode_async() and\nremove the dedicated workqueue and the deferred work item accordingly.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-4-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0ce10770963e7b4bf252fe0f0283326504bcbb36", "tree": "fdb4f40b2ef1cc5f5551c5bde0635e963b6b74a4", "parents": [ "2557834ad0ff36fe3ec220bf1d7e6098265a326d" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: extract common helpers for MAC hash filter configuration\n\nThe PSIUMHFR and PSIMMHFR registers in ENETC v4 have the same bit layout\nas in ENETC v1. The only difference between the two hardware generations\nis the register address offsets.\n\nSince the register functionality is identical, the MAC hash filter\nconfiguration code can be shared between the ENETC v1 and v4 drivers.\nExtract two new common helper functions, enetc_set_si_uc_hash_filter()\nand enetc_set_si_mc_hash_filter(), into enetc_pf_common.c. These helpers\nselect the correct register offset based on the hardware revision via\nis_enetc_rev1().\n\nRemove v1-specific enetc_clear_mac_ht_flt() and enetc_set_mac_ht_flt()\nfrom enetc_pf.c, and v4-specific enetc4_pf_set_si_uc_hash_filter() and\nenetc4_pf_set_si_mc_hash_filter() from enetc4_pf.c, as they are now\nsuperseded by the shared implementations.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-3-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2557834ad0ff36fe3ec220bf1d7e6098265a326d", "tree": "a1e55fa6ab223f91afff3438376ef6f955ec5fd9", "parents": [ "edc84a9396acf1a0e78c46230dd0bcee1b84ac53" ], "author": { "name": "Wei Fang", "email": "wei.fang@nxp.com", "time": "Mon Jul 20 09:43:03 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:31:53 2026 -0700" }, "message": "net: enetc: extract common helpers for MAC promiscuous mode setting\n\nThe PSIPMMR (Port Station Interface Promiscuous MAC Mode Register) in\nENETC v4 has the same bit layout as the PSIPMR register in ENETC v1: bit\nn controls unicast promiscuous mode for SI n, and bit (n + 16) controls\nmulticast promiscuous mode for SI n. The only difference between the two\nhardware generations is the register address offset.\n\nSince the register functionality is identical, the MAC promiscuous mode\nsetting code can be shared between ENETC v1 and v4 drivers.\n\nRename ENETC_PSIPMR to ENETC_PSIPMMR in enetc_hw.h to match the actual\nregister name used in the reference manual, and extract two new common\nhelper functions, enetc_set_si_uc_promisc() and\nenetc_set_si_mc_promisc(), into enetc_pf_common.c. These helpers select\nthe correct register offset based on the hardware revision via\nis_enetc_rev1().\n\nRemove the v4-specific enetc4_pf_set_si_mac_promisc() function from\nenetc4_pf.c and the duplicate PSIPMMR_SI_MAC_UP/MP macro definitions\nfrom enetc4_hw.h, as they are now superseded by the shared code.\n\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260720014317.1059359-2-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "edc84a9396acf1a0e78c46230dd0bcee1b84ac53", "tree": "3b7713020ef6ef2e176e84f0de9f3d0e6a774528", "parents": [ "04026c998c24ac47eb76886b9790c5710b603eb4", "90883c513ca01e77c56b8d94be7de11420c1dacf" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:01:11 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Jul 27 16:03:40 2026 -0700" }, "message": "Merge tag \u0027wireless-2026-07-26\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/wireless/wireless-next\n\nJohannes Berg says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nwireless-next-2026-07-26\n\nMostly driver changes this time:\n - new driver mm81x for an S1G device\n - new driver nxpwifi for NXP devices\n (mostly forked off from mwifiex)\n - ath12k: much kernel infrastructure integration work\n - brcmfmac: DPP support, some Cypress part update\n - nl80211: per-link statistics support\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260726105205.942922-60-johannes@sipsolutions.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "04026c998c24ac47eb76886b9790c5710b603eb4", "tree": "903ecc278526c087697bf0e512eb618fb8b7a31a", "parents": [ "e2834100751ab80b32a29390fac4c26660b86a9b" ], "author": { "name": "Weimin Xiong", "email": "xiongwm2026@163.com", "time": "Fri Jul 17 10:25:37 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jul 24 16:20:00 2026 -0700" }, "message": "net/rds: use krealloc_array() for iovector growth\n\nUse krealloc_array() for growing the RDS iovector array. This makes the\narray allocation overflow-safe and derives the element size from the\narray pointer.\n\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nSigned-off-by: Weimin Xiong \u003cxiongwm2026@163.com\u003e\nLink: https://patch.msgid.link/20260717022537.331863-1-xiongwm2026@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2834100751ab80b32a29390fac4c26660b86a9b", "tree": "5f148c79ff2b4c084ecd0f6cd2de637602a5bb0d", "parents": [ "bf8cdde4ef35b47cff5611a2a7062ac6a64fa7ff" ], "author": { "name": "Satheesh Paul A", "email": "psatheesh@marvell.com", "time": "Wed Jul 15 12:50:34 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jul 24 15:48:27 2026 -0700" }, "message": "octeontx2-af: add support for custom L2 header\n\nAdd packet parsing support for custom L2 headers. Also add support\nto include a field from the custom header for flow tag generation.\n\nIntroduce a new flow key type NIX_FLOW_KEY_TYPE_CH_LEN_90B which\nmaps to the NPC_LT_LA_CUSTOM_L2_90B_ETHER layer type. This extracts\na 2-byte field at a 24-byte offset in layer A to be used in flow\ntag generation.\n\nSigned-off-by: Satheesh Paul A \u003cpsatheesh@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nLink: https://patch.msgid.link/20260715072035.617544-1-nshettyj@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bf8cdde4ef35b47cff5611a2a7062ac6a64fa7ff", "tree": "6a5d746f76630dbf4b0a38995b4ee54076e47874", "parents": [ "be6f0d0bae229ebd03e9bfe736f78e2d6b35885f" ], "author": { "name": "Daniil Agalakov", "email": "ade@amicon.ru", "time": "Wed Jul 15 15:58:48 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jul 24 15:33:27 2026 -0700" }, "message": "net: hns: use u32 for register offset in RCB TX coalescing\n\nIn both hns_rcb_get_tx_coalesced_frames() and\nhns_rcb_set_tx_coalesced_frames(), the local variable reg holds a\nregister offset passed to dsaf_read_dev() or dsaf_write_dev().\n\nRegister offsets on this hardware are 32-bit values. Use u32 for reg\nto match the register access interfaces and avoid implying that\n64-bit offsets are supported.\n\nSigned-off-by: Daniil Agalakov \u003cade@amicon.ru\u003e\nSigned-off-by: Daniil Iskhakov \u003cdish@amicon.ru\u003e\nLink: https://patch.msgid.link/20260715125856.19346-1-dish@amicon.ru\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be6f0d0bae229ebd03e9bfe736f78e2d6b35885f", "tree": "4e05b3c36e18ca6d91a6e1ff006e264fda0bf7f8", "parents": [ "89d8006259b81dd25c962f6cc8d7ab268d6ea426" ], "author": { "name": "T.J. Mercier", "email": "tjmercier@google.com", "time": "Wed Jul 22 13:54:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Fri Jul 24 14:53:16 2026 -0700" }, "message": "selftests: drv-net: ncdevmem: Open /dev/udmabuf O_RDONLY\n\nWrite permissions on the /dev/udmabuf device file are not required to\nissue ioctls and allocate udmabufs. Applications should be opening this\nfile as O_RDONLY. The BPF dmabuf_iter selftest already does this. [1]\n\nUsers are pointing to these selftests as examples of how use udmabuf,\nand encountering permission errors on systems where write permissions\nare not available on /dev/udmabuf. Apply the principle of least\nprivilege to selftests which use udmabuf by removing the write access\nmode from drivers/net/hw/ncdevmem.c.\n\n[1] https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/tools/testing/selftests/bpf/prog_tests/dmabuf_iter.c?h\u003dv7.1#n49\n\nSigned-off-by: T.J. Mercier \u003ctjmercier@google.com\u003e\nReviewed-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nLink: https://patch.msgid.link/20260722205442.1894665-1-tjmercier@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cca2780b61947fd27ec621541edd0902e193a609", "tree": "586554523c5a92095c1409c0d0afd8cfce019beb", "parents": [ "874f455c3a2954b5b56fbedf97da39c34df9dc0e" ], "author": { "name": "Subasri S", "email": "subasris1210@gmail.com", "time": "Thu Jul 16 19:37:10 2026 +0530" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:45:19 2026 +0200" }, "message": "ipvs: use type-safe allocation helpers in ip_vs_rht_alloc\n\nAs per Documentation/process/deprecated.rst, open-coded kmalloc\nassignments for struct objects are deprecated. Replace\nkzalloc(sizeof(*ptr), GFP_KERNEL) with kzalloc_obj() and\nkvmalloc_array(n, sizeof(*ptr), GFP_KERNEL) with kvmalloc_objs()\nin ip_vs_rht_alloc().\n\nCompile tested with CONFIG_IP_VS\u003dy and runtime tested using\ntools/testing/selftests/net/netfilter/ipvs.sh on x86_64/QEMU.\n\nSigned-off-by: Subasri S \u003csubasris1210@gmail.com\u003e\nReviewed-by: Phil Sutter \u003cphil@nwl.cc\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "874f455c3a2954b5b56fbedf97da39c34df9dc0e", "tree": "17f9e8595bf91ce2e66bdba415963f7fe68b47da", "parents": [ "1c66ad76ddd4c9f141cae84e6a56c34e090cb3d9" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Jul 13 18:06:58 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:45:19 2026 +0200" }, "message": "netfilter: nf_conntrack_expect: store event cache in expectation\n\nStore the event cache in the expectation instead of accessing the\nexp-\u003emaster cache, as a step forward towards turning the exp-\u003emaster\ninto a cookie.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "1c66ad76ddd4c9f141cae84e6a56c34e090cb3d9", "tree": "d4f6144063f736dc8b9606ee27191695db4eb60a", "parents": [ "edd51a23343870dbd7cedf6e2765c13cf7a5ccbc" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Mon Jul 13 18:06:57 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:45:19 2026 +0200" }, "message": "netfilter: conntrack_helper: pass master conntrack to helper functions\n\nPass master conntrack as argument to helper functions that parse the\npacket payload, instead of using exp-\u003emaster. Although accessing\nexp-\u003emaster is safe in this case because it refers to the master\nconntrack in used by this skb, remove it to step towards turning the\nexp-\u003emaster field into a cookie value.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "edd51a23343870dbd7cedf6e2765c13cf7a5ccbc", "tree": "ec805fbde51351866e539d77590631185779cd3e", "parents": [ "16aecbe3036f6097c26b51b12e4c1cf207769690" ], "author": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 10 09:54:09 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:22:30 2026 +0200" }, "message": "netfilter: flowtable: tear down flow entries with stale dst from GC\n\nIn case of route updates, tear down flow entries with stale dst to give\nthem a chance to obtain a fresh route.\n\nThis is specifically useful for hardware offloaded entries, where the\nflowtable software dataplane sees no packet, where the existing check\nfor stale dst entries does not help.\n\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "16aecbe3036f6097c26b51b12e4c1cf207769690", "tree": "67c946ab2d94dd079e4f2c04d0f8eafb832f9758", "parents": [ "4172fd3697b0405e4f9654a950b4adf33f3a796c" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Mon Jul 06 14:30:55 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:22:22 2026 +0200" }, "message": "netfilter: nf_nat_sip: rewind offset when NAT shrinks the packet\n\nsashiko says:\n If map_addr() changes the packet length, such as when the public NAT IP\n string is shorter or longer than the internal IP, coff will still point to\n the offset relative to the pre-mangled packet.\n If the packet shrinks, coff could overshoot the correct position,\n potentially causing the next ct_sip_parse_header_uri() call to silently\n skip bytes and miss subsequent Contact headers. Could this lead to a\n failure to NAT those subsequent headers and leak internal network details?\n\nFixes: c978cd3a9371 (\"[NETFILTER]: nf_nat_sip: translate all Contact headers\")\nAssisted-by: Claude:claude-sonnet-4-6\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "4172fd3697b0405e4f9654a950b4adf33f3a796c", "tree": "5dc8ea5ea096cf5132a411ff4091fa9586e8c68b", "parents": [ "0a33bdce34c68f1d158d2ee3c9dfd011bef5c290" ], "author": { "name": "Florian Westphal", "email": "fw@strlen.de", "time": "Sat Jul 04 09:31:33 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 11:21:35 2026 +0200" }, "message": "netfilter: xt_tcpmss: extend checkentry to ipv6\n\nsashiko reports:\n Is it intentional that the new parameter validation callback is applied\n only to the NFPROTO_IPV4 match?\n\nFixes: 68fc6c6470d6 (\"netfilter: xt_tcpmss: add checkentry for parameter validation\")\nSigned-off-by: Florian Westphal \u003cfw@strlen.de\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "0a33bdce34c68f1d158d2ee3c9dfd011bef5c290", "tree": "e303f4adf0e56c72899225539f12540ff071b5d6", "parents": [ "89d8006259b81dd25c962f6cc8d7ab268d6ea426" ], "author": { "name": "Ismael Luceno", "email": "iluceno@suse.de", "time": "Thu Jul 02 12:10:50 2026 +0200" }, "committer": { "name": "Pablo Neira Ayuso", "email": "pablo@netfilter.org", "time": "Fri Jul 24 10:21:38 2026 +0200" }, "message": "ipvs: Move defense_work and est_reload_work to system_dfl_long_wq\n\nUnder synflood conditions binding these handlers to system_long_wq may\npin them to a saturated CPU.\n\nWe\u0027ve observed improved throughtput on a DPDK/VPP application with this\nchange, which we attribute to the reduced context switching.\n\nNeither handler has per-CPU data dependencies nor cache locality\nrequirements that would prevent this change.\n\nSigned-off-by: Ismael Luceno \u003ciluceno@suse.de\u003e\nAcked-by: Julian Anastasov \u003cja@ssi.bg\u003e\nSigned-off-by: Pablo Neira Ayuso \u003cpablo@netfilter.org\u003e\n" }, { "commit": "89d8006259b81dd25c962f6cc8d7ab268d6ea426", "tree": "6fb362a45540a3531072b20907d19e11e8f8b7b3", "parents": [ "ed6dc972c19ff9ffca504f5739848da4275219e3", "d326f83e819c53aa05c40d64f5805d6237b6aa1b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 14:04:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 14:07:40 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.2-rc5).\n\nConflicts:\n\ndrivers/net/amt.c\n 3656a79f94c47 (\"amt: re-read skb header pointers after every pull\")\n 586c4dcf28eb6 (\"amt: no longer rely on RTNL in amt_fill_info()\")\nhttps://lore.kernel.org/amIaJr3aOQNS_Fvl@sirena.org.uk\n\nAdjacent changes:\n\ndrivers/net/geneve.c\n 8efb8f8bbb35 (\"geneve: require CAP_NET_ADMIN in the device netns for changelink\")\n 0ba269933f73 (\"geneve: convert config to RCU-protected pointer\")\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d326f83e819c53aa05c40d64f5805d6237b6aa1b", "tree": "f3505e4347ebd0244f580e11093033ad7b885f36", "parents": [ "4539944e515183668109bdf4d0c3d7d228383d88", "6a8da869fa338e008533dd6385a0eb35dee6acf4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 12:58:08 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Jul 23 12:58:08 2026 -0700" }, "message": "Merge tag \u0027net-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Jakub Kicinski:\n \"Lots of fixes, double the count even for the \u0027new normal\u0027. Largely due\n to my time off followed by a networking conference which distracted\n most maintainers (less so the AI generators).\n\n Including fixes from Bluetooth and WiFi.\n\n Current release - regressions:\n\n - wifi: mt76: fix MAC address for non OF pcie cards\n\n Current release - new code bugs:\n\n - mptcp: fix BUILD_BUG_ON on legacy ARM config\n\n - wifi: cfg80211: guard optional PMSR nominal time\n\n Previous releases - regressions:\n\n - qrtr: ns: raise node count limit to 512, we arbitrarily picked\n 256 as a limit, turns out it was too low for real world deployments\n\n - vhost-net: fix TX stall when vhost owns virtio-net header\n\n - eth: amd-xgbe: fix MAC_AUTO_SW handling in CL37 AN\n\n - wifi: ath12k: fix low MLO RX throughput on WCN7850\n\n Previous releases - always broken:\n\n - number of random AI fixes for SCTP, RDS and TIPC protocols\n\n - more AI-looking fixes for WiFi drivers\n\n - number of fixes for missing pointer reloading after skb pull\n\n - reject BPF redirect use from qdisc qevent block\n\n - tcp: initialize standalone TCP-AO response padding\n\n - vsock/virtio: collapse receive queue under memory pressure to avoid\n client OOMing the host with tiny messages\n\n - ipv4: icmp: fill flow parameters in icmp_route_lookup decoy lookup,\n make sure the ICMP response routing follows the routing policy\n\n - gro: fix double aggregation of flush-marked skbs\n\n - ovpn: fix various refcount bugs\n\n - tls: device: push pending open record on splice EOF\n\n - eth: mlx5:\n - use sender devcom for MPV master-up\n - fix MCIA register buffer overflow on 32 dword reads\"\n\n* tag \u0027net-7.2-rc5\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (234 commits)\n drop_monitor: perform u64_stats updates under IRQ-disabled section\n drop_monitor: fix size calculations for 64-bit attributes\n net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD\n mptcp: fix BUILD_BUG_ON on legacy ARM config\n selftests: mptcp: userspace_pm: fix undefined variable port\n mptcp: fix stale skb-\u003esk reference on subflow close\n mptcp: pm: userspace: fix use-after-free in get_local_id\n mptcp: decrement subflows counter on failed passive join\n mac802154: hold an interface reference across the scan worker\n sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n phonet: check register_netdevice_notifier() error in phonet_device_init()\n phonet: pep: fix use-after-free in pep_get_sb()\n bnge/bng_re: fix ring ID widths\n tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()\n mctp: check register_netdevice_notifier() error in mctp_device_init()\n ptp: netc: explicitly clear TMR_OFF during initialization\n rds: tcp: unregister sysctl before tearing down listen socket\n ipv6: Change allocation flags to match rcu_read_lock section requirements\n net: slip: serialize receive against buffer reallocation\n ...\n" }, { "commit": "ed6dc972c19ff9ffca504f5739848da4275219e3", "tree": "c675df2cc86a3e23b636cde6b1b13d86839bc800", "parents": [ "1324135c41671f8da3bbe0b2539b6c83b09c6cb0" ], "author": { "name": "Niklas Söderlund", "email": "niklas.soderlund+renesas@ragnatech.se", "time": "Wed Jul 22 19:48:53 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:01:05 2026 -0700" }, "message": "net: dsa: microchip: Fix log typo in error path\n\nAll other log messages in the driver prefix hex values with 0x, add it\nin the one missing message. While at it also add the missing opening\nparenthesis in the same log message.\n\nSigned-off-by: Niklas Söderlund \u003cniklas.soderlund+renesas@ragnatech.se\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260722174853.2316333-1-niklas.soderlund+renesas@ragnatech.se\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a8da869fa338e008533dd6385a0eb35dee6acf4", "tree": "fbb9ba05adfee82280aafd2d27c891dcc6e3ce81", "parents": [ "5e9c8baee0329fbefe7c67aea945e2a07f15e98b", "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:03 2026 -0700" }, "message": "Merge branch \u0027drop_monitor-take-care-of-32bit-kernels\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndrop_monitor: take care of 32bit kernels\n\nThis series fixes two drop_monitor issues on 32-bit architectures:\n\n- Patch 1 uses nla_total_size_64bit() for PC and TIMESTAMP attributes to\n account for alignment padding added by nla_put_u64_64bit(), avoiding\n potential skb_over_panic() crashes.\n\n- Patch 2 moves u64_stats updates before spin_unlock_irqrestore(), ensuring\n local interrupts are disabled to prevent seqcount corruption from nested\n interrupts in probe context.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722141743.3266924-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd098a23bf8fda7eae48db9b06e7c34fc4d228fa", "tree": "fbb9ba05adfee82280aafd2d27c891dcc6e3ce81", "parents": [ "7089f7ab99c89f443c92d8fcc585e63f2727f0b3" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jul 22 14:17:43 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:01 2026 -0700" }, "message": "drop_monitor: perform u64_stats updates under IRQ-disabled section\n\nIn net_dm_packet_trace_kfree_skb_hit() and net_dm_hw_trap_packet_probe(),\nu64_stats_update_begin() / u64_stats_inc() / u64_stats_update_end() were\ncalled after spin_unlock_irqrestore(\u0026...drop_queue.lock, flags), when local\nIRQs had already been re-enabled.\n\nTracepoint probes can execute in IRQ or softirq context. On 32-bit\narchitectures, u64_stats_update_begin() disables preemption but not interrupts,\nrelying on seqcount writes. If a nested interrupt occurs on the same CPU during\nthe 64-bit stats update, the reentrant seqcount update can corrupt the\nseqcount state or stats value.\n\nFix this by performing the 64-bit per-CPU stats update before releasing\ndrop_queue.lock via spin_unlock_irqrestore(), ensuring local interrupts remain\ndisabled during the u64_stats update.\n\nFixes: e9feb58020f9 (\"drop_monitor: Expose tail drop counter\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260722141743.3266924-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7089f7ab99c89f443c92d8fcc585e63f2727f0b3", "tree": "badd342b1c0a7a457ba8c8343d549b74e49738d0", "parents": [ "5e9c8baee0329fbefe7c67aea945e2a07f15e98b" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Jul 22 14:17:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 11:00:01 2026 -0700" }, "message": "drop_monitor: fix size calculations for 64-bit attributes\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() use\nnla_put_u64_64bit() to append 64-bit attributes (NET_DM_ATTR_PC and\nNET_DM_ATTR_TIMESTAMP).\n\nOn 32-bit architectures without CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS,\nnla_put_u64_64bit() may append a 4-byte NET_DM_ATTR_PAD attribute for\n64-bit alignment.\n\nHowever, net_dm_packet_report_size() and net_dm_hw_packet_report_size()\nused nla_total_size(sizeof(u64)) instead of nla_total_size_64bit(sizeof(u64)),\nbudgeting 12 bytes instead of up to 16 bytes.\n\nThis under-estimation of SKB size can lead to an skb_over_panic() when\n__nla_reserve() or skb_put() is subsequently called.\n\nFix this by using nla_total_size_64bit(sizeof(u64)) in both size calculations.\n\nFixes: ca30707dee2b (\"drop_monitor: Add packet alert mode\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260722141743.3266924-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5e9c8baee0329fbefe7c67aea945e2a07f15e98b", "tree": "617ce3f8766920e56029663c1cbfce334f3ebd52", "parents": [ "1d4da823b75e5774161951764cbad75cb6e6a75f" ], "author": { "name": "Yehyeong Lee", "email": "yhlee@isslab.korea.ac.kr", "time": "Wed Jul 22 21:28:17 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:59:27 2026 -0700" }, "message": "net: drop_monitor: fix info leak in NET_DM_ATTR_PAYLOAD\n\nnet_dm_packet_report_fill() and net_dm_hw_packet_report_fill() open code\nthe NET_DM_ATTR_PAYLOAD attribute to avoid zeroing the packet payload\nbefore overwriting it with skb_copy_bits().\n\nskb_put() reserves nla_total_size(payload_len), i.e. the header plus the\nNLA_ALIGN() padding, but only payload_len bytes are copied in. When\npayload_len is not a multiple of 4 the 1-3 padding bytes are never\ninitialized and are leaked to user space inside the netlink message.\n\nKMSAN confirms the leak for the software path when the packet payload\nlength is not 4-byte aligned:\n\n BUG: KMSAN: kernel-infoleak in _copy_to_iter\n _copy_to_iter\n __skb_datagram_iter\n skb_copy_datagram_iter\n netlink_recvmsg\n sock_recvmsg\n __sys_recvfrom\n Uninit was created at:\n kmem_cache_alloc_node_noprof\n __alloc_skb\n net_dm_packet_work\n Bytes 173-175 of 176 are uninitialized\n\nUse __nla_reserve(), which sets up the attribute header and zeroes the\npadding, instead of open coding the attribute construction.\n\nFixes: ca30707dee2b (\"drop_monitor: Add packet alert mode\")\nFixes: 5e58109b1ea4 (\"drop_monitor: Add support for packet alert mode for hardware drops\")\nSuggested-by: Eric Dumazet \u003cedumazet@google.com\u003e\nSigned-off-by: Yehyeong Lee \u003cyhlee@isslab.korea.ac.kr\u003e\nLink: https://patch.msgid.link/20260722122817.5548-1-yhlee@isslab.korea.ac.kr\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1d4da823b75e5774161951764cbad75cb6e6a75f", "tree": "fdbe4543535b4b67c1475aff224f3f2882ef0537", "parents": [ "234e5e898b713bc0b3a631b6f002897f43d046c8", "133cca19d75b9264bc2bbcdf2c3b80e3da207649" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:42 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:43 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-2-rc5\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.2-rc5\n\nHere are various unrelated fixes:\n\n- Patch 1: decrement extra subflows counter in case of errors with\n passive MP_JOIN. A fix for v5.7.\n\n- Patch 2: fix use-after-free in userspace_pm_get_local_id. A fix for\n v5.19.\n\n- Patch 3: fix stale skb-\u003esk reference on subflow close, in case of\n concurrent read operation. A fix for v6.19.\n\n- Patch 4: wait on the correct port in the userspace_pm.sh selftest. A\n fix for v6.19.\n\n- Patch 5: fix a BUILD_BUG_ON on legacy ARM config. A fix for v7.1.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-0-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "133cca19d75b9264bc2bbcdf2c3b80e3da207649", "tree": "fdbe4543535b4b67c1475aff224f3f2882ef0537", "parents": [ "e3213292c4fd69ba442c6ed4693f91a92b753140" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Wed Jul 22 00:14:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: fix BUILD_BUG_ON on legacy ARM config\n\nThe 0-day bot managed to find kernel configs that cause build failures,\ne.g. when using the StrongARM SA1100 target (ARMv4).\n\nOn such legacy ARM architecture, all structures are apparently aligned\nto 32 bits, causing build issue here. Indeed, on such architecture,\n\u0027flags\u0027 size is not equivalent to sizeof(u16) as expected, but to\nsizeof(u32).\n\nInstead, use memset(). It was not used before to ensure a simple clear\noperation was used by the compiler. But at the end, it shouldn\u0027t matter,\nand the compiler should optimise this to the same operation with or\nwithout memset() when -O above 0 is used. So let\u0027s switch to memset() to\nfix this issue, and reduce this complexity.\n\nFixes: 5e939544f9d2 (\"mptcp: fix uninit-value in mptcp_established_options\")\nCc: stable@vger.kernel.org\nSuggested-by: Frank Ranner \u003cfrank.ranner@intel.com\u003e\nReported-by: kernel test robot \u003clkp@intel.com\u003e\nCloses: https://lore.kernel.org/oe-kbuild-all/202605312026.Srgsz7Tp-lkp@intel.com/\nCloses: https://lore.kernel.org/oe-kbuild-all/202607031100.upQfRZTM-lkp@intel.com/\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-5-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e3213292c4fd69ba442c6ed4693f91a92b753140", "tree": "f345b83f7701ef06785d58f658687e4067ef73d0", "parents": [ "bd7aae448f6ee9d82599a4474664de1e6e91a535" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Wed Jul 22 00:14:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "selftests: mptcp: userspace_pm: fix undefined variable port\n\nIn make_connection(), the variable \"port\" is used but never defined.\nThis leads to an empty argument being passed to wait_local_port_listen(),\ncausing \"printf: : invalid number\" errors:\n\n # INFO: Init\n # 01 Created network namespaces ns1, ns2 [ OK ]\n # INFO: Make connections\n # ./../lib.sh: line 651: printf: : invalid number\n # 02 Established IPv4 MPTCP Connection ns2 \u003d\u003e ns1 [ OK ]\n # INFO: Connection info: 10.0.1.2:59516 -\u003e 10.0.1.1:50002\n # ./../lib.sh: line 651: printf: : invalid number\n # 03 Established IPv6 MPTCP Connection ns2 \u003d\u003e ns1 [ OK ]\n\nFix it by using the correctly defined variable \"app_port\", which holds the\nappropriate port number for the connection.\n\nFixes: 39348f5f2f13 (\"selftests: mptcp: wait for port instead of sleep\")\nCc: stable@vger.kernel.org\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-4-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bd7aae448f6ee9d82599a4474664de1e6e91a535", "tree": "87fd06feade549ff5b90d9a64b7950c6f9e93dc8", "parents": [ "9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9" ], "author": { "name": "Kalpan Jani", "email": "kalpan.jani@mpiricsoftware.com", "time": "Wed Jul 22 00:14:40 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: fix stale skb-\u003esk reference on subflow close\n\nThe backlog list is updated by mptcp_data_ready() under\nmptcp_data_lock(). The cleanup of backlog references to a closing\nsubflow, however, was performed in mptcp_close_ssk(), before\n__mptcp_close_ssk() acquires the ssk lock, and while holding neither\nthe ssk lock nor mptcp_data_lock().\n\nBecause that traversal ran without mptcp_data_lock(), concurrent softirq\nRX processing on another CPU (subflow_data_ready() -\u003e mptcp_data_ready()\n-\u003e __mptcp_add_backlog(), under mptcp_data_lock()) could add a backlog\nentry referencing the ssk while the cleanup loop was in progress. Such\nan entry could be missed by the cleanup, or the concurrent list update\ncould corrupt the traversal, leaving skb-\u003esk pointing at the ssk after\nit is freed.\n\nA later mptcp_backlog_purge() then dereferences the stale pointer,\ntriggering a warning in inet_sock_destruct() (ssk-\u003esk_rmem_alloc !\u003d 0)\nfollowed by a use-after-free in mptcp_backlog_purge().\n\nFix this by moving the backlog cleanup into __mptcp_close_ssk(), after\nsubflow-\u003eclosing is set to 1 and while the ssk lock is still held,\nserialized under mptcp_data_lock(). The cleanup runs only on the push\npath (MPTCP_CF_PUSH), where backlog references accumulate; on other\nteardown paths the caller already handles cleanup.\n\nWith subflow-\u003eclosing set and mptcp_data_lock() held across the purge,\nany concurrent mptcp_data_ready() either completes its enqueue before\nthe purge runs and is caught, or observes closing\u003d1 and bails out. Once\nmptcp_data_unlock() is reached, no new skb referencing the ssk can be\nenqueued, so the cleanup is exhaustive.\n\nRemove the unprotected traversal from mptcp_close_ssk() entirely.\n\nFixes: ee458a3f314e (\"mptcp: introduce mptcp-level backlog\")\nCc: stable@vger.kernel.org\nSuggested-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nReported-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nCloses: https://github.com/multipath-tcp/mptcp_net-next/issues/621\nSigned-off-by: Kalpan Jani \u003ckalpan.jani@mpiricsoftware.com\u003e\nAcked-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-3-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9bc6d5e4ca9f3cbb41d43400b3a31cb0403796c9", "tree": "3d851bdb197d478d4d3d8177ab2c1896671e1821", "parents": [ "f3ca0ee2cc308e33896536789cbc5f3a12ca7b30" ], "author": { "name": "Geliang Tang", "email": "tanggeliang@kylinos.cn", "time": "Wed Jul 22 00:14:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: pm: userspace: fix use-after-free in get_local_id\n\nIn mptcp_pm_userspace_get_local_id(), the address entry is looked up under\nspinlock, but its id is read after dropping the lock. A concurrent deletion\ncan free the entry between the unlock and the read, leading to UAF.\n\nThe race window is narrow. It was reproduced only with a locally\nconstructed stress test that repeatedly overlaps an MP_JOIN SYN with a\nMPTCP_PM_CMD_SUBFLOW_DESTROY request.\n\nHowever, the KASAN report below confirms that the race is reachable:\n\n [ 666.319376] BUG: KASAN: slab-use-after-free in mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319386] Read of size 1 at addr ffff888124845610 by task swapper/0/0\n ...\n [ 666.319401] Call Trace:\n [ 666.319405] \u003cIRQ\u003e\n [ 666.319408] dump_stack_lvl+0x53/0x70\n [ 666.319412] print_address_description.constprop.0+0x2c/0x3b0\n [ 666.319418] print_report+0xbe/0x2b0\n [ 666.319421] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319423] kasan_report+0xce/0x100\n [ 666.319426] ? mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319429] mptcp_userspace_pm_get_local_id+0x1dc/0x1f0\n [ 666.319433] mptcp_pm_get_local_id+0x371/0x440\n ...\n [ 666.319821] Allocated by task 45539:\n [ 666.319844] kasan_save_stack+0x33/0x60\n [ 666.319855] kasan_save_track+0x14/0x30\n [ 666.319858] __kasan_kmalloc+0x8f/0xa0\n [ 666.319863] __kmalloc_noprof+0x1e7/0x520\n [ 666.319867] sock_kmalloc+0xdf/0x130\n [ 666.319885] sock_kmemdup+0x1b/0x40\n [ 666.319888] mptcp_userspace_pm_append_new_local_addr+0x261/0x500\n [ 666.319910] mptcp_pm_nl_announce_doit+0x16a/0x610\n ...\n [ 666.319967] Freed by task 45560:\n [ 666.319988] kasan_save_stack+0x33/0x60\n [ 666.319991] kasan_save_track+0x14/0x30\n [ 666.319994] kasan_save_free_info+0x3b/0x60\n [ 666.319998] __kasan_slab_free+0x43/0x70\n [ 666.320000] kfree+0x166/0x440\n [ 666.320003] sock_kfree_s+0x1d/0x50\n [ 666.320007] mptcp_userspace_pm_delete_local_addr.isra.0+0x157/0x200\n [ 666.320011] mptcp_pm_nl_subflow_destroy_doit+0x51d/0xea0\n\nFix by copying the id into a local variable while still holding the lock,\nand use -1 as a \"not found\" sentinel.\n\nFixes: f012d796a6de (\"mptcp: check addrs list in userspace_pm_get_local_id\")\nCc: stable@vger.kernel.org\nSigned-off-by: Geliang Tang \u003ctanggeliang@kylinos.cn\u003e\nTested-by: Xuanqiang Luo \u003cluoxuanqiang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-2-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f3ca0ee2cc308e33896536789cbc5f3a12ca7b30", "tree": "6ed6a04506189cba88aff8d4f7850f89386a1c7d", "parents": [ "234e5e898b713bc0b3a631b6f002897f43d046c8" ], "author": { "name": "Chenguang Zhao", "email": "zhaochenguang@kylinos.cn", "time": "Wed Jul 22 00:14:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:50:38 2026 -0700" }, "message": "mptcp: decrement subflows counter on failed passive join\n\nmptcp_pm_allow_new_subflow() increments extra_subflows before\n__mptcp_finish_join() on the passive MP_JOIN path.\n\nIn case of race conditions, the subflow is dropped without calling\nmptcp_close_ssk(), so the counter is not rolled back.\n\nCall mptcp_pm_close_subflow() when the join completion fails to\ndecrement the subflows counter.\n\nFixes: 10f6d46c943d (\"mptcp: fix race between MP_JOIN and close\")\nCc: stable@vger.kernel.org\nSigned-off-by: Chenguang Zhao \u003czhaochenguang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260722-net-mptcp-misc-fixes-7-2-rc5-v1-1-6fb595bc86ef@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1324135c41671f8da3bbe0b2539b6c83b09c6cb0", "tree": "af9a39d4aa7668b1e9188ed220a7af7499cfad3a", "parents": [ "1306cf6dc1dfd34b97ccff98fcb08168c352dbef", "bee40a7d0bd1263934f99054db037cdd4a33fd86" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:40:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:40:26 2026 -0700" }, "message": "Merge branch \u0027mlx5-next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmlx5-next updates 2026-07-22\n\n* \u0027mlx5-next\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/mellanox/linux:\n net/mlx5: Add PSP related fields to the mlx5_ifc\n net/mlx5: Drop redundant esw_cap, reuse e_switch_cap\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260722071030.1693021-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "234e5e898b713bc0b3a631b6f002897f43d046c8", "tree": "b416ca77899021979c74b2c3d78d2d0f4abed90f", "parents": [ "9b2854f86f0b56e9027d68e7a3fc909d1a9b566f" ], "author": { "name": "Ibrahim Hashimov", "email": "security@auditcode.ai", "time": "Tue Jul 21 23:12:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:37:46 2026 -0700" }, "message": "mac802154: hold an interface reference across the scan worker\n\nmac802154_scan_worker() captures the scanning sub-interface under RCU\nand then keeps dereferencing sdata-\u003edev after rcu_read_unlock() and\noutside the rtnl -- in the failure traces, in\nmac802154_transmit_beacon_req() (skb-\u003edev \u003d sdata-\u003edev), and in the\nend_scan cleanup. Nothing keeps that netdev alive across the worker\niteration.\n\nA concurrent DEL_INTERFACE or PHY removal can unregister the interface\nonce the worker drops the rtnl between its two drv_set_channel()\nsections. unregister_netdevice() frees the netdev asynchronously from\nnetdev_run_todo() with the rtnl already dropped, so neither holding the\nrtnl nor the per-PHY IEEE802154_IS_SCANNING flag prevents a stale worker\niteration from dereferencing the freed netdev -- a KASAN\nslab-use-after-free, reachable by racing TRIGGER_SCAN against\nDEL_INTERFACE (both CAP_NET_ADMIN).\n\nPin the netdev with netdev_hold() while the RCU read lock is still held,\nand release it at every worker exit.\n\nFixes: 57588c71177f (\"mac802154: Handle passive scanning\")\nCc: stable@vger.kernel.org\nSigned-off-by: Ibrahim Hashimov \u003csecurity@auditcode.ai\u003e\nLink: https://patch.msgid.link/20260721211228.34578-1-security@auditcode.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9b2854f86f0b56e9027d68e7a3fc909d1a9b566f", "tree": "9d8edf124075510f367841cec3a4730d0ee63fb1", "parents": [ "d1ff66b66151c14b084e88040512a064b1c1e493" ], "author": { "name": "Jun Yang", "email": "junvyyang@tencent.com", "time": "Tue Jul 21 21:14:05 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:30:31 2026 -0700" }, "message": "sctp: don\u0027t free the ASCONF\u0027s own transport in DEL-IP processing\n\nsctp_process_asconf() caches the transport the ASCONF chunk is processed\nagainst in asconf-\u003etransport (\u003d\u003d chunk-\u003etransport, set once in sctp_rcv()).\nFor an ASCONF located through its Address Parameter by\n__sctp_rcv_asconf_lookup(), that cached transport corresponds to the\nAddress Parameter, which need not be the packet\u0027s source address.\n\nsctp_process_asconf_param() rejects a DEL-IP for the packet source address\n(ADDIP D8, SCTP_ERROR_DEL_SRC_IP), but nothing protects asconf-\u003etransport.\nA single ASCONF can therefore carry, in order:\n\n [Address Parameter L] [DEL-IP L] [DEL-IP 0.0.0.0]\n\nwhere L differs from the source. The DEL-IP for L passes the D8 check and\ncalls sctp_assoc_rm_peer() on the transport that asconf-\u003etransport still\npoints at, freeing it (RCU-deferred). The following wildcard DEL-IP then\nreuses the now-dangling asconf-\u003etransport in sctp_assoc_set_primary() and\nsctp_assoc_del_nonprimary_peers(): set_primary() dereferences the freed\ntransport (-\u003eipaddr, -\u003estate) and plants the dangling pointer into\nasoc-\u003epeer.primary_path / active_path, and del_nonprimary_peers(), keeping\nonly the pointer that is no longer on the list, removes every real\ntransport, leaving the association with a transport_count of 0 and\nprimary_path/active_path pointing at freed memory.\n\nReject a DEL-IP that targets the transport the ASCONF is being processed\nagainst, mirroring the existing source-address guard, so the wildcard\nbranch can never reuse a freed transport.\n\nFixes: 42e30bf3463c (\"[SCTP]: Handle the wildcard ADD-IP Address parameter\")\nCc: stable@kernel.org\nSigned-off-by: Jun Yang \u003cjunvyyang@tencent.com\u003e\nAcked-by: Xin Long \u003clucien.xin@gmail.com\u003e\nLink: https://patch.msgid.link/tencent_73762ED1DF08CC9D5F5F61954B01350CFE0A@qq.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d1ff66b66151c14b084e88040512a064b1c1e493", "tree": "28518904cf215b0baa7b2cc54bedd04d5b580236", "parents": [ "0f71f852a96af9685858ce59fda34ecbf85c283d" ], "author": { "name": "Minhong He", "email": "heminhong@kylinos.cn", "time": "Tue Jul 21 17:39:56 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:28:50 2026 -0700" }, "message": "phonet: check register_netdevice_notifier() error in phonet_device_init()\n\nphonet_device_init() registers a netdevice notifier before calling\nphonet_netlink_register(), but does not check whether notifier\nregistration succeeded. On failure, netlink setup still proceeds and\ninit may return success without the notifier in place.\n\nAlso, the existing phonet_netlink_register() failure path called\nphonet_device_exit(), which runs rtnl_unregister_all() even though\nrtnl_register_many() already unwound any partial registration. Calling\nthe full exit helper on a partial init is not correct.\n\nCheck each registration error, including proc_create_net(), and unwind\nonly the steps that have succeeded so far, in reverse order.\n\nSigned-off-by: Minhong He \u003cheminhong@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260721093956.162617-1-heminhong@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "0f71f852a96af9685858ce59fda34ecbf85c283d", "tree": "6256457ebb1b470c4264fd4fc52c0bba53b38560", "parents": [ "b9e558976bb968162c35ddccdb076a77fc906993" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Tue Jul 21 01:58:45 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:27:08 2026 -0700" }, "message": "phonet: pep: fix use-after-free in pep_get_sb()\n\npep_get_sb() doesn\u0027t consider that pskb_may_pull() might have relocated\nthe skb data, and continue to access the older pointer, causing UAF.\n\nReproduced under KASAN:\n\n BUG: KASAN: slab-use-after-free in pep_get_sb+0x234/0x3b0\n Read of size 1 at addr ff11000105510f50 by task repro/157\n pep_get_sb+0x234/0x3b0\n pipe_handler_do_rcv+0x5f7/0xa10\n pep_do_rcv+0x203/0x410\n __sk_receive_skb+0x471/0x4a0\n phonet_rcv+0x5b3/0x6c0\n __netif_receive_skb+0xcc/0x1d0\n\nRefetch the header with skb_header_pointer() after pskb_may_pull(), so\nthe possibly stale pointer is no longer dereferenced. There are better\nways to solve this, but, this is the less instrusive one.\n\nFixes: 9641458d3ec4 (\"Phonet: Pipe End Point for Phonet Pipes protocol\")\nCc: stable@vger.kernel.org\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260721-phonet_get_sb_uaf-v1-1-95fd7881cc4e@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b9e558976bb968162c35ddccdb076a77fc906993", "tree": "7e92d71d8695da996bea8b2a695d4f510570a0dd", "parents": [ "47f42ff521b4eeb46e82f9a46a4783a99f7570d7" ], "author": { "name": "Vikas Gupta", "email": "vikas.gupta@broadcom.com", "time": "Tue Jul 21 12:07:31 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:24:12 2026 -0700" }, "message": "bnge/bng_re: fix ring ID widths\n\nFirmware requires more than 16 bits to address TX ring IDs for its\ninternal QP management. Widen the associated HSI ring ID fields to\n32 bits. The values firmware assigns remain within 24 bits, bounded\nby the hardware doorbell XID field.\n\nThe fw_ring_id field belongs to bnge_ring_struct, a common struct\nshared by all ring types, so widening it to u32 applies uniformly\nacross TX, RX, CP, and NQ rings but firmware assigns values within\n16-bit range for all ring types except TX, which requires the wider\nfield.\n\nNote that, Thor Ultra hardware has not yet been deployed and no\nfirmware has been released to field, so backward compatibility\nis not a concern.\n\nFixes: 42d1c54d6248 (\"bnge/bng_re: Add a new HSI\")\nSigned-off-by: Vikas Gupta \u003cvikas.gupta@broadcom.com\u003e\nReviewed-by: Siva Reddy Kallam \u003csiva.kallam@broadcom.com\u003e\nReviewed-by: Dharmender Garg \u003cdharmender.garg@broadcom.com\u003e\nReviewed-by: Yendapally Reddy Dhananjaya Reddy \u003cyendapally.reddy@broadcom.com\u003e\nLink: https://patch.msgid.link/20260721063731.2622500-1-vikas.gupta@broadcom.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1306cf6dc1dfd34b97ccff98fcb08168c352dbef", "tree": "ad994f41f765361b985c4c504260c3a76555e6f9", "parents": [ "b8363908ea1ea08c726c4804211a38dd353219fe" ], "author": { "name": "Petr Vorel", "email": "pvorel@suse.cz", "time": "Mon Jul 20 23:51:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:12:51 2026 -0700" }, "message": "selftests: drv-net: Fix TSO test doc\n\nReplace copy paste from csum.py with a real test purpose.\n\nSigned-off-by: Petr Vorel \u003cpvorel@suse.cz\u003e\nLink: https://patch.msgid.link/20260720215149.631145-2-pvorel@suse.cz\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b8363908ea1ea08c726c4804211a38dd353219fe", "tree": "aa646e10d33b4bcc9c727dd24eaffdcb58cd03a2", "parents": [ "94cdc6a2c837d33e64d9453e9110d35af3833eda" ], "author": { "name": "Petr Vorel", "email": "petr.vorel@gmail.com", "time": "Mon Jul 20 23:51:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:12:51 2026 -0700" }, "message": "selftests: drv-net: Fix csum path in doc\n\nC source was moved in 1d0dc857b5d87.\n\nSigned-off-by: Petr Vorel \u003cpvorel@suse.cz\u003e\nLink: https://patch.msgid.link/20260720215149.631145-1-pvorel@suse.cz\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "47f42ff521b4eeb46e82f9a46a4783a99f7570d7", "tree": "c76579e951c78d59f68a851b890a0ceca2b40a76", "parents": [ "d73a2e81f3cf6d870ef59a94f7e30880f4ee56e3" ], "author": { "name": "Cen Zhang (Microsoft)", "email": "blbllhy@gmail.com", "time": "Mon Jul 20 17:41:03 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:11:48 2026 -0700" }, "message": "tipc: fix integer overflow in tipc_recvmsg() and tipc_recvstream()\n\nIn tipc_recvmsg(), the copy length is computed as:\n\n copy \u003d min_t(int, dlen - offset, buflen);\n\nbuflen is size_t but min_t(int, ...) casts it to int. When buflen\nexceeds INT_MAX (e.g. 0xFFFFFFFF via io_uring provided buffers), it\nwraps negative, wins the comparison, and the negative copy length\npropagates to simple_copy_to_iter() where int-to-size_t promotion\nmakes it SIZE_MAX, triggering a WARN_ON. tipc_recvstream() has the\nsame pattern.\n\n Kernel panic - not syncing: kernel: panic_on_warn set ...\n RIP: 0010:simple_copy_to_iter+0x9e/0xd0 (net/core/datagram.c:521)\n Call Trace:\n __skb_datagram_iter+0x123/0x8b0 (net/core/datagram.c:402)\n skb_copy_datagram_iter+0x77/0x1a0 (net/core/datagram.c:534)\n tipc_recvmsg+0x3d7/0xe80 (net/tipc/socket.c:1934)\n io_recvmsg+0x47e/0xda0\n\nFix by changing min_t(int, ...) to min_t(size_t, ...) in both\nfunctions. The result is always \u003c\u003d (dlen - offset), which is bounded\nby TIPC maximum message size (0x1ffff bytes), so the implicit\nnarrowing on assignment to int copy is always safe.\n\nFixes: e9f8b10101c6 (\"tipc: refactor function tipc_sk_recvmsg()\")\nFixes: ec8a09fbbeff (\"tipc: refactor function tipc_sk_recv_stream()\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nReviewed-by: Tung Nguyen \u003ctung.quang.nguyen@est.tech\u003e\nLink: https://patch.msgid.link/20260720214103.47732-1-blbllhy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d73a2e81f3cf6d870ef59a94f7e30880f4ee56e3", "tree": "5bdc5ec8380779e5751ac9c54db92910955fe94d", "parents": [ "649ea07fc25a17aa51bff710baac1ab161022a7c", "f7e6287ccd3abeed9e638b581dc3fdf742106ba3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:04:16 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:04:17 2026 -0700" }, "message": "Merge tag \u0027ovpn-net-20260720\u0027 of https://github.com/OpenVPN/ovpn-net-next\n\nAntonio Quartulli says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIncluded fixes:\n* ensure keepalive timestamps are computed using monotonic source\n* avoid UAF in unlock_ovpn() when iterating over release_list\n* fix memleak in selftest tool\n* ensure reference to peer is acquired before scheduling worker\n (which may drop the not-yet-taken ref)\n* fix refcount leak in case of concurrent TX and RX TCP error\n* fix potential refcount unbalance in case of sock release in\n P2P mode\n\n* tag \u0027ovpn-net-20260720\u0027 of https://github.com/OpenVPN/ovpn-net-next:\n ovpn: use monotonic clock for peer keepalive timeouts\n ovpn: fix use after free in unlock_ovpn()\n selftests/net: ovpn: fix getaddrinfo memory leak in ovpn_parse_remote()\n ovpn: hold peer before scheduling keepalive work\n ovpn: fix peer refcount leak in TCP error paths\n ovpn: avoid putting unrelated P2P peer on socket release\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260720144131.3657121-1-antonio@openvpn.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "649ea07fc25a17aa51bff710baac1ab161022a7c", "tree": "87387ec121b47c93ba257ffc9dbb81c8b610117d", "parents": [ "d9a33cadc70a94c1582f65e6042e81027cd200c6" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Mon Jul 20 13:22:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 10:02:59 2026 -0700" }, "message": "net: airoha: fix ETS channel derivation in airoha_tc_setup_qdisc_ets()\n\nDerive the hardware QoS channel from opt-\u003eparent instead of opt-\u003ehandle\nin airoha_tc_setup_qdisc_ets(). The ETS qdisc handle is either\nuser-specified or auto-allocated by qdisc_alloc_handle() and bears no\nrelation to the HTB leaf classid that identifies the hardware channel.\nHTB derives the channel from TC_H_MIN(opt-\u003eclassid), and ETS is always\nattached as a child of an HTB leaf, so its opt-\u003eparent matches that\nclassid. Using opt-\u003ehandle instead can cause two ETS qdiscs on different\nHTB leaves to collide on the same hardware channel, corrupting scheduler\nconfiguration and stats.\n\nFixes: 20bf7d07c956 (\"net: airoha: Add sched ETS offload support\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260720-airoha-ets-handle-fix-v2-1-6f7129ddc06f@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d9a33cadc70a94c1582f65e6042e81027cd200c6", "tree": "da4c9b3839676e4c7f350248e864c97d26e36e77", "parents": [ "c3f2fc231a39e29fe9f0adc14a3ecc3c1260d3c5" ], "author": { "name": "Minhong He", "email": "heminhong@kylinos.cn", "time": "Mon Jul 20 15:25:18 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:17:36 2026 -0700" }, "message": "mctp: check register_netdevice_notifier() error in mctp_device_init()\n\nmctp_device_init() handles errors from rtnl_af_register() and\nrtnl_register_many(), but ignores the return value of\nregister_netdevice_notifier(). If notifier registration fails, init can\nstill return success while the module is only partially initialized.\n\nCheck the notifier registration error and fail module init early.\n\nFixes: 583be982d934 (\"mctp: Add device handling and netlink interface\")\nSigned-off-by: Minhong He \u003cheminhong@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260720072518.112614-1-heminhong@kylinos.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c3f2fc231a39e29fe9f0adc14a3ecc3c1260d3c5", "tree": "c835b85181a334b203c942f0be6be5722e9b76f9", "parents": [ "167e54c703ccd4fa028feb568b0d1002020cff86" ], "author": { "name": "Clark Wang", "email": "xiaoning.wang@nxp.com", "time": "Mon Jul 20 09:25:08 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:16:14 2026 -0700" }, "message": "ptp: netc: explicitly clear TMR_OFF during initialization\n\nThe NETC timer does not support function level reset, so TMR_OFF_L/H\nregisters are not cleared by pcie_flr(). If TMR_OFF was set to a\nnon-zero value in a previous binding, it will persist across driver\nrebind and cause inaccurate PTP time.\n\nThere is also a hardware issue: after a warm reset or soft reset,\nTMR_OFF_L/H registers appear to be cleared to zero, but the timer clock\ndomain internally retains the stale value. When the timer is re-enabled,\nTMR_CUR_TIME continues to track the old offset until TMR_OFF is written\nexplicitly. This can cause incorrect PTP timestamps and even PTP clock\nsynchronization failures.\n\nPer the recommendation from the IP team, explicitly write 0 to TMR_OFF\nin netc_timer_init() to flush the internally cached value and ensure\nTMR_CUR_TIME follows the freshly initialized counter.\n\nFixes: 87a201d59963 (\"ptp: netc: add NETC V4 Timer PTP driver support\")\nSigned-off-by: Clark Wang \u003cxiaoning.wang@nxp.com\u003e\nSigned-off-by: Wei Fang \u003cwei.fang@nxp.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260720012508.23227-1-wei.fang@oss.nxp.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "167e54c703ccd4fa028feb568b0d1002020cff86", "tree": "9b0a07bc981d59df701e889ecb09572cbd219857", "parents": [ "313a123e1fca8827bb463db1f4bb211309764563" ], "author": { "name": "Cen Zhang (Microsoft)", "email": "blbllhy@gmail.com", "time": "Sun Jul 19 17:03:57 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:15:20 2026 -0700" }, "message": "rds: tcp: unregister sysctl before tearing down listen socket\n\nrds_tcp_exit_net() frees the per-netns RDS TCP listen socket via\nrds_tcp_kill_sock() before unregistering the per-netns sysctl table. Since\nrds_tcp_skbuf_handler() derives the netns from\nrtn-\u003erds_tcp_listen_sock-\u003esk, a concurrent sysctl write can race with\nnetns teardown and dereference the freed socket/sk.\n\nKASAN reports the race as:\n\n BUG: KASAN: slab-use-after-free in rds_tcp_skbuf_handler+0x2aa/0x2e0\n rds_tcp_skbuf_handler net/rds/tcp.c:721\n proc_sys_call_handler fs/proc/proc_sysctl.c\n vfs_write fs/read_write.c\n __x64_sys_pwrite64 fs/read_write.c\n\nFix this by unregistering the RDS TCP sysctl table before calling\nrds_tcp_kill_sock(). unregister_net_sysctl_table() prevents new sysctl\nhandlers from starting and waits for in-flight handlers to finish, so\nthe listen socket can then be released safely. The fix was tested\nagainst the linked reproducer.\n\nFixes: 7f5611cbc487 (\"rds: sysctl: rds_tcp_{rcv,snd}buf: avoid using current-\u003ensproxy\")\nReported-by: AutonomousCodeSecurity@microsoft.com\nLink: https://lore.kernel.org/all/20260719203718.9680-1-blbllhy@gmail.com\nReviewed-by: Allison Henderson \u003cachender@kernel.org\u003e\nSigned-off-by: Cen Zhang (Microsoft) \u003cblbllhy@gmail.com\u003e\nLink: https://patch.msgid.link/20260719210357.10179-1-blbllhy@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "313a123e1fca8827bb463db1f4bb211309764563", "tree": "3df73ba2fa8bbc912b9542b716592972b8791028", "parents": [ "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d" ], "author": { "name": "Nikola Z. Ivanov", "email": "zlatistiv@gmail.com", "time": "Sun Jul 19 13:57:59 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:13:13 2026 -0700" }, "message": "ipv6: Change allocation flags to match rcu_read_lock section requirements\n\nSince the call to __ip6_del_rt_siblings has been converted under\nrcu read lock and it only has one call point\nwe should no longer block or yield.\n\nOur stack trace from the syzbot reproducer looks as follows:\n\n__ip6_del_rt_siblings\n rtnl_notify (Here we pass gfp_any() -\u003e GFP_KERNEL)\n nlmsg_notify\n nlmsg_multicast\n nlmsg_multicast_filtered\n netlink_broadcast_filtered (GFP_KERNEL passed from earlier)\n\nnetlink_broadcast_filtered can yield if GFP_KERNEL\nis passed, which we do not want to happen.\n\nFix this by changing the allocation flag of rtnl_notify.\n\nAlso change the flag passed to nlmsg_new. Even though it\nis not related to the syzbot generated bug it still falls\nunder the same requirements.\n\nReported-by: syzbot+84d4a405ed798b40c96d@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003d84d4a405ed798b40c96d\nFixes: bd11ff421d36 (\"ipv6: Get rid of RTNL for SIOCDELRT and RTM_DELROUTE.\")\nSigned-off-by: Nikola Z. Ivanov \u003czlatistiv@gmail.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20260719105759.558050-1-zlatistiv@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ee7f9bb9320add61f7b367d7e6cd55e3a3a4d65d", "tree": "d586b6a6f169463a837280fdeefed542c38e9d3b", "parents": [ "7fd55911fdb13d280133a10f41cc214df1021fc2" ], "author": { "name": "Sungmin Kang", "email": "726ksm@gmail.com", "time": "Sat Jul 18 16:36:30 2026 +0900" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:06:48 2026 -0700" }, "message": "net: slip: serialize receive against buffer reallocation\n\nsl_realloc_bufs() replaces rbuff and updates buffsize while holding\nsl-\u003elock. slip_receive_buf() reads those fields and writes through rbuff\nwithout holding the lock.\n\nAn MTU change can therefore race with receive processing. An MTU shrink\ncan expose the new smaller rbuff with the old larger bound, causing an\nout-of-bounds write. A receive callback which already loaded the old\nrbuff can instead continue writing after that buffer has been freed.\n\nSerialize receive processing with sl_realloc_bufs() by holding sl-\u003elock\nwhile consuming each receive batch.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sungmin Kang \u003c726ksm@gmail.com\u003e\nLink: https://patch.msgid.link/20260718073631.1674-1-726ksm@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7fd55911fdb13d280133a10f41cc214df1021fc2", "tree": "3934c3bb26dbe258b9c448e0919440222e5703b9", "parents": [ "440e274da4d1b93c7df2cb0ce893c3009dd4db55", "237f1f7653b8729169af11fae79f01b90d00b87e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:51 2026 -0700" }, "message": "Merge branch \u0027intel-wired-lan-driver-updates-2026-07-17-ice-idpf-iavf\u0027\n\nTony Nguyen says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Driver Updates 2026-07-17 (ice, idpf) [part]\n\nFor ice:\nVincent Chen fixes issue preventing VF creation when switchdev is not\nenabled in the configuration.\n\nMarcin corrects iteration value for profile association that was\ntruncating profiles.\n\nKarol bypasses, unnecessary, waiting on sideband queue PTP writes which\ncan cause failures with phc_ctl program.\n\nSergey adds READ_ONCE() to access of PHC time to prevent torn read on\n32-bit systems.\n\nPaul adds a check for uninitialized PTP state before attempting to\nrebuild it and restricts check of TxTime to be for PF VSI only.\n\nAlex adds bounds check on PTYPE to prevent possible out-of-bounds write.\n\nFor idpf:\nEmil defers setting of adapter max_vports value to prevent inadvertent\nuse if interim allocation errors are encountered.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260717185340.3595286-1-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "237f1f7653b8729169af11fae79f01b90d00b87e", "tree": "3934c3bb26dbe258b9c448e0919440222e5703b9", "parents": [ "59abb87159c53605c063f6e2ceb215b5eba43ee6" ], "author": { "name": "Emil Tantilov", "email": "emil.s.tantilov@intel.com", "time": "Fri Jul 17 11:53:34 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "idpf: fix max_vport related crash on allocation error during init\n\nSet adapter-\u003emax_vports only after successful allocation of vports, netdevs\nand vport_config buffers. This fixes possible crashes on reset or rmmod,\nfollowing failed allocation on init\n\n[ 305.981402] idpf 0000:83:00.0: enabling device (0100 -\u003e 0102)\n[ 305.994464] idpf 0000:83:00.0: Device HW Reset initiated\n[ 320.416872] BUG: kernel NULL pointer dereference, address: 0000000000000000\n[ 320.416918] #PF: supervisor read access in kernel mode\n[ 320.416942] #PF: error_code(0x0000) - not-present page\n[ 320.416963] PGD 2099657067 P4D 0\n[ 320.416983] Oops: Oops: 0000 [#1] SMP NOPTI\n...\n[ 320.417093] RIP: 0010:idpf_remove+0x118/0x200 [idpf]\n[ 320.417130] Code: 8b bb 98 09 00 00 e8 17 0f 5b e5 48 8b bb e8 08 00 00 e8 0b 0f 5b e5 66 83 bb 28 06 00 00 00 48 8b bb 20 06 00 00 74 49 31 ed \u003c48\u003e 8b 04 ef 48 85 c0 74 2f 48 8b 78 20 e8 66 58 91 e5 48 8b 83 20\n[ 320.417183] RSP: 0018:ff7322212903fdb8 EFLAGS: 00010246\n[ 320.417205] RAX: 0000000000000000 RBX: ff4463de40300000 RCX: ff7322212903fd4c\n[ 320.417228] RDX: 0000000000000001 RSI: ffffffffa7f7d100 RDI: 0000000000000000\n[ 320.417250] RBP: 0000000000000000 R08: 0000000000000001 R09: 0000000000000000\n[ 320.417272] R10: 0000000000000001 R11: ff4463de3a638f58 R12: ff4463be89ac7000\n[ 320.417294] R13: ff4463be89ac7198 R14: ff4463be94fc7198 R15: ffffffffc0f10f20\n[ 320.417317] FS: 00007f963c0e6740(0000) GS:ff4463fdd65d8000(0000) knlGS:0000000000000000\n[ 320.417342] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033\n[ 320.417362] CR2: 0000000000000000 CR3: 00000020ba674002 CR4: 0000000000773ef0\n[ 320.417385] PKRU: 55555554\n[ 320.417398] Call Trace:\n[ 320.417412] \u003cTASK\u003e\n[ 320.417429] pci_device_remove+0x42/0xb0\n[ 320.417459] device_release_driver_internal+0x1a9/0x210\n[ 320.417492] driver_detach+0x4b/0x90\n[ 320.417516] bus_remove_driver+0x70/0x100\n[ 320.417539] pci_unregister_driver+0x2e/0xb0\n[ 320.417564] __do_sys_delete_module.constprop.0+0x190/0x2f0\n[ 320.417592] ? kmem_cache_free+0x31e/0x550\n[ 320.417619] ? lockdep_hardirqs_on_prepare+0xde/0x190\n[ 320.417644] ? do_syscall_64+0x38/0x6b0\n[ 320.417665] do_syscall_64+0xc8/0x6b0\n[ 320.417683] ? clear_bhb_loop+0x30/0x80\n[ 320.417706] entry_SYSCALL_64_after_hwframe+0x76/0x7e\n[ 320.417727] RIP: 0033:0x7f963bb30beb\n\nFixes: 0fe45467a104 (\"idpf: add create vport and netdev configuration\")\nReviewed-by: Madhu Chittim \u003cmadhu.chittim@intel.com\u003e\nSigned-off-by: Emil Tantilov \u003cemil.s.tantilov@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Samuel Salin \u003cSamuel.salin@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-13-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "59abb87159c53605c063f6e2ceb215b5eba43ee6", "tree": "19e7db766dd54d6172067b014197a05dc9f77b13", "parents": [ "144539bbfd3cea1ab0fb6f5216d6004c1f4f029b" ], "author": { "name": "Aleksandr Loktionov", "email": "aleksandr.loktionov@intel.com", "time": "Fri Jul 17 11:53:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: reject out-of-range ptype in ice_parser_profile_init\n\nset_bit(rslt-\u003eptype, prof-\u003eptypes) operates on a DECLARE_BITMAP of\nICE_FLOW_PTYPE_MAX (1024) bits. Nothing prevents a malicious VF from\nproviding ptype \u003e\u003d 1024 through VIRTCHNL, resulting in a write past\nthe end of the bitmap and a kernel page fault.\n\nReproduced with a custom kernel module injecting a crafted\nVIRTCHNL_OP_ADD_RSS_CFG on E810-C QSFP (8086:1592),\nFW 4.91 0x800214af 1.3909.0, ICE COMMS DDP 1.3.53.0,\nkernel 7.1.0-rc1.\n\ncrash_parser: ice_parser_profile_init @ ffffffffc0d61b60\ncrash_parser: setting ptype\u003d0xffff (max valid\u003d1023)\ncrash_parser: calling ice_parser_profile_init -- expect OOB crash!\nBUG: kernel NULL pointer dereference, address: 0000000000000000\nOops: Oops: 0002 [#1] SMP NOPTI\nCPU: 56 UID: 0 PID: 165011 Comm: insmod Kdump: loaded Tainted: G S U OE 7.1.0-rc1 #1\nHardware name: Intel Corporation S2600BPB/S2600BPB\nRIP: 0010:ice_parser_profile_init+0x2d/0x1d0 [ice]\nCall Trace:\n \u003cTASK\u003e\n ? __pfx_ice_parser_profile_init+0x10/0x10 [ice]\n crash_init+0x127/0xff0 [crash_parser]\n do_one_initcall+0x45/0x310\n do_init_module+0x64/0x270\n init_module_from_file+0xcc/0xf0\n idempotent_init_module+0x17b/0x280\n __x64_sys_finit_module+0x6e/0xe0\n\nBail out early with -EINVAL when ptype is out of range.\n\nFixes: e312b3a1e209 (\"ice: add API for parser profile initialization\")\nCc: stable@vger.kernel.org\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Marcin Szycik \u003cmarcin.szycik@linux.intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-12-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "144539bbfd3cea1ab0fb6f5216d6004c1f4f029b", "tree": "e198e94cbd3af97f95d52ece23d64a00f941a92f", "parents": [ "f6a7e00b81e35ef1325234925f2fe1e53b466f92" ], "author": { "name": "Paul Greenwalt", "email": "paul.greenwalt@intel.com", "time": "Fri Jul 17 11:53:32 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: prevent tstamp ring allocation for non-PF VSI types\n\nThe pf-\u003etxtime_txqs bitmap tracks which Tx queues have ETF (Earliest\nTxTime First) offload enabled. This bitmap is indexed by queue number\nand is set by ice_offload_txtime(), which only operates on PF VSI\nqueues.\n\nHowever, ice_is_txtime_ena() does not check the VSI type before\nconsulting the bitmap. When ETF offload is enabled on PF Tx queue 0,\nbit 0 is set in pf-\u003etxtime_txqs. During a subsequent PCI reset\nrebuild, the CTRL VSI\u0027s Tx queue 0 is reconfigured and\nice_is_txtime_ena() is called for that ring. Since it only checks\npf-\u003etxtime_txqs by queue index without distinguishing VSI type, it\nfinds bit 0 set and returns true, matching the PF VSI\u0027s ETF queue,\nnot the CTRL VSI\u0027s. This causes ice_vsi_cfg_txq() to spuriously\nallocate a tstamp_ring for the CTRL VSI ring.\n\nSince CTRL VSI rings have no associated netdev, ice_clean_tx_ring()\ntakes an early return at the !netdev check before reaching\nice_free_tx_tstamp_ring(), leaking the allocation. Each PCI reset\nleaks one 64-byte tstamp_ring.\n\nFix this by restricting ice_is_txtime_ena() to return true only for\nPF VSI rings, since txtime_txqs is only meaningful for PF VSI queues.\n\nFixes: ccde82e90946 (\"ice: add E830 Earliest TxTime First Offload support\")\nSigned-off-by: Paul Greenwalt \u003cpaul.greenwalt@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-11-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6a7e00b81e35ef1325234925f2fe1e53b466f92", "tree": "2cbf27a57529dc92efc2a47f601da7c5b453695f", "parents": [ "2915681b89f817677ab9f1166d95b595bc144f5f" ], "author": { "name": "Paul Greenwalt", "email": "paul.greenwalt@intel.com", "time": "Fri Jul 17 11:53:31 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: fix PTP Call Trace during PTP release\n\nIf a PF reset occurs when the PTP state is ICE_PTP_UNINIT, then\nice_ptp_rebuild() will update the state to ICE_PTP_ERROR. This will\nresult in the following PTP release call trace during driver unload:\n\n kernel BUG at lib/list_debug.c:52!\n ice_ptp_release+0x332/0x3c0 [ice]\n ice_deinit_features.part.0+0x10e/0x120 [ice]\n ice_remove+0x100/0x220 [ice]\n\nThis was observed when passing PF1 through to a VM. ice_ptp_init()\nfails because ctrl_pf is NULL and sets the state to ICE_PTP_UNINIT.\n\nFix by detecting the ICE_PTP_UNINIT state in ice_ptp_rebuild() and\nreturning without error, preventing the invalid state transition to\nICE_PTP_ERROR. The only valid path to ICE_PTP_ERROR is from\nICE_PTP_RESETTING after a failed rebuild.\n\nFixes: 8293e4cb2ff5 (\"ice: introduce PTP state machine\")\nCc: stable@vger.kernel.org\nSigned-off-by: Paul Greenwalt \u003cpaul.greenwalt@intel.com\u003e\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-10-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2915681b89f817677ab9f1166d95b595bc144f5f", "tree": "259eccb0ea9891d51ef36fc8e7815998f248de30", "parents": [ "d6da9b7d48599db078aea6144997a381f8d90d45" ], "author": { "name": "Sergey Temerkhanov", "email": "sergey.temerkhanov@intel.com", "time": "Fri Jul 17 11:53:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: use READ_ONCE() to access cached PHC time\n\nptp.cached_phc_time is a 64-bit value updated by a periodic work item\non one CPU and read locklessly on another. On 32-bit or non-atomic\narchitectures this can result in a torn read. Use READ_ONCE() to\nenforce a single atomic load.\n\nFixes: 77a781155a65 (\"ice: enable receive hardware timestamping\")\nCc: stable@vger.kernel.org\nSigned-off-by: Sergey Temerkhanov \u003csergey.temerkhanov@intel.com\u003e\nSigned-off-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-9-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d6da9b7d48599db078aea6144997a381f8d90d45", "tree": "6d54e518249601f01f1aedb2f378aecb21c3e7ef", "parents": [ "2d19302f628853742c4828381abbd668c1315598" ], "author": { "name": "Marcin Szycik", "email": "marcin.szycik@linux.intel.com", "time": "Fri Jul 17 11:53:28 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: fix LAG recipe to profile association\n\nice_init_lag() associates recipes to profiles, assuming that Link\nAggregation-related profiles will always have profile ID lower than 70\n(ICE_PROFID_IPV6_GTPU_IPV6_TCP_INNER). This value seems arbitrary and\nmight not always be valid for some versions of DDP package, i.e. LAG\nprofiles may have profile ID greater than 70. This would lead to\nmisconfigured switch and LAG not working properly.\n\nFix it by checking up to maximum profile ID.\n\nFixes: 1e0f9881ef79 (\"ice: Flesh out implementation of support for SRIOV on bonded interface\")\nSigned-off-by: Marcin Szycik \u003cmarcin.szycik@linux.intel.com\u003e\nReviewed-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Dave Ertman \u003cdavid.m.ertman@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-7-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2d19302f628853742c4828381abbd668c1315598", "tree": "e94df110f39e7be3fd89ae1dd6a71ae9b557fe4b", "parents": [ "99d0f42b0e5c57e4c02070a908aaff082881293a" ], "author": { "name": "Michal Swiatkowski", "email": "michal.swiatkowski@linux.intel.com", "time": "Fri Jul 17 11:53:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: pass the return value of skb_checksum_help()\n\nskb_checksum_help() can fail. Pass its return value back to the caller.\n\nCommonize this software path in goto.\n\nInstead of just returning error try calculating software checksum first.\nThere is a check for TSO in checksum_sw_fb.\n\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Michal Swiatkowski \u003cmichal.swiatkowski@linux.intel.com\u003e\nTested-by: Rinitha S \u003csx.rinitha@intel.com\u003e (A Contingent worker at Intel)\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-4-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "99d0f42b0e5c57e4c02070a908aaff082881293a", "tree": "7bd6aa6bf5d9d784af7910a14c42628d709eac9f", "parents": [ "440e274da4d1b93c7df2cb0ce893c3009dd4db55" ], "author": { "name": "Vincent Chen", "email": "vincent.chen@sifive.com", "time": "Fri Jul 17 11:53:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 09:00:50 2026 -0700" }, "message": "ice: allow creating VFs when !CONFIG_ICE_SWITCHDEV\n\nCurrently ice_eswitch_attach_vf() is called unconditionally in\nice_start_vfs(), which causes VF creation to fail when CONFIG_ICE_SWITCHDEV\nis not defined.\n\nFix this by adding switchdev mode checks at the call sites before\ncalling ice_eswitch_attach_vf(), consistent with how\nice_eswitch_attach_sf() is already handled in ice_devlink_port_new().\nThis is similar to commit aacca7a83b97 (\"ice: allow creating VFs for\n!CONFIG_NET_SWITCHDEV\") which fixed the same issue for the previous\nice_eswitch_configure() API.\n\nFixes: 415db8399d06 (\"ice: make representor code generic\")\nSigned-off-by: Vincent Chen \u003cvincent.chen@sifive.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Tony Nguyen \u003canthony.l.nguyen@intel.com\u003e\nLink: https://patch.msgid.link/20260717185340.3595286-2-anthony.l.nguyen@intel.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "440e274da4d1b93c7df2cb0ce893c3009dd4db55", "tree": "d571a858ac89608dece038a3c46fa47ef498ea82", "parents": [ "bb0d96ebe5f4d1acccf4dc36ca7f01f9a8fa1ba1" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Fri Jul 17 22:32:30 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:31:44 2026 -0700" }, "message": "net: ipv6: fix dif and sdif mismatch in raw6_icmp_error\n\nIn raw6_icmp_error(), raw_v6_match() is called with inet6_iif(skb) passed\nto both the \u0027dif\u0027 and \u0027sdif\u0027 arguments. This is a copy-paste or typo error,\nas the last argument should represent the secondary interface index (sdif).\n\nThis mismatch breaks ICMPv6 error handling for IPv6 raw sockets in VRF\n(Virtual Routing and Forwarding) environments. When a raw socket is bound\nto a VRF master device, raw_v6_match() fails to find a match because it is\nnot given the correct sdif value, causing the socket to miss relevant\nICMPv6 error notifications.\n\nFix this by properly passing inet6_sdif(skb) as the last argument to\nraw_v6_match().\n\nFixes: 5108ab4bf446fa (\"net: ipv6: add second dif to raw socket lookups\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nReviewed-by: Joe Damato \u003cjoe@dama.to\u003e\nLink: https://patch.msgid.link/20260717143230.1836-1-lirongqing@baidu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bb0d96ebe5f4d1acccf4dc36ca7f01f9a8fa1ba1", "tree": "d12c5947a0f96f82e339c4d101ad1a0e34455b4b", "parents": [ "1087ba5497ae84281750da0020c30a9074782714" ], "author": { "name": "Hariprasad Kelam", "email": "hkelam@marvell.com", "time": "Fri Jul 17 14:13:49 2026 +0530" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:30:07 2026 -0700" }, "message": "octeontx2-pf: tc: fix egress ratelimiting\n\nThe egress rate calculation computes an incorrect mantissa and exponent,\ncausing up to ~50% deviation from the configured rate at lower speeds.\n\nRework the computation to follow the hardware rate formula:\n\n\trate \u003d 2 * (1 + mantissa/256) * 2^exp / (1 \u003c\u003c div_exp)\n\nKeep div_exp \u003d 0 and derive exp and mantissa from half of the requested\nrate. Rates below 2 Mbps are floored to the smallest encodable step\n(exp \u003d 0, mantissa \u003d 0).\n\nFixes: e638a83f167e (\"octeontx2-pf: TC_MATCHALL egress ratelimiting offload\")\nSigned-off-by: Hariprasad Kelam \u003chkelam@marvell.com\u003e\nSigned-off-by: Nitin Shetty J \u003cnshettyj@marvell.com\u003e\nLink: https://patch.msgid.link/20260717084349.2227796-1-nshettyj@marvell.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1087ba5497ae84281750da0020c30a9074782714", "tree": "0ded6bc648645e415f079ffe6424bf4850212bca", "parents": [ "9dfd800b374c38681364d4b3606a8b831d1478e3", "7bb18355e5996a70b15ad571f5597e13d61af00d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:27:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:27:24 2026 -0700" }, "message": "Merge branch \u0027tcp-validate-rst-sequence-in-syn-received\u0027\n\nYuxiang Yang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ntcp: validate RST sequence in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path accepts any in-window RST and\nremoves the request, even when SEG.SEQ does not exactly match RCV.NXT.\nRFC 9293 requires a challenge ACK for a non-exact in-window RST.\n\nPatch 1 applies the RFC 5961 sequence check to request sockets and shares\nthe per-netns challenge ACK quota with the established-socket path.\nPatch 2 adds a compact packetdrill regression test for exact, non-exact,\nRST|ACK, and out-of-window cases.\n\nThe implementation was tested with a separate raw-socket A/B harness on\nIPv4 and IPv6: the unpatched kernel passed 4/12 cases and the patched\nkernel passed 12/12. The packetdrill test fails on the unpatched kernel\nand passes on the patched kernel for IPv4, IPv6, and IPv4-mapped IPv6\nunder QEMU/TCG.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260717081443.809393-1-yangyx22@mails.tsinghua.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7bb18355e5996a70b15ad571f5597e13d61af00d", "tree": "0ded6bc648645e415f079ffe6424bf4850212bca", "parents": [ "a28c4fcbf774e23b4779cae468e3497a5ad1f4a1" ], "author": { "name": "Yuxiang Yang", "email": "yangyx22@mails.tsinghua.edu.cn", "time": "Fri Jul 17 08:14:43 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:27:22 2026 -0700" }, "message": "selftests/net: packetdrill: cover RST validation in SYN-RECEIVED\n\nAdd packetdrill coverage for the RFC 9293 reset checks on request\nsockets in SYN-RECEIVED. Verify that an exact RST removes the request,\na non-exact in-window RST sends a challenge ACK without removing it,\nand an out-of-window RST is silently discarded.\n\nAlso cover an RST|ACK with an unacceptable ACK number to ensure RST\nsequence validation runs before ACK-field validation.\n\nSigned-off-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260717081443.809393-3-yangyx22@mails.tsinghua.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a28c4fcbf774e23b4779cae468e3497a5ad1f4a1", "tree": "08cffd84e4fef9d2148b49c9e00b0371d7ab27bc", "parents": [ "9dfd800b374c38681364d4b3606a8b831d1478e3" ], "author": { "name": "Yuxiang Yang", "email": "yangyx22@mails.tsinghua.edu.cn", "time": "Fri Jul 17 08:14:42 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:27:22 2026 -0700" }, "message": "tcp: challenge ACK for non-exact RST in SYN-RECEIVED\n\nThe SYN-RECEIVED request-socket path in tcp_check_req() accepts an\nin-window RST without requiring SEG.SEQ to exactly match RCV.NXT. A\nnon-exact RST therefore removes the request instead of eliciting a\nchallenge ACK.\n\nRFC 9293 section 3.10.7.4 applies the RFC 5961 reset check in\nSYN-RECEIVED: an exact RST resets the connection, while a non-exact\nin-window RST must trigger a challenge ACK and be dropped.\n\nApply that check before the ACK-field validation, following the RFC\nsequence-number, RST, then ACK processing order. Factor the per-netns\nchallenge ACK quota out of tcp_send_challenge_ack() so request sockets\ncan share it. Use the request socket\u0027s send_ack() callback and its own\nout-of-window ACK timestamp to send and rate-limit the response.\n\nReported-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReported-by: Yizhou Zhao \u003czhaoyz24@mails.tsinghua.edu.cn\u003e\nReported-by: Ao Wang \u003cwangao@seu.edu.cn\u003e\nReported-by: Xuewei Feng \u003cfengxw06@126.com\u003e\nReported-by: Qi Li \u003cqli01@tsinghua.edu.cn\u003e\nReported-by: Ke Xu \u003cxuke@tsinghua.edu.cn\u003e\nFixes: 282f23c6ee34 (\"tcp: implement RFC 5961 3.2\")\nCc: stable@vger.kernel.org\nSigned-off-by: Yuxiang Yang \u003cyangyx22@mails.tsinghua.edu.cn\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260717081443.809393-2-yangyx22@mails.tsinghua.edu.cn\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9dfd800b374c38681364d4b3606a8b831d1478e3", "tree": "236760af690dbe8a832259fde3d8922e89a302bf", "parents": [ "6bd1befbd3a8c0bb20e6fe9b48584861a4a0fed1" ], "author": { "name": "Diego Fernando Mancera Gomez", "email": "diegomancera.dev@gmail.com", "time": "Fri Jul 17 02:07:04 2026 -0600" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:26:15 2026 -0700" }, "message": "usb: atm: ueagle-atm: reject descriptors that confuse probe and disconnect\n\nuea_probe() distinguishes a pre-firmware device from a post-firmware one\nusing the USB id (UEA_IS_PREFIRM()), and stores a different object as the\ninterface data in each case: a \u0027struct completion\u0027 for a pre-firmware\ndevice (to be waited on in .disconnect()), or a \u0027struct usbatm_data\u0027 for a\npost-firmware one.\n\nuea_disconnect() instead tells the two apart by the number of interfaces\nof the active configuration (a pre-firmware device exposes a single\ninterface, ADI930 has 2 and eagle has 3), and casts the interface data\naccordingly.\n\nBecause the two handlers use different criteria, a crafted device that\nadvertises a pre-firmware id together with a multi-interface descriptor\n(or a post-firmware id with a single interface) makes them disagree: the\nsmall \u0027struct completion\u0027 stored by uea_probe() is then passed to\nusbatm_usb_disconnect(), which casts it to \u0027struct usbatm_data\u0027 and takes\ninstance-\u003eserialize, reading past the end of the allocation:\n\n BUG: KASAN: slab-out-of-bounds in __mutex_lock+0x152a/0x1b80\n Read of size 8 at addr ffff8880470e2c60 by task kworker/1:2/982\n ...\n __mutex_lock+0x152a/0x1b80\n usbatm_usb_disconnect+0x70/0x820\n uea_disconnect+0x133/0x2c0\n usb_unbind_interface+0x1dd/0x9e0\n ...\n which belongs to the cache kmalloc-96 of size 96\n The buggy address is located 0 bytes to the right of\n allocated 96-byte region [ffff8880470e2c00, ffff8880470e2c60)\n\nReject such inconsistent descriptors in uea_probe() so that both handlers\nalways make the same pre/post-firmware decision.\n\nReported-by: syzbot+e62a973f8322b3bbe3ac@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003de62a973f8322b3bbe3ac\nFixes: e2674dfbed8a (\"usb: atm: ueagle-atm: wait for pre-firmware load in .disconnect()\")\nSigned-off-by: Diego Fernando Mancera Gomez \u003cdiegomancera.dev@gmail.com\u003e\nAcked-by: Stanislaw Gruszka \u003cstf_xl@wp.pl\u003e\nLink: https://patch.msgid.link/20260717080704.1264-1-diegomancera.dev@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6bd1befbd3a8c0bb20e6fe9b48584861a4a0fed1", "tree": "f67d8fc20d1e8abb5475049db7147c7b6e32cf98", "parents": [ "def9a4745e105145133e442dd8a1c126caf0f553", "9173e1d3c7c7d49a71eee813091f9e834ec7cee5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:24:55 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:24:55 2026 -0700" }, "message": "Merge branch \u0027net-mlx5e-report-zero-bandwidth-for-non-ets-traffic\u0027\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/mlx5e: Report zero bandwidth for non-ETS traffic\n\nThe IEEE 802.1Qaz standard restricts bandwidth allocation percentages\nto Enhanced Transmission Selection (ETS) traffic classes; STRICT,\nVENDOR, and CB Shaper TSA types carry no bandwidth semantics. Two\nproblems exist in the mlx5e DCBNL ETS implementation: the get path\nreports 100% bandwidth for all TCs regardless of TSA type due to a\nhardware limitation, introduced by commit 820c2c5e773d (\"net/mlx5e:\nRead ETS settings directly from firmware\"), and the set path does\nnot reject the unsupported CB Shaper TSA, introduced by commit\n08fb1dacdd76 (\"net/mlx5e: Support DCBNL IEEE ETS\").\n\nThis series by Alexei Lazar fixes the get path to report zero\nbandwidth for non-ETS traffic classes, and rejects CB Shaper TSA\nconfigurations that the driver does not support.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260717075125.1244877-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9173e1d3c7c7d49a71eee813091f9e834ec7cee5", "tree": "f67d8fc20d1e8abb5475049db7147c7b6e32cf98", "parents": [ "ffb1873b2df11945b8c395e859169248675c91c5" ], "author": { "name": "Alexei Lazar", "email": "alazar@nvidia.com", "time": "Fri Jul 17 10:51:25 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:24:52 2026 -0700" }, "message": "net/mlx5e: Reject unsupported CB Shaper TSA in ETS validation\n\nCredit Based (CB) TSA is not supported by the mlx5 driver, so reject\nany configurations that specify it.\n\nFixes: 08fb1dacdd76 (\"net/mlx5e: Support DCBNL IEEE ETS\")\nSigned-off-by: Alexei Lazar \u003calazar@nvidia.com\u003e\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260717075125.1244877-3-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ffb1873b2df11945b8c395e859169248675c91c5", "tree": "0c68d1b90e3b53964a5f09ad54163997280a1c93", "parents": [ "def9a4745e105145133e442dd8a1c126caf0f553" ], "author": { "name": "Alexei Lazar", "email": "alazar@nvidia.com", "time": "Fri Jul 17 10:51:24 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:24:52 2026 -0700" }, "message": "net/mlx5e: Report zero bandwidth for non-ETS traffic classes\n\nThe IEEE 802.1Qaz standard defines that bandwidth allocation percentages\nonly apply to Enhanced Transmission Selection (ETS) traffic classes.\nFor STRICT and VENDOR transmission selection algorithms, bandwidth\npercentage values are not applicable.\n\nCurrently for non-ETS 100 bandwidth is being reported for all traffic\nclasses in the get operation due to hardware limitation, regardless of\ntheir TSA type.\n\nFix this by reporting 0 for non-ETS traffic classes.\n\nFixes: 820c2c5e773d (\"net/mlx5e: Read ETS settings directly from firmware\")\nSigned-off-by: Alexei Lazar \u003calazar@nvidia.com\u003e\nReviewed-by: Carolina Jubran \u003ccjubran@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nReviewed-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260717075125.1244877-2-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "def9a4745e105145133e442dd8a1c126caf0f553", "tree": "5d110bd18e0518e3cf101e7fd8b35f771930e591", "parents": [ "d12956d083eb70f2c6d72711aebaf8c2ce21e170" ], "author": { "name": "Coia Prant", "email": "coiaprant@gmail.com", "time": "Fri Jul 17 15:43:25 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:22:21 2026 -0700" }, "message": "net: pcs: xpcs: fix SGMII state reading\n\nCommit 2a22b7ae2fa3 (\"net: pcs: xpcs: adapt Wangxun NICs for SGMII mode\")\nadded a path in xpcs_get_state_c37_sgmii() that reads speed/duplex from\nBMCR after AN completes. However, BMCR does not reflect the negotiated\nresult on the hardware where this has been tested:\n\n- On RK3568 (MAC side SGMII), BMCR returns a fixed hardware reset value\n- Wangxun engineer Jiawen Wu confirmed that on their side, \"BMCR looks\n like it only wants to be return as 0\" [0]\n\nThe correct information is available in CL37_ANSGM_STS, which contains\nthe actual link status and negotiated speed/duplex.\n\nThis bug was previously masked by phylink core, which overrides the PCS\nlink state with the PHY state when a PHY is present:\n\n /* If we have a phy, the \"up\" state is the union of both the\n * PHY and the MAC\n */\n if (phy)\n link_state.link \u0026\u003d pl-\u003ephy_state.link;\n\nThus, when the link is down, the PHY\u0027s link_down state is applied on top\nof whatever the PCS reports, hiding the broken PCS state reading path.\n\nModify xpcs_get_state_c37_sgmii() to:\n1. Read link state from CL37_ANSGM_STS\n2. If link is up, report speed/duplex from CL37_ANSGM_STS\n3. Remove the broken BMCR reading path entirely\n\nAlso properly set state-\u003ean_complete to reflect the AN completion status,\nand clear CL37_ANCMPLT_INTR when link is down to avoid stale state.\n\n[0] https://lore.kernel.org/all/000c01dd1593$2ac0b0f0$804212d0$@trustnetic.com/\n\nFixes: 2a22b7ae2fa3 (\"net: pcs: xpcs: adapt Wangxun NICs for SGMII mode\")\nCc: stable@vger.kernel.org\nTested-by: Jiawen Wu \u003cjiawenwu@trustnetic.com\u003e\nSigned-off-by: Coia Prant \u003ccoiaprant@gmail.com\u003e\nTested-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20260717074324.3250043-2-coiaprant@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d12956d083eb70f2c6d72711aebaf8c2ce21e170", "tree": "6989fee6e977c9a74c1306e04f5e383785c9d80a", "parents": [ "11c057d23465c7a5817a7284c896d19d54c0b616" ], "author": { "name": "Yael Chemla", "email": "ychemla@nvidia.com", "time": "Fri Jul 17 10:33:06 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:21:27 2026 -0700" }, "message": "net/mlx5: E-Switch, fix zero num_dest in prio_tag egress vlan rule\n\nesw_egress_acl_vlan_create() hardcodes num_dest\u003d0 in its\nmlx5_add_flow_rules() call. When invoked from the non-bond path\nfwd_dest is NULL and num_dest\u003d0 is correct. When invoked from\nesw_acl_egress_ofld_rules_create() during a bond event, fwd_dest is\nnon-NULL and flow_act.action carries MLX5_FLOW_CONTEXT_ACTION_FWD_DEST,\nbut _mlx5_add_flow_rules() rejects a non-NULL dest pointer paired with\ndest_num\u003c\u003d0 and returns -EINVAL. The error propagates as\n\"configure slave vport egress fwd, err(-22)\". The passive vport\u0027s egress\nACL table ends up with its flow groups allocated but no FTEs, so\nprio-tagged packets are not popped and bond failover is broken on\nprio_tag_required devices.\n\nFix by passing fwd_dest ? 1 : 0 as num_dest to match the actual number\nof destinations supplied.\n\nFixes: bf773dc0e6d5 (\"net/mlx5: E-Switch, Introduce APIs to enable egress acl forward-to-vport rule\")\nSigned-off-by: Yael Chemla \u003cychemla@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260717073306.1242399-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "11c057d23465c7a5817a7284c896d19d54c0b616", "tree": "0c9d43aaea6daef36cb8e3c5d63c94e16e685fdd", "parents": [ "9857fc06eb6f7eef3526691ee8f9358ce55ae676" ], "author": { "name": "Gal Pressman", "email": "gal@nvidia.com", "time": "Fri Jul 17 10:23:38 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:19:29 2026 -0700" }, "message": "net/mlx5: Fix MCIA register buffer overflow on 32 dword reads\n\nThe MCIA register can return up to 32 dwords (128 bytes) when the device\nadvertises the mcia_32dwords capability, but struct\nmlx5_ifc_mcia_reg_bits only defines dword_0..11, leaving room for just\n12 dwords (48 bytes) of data.\n\nmlx5_query_mcia() clamps the read size to mlx5_mcia_max_bytes() and then\nmemcpy()s that many bytes out of the register, potentially reading past\nthe end of the \u0027out\u0027 buffer. On kernels built with FORTIFY_SOURCE this\nis caught as a buffer overflow while reading the module EEPROM via\nethtool:\n\n detected buffer overflow in memcpy\n kernel BUG at lib/string_helpers.c:1048!\n RIP: 0010:fortify_panic+0x13/0x20\n Call Trace:\n mlx5_query_mcia.isra.0+0x200/0x210 [mlx5_core]\n mlx5_query_module_eeprom_by_page+0x4a/0xa0 [mlx5_core]\n mlx5e_get_module_eeprom_by_page+0xbb/0x120 [mlx5_core]\n eeprom_prepare_data+0xf3/0x170\n ethnl_default_doit+0xf1/0x3b0\n\nExtend the mcia_reg layout to 32 dwords.\n\nFixes: 271907ee2f29 (\"net/mlx5: Query the maximum MCIA register read size from firmware\")\nSigned-off-by: Gal Pressman \u003cgal@nvidia.com\u003e\nReviewed-by: Alex Lazar \u003calazar@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260717072338.1240582-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9857fc06eb6f7eef3526691ee8f9358ce55ae676", "tree": "e845bb1f7a1a001128f822f73d8569df39d6a1eb", "parents": [ "fd3a3f28ed60c6af4b2a39933b151d6b27842c3b", "8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:17:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:17:10 2026 -0700" }, "message": "Merge branch \u0027vxlan-geneve-require-cap_net_admin-in-the-device-netns-for-changelink\u0027\n\nDoruk Tan Ozturk says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvxlan, geneve: require CAP_NET_ADMIN in the device netns for changelink\n\nThe recent series \"require CAP_NET_ADMIN in the device netns for\nchangelink\" (8165f7ff57d9..27ccb68e7ccc) added rtnl_dev_link_net_capable()\nand gated the eight IP tunnel drivers (ip_gre, ipip, ip_vti, ip6_tunnel,\nip6_gre, ip6_vti, sit, xfrm_interface). VXLAN and GENEVE share the exact\nsame shape but were not covered: both store the underlay netns sticky at\nnewlink (vxlan-\u003enet / geneve-\u003enet) and their changelink() operates on that\nnetns, while the generic RTM_NEWLINK path only checks CAP_NET_ADMIN against\ndev_net(dev). Once such a device is created in or moved to another netns,\na caller privileged in dev_net(dev) but not in the underlay netns can\nreconfigure the tunnel\u0027\"\u0027\"\u0027s underlay.\n\nThis completes that series for the two UDP tunnel drivers that were left\nout. Same helper, same placement (top of changelink, before any attribute\nis parsed).\n\nVerified on next-20260714 in QEMU with CONFIG_VXLAN\u003dy + CONFIG_USER_NS\u003dy:\nan unprivileged user namespace holding CAP_NET_ADMIN only in a child netns\nissues an IFLA_INFO_DATA changelink on a vxlan device whose underlay lives\nin init_net. Before: returns 0 (reconfigures the init_net underlay).\nAfter: returns -EPERM.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260716203500.70573-1-doruk@0sec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8efb8f8bbb353b8f2fdf4f37534c6d96c9f69e01", "tree": "e845bb1f7a1a001128f822f73d8569df39d6a1eb", "parents": [ "3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e" ], "author": { "name": "Doruk Tan Ozturk", "email": "doruk@0sec.ai", "time": "Thu Jul 16 22:35:00 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:17:09 2026 -0700" }, "message": "geneve: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns geneve-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in geneve-\u003enet can rewrite a geneve\ndevice whose underlay lives in geneve-\u003enet.\n\ngeneve_changelink() applies the new configuration against geneve-\u003enet:\ngeneve_link_config() and the geneve_quiesce()/geneve_unquiesce() pair\nreopen the underlay sockets in that netns (geneve_sock_add() uses\ngeneve-\u003enet), so the same reasoning as the tunnel changelink series\napplies here.\n\nGate geneve_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).\n\nFixes: 5b861f6baa3a (\"geneve: add rtnl changelink support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Doruk Tan Ozturk \u003cdoruk@0sec.ai\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260716203500.70573-3-doruk@0sec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3a61bd9637f3d929aa846e4eb3d98b48c26fcb0e", "tree": "b00c610213eb1770918d423c59ab5d2a730991d3", "parents": [ "fd3a3f28ed60c6af4b2a39933b151d6b27842c3b" ], "author": { "name": "Doruk Tan Ozturk", "email": "doruk@0sec.ai", "time": "Thu Jul 16 22:34:59 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Jul 23 08:17:08 2026 -0700" }, "message": "vxlan: require CAP_NET_ADMIN in the device netns for changelink\n\nA tunnel changelink() operates on at most two netns, dev_net(dev) and\nthe sticky underlay netns vxlan-\u003enet. They differ once the device is\ncreated in or moved to a netns other than the one the request runs in.\nThe rtnl changelink path checks CAP_NET_ADMIN only against dev_net(dev),\nso a caller privileged there but not in vxlan-\u003enet can rewrite a vxlan\ndevice whose underlay lives in vxlan-\u003enet.\n\nvxlan_changelink() validates and applies the new configuration against\nvxlan-\u003enet (vxlan_config_validate(vxlan-\u003enet, ...)) and can reopen the\nunderlay socket in that netns, so the same reasoning as the tunnel\nchangelink series applies here.\n\nGate vxlan_changelink() with rtnl_dev_link_net_capable(), at the top of\nthe op before any attribute is parsed, matching ipgre_changelink() and\nthe rest of the \"require CAP_NET_ADMIN in the device netns for\nchangelink\" series.\n\nFound by 0sec automated security-research tooling (https://0sec.ai).\n\nFixes: 8bcdc4f3a20b (\"vxlan: add changelink support\")\nCc: stable@vger.kernel.org\nSigned-off-by: Doruk Tan Ozturk \u003cdoruk@0sec.ai\u003e\nReviewed-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nLink: https://patch.msgid.link/20260716203500.70573-2-doruk@0sec.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "fd3a3f28ed60c6af4b2a39933b151d6b27842c3b" }