)]}' { "log": [ { "commit": "279d5c8afcd38bd841832a39bfe1aa4f8518d98e", "tree": "89e047c1c1771283000e533a485345cbf0d6ad8c", "parents": [ "39e24cf5e29a01d28ef53bfa6ea08d0382a05dc2" ], "author": { "name": "David Yang", "email": "mmyangfl@gmail.com", "time": "Sat Oct 17 10:31:32 2026 +0800" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 13:36:53 2026 +0200" }, "message": "net: dsa: motorcomm: Extend ACL with UDF\n\nThe native ACL key set cannot express IP TTL or ICMP type/code. Use the\nUser Defined Filter windows to match them in the tc flower offload.\n\nSigned-off-by: David Yang \u003cmmyangfl@gmail.com\u003e\nLink: https://patch.msgid.link/20261017023136.2961543-1-mmyangfl@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "39e24cf5e29a01d28ef53bfa6ea08d0382a05dc2", "tree": "c0154dbec82e255a0a3f9a488a068e9509d01d51", "parents": [ "7dca8514c51ea5219daf7f28bc1a0536b907e611" ], "author": { "name": "Marek Vasut", "email": "marex@nabladev.com", "time": "Fri Oct 16 20:37:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 12:58:15 2026 +0200" }, "message": "net/fsl: xgmac_mdio: Add missing newlines to error prints\n\nAdd missing newlines at the end of debug prints.\n\nSigned-off-by: Marek Vasut \u003cmarex@nabladev.com\u003e\nLink: https://patch.msgid.link/20261016183804.39217-1-marex@nabladev.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7dca8514c51ea5219daf7f28bc1a0536b907e611", "tree": "fe7fc628d8658f4b4e465ddefe66b5b42ad72421", "parents": [ "66123066d8736d8f034d4d3ae23be3ef82dff78c", "3079ee3a8c62bb8ae1e9329e2f9e9c77c6b7fe16" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:58:24 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:58:24 2026 +0200" }, "message": "Merge branch \u0027vsock-so_inq-for-stream-sockets\u0027\n\nDavid Carlier says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nvsock: SO_INQ for stream sockets\n\nThis is the follow-up announced in the receive queue hint series [1]:\nSO_INQ and SCM_INQ for AF_VSOCK stream sockets, as AF_UNIX has.\n\nPatch 1 moves the SOL_SOCKET option handling to a helper without\nfunctional change, patch 2 adds SO_INQ and patch 3 covers it in\nvsock_test.\n\nThe value is the one SIOCINQ returns, so on Hyper-V it covers the\ncurrent packet only. Accepted sockets inherit the flag from the\nlistener, and the sockmap receive path does not report it.\n\nTested over loopback with vsock_test and vsock_uring_test.\n\nv2: https://lore.kernel.org/netdev/20261015154334.3217358-1-devnexen@gmail.com/\nv1: https://lore.kernel.org/netdev/20261012235524.41468-1-devnexen@gmail.com/\n\n[1] https://lore.kernel.org/netdev/20260923184008.153541-1-devnexen@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261016132716.272018-1-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3079ee3a8c62bb8ae1e9329e2f9e9c77c6b7fe16", "tree": "fe7fc628d8658f4b4e465ddefe66b5b42ad72421", "parents": [ "d7bb20b91122fd1e8ecbe6ff9fd13b8eefff8240" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Oct 16 14:27:16 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:58:21 2026 +0200" }, "message": "vsock/test: cover SO_INQ\n\nCheck the SCM_INQ value after a partial receive, after draining the\nqueue and at EOF, that no cmsg is sent while the option is off, that\naccepted sockets inherit it from the listener, and that out of range\nvalues and SOCK_SEQPACKET are rejected.\n\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nAcked-by: Bobby Eshleman \u003cbobbyeshleman@meta.com\u003e\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nLink: https://patch.msgid.link/20261016132716.272018-4-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "d7bb20b91122fd1e8ecbe6ff9fd13b8eefff8240", "tree": "f7b8e8abef1ebb7984fb37cd23b97c6a0a1812aa", "parents": [ "a006b921ad32940676993bfae460b9f57547b79b" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Oct 16 14:27:15 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:58:21 2026 +0200" }, "message": "vsock: support SO_INQ on stream sockets\n\nSO_INQ makes recvmsg() return the bytes left in the receive queue in an\nSCM_INQ cmsg, saving a SIOCINQ call per receive. AF_UNIX stream sockets\nsupport it, AF_VSOCK fails with ENOPROTOOPT.\n\nAdd it for SOCK_STREAM, reusing the hint already computed for io_uring.\nAs with TCP_INQ, 1 is reported once the stream is finished so the caller\nreads again and sees EOF, and accepted sockets inherit the setting from\nthe listener. No cmsg is sent when the transport cannot report the queue\nlength.\n\nSOCK_SEQPACKET is refused, as on AF_UNIX: its transport callback counts\nmessages, not bytes.\n\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20261016132716.272018-3-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "a006b921ad32940676993bfae460b9f57547b79b", "tree": "7a798fdb9f1b2c7e483860a6a1aaca8486081f42", "parents": [ "66123066d8736d8f034d4d3ae23be3ef82dff78c" ], "author": { "name": "David Carlier", "email": "devnexen@gmail.com", "time": "Fri Oct 16 14:27:14 2026 +0100" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:58:21 2026 +0200" }, "message": "vsock: move SOL_SOCKET options to vsock_sol_socket_setsockopt()\n\nSO_ZEROCOPY is handled inline in vsock_connectible_setsockopt(). Move it\nto a helper with a switch on optname, so other SOL_SOCKET options can be\nadded as new cases. The value parsing goes to its own helper too, so each\noption can do its own checks before it.\n\nNo functional change.\n\nSigned-off-by: David Carlier \u003cdevnexen@gmail.com\u003e\nReviewed-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20261016132716.272018-2-devnexen@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "66123066d8736d8f034d4d3ae23be3ef82dff78c", "tree": "d9b4a4ae5be09f312aaf1b39d7ba8e0213fcbcc8", "parents": [ "7888fedc74c9f601510233cf0c5842a92b9e4a49", "ffb51f75013f8d572cc3aa942425e0fa0a8e6d09" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:10 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:11 2026 +0200" }, "message": "Merge branch \u0027gtp-ynl-spec-for-the-gtp-netlink-family-two-fixes-and-a-selftest\u0027\n\nAnil Kaushik says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ngtp: ynl spec for the GTP netlink family, two fixes, and a selftest\n\nThis adds a ynl spec for the gtp genetlink family, two small driver\nfixes, and a selftest.\n\nPatch 1: the GET and dump replies carried the family id in the command\nfield, so ynl dropped them. Use GTP_CMD_GETPDP instead.\nPatch 2: new in v7. On the netdev CI debug kernel, the selftest hit an\nRCU warning: adding a PDP context looks up the device without the RCU\nread lock. Hold it around the lookup.\nPatch 3: the spec (NEWPDP/DELPDP/GETPDP/ECHOREQ), no uapi change.\nPatch 4: a selftest that adds, dumps and deletes PDP contexts.\n\nThe multicast notifications are not in the spec: they reuse the request\ncommand values, which the ynl C generator can\u0027t express with the\ncurrent uapi header.\n\nv6: https://lore.kernel.org/netdev/20261013031000.528393-1-anilkaushikwireless@gmail.com/\nv5: https://lore.kernel.org/netdev/20261012024800.400616-1-anilkaushikwireless@gmail.com/\nv4: https://lore.kernel.org/netdev/20261010105740.223992-1-anilkaushikwireless@gmail.com/\nv3: https://lore.kernel.org/netdev/20261009060615.4177402-1-anilkaushikwireless@gmail.com/\nv2: https://lore.kernel.org/netdev/20261008181031.4129029-1-anilkaushikwireless@gmail.com/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261016093225.1036375-1-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ffb51f75013f8d572cc3aa942425e0fa0a8e6d09", "tree": "d9b4a4ae5be09f312aaf1b39d7ba8e0213fcbcc8", "parents": [ "8a2f9964fc28954cef5a39e3636690d83cff3951" ], "author": { "name": "Anil Kaushik", "email": "anilkaushikwireless@gmail.com", "time": "Fri Oct 16 09:32:25 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:08 2026 +0200" }, "message": "selftests: net: add a test for the gtp netlink family\n\nExercise the gtp generic netlink family through its ynl spec: create a\ngtp device, add a PDP context with newpdp, check getpdp dumps it on that\ndevice with the expected TEIDs and addresses, and that delpdp by TEI\nremoves it. Two more cases check that two contexts are dumped and one\ncan be deleted by its MS address, and that deleting an unknown context\nfails with ENOENT, both by TEI and by MS address.\n\nynl resolves the family ids once per process, with a CTRL_CMD_GETFAMILY\ndump which does not autoload modules, so the gtp device is created\nbefore the family handle: that loads gtp.ko through its rtnl link alias.\nThe test is skipped when the kernel or iproute2 lack GTP support; any\nother failure to create the device fails it.\n\nAdd a GtpFamily ynl wrapper and register the test.\n\nSigned-off-by: Anil Kaushik \u003canilkaushikwireless@gmail.com\u003e\nLink: https://patch.msgid.link/20261016093225.1036375-5-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8a2f9964fc28954cef5a39e3636690d83cff3951", "tree": "800f7d7844907280a184428bb2320e2e888cc575", "parents": [ "fe3e1a42fb7eb18d8c55d714b50a3d51f8cd6ffe" ], "author": { "name": "Anil Kaushik", "email": "anilkaushikwireless@gmail.com", "time": "Fri Oct 16 09:32:24 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:08 2026 +0200" }, "message": "netlink: specs: add genetlink-legacy spec for GTP\n\nThe GTP (GPRS Tunnelling Protocol, user plane) generic netlink family\nhas no YAML specification under Documentation/netlink/specs/, so it\ncannot be consumed by the ynl tooling used for user-space clients,\ndocumentation and selftests.\n\nAdd a genetlink-legacy spec describing the existing family: the PDP\ncontext management commands (NEWPDP, DELPDP, GETPDP) and the GTP-U echo\nrequest (ECHOREQ), the GTPA_* attribute set, and the \"gtp\" multicast\ngroup. Command and attribute values are taken from\ninclude/uapi/linux/gtp.h and match it one-to-one. The request\nattributes of each command are the ones its handler in\ndrivers/net/gtp.c reads, and the reply attributes the ones\ngtp_genl_fill_info() emits.\n\nThe notifications sent on the \"gtp\" group are not described: they reuse\nthe command values of the NEWPDP, DELPDP and ECHOREQ requests, which\nthe ynl code generator cannot express with the existing uapi header.\nThe family doc says so.\n\nAdd the matching CFLAGS_gtp entry to tools/net/ynl/Makefile.deps, so\nthe generated code is built against the tree\u0027s gtp.h instead of an\nolder one installed on the host.\n\nThis only adds the description; there is no kernel code or uapi change.\n\nSigned-off-by: Anil Kaushik \u003canilkaushikwireless@gmail.com\u003e\nLink: https://patch.msgid.link/20261016093225.1036375-4-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fe3e1a42fb7eb18d8c55d714b50a3d51f8cd6ffe", "tree": "66876c0729327367d78b0c2ce68d1d78ae09ef2f", "parents": [ "758d8928d2c5d6703da827577cef86d643155236" ], "author": { "name": "Anil Kaushik", "email": "anilkaushikwireless@gmail.com", "time": "Fri Oct 16 09:32:23 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:08 2026 +0200" }, "message": "gtp: hold RCU for the device lookup when adding a PDP context\n\ngtp_genl_new_pdp() calls gtp_find_dev(), which looks the device up with\ndev_get_by_index_rcu(). Since commit e2d1baca2b33 (\"gtp: remove useless\nrcu_read_lock()\"), this only runs under the rtnl lock, and kernels with\nCONFIG_PROVE_RCU_LIST warn:\n\n WARNING: suspicious RCU usage\n net/core/dev.c:1047 RCU-list traversed in non-reader section!!\n ...\n dev_get_by_index_rcu\n gtp_find_dev\n gtp_genl_new_pdp\n\nHold the RCU read lock around the lookup only: gtp_pdp_add() allocates\nwith GFP_KERNEL, and the rtnl lock keeps the device alive afterwards.\n\nFound with the gtp selftest on a debug kernel.\n\nFixes: e2d1baca2b33 (\"gtp: remove useless rcu_read_lock()\")\nSigned-off-by: Anil Kaushik \u003canilkaushikwireless@gmail.com\u003e\nLink: https://patch.msgid.link/20261016093225.1036375-3-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "758d8928d2c5d6703da827577cef86d643155236", "tree": "c4ca89b4e665cd0b0fa9a4921ace99dba13f5504", "parents": [ "7888fedc74c9f601510233cf0c5842a92b9e4a49" ], "author": { "name": "Anil Kaushik", "email": "anilkaushikwireless@gmail.com", "time": "Fri Oct 16 09:32:22 2026 +0000" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 11:37:08 2026 +0200" }, "message": "gtp: set a valid genl command in PDP context get and dump replies\n\ngtp_genl_fill_info() stamps the reply with the command its callers pass\nin. gtp_genl_get_pdp() and gtp_genl_dump_pdp() pass nlmsg_type, which in\na genl message is the dynamically assigned family id rather than a\nGTP_CMD_* value, so replies to a PDP context get or dump carry a\nmeaningless command number.\n\nlibgtpnl ignores the command and is unaffected, but parsers that check\nit (for example the ynl tooling) treat the reply as an unknown command\nand discard it. Pass GTP_CMD_GETPDP, as gtp_tunnel_notify() already\npasses a real command on the notification path. No uapi change.\n\nFixes: 459aa660eb1d (\"gtp: add initial driver for datapath of GPRS Tunneling Protocol (GTP-U)\")\nSigned-off-by: Anil Kaushik \u003canilkaushikwireless@gmail.com\u003e\nLink: https://patch.msgid.link/20261016093225.1036375-2-anilkaushikwireless@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "7888fedc74c9f601510233cf0c5842a92b9e4a49", "tree": "3dd7cd0caa8a819f4af8c69ee422129c7c26b298", "parents": [ "61b8e62120b08481440f8d5559b3df11c2cd0814", "0e87a4a83e1306b36f1ebd3cc10eaf31476dfe19" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:28 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:29 2026 +0200" }, "message": "Merge branch \u0027rtnetlink-dump-link-layer-multicast-addresses\u0027\n\nYuyang Huang says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nrtnetlink: dump link-layer multicast addresses\n\n\"ip maddr show\" prints link-layer, IPv4 and IPv6 entries. The IPv4 and\nIPv6 ones come over netlink today, with IFA_MC_USERS for the user count.\nThe link-layer list, dev-\u003emc, is only exported via /proc/net/dev_mcast,\nso iproute2 and other users still parse procfs for it.\n\nThis series adds the AF_PACKET family to RTM_GETMULTICAST so that the\nlink-layer multicast addresses are reported the same way. Patch 4 dumps\ndev-\u003emc in the ifaddrmsg format of the IPv4 and IPv6 dumps: IFA_MULTICAST\ncarries the address, IFA_MC_USERS the reference count and a new\nIFA_F_GLOBAL flag marks entries added explicitly, the \"static\" column of\n/proc/net/dev_mcast. ifa_index limits the dump to one device and\nIFA_TARGET_NETNSID selects another netns. Patches 2 and 3 add a\ngeneration counter for dev-\u003emc changes so a multi-part dump reports\nNLM_F_DUMP_INTR like the IPv4 and IPv6 ones. Patches 1 and 5 update the\nrt-addr spec and patch 6 adds a selftest.\n\nAF_PACKET dumps returned -EOPNOTSUPP before, so iproute2 can keep the\nprocfs fallback for older kernels. The iproute2 side is ready and will\nbe posted once this is in.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261012011707.3378-1-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0e87a4a83e1306b36f1ebd3cc10eaf31476dfe19", "tree": "3dd7cd0caa8a819f4af8c69ee422129c7c26b298", "parents": [ "48191155c538b797765d0e4ec02e4feb542d9ef6" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:07 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "selftests: net: test AF_PACKET multicast dumps\n\nDump the link-layer multicast addresses of a dummy device and verify\nthat ifa_index restricts the dump to that device, that the all-hosts\naddress joined on link up is listed without IFA_F_GLOBAL, that an\naddress added with SIOCADDMULTI is listed with IFA_F_GLOBAL and\nIFA_MC_USERS, and that IFA_TARGET_NETNSID dumps another netns.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-7-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "48191155c538b797765d0e4ec02e4feb542d9ef6", "tree": "ae11a410e4bd5be30bc2e62f611d85716aa36c4a", "parents": [ "ebff14be20c3f2c0fbfa2da3321e3043a0ff8650" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:06 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "netlink: specs: rt-addr: document AF_PACKET multicast dumps\n\nAdd the global flag, list the attributes the AF_PACKET dump uses and\ndescribe how ifa-family selects IPv4, IPv6 or link-layer output for\nRTM_GETMULTICAST.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-6-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ebff14be20c3f2c0fbfa2da3321e3043a0ff8650", "tree": "245d2fa61b08084dba206a899eb6f99f488def62", "parents": [ "646cb8868bd29646b79e11fc0d574b8e25801a23" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:05 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "net: add AF_PACKET multicast dumps\n\nRTM_GETMULTICAST dumps IPv4 and IPv6 multicast group memberships, but\nthe device multicast list (dev-\u003emc) is only available through\n/proc/net/dev_mcast, so \"ip maddr show\" still has to parse procfs for\nits link-layer entries.\n\nHandle RTM_GETMULTICAST dumps with ifa_family set to AF_PACKET next to\nthe dev-\u003emc helpers in dev_addr_lists.c and report every entry of\ndev-\u003emc in the existing ifaddrmsg format:\n\n - IFA_MULTICAST carries the raw link-layer address\n - IFA_MC_USERS carries the entry reference count\n - IFA_F_GLOBAL in IFA_FLAGS reports netdev_hw_addr::global_use, set\n by dev_mc_add_global() (SIOCADDMULTI) and dev_mc_add_excl()\n (\"bridge fdb add ... self\"), i.e. entries added explicitly rather\n than by a protocol join. This is the static column of\n /proc/net/dev_mcast\n - ifa_scope is RT_SCOPE_LINK\n\nThis covers every column of /proc/net/dev_mcast. AF_PACKET is the\nfamily iproute2 already uses for link-layer addresses (\"ip -0\").\n\nThe default FDB dump also walks dev-\u003emc, but only for Ethernet devices\nand only if the driver uses it, vxlan for example does not, and it has\nno users count or global_use bit. Extending it would change \"bridge fdb\nshow\" output and add NDA_* attributes.\n\nRequests are always validated, there are no legacy users: prefixlen,\nflags and scope must be zero, ifa_index selects one device and\nIFA_TARGET_NETNSID is the only attribute accepted. The dump runs under\nRCU and netif_addr_lock_bh() without RTNL. cb-\u003eseq is set from the\ndev-\u003emc generation counter and dev_base_seq before each round and\nchecked after it, so an entry added or removed since the previous\nround sets NLM_F_DUMP_INTR. A round without a message skips the check\nand cb-\u003eseq is set once more after the round, so the NLMSG_DONE check\nreports a change made during the last round or before an empty one.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-5-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "646cb8868bd29646b79e11fc0d574b8e25801a23", "tree": "7b54b615a8945e7ec9eb9c289d13893a8f63c280", "parents": [ "778a262a6c690621a5c37d2a1cebc88e4585a870" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:04 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "net: add a generation counter for dev-\u003emc changes\n\nA multi-part RTM_GETMULTICAST dump of dev-\u003emc resumes by position, so\nentries added or removed between two dump rounds can be skipped or\nrepeated. The IPv4 and IPv6 dumps report that with NLM_F_DUMP_INTR by\nstamping cb-\u003eseq from a per netns generation counter combined with\ndev_base_seq, see inet_base_seq().\n\nAdd the equivalent for the device multicast lists: a per netns counter\nbumped whenever an entry is added to or removed from any dev-\u003emc. The\nlist helpers do not know which device a list belongs to, so give\nnetdev_hw_addr_list an mc_dev pointer, set for dev-\u003emc only, and bump\nthe counter of dev_net(mc_dev) from the count helpers. That covers the\ndev_mc_* helpers, both lists of a sync, the hardware sync helpers\ndrivers call from their rx mode callbacks or their own workers and the\nreconciliation after an asynchronous rx mode update. It is atomic\nsince the writers only hold the address lock of their own device.\n\nUsed by the following patch for the AF_PACKET multicast dump.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-4-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "778a262a6c690621a5c37d2a1cebc88e4585a870", "tree": "11e957171db87f8ca5a9b9910143b79d96d13608", "parents": [ "bc67283744788ad4ee7266ce64b0e420a46d2983" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:03 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "net: change netdev_hw_addr_list count through helpers\n\nThe count of a netdev_hw_addr_list is changed in several places of\ndev_addr_lists.c and a few drivers read it directly. The next patch\nneeds to account every change of the count of dev-\u003emc.\n\nAdd __hw_addr_count_add(), __hw_addr_count_inc(), __hw_addr_count_dec()\nand __hw_addr_count_reset(), use them for every change of the count\nand rename the field to _count so that a direct write stands out.\nReaders keep using netdev_hw_addr_list_count() and the netdev_uc_count()\nand netdev_mc_count() helpers, the few that read the field directly\nare converted. No functional change.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-3-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bc67283744788ad4ee7266ce64b0e420a46d2983", "tree": "6278a925505a096cee21bd02e32ffe3857564e59", "parents": [ "61b8e62120b08481440f8d5559b3df11c2cd0814" ], "author": { "name": "Yuyang Huang", "email": "sigefriedhyy@gmail.com", "time": "Mon Oct 12 10:17:02 2026 +0900" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:51:26 2026 +0200" }, "message": "netlink: specs: rt-addr: fix the type of target-netnsid\n\nThe kernel parses IFA_TARGET_NETNSID as NLA_S32 and rt-link.yaml\ndeclares its target-netnsid as s32, but rt-addr.yaml has it as binary.\n\nSigned-off-by: Yuyang Huang \u003csigefriedhyy@gmail.com\u003e\nReviewed-by: Nicolas Dichtel \u003cnicolas.dichtel@6wind.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nLink: https://patch.msgid.link/20261012011707.3378-2-sigefriedhyy@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "61b8e62120b08481440f8d5559b3df11c2cd0814", "tree": "f31230f16bc19cc8e72319b95bce14a63e4cb698", "parents": [ "78974bac98eb0581f85aab56ccc0377cdcedb964", "ce0d4765892063a801c11037c98e0e9db54f5573" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:52 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:53 2026 +0200" }, "message": "Merge branch \u0027eth-mpnic-add-basic-netdev-statistics\u0027\n\nDaniel Zahka says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\neth: mpnic: add basic netdev statistics\n\nAdd basic netdev statistics and report them via ndo_get_stats64 and\nnetdev_stat_ops.\n\nTrack per queue netdev statistics such as Tx/Rx: packets, bytes, drops,\netc. The driver keeps per-queue state for statistics that is updated\nmostly from the NAPI poll and ndo_start_xmit paths. The stats are made\navailable through the usual driver APIs.\n\nWhen the netif is transitioned down, the per-queue stat counters are\nfolded into a global per-device set of counters, and then when the netif\nis brought back up, the per-queue counters start counting again from 0.\n\nExtra care is needed for implementing ndo_get_stats64 since the instance\nlock is not taken. When ndo_get_stats64 races against ndo_stop and\nndo_open, the reader can attempt to read per-queue stats while the queue\ncount is changing. To deal with this, the writer publishes the\naggregated base stats and the active queue counts in a single RCU\nversioned object.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261012-mpnic-counters3-v2-0-8afba81c2d5a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "ce0d4765892063a801c11037c98e0e9db54f5573", "tree": "f31230f16bc19cc8e72319b95bce14a63e4cb698", "parents": [ "3b28e126619ff76e27201e2791101153da4902ac" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Mon Oct 12 05:04:37 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:49 2026 +0200" }, "message": "eth: mpnic: count Rx allocation failures\n\nCount both skb allocation failures and page pool allocation failures per\nqueue, and report them through the queue stats API. The bdq allocation\nfailures are added to the skb allocation failures when reporting to core\nand folded into base stats during aggregation, because the qstats API\ndoesn\u0027t support reporting them separately.\n\nPage pool allocation failures are also counted when the BDQs are first\nfilled in ndo_open, which runs in process context. mpnic_fill() disables\nBH around the fill, so the u64_stats update happens with preemption\ndisabled.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20261012-mpnic-counters3-v2-4-8afba81c2d5a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "3b28e126619ff76e27201e2791101153da4902ac", "tree": "63be9712ce302ce63d6d096ed546784f40aaf1f8", "parents": [ "5cc79ff41b07ce96b30469c47fe5133559531434" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Mon Oct 12 05:04:36 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:49 2026 +0200" }, "message": "eth: mpnic: count Tx queue stops and wakes\n\nCount how often a Tx queue is stopped for lack of descriptors and woken\nagain by completions, and report the counts through the queue stats API.\n\nStops are counted on the TWQ from the xmit path and wakes on the TCQ\nfrom mpnic_poll(), keeping a single writer context for each.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nLink: https://patch.msgid.link/20261012-mpnic-counters3-v2-3-8afba81c2d5a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5cc79ff41b07ce96b30469c47fe5133559531434", "tree": "15d63f674b89cceb5d69e9aaed8bb61ed7bc7ea7", "parents": [ "554c7af9367a6c1f5269dd97aed30d8abc802910" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Mon Oct 12 05:04:35 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:49 2026 +0200" }, "message": "eth: mpnic: report per-queue stats\n\nExpose the per-ring packet and byte counters through the queue stats\nAPI. Counters for deactivated rings are reported through the base stats.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20261012-mpnic-counters3-v2-2-8afba81c2d5a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "554c7af9367a6c1f5269dd97aed30d8abc802910", "tree": "9bd95dc01c3c3c7351ae9c5eb2fbdfd4e5b452d7", "parents": [ "78974bac98eb0581f85aab56ccc0377cdcedb964" ], "author": { "name": "Daniel Zahka", "email": "daniel.zahka@gmail.com", "time": "Mon Oct 12 05:04:34 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Oct 21 10:26:49 2026 +0200" }, "message": "eth: mpnic: count packets, bytes, and drops per ring\n\nKeep packet, byte and drop counters on each Tx work, Tx completion, and\nRx completion queue. Report them to the core via the rtnl_link_stats64\ninterface.\n\nRx completion queues also count errors. Frames the device marked with an\nuncorrectable error are counted as errors, and frames that fail for any\nother reason are counted as drops.\n\nAll packets cleaned from the TWQ during mpnic_flush() are counted as\ndrops, though completions for some of them may have been DMA\u0027d into\nthe completion ring between the time mpnic_poll() last ran and before\nmpnic_wait_all_queues_idle() returns. This is done for code simplicity.\n\nAn RCU approach is used because ndo_get_stats64 is not called with the\ninstance lock.\n\nSigned-off-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nAcked-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://patch.msgid.link/20261012-mpnic-counters3-v2-1-8afba81c2d5a@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "78974bac98eb0581f85aab56ccc0377cdcedb964", "tree": "2477ea25b42cc509ffb8aec8218147d11bf0e4a5", "parents": [ "4a929eba247b7cde87fa2a9cf6033301fdd2981a", "aca2542b886dc64c4f7c7fe67647ca971d3f0794" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 20:22:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 20:22:24 2026 -0700" }, "message": "Merge branch \u0027selftests-drv-net-introduce-flow-control-selftest\u0027\n\nMaxime Chevallier says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nselftests: drv-net: Introduce flow-control selftest\n\nThis test aims at validating the flow control implementation in drivers,\nusing the ethtool API.\n\nThe test can run in various conditions :\n\nDUT \u003c-----\u003e Anything that has link up (not controllable)\nDUT \u003c-----\u003e A directly connected device\n\nIt enumerates the local and remote device\u0027s capabilities, to test as\nmuch as possibly testable. I\u0027ve run it on 17 different boards connected\nto other boards through various means : Usb to Eth dongles, direct\nconnection to the board, connection through a switch. Some of the ports\ntested were user ports of DSA switches too.\n\nContrary to V2, on V3 we really only have a collection of actual\nfailures that show during tests, as one of the peer\u0027s I\u0027m running these\non has a v6.18 kernel that pre-dates the realtek phylink port and show\nactual bugs in the driver.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261015134350.629593-1-maxime.chevallier@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aca2542b886dc64c4f7c7fe67647ca971d3f0794", "tree": "2477ea25b42cc509ffb8aec8218147d11bf0e4a5", "parents": [ "8f897f26ef34d45570d2219fdd881184100668d2" ], "author": { "name": "Maxime Chevallier (Netdev Foundation)", "email": "maxime.chevallier@bootlin.com", "time": "Thu Oct 15 15:43:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 20:22:21 2026 -0700" }, "message": "selftests: drv-net: pause: Validate pause autoneg interactions with link autoneg\n\nPause autonegotiation happens with the link partner using the same words\nas the link negotiation, used for speed and duplex exchanges. However,\npause and link autonegotiation can be separately toggled :\n\nethtool -s eth0 autoneg on # Enable link negotiation\nethtool -A eth0 autoneg on # Enable Pause negotiation\n\nPause can\u0027t be negotiated if the link autoneg isn\u0027t enabled.\n\nPause autoneg and link autoneg settings must not interfere with one\nanother when user is configuring them :\n - If Pause autoneg is on, it must stay on when link autoneg is disabled\n (even though Pause won\u0027t actually be negotiated)\n - If Pause autoneg is off, it must stay off when link autoneg is\n enabled\n\nIntroduce a set of tests to verify that pause and link autoneg are\nbehaving correctly, in particular that the user intent is correctly\ncached when toggling link autoneg.\n\nSigned-off-by: Maxime Chevallier (Netdev Foundation) \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261015134350.629593-4-maxime.chevallier@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8f897f26ef34d45570d2219fdd881184100668d2", "tree": "b2da4aa0394febc9525d8beef5df7ce1ea8df588", "parents": [ "cbd8a536cd6d66d695deacd26d74557c020e3be0" ], "author": { "name": "Maxime Chevallier (Netdev Foundation)", "email": "maxime.chevallier@bootlin.com", "time": "Thu Oct 15 15:43:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 20:22:21 2026 -0700" }, "message": "selftests: drv-net: pause: Validate the pause autonegotiation with a partner\n\nPause autonegotiation behaves differently than the regular link params\nautonegotiation, in that the user intention may differ from the\nnegotiated pause parameters.\n\nIntroduce a test that validates we\u0027re correctly resolving pause\nparameters according to 802.3.\n\nThe validation is done based on what the local interface reports in\nterms of advertised and lp_advertised linkmodes.\n\nIf the remote can express what it sees in terms of its own advertised\nand lp_advertised modes, validate the autoneg results on the peer as\nwell.\n\nSigned-off-by: Maxime Chevallier (Netdev Foundation) \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261015134350.629593-3-maxime.chevallier@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cbd8a536cd6d66d695deacd26d74557c020e3be0", "tree": "b48beaebfbff8e06e386715b8ab0227612ce7281", "parents": [ "4a929eba247b7cde87fa2a9cf6033301fdd2981a" ], "author": { "name": "Maxime Chevallier (Netdev Foundation)", "email": "maxime.chevallier@bootlin.com", "time": "Thu Oct 15 15:43:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 20:22:21 2026 -0700" }, "message": "selftests: drv-net: Introduce a selftest for ethtool flow control\n\nEthernet flow control is a tricky thing to get right, especially when it\ncomes to correctly handling the negotiation of the parameters with a\nlink partner.\n\nOn one hand, the userspace API talks in terms of the device\u0027s ability to\nsend Pause frames when the device is overwhelmed by ingress traffic (TX\npause) and the ability to stop sending traffic upon receiving Pause\nframes (RX pause).\n\nOn the other hand, 802.3 explains that devices can exchange their\nabilities over link negotiation, but instead of echanging TX and RX\nabilities, they exchange Pause and Asymmetric Pause capabilities :\n\nRX unable TX unable \u003d\u003e None\nRX able TX unable \u003d\u003e Pause + Asymmetric\nRX unable TX able \u003d\u003e Asymmetric\nRX able TX able \u003d\u003e Pause\n\nThe reported Pause and Asym abilities depend both on the MAC, that\neventually sends and processes these frames, and the PHY, that\nadvertises these to the partner.\n\nBoth MAC and PHYs can have their own limitations, and getting the\ncorrect set of supported Pause/Asym parameters is non-trivial, unless\nthe MAC uses phylink, which deals with the complexity.\n\nIntroduce a set of Pause selftests that verify that the local\ninterface\u0027s supported pause parameters reported from ethtool (in terms\nof Pause + Asym ) match the accepted parameters from \"ethtool -A\",\ncorresponding to ethtool\u0027s .set_pauseparams() ops, expressed in TX and\nRX abilities.\n\nSigned-off-by: Maxime Chevallier (Netdev Foundation) \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261015134350.629593-2-maxime.chevallier@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4a929eba247b7cde87fa2a9cf6033301fdd2981a", "tree": "e8d090633184a1fa39425700f52ef11f37c9646d", "parents": [ "a9ee66f1e63e2b51bbe170662426d60f15cd1ab1" ], "author": { "name": "Marek Vasut", "email": "marex@nabladev.com", "time": "Fri Oct 16 20:57:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:53:49 2026 -0700" }, "message": "Revert \"enetc: Increase eMDIO MDC rate to 2.5 MHz\"\n\nThis reverts commit 587acb86d6465efdc03f6d8524461e6e725597b7.\n\nWhile the i.MX95 MDIO MDC clock is improved by the commit\n587acb86d646 (\"enetc: Increase eMDIO MDC rate to 2.5 MHz\"),\nother SoCs use different base clock for their MDIO and the\nMDC clock on those SoCs is set out of specification by the\naforementioned commit. The fix for the i.MX95 MDIO MDC has\nto be done differently, and will be done so in a follow up\nchange. Until that is done, revert the commit to fix the\nother SoCs.\n\nFixes: 587acb86d646 (\"enetc: Increase eMDIO MDC rate to 2.5 MHz\")\nSigned-off-by: Marek Vasut \u003cmarex@nabladev.com\u003e\nLink: https://patch.msgid.link/20261016185817.54096-1-marex@nabladev.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a9ee66f1e63e2b51bbe170662426d60f15cd1ab1", "tree": "404ff723c7765d509e37db8301656d477f070379", "parents": [ "457dc9fefe9aed6505502d20930d9dec4b10eabc", "ca4bd46de863970281657004c4c536e05cc6b239" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:46:32 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:46:32 2026 -0700" }, "message": "Merge branch \u0027net-pse-pd-plain-i2c-transport-for-realtek-gen1\u0027\n\nSander Vanheule says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: pse-pd: Plain I2C transport for Realtek Gen1\n\nWhile for the Gen2 protocol both a plain I2C transport and an SMBus\ntransport were provided, Gen1 only got SMBus. The Unifi Switch Lite 16\nPoE uses the Gen1 protocol to manage a single BCM59121, but does to\nusing plain I2C.\n\nThese patches simply add a new compatible for the plain I2C transport\nand the associated match data. This is sufficient to let the existing\ncode talk to the management MCU.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261018161248.376205-1-sander@svanheule.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ca4bd46de863970281657004c4c536e05cc6b239", "tree": "404ff723c7765d509e37db8301656d477f070379", "parents": [ "9e6df8d57ee551b000518d1d58c65aa4163c3bc2" ], "author": { "name": "Sander Vanheule", "email": "sander@svanheule.net", "time": "Sun Oct 18 18:12:48 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:46:30 2026 -0700" }, "message": "net: pse-pd: realtek-pse-mcu: add gen1 I2C transport\n\nProvide the required data for the gen1 raw I2C binding, which like for\ngen2 is simply the gen1 protocol data with the native_i2c flag set.\n\nSigned-off-by: Sander Vanheule \u003csander@svanheule.net\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nAcked-by: Oleksij Rempel \u003co.rempel@pengutronix.de\u003e\nAcked-by: Jonas Jelonek \u003cjonas@jonasjelonek.de\u003e\nLink: https://patch.msgid.link/20261018161248.376205-3-sander@svanheule.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e6df8d57ee551b000518d1d58c65aa4163c3bc2", "tree": "e598d07185dec972338b2b6b855da3aa1458a0f0", "parents": [ "457dc9fefe9aed6505502d20930d9dec4b10eabc" ], "author": { "name": "Sander Vanheule", "email": "sander@svanheule.net", "time": "Sun Oct 18 18:12:47 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:46:30 2026 -0700" }, "message": "dt-bindings: net: pse-pd: realtek,pse: add gen1 I2C transport\n\nLike the gen2 protocol, the gen1 protocol can also be used over both a\nraw I2C transport and an SMBUs transport. Add a compatible for the\nformer and the compatible for the Ubiquiti Unifi Switch Lite 16 PoE\ndevice that uses it.\n\nSigned-off-by: Sander Vanheule \u003csander@svanheule.net\u003e\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nAcked-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nReviewed-by: Rob Herring (Arm) \u003crobh@kernel.org\u003e\nLink: https://patch.msgid.link/20261018161248.376205-2-sander@svanheule.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "457dc9fefe9aed6505502d20930d9dec4b10eabc", "tree": "52788688ba1c776a9780b825315b01e816acf04f", "parents": [ "eeb63e1e0bfc6203086dd496247e905b84704343" ], "author": { "name": "Demos Ra", "email": "demosthenes.ra@gmail.com", "time": "Mon Oct 19 13:35:51 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:40:16 2026 -0700" }, "message": "netlink: specs: Add a spec for nexthops in rtnetlink\n\nAdd a YNL spec for nexthop objects and nexthop buckets in rtnetlink.\n\n./tools/net/ynl/pyynl/cli.py \\\n --spec Documentation/netlink/specs/rt-nexthop.yaml \\\n --dump getnexthop\n\nExclude newnexthopbucket-ntf from the C code generation. ynl_gen_c.py\nlooks up a classic notification by the request of the same message\ntype, and no request uses RTM_NEWNEXTHOPBUCKET. The spec keeps the\nnotification, so the Python tools can still subscribe to it.\n\nSigned-off-by: Demos Ra \u003cdemosthenes.ra@gmail.com\u003e\nLink: https://patch.msgid.link/20261019-rt-nexthop-spec-v1-1-9c586edf86ab@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "eeb63e1e0bfc6203086dd496247e905b84704343", "tree": "0f9fcff0f9efe1d733ea5328651b4bd799a284ff", "parents": [ "57214815080fdefe2a651082ff3ea44c9145d8c6" ], "author": { "name": "Victor Nogueira", "email": "victor@mojatatu.com", "time": "Thu Oct 15 16:15:24 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:15:11 2026 -0700" }, "message": "selftests: tc-testing: keep IPv6 autoconf out of exact-counter checks\n\nSeveral tc-testing cases assert an exact bytes/packets value from a single\ninjected frame, but count every frame that traverses an egress qdisc (or\nmatch with \"protocol all\"). Every case creates a fresh veth pair (and, for\nthe gso_skb cases, a netdevsim device) and brings it up with IPv6 enabled;\na device whose link-local autoconfiguration runs then emits neighbour\nsolicitations, MLD reports and router solicitations for a few seconds.\nThose are ordinary Ethernet frames (0x86DD) and are counted too, so the\nexact assertions race with the autoconf burst and fail intermittently. The\n$DEV0 peer of the veth pair lives in the init netns, so its frames follow\nthe init-netns IPv6 sysctls.\n\nConditions to recreate the bug:\nRun the affected cases with IPv6 enabled (the tdc default) on net-next\n(7.3.0-rc6+). 4e6b fails intermittently (4/6 here); the four netdevsim\n\"gso_skb\" cases fail intermittently too (fb6c 1/25, 0235 4/15, 476f 4/8).\n1922 did not trip in the sampled runs but shares the same setup and is\nfixed for uniformity. Each failure carries a stray autoconf frame, e.g.\n\"bytes: 98 !\u003d 188\".\n\nThe Fix:\nFix the affected cases:\n\n - actions/ife.json 4e6b injects only an 0xED3E frame but matches with\n \"protocol all\"; scope the filter to that ethertype.\n\n - The four netdevsim \"gso_skb\" cases (fb6c, 1922, 476f, 0235) create $ETH\n from within the case and bring it up immediately before installing the\n qdiscs, so the autoconf burst overlaps the measurement. Set\n \"addrgenmode none\" before the link is brought up, so the device\n generates no link-local address and the counter holds only the injected\n packet. IPv6 stays usable (a manually added address still works), so\n cases that exercise IPv6 are unaffected. On a kernel without IPv6\n (CONFIG_IPV6\u003dn, or booted with ipv6.disable\u003d1) the attribute is not\n available, so the line is made non-fatal like every neighbouring setup\n line.\n\nWith this change the affected cases pass 20/20, and the whole ife.json\n(51/51) and infra/qdiscs.json (48/48) suites pass, as do the protocol-ipv6\nmatchall cases (filters/matchall.json 0596, 41df, 8bd2, 2a4a).\n\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nSigned-off-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-L9J8.v1.r0.20261014162217-1@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "57214815080fdefe2a651082ff3ea44c9145d8c6", "tree": "a5fcf61dc29afc549248c768301f63ceb9168a46", "parents": [ "44b94df56cbdbd26809cc40ed65666a8899f3b91", "bb3183e1c938758ca32793e55fe4985f9745246c" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:10:33 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "Merge branch \u0027net-stmmac-qcom-ethqos-add-support-for-scmi-power-domains\u0027\n\nBartosz Golaszewski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: qcom-ethqos: add support for SCMI power domains\n\nAdd support for the firmware-managed variant of the DesignWare MAC on\nthe sa8255p platform. This series contains new DT bindings and driver\nchanges required to support the MAC in the STMMAC driver.\n\nIt also reorganizes the ethqos code quite a bit to make the introduction\nof power domains into the driver a bit easier on the eye.\n\nThe DTS changes will go in separately.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-0-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "bb3183e1c938758ca32793e55fe4985f9745246c", "tree": "a5fcf61dc29afc549248c768301f63ceb9168a46", "parents": [ "acf1e3db9151e142020f21d47fd28dce5ba05e03" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "net: stmmac: qcom-ethqos: add support for sa8255p\n\nExtend the driver to support a new model - sa8255p. Unlike the previously\nsupported variants, this one\u0027s power management is done in the firmware\nover SCMI. This is modeled in linux using power domains so add a new\nemac data variant and a separate setup callback.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-7-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "acf1e3db9151e142020f21d47fd28dce5ba05e03", "tree": "cb5010178ef258656ec86e22bb981f75963d1675", "parents": [ "92719abd63787729c89d353db1a7547ad749fc18" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:45 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "net: stmmac: qcom-ethqos: factor out linux-level setup into a separate function\n\nAhead of adding support for firmware-controlled EMAC variants, extend\nthe ethqos_emac_driver_data structure with a setup() callback, implement\nit for the existing models and move all operations not required in SCMI\nmode into it.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Mohd Ayaan Anwar \u003cmohd.anwar@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-6-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "92719abd63787729c89d353db1a7547ad749fc18", "tree": "55edc27c93af2e6056d53ca8ff09a198632e79c7", "parents": [ "05b3ea7346e3ae2f43927faa0949c29c08d95036" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:44 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "net: stmmac: qcom-ethqos: reuse the address of ethqos_emac_driver_data\n\nInstead of needlessly copying the fields of ethqos_emac_driver_data into\nstruct qcom_ethqos, just use the address of the former as a reference.\nIt\u0027s .rodata after all. This is done in order to avoid having either two\ncalls to of_device_get_match_data() or having to extend the latter with\nanother field when adding support for SCMI.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Mohd Ayaan Anwar \u003cmohd.anwar@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-5-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "05b3ea7346e3ae2f43927faa0949c29c08d95036", "tree": "aa09750a83d7f9afc14f83e8c02178aed5060d73", "parents": [ "7af44cb9e44771409953241644643f82f2101a06" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:43 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "net: stmmac: qcom-ethqos: update phy_mode to the resolved interface in mac_finish()\n\nethqos-\u003ephy_mode is read by serdes_powerup() and\nqcom_ethqos_set_sgmii_loopback() to configure the SerDes and its\nwrapper for the correct interface. It is set once at probe from the DT\nphy-mode property and never updated.\n\nphylink resolves the actual runtime interface and passes it to the\nmac_finish() callback. On platforms that only ever operate at one speed\nthese two values are always the same, but when the interface changes\nat runtime - for example switching between SGMII and 2500BASE-X - the\nstored value becomes stale. The next serdes_powerup() call, on\na subsequent link cycle, then reinitializes the SerDes to the wrong mode.\n\nUpdate ethqos-\u003ephy_mode from the interface argument in\nethqos_mac_finish_serdes() so that it always reflects the last\nresolved interface.\n\nWith that, we now update the phy_mode to the runtime-resolved interface,\nso any subsequent resume with a 1G SGMII link skips the loopback setup\nand the DMA reset hangs. To remedy this, extend the guard to include\nPHY_INTERFACE_MODE_SGMII.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Mohd Ayaan Anwar \u003cmohd.anwar@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-4-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7af44cb9e44771409953241644643f82f2101a06", "tree": "c28fe482f1c3959f917ead14d8e2237524621037", "parents": [ "534198a05d926f8508e36d44b9529729d6794cde" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:42 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "net: stmmac: qcom-ethqos: set serdes mode before powerup\n\nCall phy_set_mode_ext() before phy_power_on() in\nqcom_ethqos_serdes_powerup(). This is harmless for existing users but on\nSCMI systems this is required for the PHY driver to select the right\nperformance level - which translates to the link speed. This is done\nahead of adding support for the firmware-managed EMAC on Qualcomm sa8255p.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nReviewed-by: Mohd Ayaan Anwar \u003cmohd.anwar@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-3-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "534198a05d926f8508e36d44b9529729d6794cde", "tree": "49675512c96f938673971af0255aa994cc3b4a6c", "parents": [ "d09d7b8e86e597da21dd26c9883831ddf5c25aae" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@linaro.org", "time": "Wed Oct 14 14:36:41 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:20 2026 -0700" }, "message": "dt-bindings: net: qcom: document the ethqos device for SCMI-based systems\n\nDescribe the firmware-managed variant of the QCom DesignWare MAC. As the\nproperties here differ a lot from the HLOS-managed variant, lets put it\nin a separate file. Since we need to update the maximum number of power\ndomains, let\u0027s update existing bindings referencing the top-level\nsnps,dwmac.yaml and limit their maxItems for power-domains to 1.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@linaro.org\u003e\nReviewed-by: Martin Blumenstingl \u003cmartin.blumenstingl@googlemail.com\u003e\nReviewed-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nReviewed-by: Lad Prabhakar \u003cprabhakar.mahadev-lad.rj@bp.renesas.com\u003e\nReviewed-by: Romain Gantois \u003cromain.gantois@bootlin.com\u003e # For RZ/N1\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-2-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d09d7b8e86e597da21dd26c9883831ddf5c25aae", "tree": "2b2b6c758f143eb818ca1b05e34bbdadebc0dbba", "parents": [ "44b94df56cbdbd26809cc40ed65666a8899f3b91" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Wed Oct 14 14:36:40 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 19:11:01 2026 -0700" }, "message": "net: stmmac: dwmac4: don\u0027t program the 1us tick counter without a CSR clock\n\ndwmac4_core_init() derives the TIC counter value from the rate of the CSR\nclock. If no such clock is available (for instance because clocks are\nmanaged by firmware and not described in DT), the rate is 0 and\n(0 / 1000000) - 1 underflows to 0xffffffff, which is then written\nto the register and can break the LPI timers that count in microseconds.\n\nLeave the register at its reset value when the CSR clock rate is\nunknown. The RX watchdog conversion helpers already cope with a missing\nclock by falling back to clk_ref_rate or returning 0, so nothing else\nneeds to change.\n\nThis is first hit with the Qualcomm sa8255p ethernet, whose DT has no\nclocks.\n\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://lore.kernel.org/all/179052656185.2160803.1751830002645522416@kernel.org/\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20261014-qcom-sa8255p-emac-v16-1-0266c2ead980@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "44b94df56cbdbd26809cc40ed65666a8899f3b91", "tree": "2c4555b69bb46192a9e498b29b1e3d357a46d20f", "parents": [ "599d0e97610f09162d84c4ede4164628c066921e", "569b57762694e7a4d4cffde35f65dbab5a2fc9cf" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 18:18:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 18:18:23 2026 -0700" }, "message": "Merge branch \u0027net-pse-pd-si3474-probe-error-path-cleanups\u0027\n\nCarlo Szelinsky says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: pse-pd: si3474: probe error path cleanups\n\nTwo small changes to the error paths in si3474 probe. They do not\ndepend on the PSE fixes for net (\"net: pse-pd: assorted lifetime and\nerror-path fixes\" v2) and apply to net-next as they are.\n\n 1 The error message after a failed devm_add_action_or_reset() reads\n the ancillary I2C client, which was just unregistered.\n 2 Use dev_err_probe() for a failed controller registration, as\n pd692x0 and tps23881 do.\n\n1 was found by code inspection and not reproduced. Both are\nbuild-tested only, with W\u003d1.\n\n[1] https://lore.kernel.org/20261018082314.48950-1-github@szelinsky.de\n[2] https://lore.kernel.org/20261018081853.47484-1-github@szelinsky.de\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261020171134.852878-1-github@szelinsky.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "569b57762694e7a4d4cffde35f65dbab5a2fc9cf", "tree": "2c4555b69bb46192a9e498b29b1e3d357a46d20f", "parents": [ "70c29b35fd87f87a7b8dad6eb8d55ce54a0d549a" ], "author": { "name": "Carlo Szelinsky", "email": "github@szelinsky.de", "time": "Tue Oct 20 19:11:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 18:18:21 2026 -0700" }, "message": "net: pse-pd: si3474: use dev_err_probe() for controller registration\n\nsi3474 prints the error of a failed controller registration as a hex\nnumber, such as 0xfffffff4 for -ENOMEM. Use dev_err_probe(), as\npd692x0 and tps23881 already do. It prints the error by name, and if\nthe registration ever returns -EPROBE_DEFER, it does not log that as\nan error.\n\nOnly the log message changes.\n\nSigned-off-by: Carlo Szelinsky \u003cgithub@szelinsky.de\u003e\nLink: https://patch.msgid.link/20261020171134.852878-3-github@szelinsky.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "70c29b35fd87f87a7b8dad6eb8d55ce54a0d549a", "tree": "891ebd68d9e046b7e37907e6c74328ae7c90216a", "parents": [ "599d0e97610f09162d84c4ede4164628c066921e" ], "author": { "name": "Carlo Szelinsky", "email": "github@szelinsky.de", "time": "Tue Oct 20 19:11:32 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 18:18:21 2026 -0700" }, "message": "net: pse-pd: si3474: fix use-after-free in ancillary client error path\n\nIf devm_add_action_or_reset() fails, it has already unregistered the\nancillary I2C client, and the error message then reads that client\u0027s\ndevice. It can only fail with -ENOMEM, which is already reported, so\ndrop the message.\n\nFound by code inspection. Not reproduced.\n\nFixes: a2317231df4b (\"net: pse-pd: Add Si3474 PSE controller driver\")\nReviewed-by: Kory Maincent \u003ckory.maincent@bootlin.com\u003e\nSigned-off-by: Carlo Szelinsky \u003cgithub@szelinsky.de\u003e\nLink: https://patch.msgid.link/20261020171134.852878-2-github@szelinsky.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "599d0e97610f09162d84c4ede4164628c066921e", "tree": "81d35e6be935ce00857d73d4baafeb08129d03ef", "parents": [ "d53a5309cc4a874d2686b1ad35f1ab17f84ef1ec" ], "author": { "name": "Ali Firas", "email": "alishmery18@gmail.com", "time": "Wed Oct 14 15:38:08 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 17:35:04 2026 -0700" }, "message": "vxlan: vnifilter: validate the VXLAN_VNIFILTER_ENTRY nest\n\nvxlan_vnifilter_process() parses the message with vni_filter_policy,\nwhose VXLAN_VNIFILTER_ENTRY is a bare NLA_NESTED with no nested policy\nattached. The entry attributes are therefore validated only later, one\nentry at a time, by the nla_parse_nested() inside\nvxlan_process_vni_filter(). Entries are parsed as they are dispatched:\nin a message whose first entry is valid and whose second is not, the\nfirst entry is applied and its RTM_NEWTUNNEL notification sent before\nthe second is rejected.\n\nLink the nest to vni_filter_entry_policy with NLA_POLICY_NESTED() so\nevery entry is checked against the entry policy up front, before any\nentry is acted on. A message whose entry the policy rejects -- a\nmalformed attribute, or, with the next patch, an out-of-range endpoint\n-- is now refused as a unit and installs nothing. Faults the policy does\nnot cover, such as a device or handler error raised on a later entry,\nare unchanged: entries are still dispatched and applied one at a time.\n\nThis reorders two faults. The nest is validated before the device is\nlooked up and before the vnifilter flag is checked, so a request\nrejected by the entry policy, aimed at a missing or non-vnifilter\ndevice, now returns that policy error where it previously returned\n-ENODEV or -EOPNOTSUPP. The request was invalid either way; only the\nerrno an operator sees changes.\n\nThe nla_parse_nested() in vxlan_process_vni_filter() stays: it is what\nfills the per-entry attribute table the handler reads. It can no longer\nfail on a message that has reached it.\n\nSuggested-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nLink: https://lore.kernel.org/netdev/20260921150904.65a704eb@kernel.org/\nSigned-off-by: Ali Firas \u003calishmery18@gmail.com\u003e\nLink: https://patch.msgid.link/20261014123814.388557-2-alishmery18@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d53a5309cc4a874d2686b1ad35f1ab17f84ef1ec", "tree": "a9bd597b1907ab09ade201c92b682236af45d1fe", "parents": [ "5ed6ab32767c6e957eeecc0b9924e8d0e0758ec0", "9486c89a8e157cedecfb561c3d86053e654d32ab" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:54 2026 -0700" }, "message": "Merge branch \u0027ibmveth-fix-hangs-use-after-frees-and-netpoll-races\u0027\n\nMingming Cao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nibmveth: fix hangs, use-after-frees and netpoll races\n\nNine fixes for serious bugs in the ibmveth driver: two hang the\nsystem, four are use-after-frees, one corrupts memory, one lets a\nframe from another partition stall or oops the receiver, and one makes\nethtool -L report success when it failed.\n\n 1. Netpoll races with RX replenish (memory corruption, NULL\n dereference): remove ndo_poll_controller, as was done for\n ibmvnic, skip RX replenish in netpoll\u0027s budget-0 poll, and\n enable NAPI only once the RX resources exist.\n Fixes: 6b4223748895, bea3348eef27\n\n 2. Hang after a failed internal reopen: the next close() waits in\n napi_disable() forever with RTNL held, and only a reboot\n recovers. Skip close() when open() did not succeed.\n Fixes: 860f242eb534\n\n 3. Use-after-free in remove(): a reset queued from NAPI could run\n on the freed adapter. Disable the reset work first.\n Fixes: 2c91e2319ed9\n\n 4. Hang or NULL dereference on a bad RX correlator from PHYP: poll\n spun on that slot until RCU stalled, and a correlator naming an\n inactive pool dereferenced NULL. A frame that does not fit its\n buffer was copied past the end. Move past the bad slot and stay\n in poll, and drop a frame that does not fit.\n Fixes: 2c91e2319ed9, 860f242eb534\n\n 5. Use-after-free after a failed probe: the pool kobjects stay in\n sysfs after the adapter is freed. Put them, as remove() does,\n and give them a release() that probe and remove() wait for, so\n CONFIG_DEBUG_KOBJECT_RELEASE cannot free them early either.\n Fixes: 860f242eb534\n\n 6. ethtool -L returns 0 when it cannot allocate the new TX queues.\n Return the allocation error.\n Fixes: 10c2aba89cc0\n\n 7. Use-after-free of TX buffers: close() frees them without\n waiting for a running transmit. It is called directly for MTU,\n offload and buffer pool changes, and through dev_close(), which\n does not wait either with a noqueue qdisc. Use\n netif_tx_disable().\n Fixes: d6832ca48d8a\n\n 8. Use-after-free of the RX queue: napi_disable() returns before\n the poll has finished, and the rest of the poll re-enables the\n interrupt and reads the RX queue that close() then frees. Wait\n with synchronize_net().\n Fixes: bea3348eef27\n\n 9. Stall or oops from a frame sent by another partition: the RX\n checksum helper passes the IPv4 ihl to ip_fast_csum(), which on\n ppc64 reads up to 16 GiB for ihl 0, and both RX offload helpers\n trust the IP and TCP header lengths. Check the headers before\n use, with KUnit cases.\n Fixes: 9c7e8bc584f5, 7b5967389f5a, 66aa0678efc2\n\nPatches 1-8 were found in review of the ibmveth multi-queue RX\nseries [1] (the patch 4 frame bound by the Sashiko review of v2), and\npatch 9 by the Sashiko review of v3 and the review that followed it.\nLanding them first also shrinks that series, which then only extends\nthis handling per queue.\n\nTesting: the new and extended KUnit cases in patches 4 and 9 fail or\noops on the unfixed driver and pass on qemu pseries (ppc64le). On a\nPOWER10 LPAR: the v3 suite (netconsole under printk and ping floods,\nMTU and buffer pool changes under traffic, a forced open() failure\nfollowed by down and up, unbind/bind under traffic, a forced\nregister_netdev() failure in probe, ethtool -L with a forced TX\nbuffer allocation failure, and rapid link down/up and MTU cycles under\na ping flood for patch 8) and patch 9 large-send regression on v5\n(iperf3 over IPv4 and IPv6 at MTU 1500 and 9000, threaded NAPI and\nbusy polling; no new drops or InCsumErrors). The forced failures used\ntest-only module parameters that are not part of this series.\n\nThe triggers are rare and there are no field reports, so the series\ntargets net-next. It is based on net-next d8674294aefe (\"Merge\ngit://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\"), which\nincludes the two open() error-path fixes (af0524bf4ce1,\n84bec0bf0352). Patch 2 explains how it relates to them. It also\napplies cleanly to net. All carry Fixes: tags; I am happy to\nrepost against net, or add Cc: stable, if you prefer.\n\nChanges in v5:\n\nPatches 1-8: commit message wording only; the code is unchanged.\n\nPatch 9 fixes a gso_segs undercount found by the Sashiko review of v4.\nThe large send helper accepted a frame longer than its IP length and\ncomputed gso_segs from the IP length. Bytes past the IP length stay in\na bridged or switched frame, so the egress path produced more segments\nthan gso_segs claimed. The helper now refuses a frame whose IP length\nis not the frame length.\n\nAlso in patch 9: new KUnit cases for that and for header-only frames,\nso the TCP payload check is still covered. The message no longer says\na refused frame is checked by the stack, which a bridged or switched\nframe is not.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261013182926.30417-1-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9486c89a8e157cedecfb561c3d86053e654d32ab", "tree": "a9bd597b1907ab09ade201c92b682236af45d1fe", "parents": [ "3f872b34368c7c1d2a8900950e0fee4cb4dd9a34" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:26 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:50 2026 -0700" }, "message": "ibmveth: check headers in the RX large send and checksum helpers\n\nibmveth_rx_mss_helper() and ibmveth_rx_csum_helper() trust the IP and\nTCP headers of received frames, which come from another partition on\nthe virtual LAN.\n\nThe worst case is an IPv4 frame with ihl 0 and iph-\u003echeck 0xffff: the\nchecksum helper calls ip_fast_csum(iph, 0), and the ppc64 version\nloops ihl - 1 times on an unsigned count, reading up to 16 GiB in\nsoftirq: a long stall, or an oops once the read leaves mapped memory.\nBoth helpers also read and write header fields past the end of a short\nframe. The large send helper takes the segment size from the TCP\nchecksum field and gso_segs from a TCP header length it never checks,\nand treats an IPv4 TCP fragment as a large send, which can zero two of\nits bytes; the checksum helper can write a checksum into a later\nfragment\u0027s payload.\n\nThe ihl problem dates from the first commit in Fixes:, the large send\nhelper from the second, and the checksum helper from the third.\n\nBefore using a header, check that it fits the frame, that the IPv4 ihl\nis at least 5, and that an IPv4 TCP frame is not a fragment. In the\nlarge send helper, also require a TCP doff of at least 5, TCP payload\nwithin the IP length, and an IP length equal to the frame length:\nEthernet padding or other bytes past the IP length would otherwise\nstay in a bridged or switched frame, which the stack does not trim,\nand be segmented but not counted in gso_segs. Compute gso_segs from\nthe IP length, and keep the segment size at or above TCP_MIN_GSO_SIZE,\nas virtio_net_hdr_to_skb() does since commit c27c449d455a (\"virtio-net:\nEnsure that TCP packets don\u0027t overflow gso_segs\"), and below\nGSO_BY_FRAGS, which virtio rejects. With the headers checked and\ngso_segs computed, the skb is not marked SKB_GSO_DODGY, which would\nalso keep it from hardware TSO on the egress device.\n\nA frame that fails a check is passed up unchanged, without the GSO\nfields or CHECKSUM_UNNECESSARY, so nothing downstream trusts its\nsegment count or checksum. The skb is linear, so the checks use\nskb_headlen(); pskb_may_pull() could reallocate the head under the\nhelpers\u0027 header pointers.\n\nAdd KUnit cases for both helpers: valid IPv4 and IPv6 large sends, the\nsegment size clamp, and refused frames. With any one of the ihl, doff,\nIP length, TCP payload, fragment or clamp checks, or the checksum\nhelper\u0027s IPv4 options, IPv6 header or TCP header length checks,\nremoved, a case fails; without the checksum helper\u0027s ihl check,\nip_fast_csum() oopses on qemu.\n\nFound by the Sashiko review of the previous version of this series and\nconfirmed by code inspection and the KUnit cases above. Tested with\nKUnit on qemu pseries (ppc64le) and on a POWER10 LPAR with iperf3 large\nsends over IPv4 and IPv6 at MTU 1500 and 9000, threaded NAPI and busy\npolling, with no new drops or InCsumErrors. No kernel selftests cover\nibmveth.\n\nFixes: 9c7e8bc584f5 (\"ibmveth: Add support for Large Receive Offload\")\nFixes: 7b5967389f5a (\"ibmveth: set correct gso_size and gso_type\")\nFixes: 66aa0678efc2 (\"ibmveth: Support to enable LSO/CSO for Trunk VEA.\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-10-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3f872b34368c7c1d2a8900950e0fee4cb4dd9a34", "tree": "a220bddee4082caef70ced70782bcfb305c9a181", "parents": [ "c807573ea58e615339a9c72675c45c157ffe245c" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:25 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:50 2026 -0700" }, "message": "ibmveth: wait for the RX poll to return before freeing the RX queue\n\nnapi_disable() returns once ibmveth_poll() has called\nnapi_complete_done(), but the poll is not finished: it then re-enables\nthe interrupt and calls ibmveth_rxq_pending_buffer(), which reads the\nRX queue. ibmveth_close() can free that queue in the meantime, and the\nlate enable can leave the interrupt unmasked after close() masked it.\nThe request_irq() failure path in ibmveth_open() frees the same memory\nafter napi_disable() too.\n\nCall synchronize_net() after napi_disable() on both paths. Every\ncaller of ibmveth_poll() runs it with bottom halves or interrupts\ndisabled, so this waits for the poll to return.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection; also raised by the Sashiko review of the first version\nof this series. The race was not reproduced. Tested on a POWER10 LPAR\nunder an incoming ping flood with 30 rapid link down/up cycles and 30\nrapid MTU cycles (1500 \u003c-\u003e 9000); ran cleanly with no warnings or\nfaults. No kernel selftests cover ibmveth.\n\nFixes: bea3348eef27 (\"[NET]: Make NAPI polling independent of struct net_device objects.\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-9-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c807573ea58e615339a9c72675c45c157ffe245c", "tree": "0cce6919ddc097417f81f6391ec0dec7583612d4", "parents": [ "16abfa871dc840e55f1726408c5994c66a9773e2" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:50 2026 -0700" }, "message": "ibmveth: wait for in-flight transmits in ibmveth_close()\n\nibmveth_close() frees the TX buffers after netif_tx_stop_all_queues(),\nwhich does not wait for an ibmveth_start_xmit() already running on\nanother CPU. That transmit can copy into a freed buffer and hand PHYP\na stale DMA address.\n\nMTU, csum/TSO and buffer pool changes call ibmveth_close() directly\nwhile traffic flows. ifdown and the reset work go through dev_close(),\nwhich waits for running transmits only when the qdisc has an enqueue\nfunction, so with noqueue they race the same way.\n\nUse netif_tx_disable(), which waits for running transmits.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection; the race was not reproduced. Tested on a POWER10 LPAR\nwith MTU changes during a ping flood, with no warnings. No kernel\nselftests cover ibmveth.\n\nFixes: d6832ca48d8a (\"ibmveth: Copy tx skbs into a premapped buffer\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-8-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "16abfa871dc840e55f1726408c5994c66a9773e2", "tree": "d659d08d21bfb0cda1f51160a1ae1c7444505ac9", "parents": [ "fd052c6823b31eb45f824660567ab3f2da2d5195" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:23 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:50 2026 -0700" }, "message": "ibmveth: return the error when set_channels cannot add TX queues\n\nWhen ibmveth_set_channels() cannot allocate a TX buffer for a new\nqueue, it falls back to the old queue count, and the successful\nnetif_set_real_num_tx_queues() call then overwrites rc. ethtool -L\nreports success while the queue count is unchanged.\n\nReturn the allocation error when the fallback succeeds.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection. Tested on a POWER10 LPAR with the TX buffer allocation\nforced to fail by a test-only module parameter (not part of this patch):\nethtool -L tx 8 now fails with -ENOMEM and the device keeps its four\nqueues and passes traffic. No kernel selftests cover ibmveth.\n\nFixes: 10c2aba89cc0 (\"ibmveth: Ethtool set queue support\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-7-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "fd052c6823b31eb45f824660567ab3f2da2d5195", "tree": "34661d78bb89be62a2b6eaba94d76b29cab24231", "parents": [ "c9b95adc755f2396307be676ce838161fb011986" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:49 2026 -0700" }, "message": "ibmveth: release the pool kobjects when probe fails\n\nIf register_netdev() fails in ibmveth_probe(), for example with -EINTR\nwhen the binding task is killed, probe frees the netdev but leaves the\npool%d kobjects embedded in it registered in sysfs. Reading\n/sys/devices/vio/\u003cunit\u003e/pool0/num is then a use-after-free, and the\nnext probe cannot add pool0.\n\nPut the kobjects before freeing the netdev, as ibmveth_remove() does,\non this path and on the netif_set_real_num_tx_queues() one.\n\nThe kobjects also have no release(). With CONFIG_DEBUG_KOBJECT_RELEASE,\nkobject_put() defers their cleanup, including removing the sysfs files,\nto a work item, so free_netdev() can free them first, here and in\nremove(). Add a release() that signals a per-pool completion, and wait\nfor it in both places before free_netdev(). Without that config,\nrelease() runs from kobject_put() and the wait returns at once.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection; the release() part was raised by the Sashiko review of\nthe first version. Tested on a POWER10 LPAR with register_netdev()\nforced to fail with -EINTR by a test-only module parameter (not part of\nthis patch): no pool%d directories remain and the device binds again. No\nkernel selftests cover ibmveth.\n\nFixes: 860f242eb534 (\"[PATCH] ibmveth change buffer pools dynamically\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-6-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c9b95adc755f2396307be676ce838161fb011986", "tree": "27fb7cbaee81622e7d9bb2bbbd70a6906732d179", "parents": [ "1412235447869922eb0ee041a31fab6176e60ab0" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:21 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:49 2026 -0700" }, "message": "ibmveth: step past bad RX correlators instead of spinning or oopsing\n\nibmveth_poll() mishandles a bad RX correlator from PHYP in two ways.\n\nIf harvest fails or ibmveth_rxq_get_buffer() returns NULL, poll\nbreaks out without advancing the ring and restarts on the same slot\nforever. For an out-of-range correlator it also fires a WARN_ON() and\nschedules a reset each pass, but the reset is queued on that CPU and\nnever runs, and the CPU stalls RCU, so RTNL holders hang too. This\ndates from the first commit in Fixes:, which turned the BUG_ON()s\nhere into WARN_ON() plus a reset.\n\nThe range check also accepts a correlator naming an inactive buffer\npool (pools 2 and 3 by default), whose skbuff array is NULL, so the\nlookup dereferences NULL in softirq. Pools became inactive with the\nsecond commit in Fixes:.\n\nValidate the correlator in one helper that also rejects a pool with\nno skbuff array. On a bad slot, advance the ring, count the drop in\nrx_dropped and still schedule the reset, which rebuilds the pools.\nThe slot has moved, so stay in the budget loop and count it in\nframes_processed. Breaking out would complete NAPI, re-arm, and\nnapi_schedule() with budget left. When the final check finds more\nwork, queue the NAPI and return instead of going back to\nrestart_poll: after napi_complete_done() the NAPI is no longer this\ncall\u0027s, and with threaded NAPI and busy polling the kthread can\nalready be polling it on another CPU. frames_processed is below\nbudget there, so busy_poll_stop() does not queue it a second time.\nMask the interrupt before queueing, as ibmveth_interrupt() does;\nmasking after napi_schedule() could land after that kthread has\nfinished and unmasked, leaving RX masked with nothing scheduled.\n\nDrop a frame whose offset + length does not fit the pool buffer:\ncopybreak would read past the RX buffer and skb_put() would BUG().\nAlso drop one shorter than an Ethernet header, which eth_type_trans()\nwould read past. Read the correlator once per slot and use that value\nfor the lookup, the bound and the harvest.\n\nThe base driver never checked frame bounds, and they have not been\nseen in the field, so they have no Fixes: tag of their own. The tags\nbelow are for the correlator hang.\n\nThe correlator comes from PHYP, and with the ring advancing a burst\nof bad slots would WARN once per slot (and panic with\npanic_on_warn), so use a ratelimited netdev_err() instead. Also free\nthe rx_copybreak skb if harvest fails there.\n\nAdd a KUnit case for harvest advancing on errors and extend the\nexisting cases to an inactive pool. Run against the unfixed driver,\nwith the calls changed back to its signatures, the first fails and\nthe others oops.\n\nFound in review of the ibmveth multi-queue RX series (the frame bound by\nthe Sashiko review of v2 of this series) and confirmed by code\ninspection and the KUnit cases above. Hitting either correlator bug\nneeds PHYP to return a bad correlator, so neither was reproduced on\nhardware. Tested with KUnit on qemu pseries (ppc64le), and on a POWER10\nLPAR with a ping flood and MTU changes under traffic. No kernel\nselftests cover ibmveth.\n\nFixes: 2c91e2319ed9 (\"net: ibmveth: Reset the adapter when unexpected states are detected\")\nFixes: 860f242eb534 (\"[PATCH] ibmveth change buffer pools dynamically\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-5-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1412235447869922eb0ee041a31fab6176e60ab0", "tree": "aab1c61d4be7f6796b0d32805df057fab252d9ee", "parents": [ "95811c873d1b97c424a7e6e731730cbf6656ab7e" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:49 2026 -0700" }, "message": "ibmveth: disable the reset work before unregister in remove\n\nibmveth_remove() cancels the reset work before unregister_netdev(),\nbut NAPI keeps running until unregister closes the device and can\nqueue the reset again, on an interrupt enable failure, a bad\nfree_map entry or a bad RX slot. The reset can then run on the\nadapter after free_netdev(), or reopen the device during unregister.\n\nUse disable_work_sync(), which waits for a running reset and keeps\nthe work from being queued again. A bad RX slot also makes poll\nspin, which can stall unregister; a later patch in this series\nfixes that.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection; it was not reproduced. Tested on a POWER10 LPAR with\nunbind and bind cycles under traffic. No kernel selftests cover ibmveth.\n\nFixes: 2c91e2319ed9 (\"net: ibmveth: Reset the adapter when unexpected states are detected\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-4-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "95811c873d1b97c424a7e6e731730cbf6656ab7e", "tree": "549ffbd255c24de9fc42cbddd266f65910442e1e", "parents": [ "8d9ecac6b96e61d0e6d126c60644829fd9f66952" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:19 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:49 2026 -0700" }, "message": "ibmveth: do not close twice after a failed reopen\n\nibmveth_change_mtu(), veth_pool_store(), ibmveth_set_csum_offload()\nand ibmveth_set_tso() call close() and open() directly. If open() fails,\nNAPI is left disabled while IFF_UP stays set, so the next close()\n(ifdown, unregister or another reconfiguration) calls napi_disable()\nagain and waits forever with RTNL held. Networking and shutdown\nhang; only a reboot recovers. ethtool -L in that state also wakes\nqueues that have no TX buffer and dereferences NULL in\nibmveth_start_xmit().\n\nAny open() failure on those paths triggers it, for example an\nallocation failure on an MTU change to jumbo frames.\n\nTrack a successful open in adapter-\u003eopened. close() returns early\nwhen it is clear, and set_channels() checks it instead of IFF_UP.\n\nThe open() error-path leaks were fixed separately in net by\ncommit af0524bf4ce1 (\"ibmveth: h_free logical LAN on open-fail after\nregister\") and commit 84bec0bf0352 (\"ibmveth: fix TX LTB and filter\nunwind on open-fail\"), which are now in net-next too, so a failed\nopen() no longer leaves TX buffers or the logical LAN registration\nbehind for the early return to skip.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection. Tested on a POWER10 LPAR with ibmveth_open() forced to\nfail by a test-only module parameter (not part of this patch): \u0027ip link\nset dev eth1 mtu 9000\u0027 fails, then \u0027ip link set dev eth1 down\u0027 returns\nat once and \u0027ip link set dev eth1 up\u0027 recovers the interface. No kernel\nselftests cover ibmveth.\n\nFixes: 860f242eb534 (\"[PATCH] ibmveth change buffer pools dynamically\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-3-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8d9ecac6b96e61d0e6d126c60644829fd9f66952", "tree": "6bba06eaf7aaccd961fe6c541c819426b516efb2", "parents": [ "5ed6ab32767c6e957eeecc0b9924e8d0e0758ec0" ], "author": { "name": "Mingming Cao", "email": "mmc@linux.ibm.com", "time": "Tue Oct 13 11:29:18 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:37:49 2026 -0700" }, "message": "ibmveth: fix netpoll races with RX replenish\n\nibmveth_poll_controller() runs RX replenish outside NAPI and without\na lock, racing NAPI\u0027s replenish on another CPU. Both can fill the\nsame slot, so an skb and its DMA mapping leak and PHYP can write\ninto an unmapped buffer. netpoll calls it from netconsole and from\nnetpoll-enabled bonds.\n\nibmveth_open() also enables NAPI before the RX resources exist.\nibmveth_change_mtu(), veth_pool_store(), ibmveth_set_csum_offload()\nand ibmveth_set_tso() call close() and open() directly, so while\nopen() is still setting up, netpoll and the direct ibmveth_interrupt()\ncalls can replenish NULL pools and read freed memory.\n\nRemove the callback, as Eric Dumazet did for many drivers after\ncommit ac3d9dd034e5 (\"netpoll: make ndo_poll_controller() optional\"),\nincluding ibmvnic in commit 0c3b9d1b37df (\"ibmvnic: remove\nndo_poll_controller\"). netpoll then polls NAPI itself with budget 0.\nnapi-\u003epoll_owner serializes that with NAPI, but not with a NAPI poll\nthat was already running when netpoll was set up, so skip RX\nreplenish at budget 0, which netpoll uses for TX only. TX completes\nsynchronously, so ibmveth_poll() has nothing else to do for netpoll.\n\nEnable NAPI just before request_irq(), once everything\nibmveth_poll() touches exists.\n\nFound in review of the ibmveth multi-queue RX series and confirmed by\ncode inspection of poll_one_napi() and the direct close()/open()\ncallers; neither race was reproduced. Tested on a POWER10 LPAR with\nnetconsole over ibmveth: a ping flood (678,470 packets, no loss) during\na printk flood, and MTU changes and buffer pool toggles under traffic,\nwith no warnings. No kernel selftests cover ibmveth.\n\nFixes: 6b4223748895 (\"[PATCH] ibmveth: Add netpoll function\")\nFixes: bea3348eef27 (\"[NET]: Make NAPI polling independent of struct net_device objects.\")\nSigned-off-by: Mingming Cao \u003cmmc@linux.ibm.com\u003e\nLink: https://patch.msgid.link/20261013182926.30417-2-mmc@linux.ibm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5ed6ab32767c6e957eeecc0b9924e8d0e0758ec0", "tree": "f5320707e211fd7a0089349c964cffb1df61dc74", "parents": [ "3c9d71edf50ad153e892ef887e54496286774544", "aee7b59e6e7b353a48ca8b07794a441b03eac6a0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:28:12 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:28:12 2026 -0700" }, "message": "Merge branch \u0027net-stmmac-track-and-report-the-tx-dma-threshold-per-queue\u0027\n\nOvidiu Panait says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: stmmac: Track and report the TX DMA threshold per queue\n\nOn the Renesas RZ/V2H platform, which has two dwmac4 controllers, we\nobserved sporadic iperf3 TCP TX failures on one of the controllers, with\nthroughput dropping from \u003e900Mbit/s to ~1Mbit/s due to TX underflows and\nthe resulting retransmissions.\n\nCommit 3a6c12a0c6c3 (\"net: stmmac: bump tc when get underflow error from\nDMA descriptor\") made dwmac4 raise the DMA threshold of the queues that\nreport TX underflows, by increasing a global module parameter \u0027tc\u0027.\nHowever, this logic does not work correctly across multiple queues and\ncontrollers, and can leave the TX DMA threshold stuck at 64 bytes.\n\nThis series fixes that logic to track and report the TX DMA threshold per\nqueue for each controller.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261013114503.57487-1-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aee7b59e6e7b353a48ca8b07794a441b03eac6a0", "tree": "f5320707e211fd7a0089349c964cffb1df61dc74", "parents": [ "9dd53418781900f02897c805eed397555cf98417" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Oct 13 11:45:03 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:28:11 2026 -0700" }, "message": "net: stmmac: Report the TX DMA threshold per queue\n\nThe \"threshold\" ethtool statistic reports a single TX DMA threshold for\nthe whole device. However, since commit d62a107a4f15 (\"net: stmmac:\nprepare dma interrupt treatment for multiple queues\"), a single TX DMA\nthreshold per device doesn\u0027t make sense anymore, as each individual queue\nthat underflows gets its threshold increased, so the queues are out of\nsync.\n\nTo make the reporting accurate, remove it and report the threshold of\neach TX queue instead, as \"qN_tx_threshold\".\n\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nLink: https://patch.msgid.link/20261013114503.57487-3-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9dd53418781900f02897c805eed397555cf98417", "tree": "b2e4aedf600b33b09b89cd66df271927792ce506", "parents": [ "3c9d71edf50ad153e892ef887e54496286774544" ], "author": { "name": "Ovidiu Panait", "email": "ovidiu.panait.rb@renesas.com", "time": "Tue Oct 13 11:45:02 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 15:28:10 2026 -0700" }, "message": "net: stmmac: Track the TX DMA threshold per queue\n\nCommit 3a6c12a0c6c3 (\"net: stmmac: bump tc when get underflow error from\nDMA descriptor\") made dwmac4 raise the DMA threshold of the queues that\nreport TX underflows. This is done by incrementing a module global\nparameter \u0027tc\u0027 by 64 on each underflow.\n\nThis leads to inconsistent TX DMA thresholds between queues and causes\nissues on platforms with multiple stmmac controllers, as \u0027tc\u0027 is shared\nby all of them. Once \u0027tc\u0027 goes over 256 the bumping stops, and queues\nthat did not underflow before are left at the initial threshold.\n\nOn the Renesas RZ/V2H platform, which has two dwmac4 controllers, we\nobserved sporadic iperf3 TCP TX failures:\n\n iperf3 -c \u003cserver\u003e -t5 --bind-dev end1\n ...\n [ 5] 0.00-5.00 sec 1.00 MBytes 1.68 Mbits/sec 87 sender\n [ 5] 0.00-5.00 sec 768 KBytes 1.26 Mbits/sec receiver\n\nThis happens because the TX queues of end1 were underflowing on a large\nfraction of the packets, but the DMA TX threshold was never raised from\nthe default of 64 bytes. The threshold was not raised because end0\nhad underflowed first and had already pushed \u0027tc\u0027 past 256. Which\ncontroller is affected depends on which one underflows first.\n\nTo fix this, make the TX DMA threshold per queue instead of global.\nEach time an underflow happens on a queue, its TX DMA threshold gets\nincremented, without affecting other queues or controllers. With this\nchange, \u0027tc\u0027 is only used as the initial value, and the RX threshold\nis no longer bumped together with the TX one, as TX underflows have\nnothing to do with the RX side.\n\nFixes: 3a6c12a0c6c3 (\"net: stmmac: bump tc when get underflow error from DMA descriptor\")\nSigned-off-by: Ovidiu Panait \u003covidiu.panait.rb@renesas.com\u003e\nReviewed-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nLink: https://patch.msgid.link/20261013114503.57487-2-ovidiu.panait.rb@renesas.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3c9d71edf50ad153e892ef887e54496286774544", "tree": "e44177788f12d456b162733797cec5ff133c6271", "parents": [ "56c7aa17f0f09844dcf2c25bbe76fc4a87519192", "9e061caa3bdd288b007fa3a10cb4489f6472e671" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:36 2026 -0700" }, "message": "Merge branch \u0027net-mctp-usblib-increase-coverage-of-kunit-testing\u0027\n\nJames Lee says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: mctp: usblib: Increase coverage of kunit testing\n\nCurrent usblib tests only check receipt of a limited combination of\npackets lengths.\n\nAdded tests of receiving packets with invalid fields, and more complex\npacket spanning. Also created tests for transmitting packets, covering\nmost code, except for mctp_usblib_tx_cancel() and allocation failures.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-0-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "9e061caa3bdd288b007fa3a10cb4489f6472e671", "tree": "e44177788f12d456b162733797cec5ff133c6271", "parents": [ "1e12f734afc10477bbe050e424f13cf168ff7f42" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:37 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:33 2026 -0700" }, "message": "net: mctp: usblib: Add test for failing append\n\nAdd test ensuring that network device stats are updated appropriately\nwhen a previously pushed packet fails to send during a subsequent push.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-7-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1e12f734afc10477bbe050e424f13cf168ff7f42", "tree": "201a576d45257a2d7a290cdd1d127ae7ef084043", "parents": [ "77cb5c6b3464501eb4dfdb5a5679a7a70bc71570" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:36 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:33 2026 -0700" }, "message": "net: mctp: usblib: Add initial kunit tx tests\n\nAdd tests for the transmit path, where MCTP packets are handed to\noutgoing USB transfer data. Testing a spanning transfer that is expected\nto succeed, the failure paths when sends fail, and large sequential\nsends.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-6-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "77cb5c6b3464501eb4dfdb5a5679a7a70bc71570", "tree": "df37f0529ea3ba91a1cc98501a13e48619d31b2a", "parents": [ "40e59c00ae219f01fe17365df1f69769eb61b0c3" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:35 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:32 2026 -0700" }, "message": "net: mctp: usblib: Simplify allocation logic in mctp_usblib_test_rx_init\n\nThe if statement testing rx\u0027s allocation is unneeded.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-5-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "40e59c00ae219f01fe17365df1f69769eb61b0c3", "tree": "30762187e1317ccf065a8ffb241f387457c742cd", "parents": [ "c0a372f7297250524845eae6cc41ce69d7838eb0" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:34 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:32 2026 -0700" }, "message": "net: mctp: usblib: Complete rx tests\n\nAdd rx tests without spanning, covering cases where a packet is shorter\nthan allowed without spanning, isn\u0027t completed within one submission.\n\nFully cover rx functions except for memory allocation failures and\ntrivial functions.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-4-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c0a372f7297250524845eae6cc41ce69d7838eb0", "tree": "2182d988b0c031efd3015983747bafaae3cea79e", "parents": [ "21e1d4515755be34172e4776e4c288d64e01b3c5" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:33 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:32 2026 -0700" }, "message": "net: mctp: usblib: Add tests of invalid headers\n\nAdd tests where the length field of the USB transport header is below\nthe minimum value, and where the DMTF ID is invalid.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-3-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "21e1d4515755be34172e4776e4c288d64e01b3c5", "tree": "64d418c7baa0aa5e5e3d6a50a60b7ff5dfa51540", "parents": [ "acfb9c263d70b93f05240b136d7765b096c66956" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:32 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:32 2026 -0700" }, "message": "net: mctp: usblib: Add test for splits inside headers\n\nAdd test covering every possible split of a packet\u0027s headers between\ntransfers and remove parameterized tests that are now covered.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-2-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "acfb9c263d70b93f05240b136d7765b096c66956", "tree": "fb859d132d1ea244e73e480579fecab8c110dea4", "parents": [ "56c7aa17f0f09844dcf2c25bbe76fc4a87519192" ], "author": { "name": "James Lee", "email": "james@codeconstruct.com.au", "time": "Wed Oct 14 12:47:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:25:32 2026 -0700" }, "message": "net: mctp: usblib: Add to parameterized kunit tests.\n\nAdd parameterized tests to cover worst case scenarios for packet\nsplitting and length.\n\nSigned-off-by: James Lee \u003cjames@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20261014-dev-mctp-usb-lib-test-v3-1-ee5bc3ea1db1@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56c7aa17f0f09844dcf2c25bbe76fc4a87519192", "tree": "d52c9e10207ac405c1d68ac3442a280291f2d900", "parents": [ "238164201431a425e48dfcb8e9a59de63caf175b" ], "author": { "name": "Luiz Angelo Daros de Luca", "email": "luizluca@gmail.com", "time": "Mon Oct 19 01:26:27 2026 -0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:13:07 2026 -0700" }, "message": "net: dsa: realtek: use \u003cmodule\u003e-y in Makefile\n\nSwitch from \u003cmodule\u003e-objs to \u003cmodule\u003e-y to eliminate ifdefs and simplify\nconditional object list construction. Drop the obsolete trailing\ncomment.\n\nSigned-off-by: Luiz Angelo Daros de Luca \u003cluizluca@gmail.com\u003e\nReviewed-by: Alvin Šipraga \u003calvin.sipraga@analog.com\u003e\nLink: https://patch.msgid.link/20261019-realtek_mkf-v1-1-3246a77d5782@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "238164201431a425e48dfcb8e9a59de63caf175b", "tree": "a4ccf80bb11c193800879f84b5e21d5564c96c42", "parents": [ "17271848c9a79cdbee49537cb9a73e7de0906962" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Sat Oct 17 12:42:28 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:00:36 2026 -0700" }, "message": "ip6mr: clear skb-\u003ecb[] in reg_vif_xmit()\n\nreg_vif_xmit() hands the skb to ip6mr_cache_report() as an\nMRT6MSG_WHOLEPKT report. skb_realloc_headroom() copies skb-\u003ecb[]\ninto the report, which is queued to the mroute socket, where\nrawv6_recvmsg() reads it as IP6CB.\n\nBy the time the pim6reg device transmits the packet, skb-\u003ecb[] is\nnot IP6CB anymore: qdisc_pkt_len_init() overwrites iif and ra,\nand any qdisc installed on the device (fq, fq_codel, pie, cake...)\nor a tc BPF program writing skb-\u003ecb[] fills the area holding\ndst0, srcrt, dst1, lastopt and flags.\n\nSince commit dd433671fef3 (\"ipv6: validate extension header length\nbefore copying to cmsg\") these stale offsets can no longer cause\nout-of-bounds reads, but the mroute socket can still receive bogus\nIPV6_PKTINFO ifindex and extension header ancillary data.\n\nClear IP6CB before building the report. The skb is freed right\nafter, so nothing else depends on its control block.\n\nFixes: 14fb64e1f449 (\"[IPV6] MROUTE: Support PIM-SM (SSM).\")\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "17271848c9a79cdbee49537cb9a73e7de0906962", "tree": "dd823b5b0b228dd9727309d88bedd66ae3cea54d", "parents": [ "f6fa1d60ec3ceb7e6c26aa91eadfef34f94014e1" ], "author": { "name": "Hangbin Liu", "email": "liuhangbin@kylinos.cn", "time": "Mon Oct 19 08:41:03 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 14:00:03 2026 -0700" }, "message": "selftests: net: exit with test failure status\n\nThe changed four tests can print [FAIL] subtests while still exiting with\nstatus 0. Their log_test(), aka log_test_expected() in lib.sh, helpers\nrecord a failure in ret, but the scripts never propagate ret to the exit\ncode, so a kselftest runner treats the run as a pass.\n\nInitialize ret and exit with it at the end of each script so failed\nsubtests are reflected in the exit status.\n\nSigned-off-by: Hangbin Liu \u003cliuhangbin@kylinos.cn\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f6fa1d60ec3ceb7e6c26aa91eadfef34f94014e1", "tree": "01105d5a12de3228f287494156f86ad80d7a7321", "parents": [ "5d1b850ea3f6e6ba2090ebc437e9bbec1d7e5ae4" ], "author": { "name": "Nguyen Ngoc Thang", "email": "ngocthang2710.1999@gmail.com", "time": "Fri Oct 16 23:15:25 2026 +0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:57:16 2026 -0700" }, "message": "net/rds: ib: don\u0027t enable IRQs in rds_ib_conn_free()\n\n__rds_conn_create() calls trans-\u003econn_free() with rds_conn_lock held\nand IRQs disabled when it loses the race to insert a connection.\nrds_ib_conn_free() takes the device list lock with spin_lock_irq() and\nreleases it with spin_unlock_irq(), so IRQs are turned on while\nrds_conn_lock is still held:\n\n raw_local_irq_restore() called with IRQs enabled\n WARNING: kernel/locking/irqflag-debug.c:10 at warn_bogus_irq_restore+0xc/0x20\n _raw_spin_unlock_irqrestore+0x67/0x80\n __rds_conn_create+0x1de5/0x2290\n rds_conn_create_outgoing+0x43/0x60\n rds_sendmsg+0xfca/0x20e0\n __sys_sendto+0x408/0x5a0\n\nIt needs an RDS socket bound to an address on an RDMA device (e.g. rxe)\nand two concurrent sendto() calls to the same new destination.\n\nThe TCP and loopback -\u003econn_free() callbacks already use irqsave, so\ndo the same here.\n\nFixes: 745cbccac3fe (\"RDS: Rewrite connection cleanup, fixing oops on rmmod\")\nReported-by: syzbot+c3741bb338b5c6d6a4aa@syzkaller.appspotmail.com\nCloses: https://syzkaller.appspot.com/bug?extid\u003dc3741bb338b5c6d6a4aa\nCc: stable@vger.kernel.org\nSigned-off-by: Nguyen Ngoc Thang \u003cngocthang2710.1999@gmail.com\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5d1b850ea3f6e6ba2090ebc437e9bbec1d7e5ae4", "tree": "09fe86a3f9f2cb07f3d69b06ee9a664dfddc24c8", "parents": [ "799cdeaa5c39f75a5e8db7aecd7fa30e7fb958b0", "d0107f38162279d9cb0e012210731176265f835d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:48:47 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:48:48 2026 -0700" }, "message": "Merge tag \u0027nf-next-26-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter updates for net-next\n\nThe following patchset contains Netfilter/IPVS updates for net-next:\n\n1) Disable br_netfilter in userns and schedule it for removal in 2027,\n from Florian Westphal.\n\n2) Update selftest nft_queue.sh to make it more stable on debug\n kernels, from Jakub Kicinski.\n\n3) Fix a overflow in IPVS sync messages which can only happen in very\n old 2.6 kernels, from Julian Anastasov.\n\n4) Finer grain packet drop in nfnetlink_queue when dependency objects\n are going away, from Antonio Ojea.\n\n5) Add a selftest for the nfnetlink_queue packet drop case, also\n from Antonio Ojea.\n\n6) Flush conntrack gc worker when existing netns to address a unlikely\n UaF, from Florian Westphal.\n\n7) Switch nf_tables chain types to use rcu, otherwise module removal\n can trigger UaF, also from Florian.\n\n8) Remove redundant parsing in nft_exthdr for the tcp options case,\n from Fernando F. Mancera.\n\n9) Remove redundant skb_header_pointer() calls in nft_exthdr for tcp\n options, from Fernando F. Mancera.\n\n10) Fix conntrack_vrf.sh selftest return value in zone subtest,\n from Florian Westphal.\n\n11) Restrict raw table in nft_compat to specific family, hook and\n priority, from Florian Westphal.\n\nPrepare the flowtable to support for IPv4 over IPv6 tunneling and\nvice-versa, this includes 4 patches from Lorenzo Bianconi.\n\n12) Explicitly set inner protocol when popping header, this is not\n needed for the existing IPIP and IP6IP6 case because skb-\u003eprotocol\n remains the same.\n\n13) Simplify tuple tunnel information fill up when parsing outer\n tunnel IP headers.\n\n14) Add a new encap_proto which determines the outer tunnel protocol\n family.\n\n15) Prepare flowtable forwarding path to deal with mixed IPv4-IPv6\n tunnels.\n\n* tag \u0027nf-next-26-10-18\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf-next:\n netfilter: flowtable: unify tunnel push for IPv4 and IPv6\n netfilter: flowtable: add encap_proto to flow_offload_tunnel\n netfilter: flowtable: populate tunnel tuple regardless of inner protocol\n netfilter: flowtable: set inner protocol when popping tunnel header\n netfilter: nft_compat: restrict raw table targets/matches\n selftests: netfilter: fix return value in zone subtest\n netfilter: nft_exthdr: avoid 60 bytes stack buffer in TCP option mangling\n netfilter: nft_exthdr: remove redundant op parsing in tcp_set_init\n netfilter: nf_tables: switch chain_types array to rcu\n netfilter: conntrack: fix unlikely UaF in gc worker\n selftests: netfilter: nft_queue: check the scope of the hook drop flush\n netfilter: nf_queue: limit the hook drop flush to the unregistered hook point\n ipvs: fix buffer overflow when sending sync messages\n selftests: netfilter: nft_queue.sh: only queue icmp echo request/reply\n netfilter: disable br_netfilter in user namespaces\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261018005638.1776148-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "799cdeaa5c39f75a5e8db7aecd7fa30e7fb958b0", "tree": "a1712864e207b26c126a1ea0c1f6c18e3de4ff1c", "parents": [ "e64bff85e3c8fb6e0f55e00b2c4d219a0edb33a8" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Tue Oct 13 17:49:37 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:45:52 2026 -0700" }, "message": "net: mana: add BQL support\n\nMANA doesn\u0027t support byte queue limits, so each TX queue can hold 256\nWQEs by default, and up to 16384, of up to 64 KB TSO packets, before the\nqdisc layer sees any backpressure. This adds latency to all the flows\nsharing a queue, and defeats AQM qdiscs such as fq_codel, which rely on\nBQL to keep the driver queues short.\n\nReport the bytes queued and completed to BQL, except for the XDP_TX and\nXDP_REDIRECT frames. These share the SQs, but bypass the qdisc and are\nsent even when the queue is stopped, so BQL can\u0027t hold them back.\nCounting them would let sustained XDP traffic keep the queue stopped,\nstarving the stack, and the TX watchdog would then either fire while the\ncompletions still arrive, or, if the XDP sends refreshed trans_start,\nnot fire when the completions stop. The XDP SKBs are marked in their\nskb-\u003ecb, next to the WQE size, so that their completions are skipped as\nwell.\n\nReset the BQL state when destroying the queues, once their NAPI is\ndisabled, since the SKBs still pending after a drain timeout are freed\nwithout being completed.\n\nLost TX completions can now stop a queue sooner: it also stops when the\nbytes in flight exceed the BQL limit, not only when the SQ is full, and\nthe limit may never grow enough to cover the lost bytes. This includes\nthe completions skipped by the WARN_ON_ONCE() early returns in\nmana_poll_tx_cq(), which already leak SQ space: completing the SKBs\nalready freed there wouldn\u0027t reliably balance BQL, since\nmana_gd_poll_cq() has already consumed the CQEs of the rest of the\nbatch. The TX watchdog then fires, as nothing refreshes the trans_start\nof a queue stopped by BQL, and its handler resets the queues along with\ntheir BQL state. The exception, as before this patch, is XDP traffic\nkeeping the SQ full: each XDP send then stops the queue again,\nrefreshing its trans_start.\n\nTested on two Standard_D16ds_v6 Azure VMs in a proximity placement\ngroup, where the throughput is capped at 10.6 Gbps, with the DUT\nalternately booting net-next (c1c1f0a31712) with and without this patch\napplied.\n\nThe throughput stays at the cap with 1, 8 and 64 TCP flows, and the idle\nTCP_RR latency doesn\u0027t change (p50 of 47 us with vs. without the patch).\nWith 16 senders of 64-byte UDP packets, the DUT sends 3.7 to 4.0 Mpps\nwithout the patch and 3.7 to 4.1 Mpps with it. With bulk TCP flows\nsharing the queues, the netperf TCP_RR latency drops (medians of 6\nruns):\n\n 16 queues, 64 flows: p50 4649 -\u003e 2182 us, p99 5621 -\u003e 2677 us\n 1 queue, 8 flows: p50 2554 -\u003e 418 us, p99 2723 -\u003e 624 us\n\nThe standing queue moves from the SQs to fq_codel, which now drops\npackets: about 2500 qdisc drops and 88K TCP retransmissions per 48 s run\nwith 64 flows, against at most 29 retransmissions before. The\nretransmissions are about 0.2% of the segments sent. The TCP_RR flows\nlose no packets, and the packets of the bulk flows are dropped before\nthey reach the wire, so the goodput changes by less than 0.01%.\n\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nReviewed-by: Haiyang Zhang \u003chaiyangz@microsoft.com\u003e\nLink: https://patch.msgid.link/20261013214937.145312-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e64bff85e3c8fb6e0f55e00b2c4d219a0edb33a8", "tree": "984fe26b95e72c24581fdc87bc99ad53071b9af6", "parents": [ "b59787892d04a5647a7e662fbb02cd0abdb1a993" ], "author": { "name": "Daniel Borkmann", "email": "daniel@iogearbox.net", "time": "Thu Oct 15 17:10:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:44:18 2026 -0700" }, "message": "net: Port skb_segment tests of the test_bpf module to KUnit\n\nThe old test_bpf module is going away, therefore port the two test\ncases which were added in 76db8087c4c9 (\"net: bpf: add a test for\nskb_segment in test_bpf module\") as well as cf204a718357 (\"bpf,\ntesting: Introduce \u0027gso_linear_no_head_frag\u0027 skb_segment test\")\ninto the net_test.c to retain coverage. With it in place:\n\n # Subtest: gso_test_func\n ok 1 no_gso\n ok 2 linear\n ok 3 frags\n ok 4 frags_pure\n ok 5 gso_partial\n ok 6 frag_list\n ok 7 frag_list_pure\n ok 8 frag_list_non_uniform\n ok 9 frag_list_head_frag\n ok 10 frag_list_no_head_frag\n ok 11 gso_by_frags\n ok 12 resegment\n ok 13 resegment_multi\n ok 14 resegment_tail\n ok 15 resegment_one_mss\n # gso_test_func: pass:15 fail:0 skip:0 total:15\n\nSigned-off-by: Daniel Borkmann \u003cdaniel@iogearbox.net\u003e\nCc: Willem de Bruijn \u003cwillemb@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20261015151033.591439-1-daniel@iogearbox.net\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b59787892d04a5647a7e662fbb02cd0abdb1a993", "tree": "ea3ea09266ebf9929fbde6bf096ece3f27d5f7fe", "parents": [ "69ab87acc614cbe0bd08a65ece6e1aabee805106" ], "author": { "name": "Sagi Maimon", "email": "maimon.sagi@gmail.com", "time": "Thu Oct 15 11:47:43 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:38:48 2026 -0700" }, "message": "net: axienet: release every RX buffer in axienet_dma_bd_release()\n\nThe RX walk in axienet_dma_bd_release() stops at the first descriptor\nwithout an skb, assuming that such a slot and all after it were never\nfilled. That holds on the axienet_dma_bd_init() error path, but not once\nthe ring has been running: when axienet_rx_poll() fails to allocate or\nmap a replacement buffer it leaves the slot it emptied with a NULL skb,\nin the middle of a populated ring, until a later poll refills it.\nClosing the interface before then leaks the skb and the streaming DMA\nmapping of every descriptor after that slot, which can be most of the\nring, and is most likely under memory pressure.\n\nThe walk also frees each skb before unmapping it. With swiotlb, the\nDMA_FROM_DEVICE unmap copies the bounce buffer back into the skb data\nthat was just freed, and on non-coherent platforms it invalidates cache\nlines that may already belong to a new owner.\n\nSkip empty slots instead of stopping at the first one. An emptied slot\nstill has a non-zero cntrl but its buffer is already unmapped, so the\nskip has to cover the unmap too, which it does by coming before it.\nThen unmap before freeing, as axienet_rx_poll() does.\n\nThis was reported by the Sashiko AI review bot.\n\nTested on the AXI Ethernet MAC of an ADVA TimeCard X2 (PCIe card, with\nthe built-in AXI DMA): traffic passes after each of ten down/up cycles,\neach running axienet_dma_bd_release(), so the unmap-then-free order is\nexercised on every buffer. A failed RX refill was not reproduced, so\nthe skip over an empty slot was not exercised.\n\nFixes: f26667a373f3 (\"net: axienet: Fix DMA descriptor cleanup path\")\nFixes: 7a7d340ba4d9 (\"net: axienet: fix RX ring refill allocation failure handling\")\nSigned-off-by: Sagi Maimon \u003cmaimon.sagi@gmail.com\u003e\nLink: https://patch.msgid.link/20261015084743.1798326-1-maimon.sagi@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "69ab87acc614cbe0bd08a65ece6e1aabee805106", "tree": "d9d339f762c4915040c7ccc8e35e3ebe90e3791e", "parents": [ "42ee6e77ab4592ab43a7724f57f1942a7267b505" ], "author": { "name": "Erfan Sharafzadeh", "email": "erfansh@meta.com", "time": "Tue Oct 13 14:09:54 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:22:38 2026 -0700" }, "message": "net: devmem: allow peer-to-peer dma-buf attach for bindings\n\nnet_devmem_bind_dmabuf() uses dma_buf_attach(), a static attachment\nwith peer2peer false. Exporters must then keep the buffer reachable\nwithout P2P; amdgpu does so by placing it in GTT (system memory), so a\ndevice memory binding silently ends up in host memory.\n\nUse dma_buf_dynamic_attach() with allow_peer2peer set, so an exporter\nthat can do P2P to the device keeps the buffer in device memory.\nDynamic attachments are not pinned on map, and devmem cannot handle the\nbuffer moving, so:\n\n- pin it with dma_buf_pin() before mapping, which keeps it in place for\n the lifetime of the binding, as before;\n- wait for the exporter\u0027s kernel fences after mapping, interruptibly,\n as the core does for static attachments.\n\nThis follows the pinned RDMA umem path, including its limits: the\nbinding cannot be revoked by the exporter, and once a P2P binding has\npinned a buffer in device memory, a later attachment to the same buffer\nthat cannot do P2P may fail to pin it. Exporters that cannot do P2P to\nthe device place the buffer as before. RX and TX bindings both go\nthrough this function.\n\nSigned-off-by: Erfan Sharafzadeh \u003cerfansh@meta.com\u003e\nAcked-by: Stanislav Fomichev \u003csdf@fomichev.me\u003e\nLink: https://patch.msgid.link/20261013210954.2170175-1-erfansh@meta.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "42ee6e77ab4592ab43a7724f57f1942a7267b505", "tree": "fc8da34cb7c8cea6550b2961ebc21581e27c216c", "parents": [ "8754a53984e6f95b9cee7377d43724be1fa89551" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Fri Oct 16 11:35:18 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:05:20 2026 -0700" }, "message": "hinic: use skb_put_padto()\n\nhinic_xmit_frame() pads short frames with skb_pad(), then\nsets skb-\u003elen directly, leaving skb-\u003etail stale.\n\nUse skb_put_padto(), which updates both and is a litle less confusing.\n\nAlso remove one pointless netdev_err() call.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261016093518.2756935-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8754a53984e6f95b9cee7377d43724be1fa89551", "tree": "86ee10876e84d0a9d77ddefd452ef56dc05bf9d1", "parents": [ "4f29e69cf1d844a81465439dd58339c48b10b994" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Fri Oct 16 11:43:12 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:05:12 2026 -0700" }, "message": "fm10k: use skb_put_padto()\n\nReplace the open-coded skb_pad() + __skb_put() sequence\nin fm10k_xmit_frame() with skb_put_padto().\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261016094312.2759956-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4f29e69cf1d844a81465439dd58339c48b10b994", "tree": "fc5960f8c1b093d9b534889feaef2591a23d23e6", "parents": [ "87cce46329a811ea3fe108ac721e0a2400d0a3bb" ], "author": { "name": "Eric Dumazet", "email": "edumazet@kernel.org", "time": "Fri Oct 16 11:49:25 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 13:05:07 2026 -0700" }, "message": "iavf: use skb_put_padto()\n\nReplace skb_pad() and the manual skb-\u003elen and tail pointer updates\nin iavf_xmit_frame() with skb_put_padto().\n\nNo functional change.\n\nSigned-off-by: Eric Dumazet \u003cedumazet@kernel.org\u003e\nLink: https://patch.msgid.link/20261016094925.2762785-1-edumazet@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "87cce46329a811ea3fe108ac721e0a2400d0a3bb", "tree": "61d236a73c76b9d2d546939879f955f306bc05e0", "parents": [ "20c0c677362468b0af23e26e5fdb871ea911bc25" ], "author": { "name": "Myeonghun Pak", "email": "mhun512@gmail.com", "time": "Wed Oct 14 22:26:35 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:59:47 2026 -0700" }, "message": "net: hix5hd2: serialize timeout recovery with interface teardown\n\nThe timeout worker calls the driver\u0027s close and open methods without\nRTNL or a running-state check. A timeout queued before an interface is\nclosed can call close again after ndo_stop has disabled NAPI. The second\nnapi_disable() can then wait indefinitely. The worker can also race with\nan ongoing close.\n\nTake RTNL and skip recovery when the interface is no longer running.\nUse the netdev core close and open helpers so a failed reopen leaves the\ninterface down, rather than leaving it marked running with NAPI disabled.\n\nAfter unregister_netdev() has stopped the watchdog, drain the worker\nbefore releasing its MDIO and descriptor resources. This wait is outside\nRTNL, allowing an already queued worker to take RTNL, observe the down\nstate, and finish.\n\nThis issue was identified as part of our ongoing research while\nreviewing kernel code.\n\nFixes: 57c5bc9ad7d7 (\"net: hisilicon: add hix5hd2 mac driver\")\nCo-developed-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Ijae Kim \u003cae878000@gmail.com\u003e\nSigned-off-by: Myeonghun Pak \u003cmhun512@gmail.com\u003e\nReviewed-by: Jijie Shao \u003cshaojijie@huawei.com\u003e\nLink: https://patch.msgid.link/179203116093.2621539.3718842986255459438.G202@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "20c0c677362468b0af23e26e5fdb871ea911bc25", "tree": "dd2e6e8eff430b5a33502e19d03131c768503106", "parents": [ "96dd6308f5adb673dbda80591ce30d9ffd1fe143" ], "author": { "name": "Karl Mehltretter", "email": "kmehltretter@gmail.com", "time": "Thu Oct 15 06:50:01 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:57:08 2026 -0700" }, "message": "net: phy: realtek: restore RTL8211F RGMII delays on resume\n\nRTL8211F and RTL8211F-VD both use rtl8211f_config_rgmii_delay() during\ninitialization and share rtl821x_resume(). The RTL8211F-VD loses its\nRGMII TX and RX delay enable bits across a software power-down, but the\nshared resume path only clears BMCR_PDOWN and waits for the receive clock\nto stabilize.\n\nOn a BeagleV Ahead configured for rgmii-id, carrier and the negotiated\nspeed return after an interface close/open, but the receive path does not\nwork. At 100 Mbit/s no frames were received. At 1000 Mbit/s all 11\nobserved frames had CRC errors.\n\nReapply the RGMII delay configuration after the existing resume delay.\n\nTested on a BeagleV Ahead with an RTL8211F-VD at 100 and 1000 Mbit/s,\nincluding close/open without a link partner.\n\nFixes: bb726b753f75 (\"net: phy: realtek: add support for RTL8211F(D)(I)-VD-CG\")\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nSigned-off-by: Karl Mehltretter \u003ckmehltretter@gmail.com\u003e\nLink: https://patch.msgid.link/20261015045001.83986-1-kmehltretter@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "96dd6308f5adb673dbda80591ce30d9ffd1fe143", "tree": "3913a155fd5290e729c93a6c1bfb1efc04650371", "parents": [ "dcaa6219648955f7a8160313f1685321dbd1bf28", "10a486c17dff0e88122344b27351a5b22e018099" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:54 2026 -0700" }, "message": "Merge branch \u0027net-sched-reject-oversized-action-dumps-and-cap-unbounded-entry-lists\u0027\n\nJamal Hadi Salim says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: reject oversized action dumps and cap unbounded entry lists\n\nAn action dump is carried inside nested netlink attributes whose lengths\nare u16. When a single action\u0027s dump does not fit, a plain nla_nest_end()\nwrites a wrapped length and the kernel hands userspace a corrupt reply; on\nthe classifier path the -EMSGSIZE this produces is mistaken for socket\nbuffer exhaustion and retried in a loop that can never succeed.\n\nPatch 1 makes every nest an action dump can be carried in fail cleanly\n(-EMSGSIZE) instead of wrapping, bounds the tfilter_notify_prep() retry,\nand stops a notification that cannot be built from vetoing a filter or\naction delete. Patch 2 stops an action add whose actions were already\ncommitted from being reported as a failure when the notification cannot\nbe built. Patch 3 caps the number of gate scheduling entries at 1024,\nrejected with -E2BIG and an extack message. Patch 4 caps the number of\ntaprio schedule entries at 1024 in the same way. Patch 5 makes the action\ndump report an action that cannot be serialized into one dump skb as\n-EMSGSIZE instead of returning success and silently dropping the rest of\nthe list.\n\nPatches 3 and 4 each bound an unbounded userspace-supplied entry list that\na reviewer reading the gate cap would ask about next: the qdisc-side\nsibling and the SJA1105 schedule-table producer. Patch 5 closes the\nsilent-truncation that the cap admits but cannot reach. They are folded\ninto this posting so the family is fixed in one patchset rather than a\nstream of follow-ups; each stays a separate commit, so any one can drop\nout without touching the others.\n\nA pre-existing filter reference-count leak in cls_flower, found alongside\nthis work, is being sent to net as its own fix with a Fixes: tag; it is not\npart of this series.\n\nThis patchset is a retarget from net to net-next of the previous posting:\nhttps://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/\nThe wrapped-nla_len corruption this series addresses is not a regression of\ncommit cfa165cbfbed (\"net/sched: act_gate: budget the per-entry list in\nget_fill_size\"): the enclosing action and filter nests antedate it and a\nplain nla_nest_end() has always written the wrapped length at U16_MAX.\n\nThis is hardening, not a regression fix, so it targets net-next.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "10a486c17dff0e88122344b27351a5b22e018099", "tree": "3913a155fd5290e729c93a6c1bfb1efc04650371", "parents": [ "2bc124a5f8df56aeabd444cded132407d91d9876" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 13 04:54:31 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:52 2026 -0700" }, "message": "net/sched: act_api: report an oversized action dump instead of silently truncating it\n\nThe issue:\ntcf_dump_walker() trims the half-built nest and returns the number of\nactions dumped so far as soon as one action does not fit. When the action\nat the current index cannot be serialized even into an *empty* dump skb,\nthat count is zero, so tc_dump_action() returns skb-\u003elen (zero) and\nnetlink sends NLMSG_DONE with no error: \"tc actions ls\" silently drops\nthat action and every action after it.\n\nThat case is reachable inside the gate entry cap this series adds: a gate\nentry serializes to 36 bytes (40 with the gate-open flag) while a dump skb\nis clamped to SKB_WITH_OVERHEAD(32768) by netlink_recvmsg()/netlink_dump(),\nso the top of the range the cap admits installs but cannot be dumped -\nand, before this change, fails silently.\n\nThe Fix:\ntcf_dump_walker() already has to distinguish the two cases: a walk that\nfilled the skb before completing the current action must keep returning a\npositive count so netlink retries that action in a fresh skb, while an\naction that cannot be serialized even into an empty skb must return\n-EMSGSIZE. So return n_i when anything was dumped and -EMSGSIZE (with an\nextack) when nothing was, and let tc_dump_action() propagate the walker\u0027s\nerror code instead of overwriting it with skb-\u003elen. That mirrors\ntc_dump_tfilter(), which returns the walker error when a retry made no\nprogress (if (skb-\u003elen \u003d\u003d 0 \u0026\u0026 err) return err;), and tc_dump_chain()\ncarries the same idiom. This is netlink\u0027s documented contract: -EMSGSIZE\nwith data in the skb means \"more to dump\", -EMSGSIZE with an empty skb is\ndelivered to user space.\n\nContext note:\nThe shared nla_put_failure label stamps -EMSGSIZE for any inner\ntcf_action_dump_1()/terse failure, not only a size failure, consistent\nwith how every other nla_put_failure label in the file reports; the\n-EMSGSIZE the action dump now returns is therefore not a strict size\nassertion.\n\nThe cap stays a memory bound; this only makes an action the cap admits but\nthe dump buffer cannot carry fail loudly instead of silently truncating\nthe list. This is a long-standing silent failure, not a regression, so it\nis net-next hardening.\n\nReported-by: Paul Moses \u003cp@1g4.org\u003e\nCloses: https://lore.kernel.org/netdev/vPFrhbkwAui8zFPcGQTUDazQfsFDlr5GYuaYQ5BxJcrDiT6x1EljEze4cYadHqbeUW2ivLdpa8eC_cXC6ceACswgb-lW47aSVkHvHjhn_X8\u003d@1g4.org/\nSuggested-by: Paul Moses \u003cp@1g4.org\u003e\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-5@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2bc124a5f8df56aeabd444cded132407d91d9876", "tree": "c2f3eb9b1d823a9a7cf96f6166c0e3e608ee2b80", "parents": [ "150167ea4d7abdc3dba504abbbea699c9abeb425" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 13 04:54:30 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:51 2026 -0700" }, "message": "net/sched: sch_taprio: cap the number of schedule entries\n\nparse_sched_list() accepts _any number_ of TCA_TAPRIO_SCHED_ENTRY\nelements. The only bound is the enclosing nlattr u16 nla_len. A minimal\naccepted entry is 12 bytes (the entry nest plus\nTCA_TAPRIO_SCHED_ENTRY_INTERVAL), so that u16 admits roughly 5460\nentries - protocol-bounded amplification, not truly unbounded, but far\npast any hardware schedule.\n\nThe bug:\nEach entry is a separate sched_entry allocation (368 bytes, rounded up\nto the kmalloc-512 bucket) and, in full offload, is also composed into a\nper-entry offload array, so the largest representable minimal list pins\nroughly 2.7 MiB for the lifetime of the schedule.\n\nSome context:\nThe schedule list is not dumped the way the gate action list is: a\ntaprio dump is bounded by the carrying skb (the 32K dump skb, and\nNLMSG_GOODSIZE for notify and unicast get), which keeps the plain\nnla_nest_end() closes from ever seeing a wrapped length. But the\ninput-side amplification is the same class as the act_gate entry list,\nand the offload interface composes every supplied entry into the\nhardware schedule table without a capacity check.\n\nThe top of the accepted band cannot be read back: a schedule above\nroughly 900 entries does not fit the 32K dump skb, so \"tc qdisc show\"\nfails loudly with -EMSGSIZE for it (as the action-dump patch does). The\npre-existing silent gaps - no change notification above about 100\nentries, and no unicast get reply - are tracked separately.\n\nThe Cap:\nCap the list at 1024 entries. This matches the SJA1105 schedule-table\ncapacity (SJA1110 provides 4096) and the act_gate entry cap, and keeps\nthe list inside the current 16-bit TLV format.\n\nThis is an operational cap on a configuration the uAPI accepted before,\nso it is net-next hardening; a stable backport would start rejecting\ntaprio configurations that install today.\n\nConditions to recreate the bug:\nCAP_NET_ADMIN with CONFIG_NET_SCH_TAPRIO\u003dy. Install a taprio qdisc with\nmore than 1024 minimal TCA_TAPRIO_SCHED_ENTRY elements over a raw\nnetlink RTM_NEWQDISC request. The cap rejects the list with -E2BIG and\nan extack naming the limit; 1024 entries install.\n\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-4@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "150167ea4d7abdc3dba504abbbea699c9abeb425", "tree": "b186388cc86e0c1c74efe6f4dfdb19f7e94d1962", "parents": [ "1a49567560a13bf9501eeafbbaa9414c2ff624ac" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 13 04:54:29 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:51 2026 -0700" }, "message": "net/sched: act_gate: cap the number of scheduling entries\n\nparse_gate_list() accepts _any number_ of TCA_GATE_ONE_ENTRY elements.\nThe only bound/cap is the enclosing nlattr u16 nla_len (~5460\nminimal 12-byte entries). Each entry is a separate GFP_ATOMIC\nallocation, and the dump of a large list grows one action\u0027s reply well\npast NLMSG_GOODSIZE.\n\nThe bugs:\n1. A single gate can make tcf_dump_walker() silently truncate\n\"tc actions ls\" (\"net/sched: act_api: report an oversized action dump\ninstead of silently truncating it\" makes such an action report -EMSGSIZE\ninstead of dropping the rest of the list).\n2. Lack of capping pins memory for as long as the action lives: the\nlargest representable minimal list is roughly 5460 entries, each a\nseparate GFP_ATOMIC allocation, with a per-entry offload array on top in\nfull offload. The held-reply RTM_GETACTION amplification demonstrated in\nthe original posting of this series (Link below) is a generic netlink\nproperty this cap does not remove; the bound added here is the install-side\npin.\n\nSo we need to provide an upper bound cap of TCA_GATE_ONE_ENTRY elements.\n\nSome context:\nThe gate action offloads through FLOW_ACTION_GATE. The offload\ninterface passes the priority, base time, cycle time, cycle-time\nextension, the complete entry count and an array holding each entry\u0027s\ngate state, interval, IPV and maximum-octet value. The in-tree SJA1105\nDSA driver forwards that complete list to sja1105_vl_gate() without any\nentry cap check, and composes every supplied entry into the hardware\nschedule table.\n\nAct gate challenges:\nSJA1105 and SJA1110 are two device families in the one sja1105 driver.\nThey expose different schedule-table capacities: SJA1105 provides up to\n1024 schedule entries and SJA1110 up to 4096. These are total table\ncapacities shared with other schedules, so they are upper bounds, not a\nguaranteed per-action budget. Software gate actions with _a lot more_\nentries install and serialize today, so a low cap would reject working\nconfigurations and would look like a UAPI breakage; but an infinite size\nof entries is a bogus choice; a 65-entry configuration was verified\nduring this work to install and dump well-formed.\n\nNetlink Challenges:\nNetlink attributes record their total size, including the four-byte\nheader, in a 16-bit nla_len, so a nested attribute can describe at most\n65532 bytes. A minimal accepted input entry is 12 bytes, which puts the\nmax we can fit at roughly 5460 entries; a dumped entry occupies 36 bytes,\nor 40 bytes when it carries the gate-open flag.\n1024 entries therefore serialize to 36868-40964 bytes, which fits\ninside one nested attribute, while a 4096-entry schedule would need\nroughly 144-160 KiB which _cannot fit_ at the moment due to the 16bit\nlength.\n\nNote: This represents challenges primarily with netlink.\n\nThe Cap:\nCap the list at 1024 entries. This value is based on the existing\nSJA1105 schedule-table capacity and preserves the verified 65-entry\nconfiguration while providing a substantial headroom, and keeps the\ncomplete gate list inside the current 16-bit TLV format. It\ndeliberately declines to expose SJA1110\u0027s 1025-4096 range through\nan interface that cannot serialize it, and deliberately rejects\nsoftware-only schedules above 1024.\n\nWhy 1024 despite the dump budget:\n1024 is a SJA1105 schedule-table capacity, not a dump-budget value. The\nkernel clamps a dump skb to SKB_WITH_OVERHEAD(32768), so only ~800-890\nentries of this list fit \"tc actions ls\"; the top of the admitted band\ntherefore installs but is not listed. That is accepted deliberately:\na unicast RTM_GETACTION reply is pre-sized from the action\u0027s advertised\nsize (budgeted per entry since the parent fix), so \"tc actions get\"\nenumerates the whole band, and \"net/sched: act_api: report an oversized\naction dump instead of silently truncating it\" makes the list view fail\nloudly with -EMSGSIZE and an extack rather than silently truncating. A\nfilter whose action list contains such a gate also stops \"tc filter show\"\nfor that chain with -EMSGSIZE (loud), through tc_dump_tfilter()\u0027s\nno-progress path.\n\nThis is an operational cap on a configuration the uAPI accepted before,\nso it is net-next hardening; if we made this a stable backport then\nit would start rejecting gate configurations that install today (even\nthough those settings would be totally bogus).\n\nConditions to recreate the bug:\nCAP_NET_ADMIN with CONFIG_NET_ACT_GATE\u003dy. Install a gate\naction with 1025 or more minimal TCA_GATE_ONE_ENTRY elements over a raw\nnetlink RTM_NEWACTION request. The cap rejects the list with -E2BIG and\nan extack naming the limit; 1024 entries install and an indexed\nRTM_GETACTION returns a well-formed reply.\n\nLink: https://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-3@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1a49567560a13bf9501eeafbbaa9414c2ff624ac", "tree": "5a1a6d991d772f294773ed67d45c3ef0cc9b60dc", "parents": [ "ed9e404dcf9b7bd0bf319bccbdf7ddf90f96dbbb" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 13 04:54:28 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:51 2026 -0700" }, "message": "net/sched: act_api: keep an add that created its actions from failing\n\nSpotted while fixing the dump sizing reported by Sashiko. This references\ncommit cfa165cbfbed (\"net/sched: act_gate: budget the per-entry list in\nget_fill_size\"), which is only one way to trigger the issue.\n\nThe issue:\ntcf_action_add() returns the result of tcf_add_notify(), so an\nRTM_NEWACTION is reported back to user space as a failure when the event\nnotification cannot be built, even though tcf_action_init() has already\ninserted the actions into the idr. The realistic trigger is an action\nlist whose TCA_ACT_TAB exceeds a u16 nest (the notification can never be\nbuilt), or a memory-pressure -ENOBUFS from the notification\u0027s alloc_skb().\n\nThe Fix:\nDrop the notification failure on the add path: the created actions\nstay installed and the add reports success, with an extack noting that\nthe event notification could not be sent. The extack is set on a\nsuccessful ack, so iproute2 reports it as a warning; it replaces any\nwarning tcf_action_init() left there. This needs no idr/refcount\naudit - tca_put_bound_many() already runs unconditionally after the\nnotification, so this path releases exactly what the success path does\nand only the returned result changes. A create that ignores a\nnotification failure is already the filter-side norm: tc_new_tfilter()\ndoes not look at tfilter_notify()\u0027s result.\n\nThis is net-next hardening: it corrects the reported result of an add\nthat already took effect, not a regression.\n\nConditions to recreate the bug:\nCONFIG_NET_CLS_ACT\u003dy; CONFIG_NET_ACT_GATE\u003dy. Send an RTM_NEWACTION whose\nactions create an aggregate TCA_ACT_TAB larger than a u16 nest, so the\nnotification cannot be built; before this change the add reports -EINVAL\nalthough the actions were installed, after it the add reports success and\nthe actions are present.\n\nReported-by: Sashiko (nipa) \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-2@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ed9e404dcf9b7bd0bf319bccbdf7ddf90f96dbbb", "tree": "79c64470e086c137dade8a48029676b77d160655", "parents": [ "dcaa6219648955f7a8160313f1685321dbd1bf28" ], "author": { "name": "Jamal Hadi Salim", "email": "jhs@mojatatu.com", "time": "Tue Oct 13 04:54:27 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:55:51 2026 -0700" }, "message": "net/sched: act_gate: reject oversized dumps instead of wrapping them\n\nThis is a followup of commit cfa165cbfbed (\"net/sched: act_gate: budget\nthe per-entry list in get_fill_size\") as reported by Sashiko.\n\nThe issue:\nAn action dump is carried inside nested netlink attributes whose lengths\nare u16. A gate action with enough schedule entries produces a dump\nlarger than U16_MAX, and the plain nla_nest_end() closes by writing a\nwrapped length: the reply is structurally corrupt. On a CONFIG_DEBUG_NET\nkernel a plain nla_nest_end() also warns (DEBUG_NET_WARN_ON_ONCE warns\nonce per call site), which an unprivileged RTM_GETACTION or\nRTM_GETTFILTER can reach once the action or filter exists.\n\nThe oversized dump also reaches the filter notification path through\ntcf_fill_node(), which reports the failure as -EMSGSIZE.\ntfilter_notify_prep() treats that as socket-buffer exhaustion and\nretries with an ever larger alloc_skb(); a dump that does not fit a u16\nnest cannot be built at any skb size, so the loop only spins until the\nallocation itself fails.\n\nThe Fix:\nClose every wrap-capable nest an action dump travels in with\nnla_nest_end_safe(), which reports -EMSGSIZE before writing a wrapped\nlength: TCA_GATE_ENTRY_LIST, TCA_ACT_OPTIONS, the per-action nest and\nTCA_ACT_TAB; the shared action and police containers in\ntcf_exts_dump()/tcf_exts_terse_dump(); and the caller-owned TCA_OPTIONS\nof every action-capable classifier (flower, matchall, basic, bpf,\ncgroup, flow, fw, route4, u32). The output is byte identical for every\nmessage that serializes. Bound the tfilter_notify_prep() retry once the\nskb is already larger than any valid message, while a regular dump that\nonly needs a bigger skb still retries.\n\nThe retry bound and the checked closes are one change: it is\nnla_nest_end_safe() that turns an unrepresentable dump into -EMSGSIZE,\nso a backport has to take both together if either is taken.\n\nContext note:\nA delete notification that cannot be built must not veto the state\nchange the caller asked for. Two delete paths built the notification\nbefore the state change and propagated the build failure.\ntfilter_del_notify() builds the filter\u0027s delete notification before\ncalling -\u003edelete(), so a filter whose dump cannot be represented in a u16\nnest could be created but never removed by \"tc filter del ... handle H\" -\nand only when a notification was actually needed (rtnl_notify_needed():\nan RTNLGRP_TC listener or NLM_F_ECHO), which made it intermittent.\ntcf_del_notify() has the same shape for RTM_DELACTION: it builds the\nnotification before tcf_action_delete(), so an action list whose\nTCA_ACT_TAB exceeds a u16 nest could not be deleted either. In both cases\ndrop the unbuildable notification instead: on -EMSGSIZE the delete\nproceeds. This needs tca_get_fill() and tcf_del_notify_msg() to pass\n-EMSGSIZE up instead of collapsing it to -1/-EINVAL, and tca_get_fill()\nreports any inner tcf_action_dump() failure as -EMSGSIZE too\n(tcf_gate_dump() and tcf_action_dump_1() return plain -1 after one of\ntheir checked closes fails), so a single oversized action\u0027s delete is not\nvetoed either. On the delete paths the rule is scoped to notification\nBUILD failures: a\ndelivery failure after the state change (rtnetlink_send() failing once\n-\u003edelete() has already committed) still reports an error to the caller,\nas it did before this series. The extack that notes a dropped filter\nevent is set only after -\u003edelete() has returned 0.\n-EMSGSIZE here is the general tcf_fill_node() outcome for any -\u003edump()\nthat does not fit, not only a u16 nest overflow; the effect of the new\nbranch is limited to dropping a best-effort notification.\n\nwhy net-next?\nThis is hardening rather than a regression fix: the enclosing action and\nfilter-path nests have wrapped since the actions and classifiers allowed\nlarge entry lists - TCA_ACT_TAB is core act_api and the filter-side\ncontainer predates the act_gate sizing change. A plain nla_nest_end()\nhas always written the wrapped length at U16_MAX; this stops the\ncorruption at the abstraction boundary instead of imposing a new policy\nlimit on accepted gate schedules. A separate patch caps the entry list\nitself.\n\nConditions to recreate the bug:\nCONFIG_NET_CLS_ACT\u003dy; CONFIG_NET_ACT_GATE\u003dy;\nCONFIG_NET_CLS_MATCHALL\u003dy and/or CONFIG_NET_CLS_BASIC\u003dy. Create a\nmatchall or basic filter on an ingress/clsact qdisc whose action list\nholds two gate actions of 1024 minimal TCA_GATE_ONE_ENTRY elements\neach (TCA_ACT_MAX_PRIO admits up to 32 actions); the aggregate\nTCA_ACT_TAB nest is ~74.3 KiB \u003e 65532 and wraps, then RTM_GETTFILTER\nit (or trigger the notify with NLM_F_ECHO).\nThe same shape as two standalone gate actions is hit on the action path\nby RTM_DELACTION with NLM_F_ECHO; before this change the fill fails and\nthe delete is refused, after it the actions are removed and only the\nnotification is dropped.\nFor a single action the outermost TCA_ACT_TAB wraps from 1815 entries\n(1821 for the innermost TCA_GATE_ENTRY_LIST); on the filter path the\noutermost wrap-capable nest is the classifier\u0027s TCA_OPTIONS. Installing\nneeds CAP_NET_ADMIN in a user namespace; the RTM_GETTFILTER trigger needs\nno capability once it exists. The two-action shape survives the\nper-action cap added by \"net/sched: act_gate: cap the number of scheduling\nentries\": the enclosing nests overflow from aggregate action size, which\nno per-action cap can bound.\n\nReported-by: Sashiko (nipa) \u003csashiko-bot@kernel.org\u003e\nCloses: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/20260824153903.4143642-1-victor@mojatatu.com\nLink: https://netdev-ai.bots.linux.dev/sashiko/#/patchset/QDISC-H19Z.v2.20261007062551%40mojatatu.com\nLink: https://lore.kernel.org/netdev/QDISC-H19Z.v2.20261007062551@mojatatu.com/\nLink: https://lore.kernel.org/netdev/QDISC-H19Z.v1.20261001053234@mojatatu.com/\nLink: https://lore.kernel.org/netdev/179111893181.434549.13449660670267048994@kernel.org/\nReviewed-by: Victor Nogueira \u003cvictor@mojatatu.com\u003e\nSigned-off-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/QDISC-H19Z.v3.r0.20261012193813-1@mojatatu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dcaa6219648955f7a8160313f1685321dbd1bf28", "tree": "8c62ae8c10d726cc78656ff87c8d744c8492c610", "parents": [ "f89a228125238f8d4c7e2b8161e2a85fe35307b6" ], "author": { "name": "Binbin Deng", "email": "18983559317@163.com", "time": "Wed Oct 14 14:42:04 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:34:27 2026 -0700" }, "message": "octeontx2: Fix use-after-free of qos node in delete path\n\nhash_del_rcu() only unlinks the node; a reader that already holds the\nbucket iterator still uses the node. The immediate kfree() has no\ngrace period, so a concurrent transmit on a socket whose skb priority\ncarries the deleted classid reads node-\u003eclassid / node-\u003eqid from freed\nmemory (use-after-free in the softirq transmit path).\n\nFix this by calling synchronize_net() before the node is freed, as\nmlx5e does.\n\nFound during a static-analysis-assisted audit: candidate sites were\nsurfaced by a Coccinelle rule, and the reader/writer paths were\nconfirmed by LLM-assisted (GLM-5.3) code inspection. The issue was\nnot observed at runtime; it is identified by code inspection only.\n\nFixes: 5e6808b4c68d (\"octeontx2-pf: Add support for HTB offload\")\nSigned-off-by: Binbin Deng \u003c18983559317@163.com\u003e\nReviewed-by: Ratheesh Kannoth \u003crkannoth@marvell.com\u003e\nLink: https://patch.msgid.link/20261014064204.291688-1-18983559317@163.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f89a228125238f8d4c7e2b8161e2a85fe35307b6", "tree": "9b771693ca33e2829757cd53b578e8025603433d", "parents": [ "56f8d919739b588e2ad8cb9fb9eff704f32afaab" ], "author": { "name": "Rishikesh Jethwani", "email": "rjethwani@purestorage.com", "time": "Tue Oct 13 15:35:17 2026 -0600" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:32:50 2026 -0700" }, "message": "tls: device: protect async RX resync state during device-down\n\ntls_device_rx_resync_new_rec() can run in process context with the\nsocket lock held, but without an RCU read lock: from the strparser work\nitem (tls_strp_work()) and from the receive paths (tls_rx_rec_wait(),\ntls_rx_rec_done()). The resync_async pointer belongs to the driver RX\ncontext, which tls_device_down() tears down from the netdev notifier\nwithout taking the socket lock; only the softirq entry to the parser is\nimplicitly inside an RCU section.\n\nIf the parser passes the TLS_RX_DEV_DEGRADED check before device-down\nsets it, tls_device_down() can complete synchronize_net() and delete the\ndriver context before the parser accesses resync_async-\u003ereq or its\nrecord log. In the asynchronous stage the parser also writes the record\nlog, so this is a write to freed memory, not only a stale read. The RCU\nsection in tls_device_resync_rx() starts after those accesses and\ntherefore does not prevent the use-after-free.\n\nFound by code inspection; not reproduced. Hitting the window requires\nthe parser to be preempted between the DEGRADED check and the\nresync_async access across the device-down grace period and the\ndriver\u0027s teardown.\n\nFixes: ed9b7646b06a (\"net/tls: Add asynchronous resync\")\nSigned-off-by: Rishikesh Jethwani \u003crjethwani@purestorage.com\u003e\nLink: https://patch.msgid.link/20261013213517.2219663-1-rjethwani@purestorage.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "56f8d919739b588e2ad8cb9fb9eff704f32afaab", "tree": "0d6fafb91be3b7e639698da9b130872c00906961", "parents": [ "cb790252f8e13741ba9e13d100cb3c25b7545506" ], "author": { "name": "Kees Cook", "email": "kees@kernel.org", "time": "Thu Oct 15 10:00:03 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:19:33 2026 -0700" }, "message": "netdev: Hide the netdev_priv() origin from GCC in netdev_from_priv()\n\nGCC 15.1 and later can compute an object size of 0 for a pointer that\ncontainer_of() derives from a pointer into a __counted_by flexible array\nmember[1]; Clang gets it right. netdev_from_priv() does this with struct\nnet_device\u0027s \"priv\" array, so when GCC can see that its argument came\nfrom netdev_priv(), FORTIFY_SOURCE sees a zero-sized net_device. Since\ncommit 9027497a25e3c (\"team: use netdev_from_priv()\"), adding a port of\nanother type to a team device can then fail the memcpy() to\n\"dev-\u003ebroadcast\" in team_setup_by_port(), which GCC sees through after\ninlining team_port_add() into team_add_slave():\n\n memcpy: detected buffer overflow: 4 byte write of buffer size 0\n ...\n kernel BUG at lib/string_helpers.c:1044!\n ...\n Call Trace:\n \u003cTASK\u003e\n team_add_slave.cold+0x88/0x201\n do_set_master+0x11c/0x180\n do_setlink.isra.0+0x3a4/0x1410\n\nWhether GCC inlines that far depends on the architecture and the\nconfiguration. It does on ppc64le, where this was reported, and on\nx86_64 with defconfig plus hardening.config or with Debian\u0027s\nconfiguration, but not with allmodconfig.\n\nHide where \"priv\" came from with OPTIMIZER_HIDE_VAR(), so GCC sees a\nnet_device of unknown size whose members have their declared sizes. (An\n\"unknown\" size is considered uncheckable by FORTIFY.) FORTIFY still\nbounds writes to members; only the whole-object size becomes unknown,\nas it already is for any net_device pointer GCC can\u0027t trace to its\nallocation. In an extracted PoC, the __builtin_dynamic_object_size()\nof \"dev-\u003ebroadcast\" for the two types FORTIFY sees, before and after\nthis patch:\n\n GCC 16.2.0 Clang 22 and 24\n before after\n plain pointer, whole object unknown unknown 44\n container_of(), whole object 0 unknown 44\n container_of(), member 0 32 32\n\nIn addition to getting the bogus \"0\" fixed in GCC, I\u0027ll be following up\nto solve the whole-object visiblity disparity as well.\n\nBuild tested with GCC 16.2.0: ARCH\u003dx86_64 defconfig with hardening.config,\nCONFIG_NET_TEAM\u003dy, and CONFIG_NET_IPGRE\u003dy; ARCH\u003darm64 defconfig with\nhardening.config, CONFIG_NET_TEAM\u003dy, CONFIG_PPP\u003dy, and CONFIG_NET_AIROHA\u003dm;\nand drivers/net/team/, drivers/net/ppp/, and drivers/net/ethernet/airoha/\nin ARCH\u003dx86_64 allmodconfig. Under QEMU, the x86_64 kernel hits the BUG\nabove when adding the GRE fallback device \"gre0\" as a port of a new team\ndevice without this patch, and adds it with the patch.\n\nReported-by: Yeswanth Krishna Tellakula \u003cyeswanth@linux.ibm.com\u003e\nCloses: https://lore.kernel.org/all/3ad19e86-234c-408f-896e-0d6c774fea49@linux.ibm.com/\nFixes: 9027497a25e3c (\"team: use netdev_from_priv()\")\nCc: stable@vger.kernel.org\nLink: https://gcc.gnu.org/bugzilla/show_bug.cgi?id\u003d127875 [1]\nSigned-off-by: Kees Cook \u003ckees@kernel.org\u003e\nLink: https://patch.msgid.link/20261015165959.i.798-kees@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "cb790252f8e13741ba9e13d100cb3c25b7545506", "tree": "94107437af5256213611fe7ec6bc49b678d4ccb5", "parents": [ "94c02e9b3e6da00382d5f750a07613e68a6255e1" ], "author": { "name": "Josef Bacik", "email": "josef@toxicpanda.com", "time": "Tue Oct 13 18:25:06 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 12:04:00 2026 -0700" }, "message": "net: axienet: don\u0027t advance the TX ring head before the descriptor is ready\n\naxienet_start_xmit_dmaengine() bumps lp-\u003etx_ring_head before\nskb_to_sgvec(), dma_map_sg() and device_prep_slave_sg(), and none of\ntheir error paths undo it. The skb is freed and nothing is submitted,\nbut the slot stays claimed. axienet_dma_tx_cb() walks tx_ring_tail\nonce per completion, so the next completion lands on the abandoned slot\nand dereferences whatever skb pointer is left there: NULL if the slot\nwas never used or was already completed, or a stale skb that gets\nconsumed a second time. Every completion after that is accounted\nagainst the wrong slot.\n\ndma_map_sg() and device_prep_slave_sg() can fail at runtime, and so can\nskb_to_sgvec() on a malformed skb. Only advance tx_ring_head once\nthose have succeeded. The completion callback can\u0027t run before\ndmaengine_submit(), so claiming the slot just before that is fine.\n\ndmaengine_submit() itself can also fail on xilinx_dma after a channel\nerror, and its return isn\u0027t checked either. That\u0027s a separate problem\nand isn\u0027t changed here.\n\nThis was found by the Sashiko AI review of the skbuff BUG_ON() series.\n\nCc: stable+noautosel@kernel.org # LLM report + LLM fix, untested\nFixes: 6a91b846af85 (\"net: axienet: Introduce dmaengine support\")\nLink: https://lore.kernel.org/all/20261007-b4-skbuff-bug-on-v2-0-b9a5f732895b@toxicpanda.com/\nSigned-off-by: Josef Bacik \u003cjosef@toxicpanda.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20261013-b4-axienet-dmaengine-ring-head-v1-1-7add24e74477@toxicpanda.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "94c02e9b3e6da00382d5f750a07613e68a6255e1", "tree": "152ded57fcd8f7737e7218e687b9eac94705b3b5", "parents": [ "ff5a2a7acec1bcd0921f986c8fd1c0285ed97b50", "ccd0742641dcbfd7ceab49fba841211be204e12b" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:10 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:10 2026 -0700" }, "message": "Merge branch \u0027neighbour-misc-follow-ups-on-per-netns-neigh_table-series\u0027\n\nKuniyuki Iwashima says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nneighbour: Misc follow-ups on per-netns neigh_table series.\n\nPatch 1 updates the switchdev doc, s/arp_tbl/arp_table(net)/.\n\nPatch 2 updates a selftest for per-netns sysctl knobs, though this\nis not an actual issue since the test does not hit gc_thresh by\ndefault.\n\nPatches 3 ~ 5 are based on a suggestion by Ido Schimmel to make\nneigh_periodic_work() and neigh_managed_work() CPU-friendly:\n\n https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20261013205816.1642597-1-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ccd0742641dcbfd7ceab49fba841211be204e12b", "tree": "152ded57fcd8f7737e7218e687b9eac94705b3b5", "parents": [ "7a71343ba1a69fee4c50fad47c62c6acbd454492" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 13 20:57:32 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:08 2026 -0700" }, "message": "neighbour: Floor neigh_periodic_work() interval at 1s.\n\nneigh_periodic_work() reschedules tbl-\u003egc_work with a delay of\nBASE_REACHABLE_TIME \u003e\u003e 1.\n\nneigh_table is now per-netns, and a user could hog CPU by setting\nBASE_REACHABLE_TIME to a small value.\n\nUnlike INTERVAL_PROBE_TIME_MS, BASE_REACHABLE_TIME is also used to\ncompute reachable_time for NUD_REACHABLE entries.\n\nLet\u0027s floor only the GC interval at 1 second.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261013205816.1642597-6-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7a71343ba1a69fee4c50fad47c62c6acbd454492", "tree": "eabb0111770970f289a4a8ff0756561f6fae7304", "parents": [ "8854b0e247aefcdc80697a12532e59e7ae8a5577" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 13 20:57:31 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:08 2026 -0700" }, "message": "neighbour: Floor INTERVAL_PROBE_TIME_MS at 1000.\n\nPreviously, neigh_managed_work() was not rescheduled within\n1s since commit ed6cd6a17896 (\"net, neigh: Set lower cap for\nneigh_managed_work rearming\").\n\nLater, commit 211da42eaa45 (\"net, neigh: introduce\ninterval_probe_time_ms for periodic probe\") added\nINTERVAL_PROBE_TIME_MS and changed the limit to 1ms.\n\nThe limit actually did not work but was fixed with\nnetlink_range_validation by commit 6d79b223ec44 (\"neighbour:\nEnforce min/max to NDTPA_INTERVAL_PROBE_TIME_MS.\").\n\nneigh_table is now per-netns, and a user could hog CPU by setting\nINTERVAL_PROBE_TIME_MS to a small value.\n\nLet\u0027s floor the value at 1 second.\n\nThis is a user-visible change, but given we had the 1s floor before\nand the default is 5s, it is unlikely that anyone but syzbot is\nsetting it below 1s and affected by this change.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261013205816.1642597-5-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8854b0e247aefcdc80697a12532e59e7ae8a5577", "tree": "81e4ce3fd746b2ba95baec471fc77875c277a193", "parents": [ "2335e48461f233d53170dceb91984582f3fe274a" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 13 20:57:30 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:08 2026 -0700" }, "message": "neighbour: Schedule neigh_managed_work only when needed.\n\nneigh_table is now per-netns.\n\ntbl-\u003emanaged_work is scheduled when netns is created and runs\nperiodically even though the netns does not have any NTF_MANAGED\nentries.\n\nLet\u0027s delay scheduling the work for the first NTF_MANAGED entry\nand stop rescheduling if tbl-\u003emanaged_list is empty.\n\nSuggested-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://lore.kernel.org/netdev/20260902143023.GA3966681@shredder/\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nLink: https://patch.msgid.link/20261013205816.1642597-4-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2335e48461f233d53170dceb91984582f3fe274a", "tree": "f8a98000f4487dac8a92fe872b0eb3ee347da13b", "parents": [ "3e2ca51e7e35dca9ec457f690e2fb490a8cbb320" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 13 20:57:29 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:08 2026 -0700" }, "message": "selftests: netfilter: Set gc_thresh[123] for gw netns in nft_nat_zones.sh.\n\nSince commit cda2962b6e2b (\"neighbour: Namespacify neigh_tables.\"),\nnet.ipv[46].neigh.default.gc_thresh[123] are per-netns attributes.\n\nLet\u0027s update nft_nat_zones.sh.\n\nNote that the number of neighbour entries does not even reach the\ndefault gc_thresh1 (128) with the default maxclients\u003d100, and the\nraised thresholds are only needed for gw netns when maxclients is\nmanually increased (e.g., 2000 as mentioned in the comment).\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261013205816.1642597-3-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "3e2ca51e7e35dca9ec457f690e2fb490a8cbb320", "tree": "d3046507c7266632226bdc30a0d7b9426c149645", "parents": [ "ff5a2a7acec1bcd0921f986c8fd1c0285ed97b50" ], "author": { "name": "Kuniyuki Iwashima", "email": "kuniyu@google.com", "time": "Tue Oct 13 20:57:28 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:57:08 2026 -0700" }, "message": "Documentation: networking: switchdev: Replace arp_tbl with arp_table(net).\n\nSince commit cda2962b6e2b (\"neighbour: Namespacify neigh_tables.\"),\narp_tbl is a template for the per-netns table.\n\nLet\u0027s apply s/arp_tbl/arp_table(net)/ to switchdev.rst.\n\nSigned-off-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nLink: https://patch.msgid.link/20261013205816.1642597-2-kuniyu@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "ff5a2a7acec1bcd0921f986c8fd1c0285ed97b50", "tree": "26b5c4f63c6dc7adf0760b65f933413628a6710e", "parents": [ "267bc3f113d8c441f57014c502443686f5d33d57" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Thu Oct 15 16:01:09 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:55:30 2026 -0700" }, "message": "net: ethernet: mtk_wed: Fix dma_unmap_single() size\n\nIn mtk_wed_wo_queue_refill(), the entry-\u003ebuf is DMA mapped with length\nq-\u003ebuf_size which saved in entry-\u003elen. However, in mtk_wed_wo_dequeue(),\nthe same buffer is DMA unmapped with length buf_len which is set to\nSKB_WITH_OVERHEAD(q-\u003ebuf_size).\n\nChange the size to q-\u003ebuf_size.\n\nThis was discovered with static analysis and was only compile-tested.\n\nCc: stable+noautosel@kernel.org # LLM report + LLM fix, untested\nFixes: 799684448e3e (\"net: ethernet: mtk_wed: introduce wed wo support\")\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nAcked-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20261015140110.41988-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "267bc3f113d8c441f57014c502443686f5d33d57", "tree": "207b32ddc8146bc7e551b579894c61f441880a0d", "parents": [ "03977f8f1a6322749d91c870b4b4eae2b9cd4ced" ], "author": { "name": "Li RongQing", "email": "lirongqing@baidu.com", "time": "Wed Oct 14 09:36:20 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:54:12 2026 -0700" }, "message": "veth: decide peer queue count from the peer\u0027s own attributes\n\nveth_newlink() creates the peer netdev from tbp, which points at the\nnested VETH_INFO_PEER attributes when they are supplied (peer_tb) and\nonly aliases the primary device\u0027s tb otherwise. However the queue\nreduction is gated on the primary device\u0027s attributes:\n\n\terr \u003d veth_init_queues(peer, tb);\n\nveth_init_queues() checks !tb[IFLA_NUM_{TX,RX}_QUEUES], so for the peer\nit inspects the wrong attribute set whenever nested peer attributes are\nused:\n\n - If the user requests IFLA_NUM_TX/RX_QUEUES only for the peer, tb\n carries no such attribute and veth_init_queues() still shrinks the\n peer\u0027s real_num_{tx,rx}_queues back to 1, silently dropping the\n user\u0027s explicit multi-queue request for the peer.\n\n - If the user requests the counts only for the primary device, the\n peer keeps nr_possible_cpus real queues instead of the legacy\n default of 1.\n\nPass tbp so the peer\u0027s queue count is decided from the peer\u0027s own\nattributes. When no nested peer attributes are given tbp aliases tb, so\nthe common case is unchanged.\n\nCc: stable+noautosel@kernel.org # never worked, high regression risk\nFixes: 9d3684c24a52 (\"veth: create by default nr_possible_cpus queues\")\nSigned-off-by: Li RongQing \u003clirongqing@baidu.com\u003e\nLink: https://patch.msgid.link/20261014013620.2497-1-lirongqing@baidu.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "03977f8f1a6322749d91c870b4b4eae2b9cd4ced", "tree": "d3317e6b64f58a0549c6fd5282332f9cf5a1cc25", "parents": [ "4d0d8f491307f22aea34b22f73351e1cd2ede735" ], "author": { "name": "Thomas Fourier", "email": "fourier.thomas@gmail.com", "time": "Thu Oct 15 14:45:46 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:51:49 2026 -0700" }, "message": "drivers: net: xgene: Fix dma_unmap_single() size\n\nIn xgene_enet_refill_bufpool(), the skb-\u003edata is dma-mapped with length\nlen which is set to XGENE_ENET_STD_MTU which equals 1536. However, in\nxgene_enet_delete_bufpool(), the same buffer is unmapped with length\nXGENE_ENET_MAX_MTU which is 9600. This may erroneously unmap other\nDMA buffers or cause other issues.\n\nChange unmap length to XGENE_ENET_STD_MTU.\n\nCc: stable+noautosel@kernel.org # LLM report + LLM fix, untested\nFixes: a9380b0f7be8 (\"drivers: net: xgene: Add support for Jumbo frame\")\nSigned-off-by: Thomas Fourier \u003cfourier.thomas@gmail.com\u003e\nReviewed-by: Daniel Machon \u003cdaniel.machon@microchip.com\u003e\nLink: https://patch.msgid.link/20261015124547.29996-2-fourier.thomas@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4d0d8f491307f22aea34b22f73351e1cd2ede735", "tree": "80eca4fb2961d90fc664519c631796af2c48ad40", "parents": [ "14c0350142ab0a10ebeefed03b779df23749e16a" ], "author": { "name": "Fernando Fernandez Mancera", "email": "fmancera@suse.de", "time": "Thu Oct 15 14:47:49 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Oct 20 11:46:20 2026 -0700" }, "message": "net: openvswitch: drop IP fragments on SCTP set action\n\nThe SCTP checksum is a CRC32c over the whole SCTP packet. set_sctp()\nupdates it as old_csum ^ old_correct_csum ^ new_csum, with the two CRCs\ncomputed over the bytes of the current skb only. That is correct only\nwhen the skb holds the whole SCTP packet. For a first fragment, and for\na later fragment, it holds just a part of it, and the CRC delta of a\nchange at the start of the packet depends on how many bytes follow, so\nthe checksum written is wrong. The receiver drops the reassembled\npacket.\n\nvalidate_set() accepts SCTP set action for any flow with ip.proto set to\nSCTP, regardless of the fragmentation bits, as it only receives the\nmasked key. As the checksum cannot be fixed up without the whole\ndatagram, fail the action for packets that are IP fragments of either\nfamily, so the packet is dropped with OVS_DROP_ACTION_ERROR instead of\nbeing forwarded with modified ports and an invalid checksum.\n\nLink: https://lore.kernel.org/netdev/d4fc14f3-4308-4560-9012-43c09c1b3845@ovn.org/\nFixes: a175a723301a (\"openvswitch: Add SCTP support\")\nSigned-off-by: Fernando Fernandez Mancera \u003cfmancera@suse.de\u003e\nReviewed-by: Ilya Maximets \u003ci.maximets@ovn.org\u003e\nLink: https://patch.msgid.link/20261015124749.4694-2-fmancera@suse.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" } ], "next": "14c0350142ab0a10ebeefed03b779df23749e16a" }