)]}' { "log": [ { "commit": "8ca4bff2ff3eb523154eb6bdc8e1efe47d6f9888", "tree": "36d26d3344ac0fc9ac6ac6fa11cd608c3dd41cbb", "parents": [ "7c04aa3b2f3751f3eb2370f280eeb8557962ad96" ], "author": { "name": "Jeremy Kerr", "email": "jk@codeconstruct.com.au", "time": "Wed Apr 29 16:27:31 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 13:37:51 2026 -0700" }, "message": "net: mctp: test: remove skb dumps from test output\n\nWe\u0027re currently dumping skb info in our fragment input test, which makes\ninterpreting the TAP test output a bit awkward.\n\nRemove the skb dumps.\n\nSigned-off-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260429-dev-mctp-test-skb-dump-v1-1-13fd5789ef71@codeconstruct.com.au\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "7c04aa3b2f3751f3eb2370f280eeb8557962ad96", "tree": "f2852cf362d39c0fb09f21227b483edf350444ff", "parents": [ "82968921d206abeef34bbfdb643d62a08dc7fe30", "08d0d3466664000ba0670e0ef0d447f23459e0d4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 12:49:56 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Thu Apr 30 12:51:05 2026 -0700" }, "message": "Merge git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nCross-merge networking fixes after downstream PR (net-7.1-rc2).\n\nNo conflicts, or adjacent changes.\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "08d0d3466664000ba0670e0ef0d447f23459e0d4", "tree": "5ec3400307dfa373fdfb64cc2338bf0eed5716cc", "parents": [ "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "1e01abec856593e02cd69fd95b784c10dd46880c" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:45:43 2026 -0700" }, "message": "Merge tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net\n\nPull networking fixes from Paolo Abeni:\n \"Including fixes from netfilter.\n\n Current release - regressions:\n\n - ipmr: free mr_table after RCU grace period.\n\n Previous releases - regressions:\n\n - core: add net_iov_init() and use it to initialize -\u003epage_type\n\n - sched: taprio: fix NULL pointer dereference in class dump\n\n - netfilter: nf_tables:\n - use list_del_rcu for netlink hooks\n - fix strict mode inbound policy matching\n\n - tcp: make probe0 timer handle expired user timeout\n\n - vrf: fix a potential NPD when removing a port from a VRF\n\n - eth: ice:\n - fix NULL pointer dereference in ice_reset_all_vfs()\n - fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\n Previous releases - always broken:\n\n - page_pool: fix memory-provider leak in error path\n\n - sched: sch_cake: annotate data-races in cake_dump_stats()\n\n - mptcp: fix scheduling with atomic in timestamp sockopt\n\n - psp: check for device unregister when creating assoc\n\n - tls: fix strparser anchor skb leak on offload RX setup failure\n\n - eth:\n - stmmac: prevent NULL deref when RX memory exhausted\n - airoha: do not read uninitialized fragment address\n - rtl8150: fix use-after-free in rtl8150_start_xmit()\n\n Misc:\n\n - add Ido Schimmel as IPv4/IPv6 maintainer\n\n - add David Heidelberg as NFC subsystem maintainer\"\n\n* tag \u0027net-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (79 commits)\n net/sched: cls_flower: revert unintended changes\n sfc: fix error code in efx_devlink_info_running_versions()\n net: tls: fix strparser anchor skb leak on offload RX setup failure\n ice: add dpll peer notification for paired SMA and U.FL pins\n ice: fix missing dpll notifications for SW pins\n dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n ice: fix SMA and U.FL pin state changes affecting paired pin\n ice: fix missing SMA pin initialization in DPLL subsystem\n ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n ice: fix NULL pointer dereference in ice_reset_all_vfs()\n iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n iavf: wait for PF confirmation before removing VLAN filters\n iavf: stop removing VLAN filters from PF on interface down\n iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n net: airoha: Do not return err in ndo_stop() callback\n hv_sock: fix ARM64 support\n MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n selftests: drv-net: clarify linters and frameworks in README\n ...\n" }, { "commit": "6cd70263a6c6ceb677a679eba61a0a798d2338d5", "tree": "f97f638c106ae2b337ee198a868a70a8f828b4ab", "parents": [ "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "163f6494233e1679ec6fa6a4803f74ae7b1c94db" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:35:36 2026 -0700" }, "message": "Merge tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux\n\nPull ata fix from Niklas Cassel:\n\n - Fix a reference leak on device_register() failure in pata_parport\n\n* tag \u0027ata-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/libata/linux:\n ata: pata_parport: switch to dynamic root device\n" }, { "commit": "2aa0a3691711257b888d6024a492eb9fd1e8f52a", "tree": "d23dfa6ede142650bdf84a2be288ed389ba77158", "parents": [ "e75a43c7cec459a07d91ed17de4de13ede2b7758", "e052a1f7199260eda4d6ca08a59c3b98738f8491" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Thu Apr 30 08:29:56 2026 -0700" }, "message": "Merge tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound\n\nPull sound fixes from Takashi Iwai:\n \"A bunch of small fixes. One minor fix is found in the core side for\n data race in PCM OSS layer, while remaining changes are various\n device-specific fixes and quirks.\n\n - Core: PCM OSS data race fix\n\n - HD-audio: Fixes for TAS2781, CS35L56, and Realtek/Conexant quirks;\n avoidance of a WARN_ON for HDMI channel mapping\n\n - USB-audio: Improvements in UAC3 parsing robustness (leaks, size\n checks) and fixes for potential endless loops\n\n - ASoC: Driver-specific fixes for CS35L56, Intel bytcr_wm5102,\n Spacemit, AW88395, and others, plus a new quirk for Steam Deck\n OLED\n\n - Misc: A UAF fix in aloop driver, division by zero fix in ua101\n driver and leak fixes in caiaq driver\"\n\n* tag \u0027sound-7.1-rc2\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tiwai/sound: (32 commits)\n ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages \u003e1\n ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()\n ALSA: hda/conexant: Fix missing error check for jack detection\n ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks\n ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB\n ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size\n ASoC: spacemit: move hw constraints from hw_params to startup\n ASoC: codecs: ab8500: Fix casting of private data\n ASoC: cs35l56: Fix illegal writes to OTP_MEM registers\n ASoC: Intel: bytcr_wm5102: Fix MCLK leak on platform_clock_control error\n ALSA: usb-audio: Avoid potential endless loop in convert_chmap_v3()\n ALSA: usb-audio: Fix potential leak of pd at parsing UAC3 streams\n ALSA: caiaq: Don\u0027t abort when no input device is available\n ALSA: caiaq: Fix potentially leftover ep1_in_urb at error path\n ASoC: aw88395: Fix kernel panic caused by invalid GPIO error pointer\n ALSA: caiaq: fix usb_dev refcount leak on probe failure\n sound: ua101: fix division by zero at probe\n ALSA: usb-audio: apply quirk for Playstation PDP Riffmaster\n ALSA: hda: Remove duplicate cmedia entries in codecs Makefile\n ALSA: hda/realtek: Add micmute LED quirk for Acer Aspire A315-44P\n ...\n" }, { "commit": "82968921d206abeef34bbfdb643d62a08dc7fe30", "tree": "562b6e7a43b0f575ac36bdec20a77e18d00de119", "parents": [ "fdd2c9a1d082c838ad8b66d7795c6dd450a8c9ee", "c53f8f8dce776e032b1a11fb4d9b6e12bb63d958" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 16:22:06 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 16:22:06 2026 +0200" }, "message": "Merge branch \u0027dpll-add-pin-operational-state\u0027\n\nIvan Vecera says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\ndpll: add pin operational state\n\nAdd pin operational state (operstate) to the DPLL subsystem to\nseparate administrative intent from actual hardware status.\n\nCurrently pin-state mixes what the user requested (connected,\nselectable, disconnected) with what the hardware is actually doing.\nThis makes it difficult to diagnose situations where a user sets\na pin as selectable or connected but the hardware cannot use it\ndue to signal issues.\n\nThe new operstate attribute is reported inside the pin-parent-device\nnest alongside the existing state and is read-only. Defined values:\n\n - active: pin is qualified and actively used by the DPLL\n - standby: pin is qualified but not actively used by the DPLL\n - no-signal: pin does not have a valid signal\n - qual-failed: pin signal failed qualification checks\n\nPatch 1 adds the operstate enum, netlink attribute and the\noperstate_on_dpll_get callback to the DPLL subsystem. It also\nupdates Documentation/driver-api/dpll.rst to describe the\nseparation between admin state and operational state.\n\nPatch 2 implements the callback for ZL3073x input pins using the\nreference monitor status register. It also refactors the existing\nstate_on_dpll_get to return purely administrative state and switches\nperiodic monitoring to track operstate changes.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260428154907.2820654-1-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "c53f8f8dce776e032b1a11fb4d9b6e12bb63d958", "tree": "562b6e7a43b0f575ac36bdec20a77e18d00de119", "parents": [ "781c8893a5da8522ae4ded93e5ef3adbe9559300" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue Apr 28 17:49:07 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 16:21:49 2026 +0200" }, "message": "dpll: zl3073x: implement pin operational state reporting\n\nImplement operstate_on_dpll_get callback for input pins to report\nthe actual hardware status:\n\n - active: pin is the currently locked reference\n - standby: signal is valid but pin is not actively used\n - no-signal: reference monitor reports Loss of Signal (LOS)\n - qual-failed: reference monitor reports a qualification failure\n (SCM, CFM, GST, PFM, eSync or Split-XO)\n\nSeparate administrative state (state_on_dpll_get) from operational\nstate: admin state now reports purely the user-requested intent\n(connected in reflock mode, selectable in auto mode).\n\nSwitch periodic monitoring to track operstate changes instead of\nthe mixed admin/oper state that was previously reported.\n\nAdd ref_mon_status bit definitions to regs.h.\n\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Petr Oros \u003cporos@redhat.com\u003e\nLink: https://patch.msgid.link/20260428154907.2820654-3-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "781c8893a5da8522ae4ded93e5ef3adbe9559300", "tree": "7081331804d3707732567c6149a147bb7a68fa82", "parents": [ "fdd2c9a1d082c838ad8b66d7795c6dd450a8c9ee" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Tue Apr 28 17:49:06 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 16:21:49 2026 +0200" }, "message": "dpll: add pin operational state\n\nAdd pin-operstate enum and operstate_on_dpll_get callback to report\nthe actual hardware status of a pin with respect to its parent DPLL\ndevice. Unlike pin-state (which reflects administrative intent set\nby the user), operstate reflects what the hardware is actually doing.\n\nDefined operational states:\n - active: pin is qualified and actively used by the DPLL\n - standby: pin is qualified but not actively used by the DPLL\n - no-signal: pin does not have a valid signal\n - qual-failed: pin signal failed qualification\n\nThe operstate is reported inside the pin-parent-device nested\nattribute alongside the existing state and phase-offset attributes.\n\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Jiri Pirko \u003cjiri@nvidia.com\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nReviewed-by: Petr Oros \u003cporos@redhat.com\u003e\nLink: https://patch.msgid.link/20260428154907.2820654-2-ivecera@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1e01abec856593e02cd69fd95b784c10dd46880c", "tree": "8faa6af8c4511bf2689ef016fadea0c06857c1a3", "parents": [ "051ffb001b8a232cfa6e72f38bb5f51c4270a60b" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Wed Apr 29 09:39:11 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:47:01 2026 +0200" }, "message": "net/sched: cls_flower: revert unintended changes\n\nWhile applying the blamed commit 4ca07b9239bd (\"net: mctp i2c: check\nlength before marking flow active\"), I unintentionally included\nunrelated and unacceptable changes.\n\nRevert them.\n\nFixes: 4ca07b9239bd (\"net: mctp i2c: check length before marking flow active\")\nReported-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nCloses: https://lore.kernel.org/netdev/bd8704fe0bd53e278add5cde4873256656623e2e.camel@codeconstruct.com.au/\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\nLink: https://patch.msgid.link/043026a53ff84da88b17648c4b0d17f0331749cb.1777447863.git.pabeni@redhat.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "051ffb001b8a232cfa6e72f38bb5f51c4270a60b", "tree": "367d3065e8dbf4acdd6f2d0ed7bf3631fe2aef37", "parents": [ "58689498ca3384851145a754dbb1d8ed1cf9fb54" ], "author": { "name": "Dan Carpenter", "email": "error27@gmail.com", "time": "Wed Apr 29 09:48:17 2026 +0300" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:44:30 2026 +0200" }, "message": "sfc: fix error code in efx_devlink_info_running_versions()\n\nReturn -EIO if efx_mcdi_rpc() doesn\u0027t return enough space.\n\nFixes: 14743ddd2495 (\"sfc: add devlink info support for ef100\")\nSigned-off-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nReviewed-by: Edward Cree \u003cecree.xilinx@gmail.com\u003e\nLink: https://patch.msgid.link/afGpsbLRHL4_H0KS@stanley.mountain\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "58689498ca3384851145a754dbb1d8ed1cf9fb54", "tree": "3cb276b27203c391f68522db2fd63018ae7b3a91", "parents": [ "47888597a3b41b5088e758ab8ca36bf624d46327" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 16:15:59 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 13:38:29 2026 +0200" }, "message": "net: tls: fix strparser anchor skb leak on offload RX setup failure\n\nWhen tls_set_device_offload_rx() fails at tls_dev_add(), the error path\ncalls tls_sw_free_resources_rx() to clean up the SW context that was\ninitialized by tls_set_sw_offload(). This function calls\ntls_sw_release_resources_rx() (which stops the strparser via\ntls_strp_stop()) and tls_sw_free_ctx_rx() (which kfrees the context),\nbut never frees the anchor skb that was allocated by alloc_skb(0) in\ntls_strp_init().\n\nNote that tls_sw_free_resources_rx() is exclusively used for this\n\"failed to start offload\" code path, there\u0027s no other caller.\n\nThe leak did not exist before commit 84c61fe1a75b (\"tls: rx: do not use\nthe standard strparser\"), because the standard strparser doesn\u0027t try\nto pre-allocate an skb.\n\nThe normal close path in tls_sk_proto_close() handles cleanup by calling\ntls_sw_strparser_done() (which calls tls_strp_done()) after dropping\nthe socket lock, because tls_strp_done() does cancel_work_sync() and\nthe strparser work handler takes the socket lock.\n\nFixes: 84c61fe1a75b (\"tls: rx: do not use the standard strparser\")\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\nReviewed-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nLink: https://patch.msgid.link/20260428231559.1358502-1-kuba@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "47888597a3b41b5088e758ab8ca36bf624d46327", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6", "9e5dead140af10e8b5f975b8f04e46197d48d274" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:42 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:43 2026 +0200" }, "message": "Merge branch \u0027intel-wired-lan-update-2026-04-27-ice-iavf\u0027\n\nJacob Keller says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nIntel Wired LAN Update 2026-04-27 (ice, iavf)\n\nPetr Oros from RedHat has accumulated a number of fixes for the Intel ice\nand iavf drivers, bundled together in this series.\n\nFirst, a series of 4 fixes to resolve issues with the iavf driver logic for\nhandling VLAN filters. This includes keeping VLAN filters while the\ninterface is brought down, waiting for confirmation on filter deletion\nbefore deleting filters from the driver tracking structures, and handling\nthe VIRTCHNL_OP_ADD_VLAN for the old v1 VLAN_ADD command.\n\nA fix for a crash in ice_reset_all_vfs(), properly checking for errors when\nice_vf_rebuild_vsi() fails.\n\nA fix for a possible infinite recursion in ice_cfg_tx_topo() that occurs\nwhen trying to apply invalid Tx topology configuration.\n\nA fix to initialize the SMA pins in the DPLL subsystem properly.\n\nA fix to change the SMA and U.FL pin state for paired pins, ensuring that\nall flows changing one pin will also update its shared pin appropriately.\n\nA preparatory patch to export __dpll_pin_change_ntf() so that drivers can\nnotify pin changes while already holding the dpll_lock.\n\nA fix to ensure DPLL notifications are sent for the software-controlled\npins which wrap the physical CGU input/output pins.\n\nA fix to add DPLL notifications for peer pins when changing the SMA or U.FL\npins, ensuring DPLL subsystem is notified about the paired connected pins.\n\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-0-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "9e5dead140af10e8b5f975b8f04e46197d48d274", "tree": "822c656bc0c57830c8a5d7910248321968feec4a", "parents": [ "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:23 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: add dpll peer notification for paired SMA and U.FL pins\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2). When one pin\u0027s state changes via a PCA9575 GPIO write,\nthe paired pin\u0027s state also changes, but no notification is sent for\nthe peer pin. Userspace consumers monitoring the peer via dpll netlink\nsubscribe never learn about the update.\n\nAdd ice_dpll_sw_pin_notify_peer() which sends a change notification for\nthe paired SW pin. Call it from ice_dpll_pin_sma_direction_set(),\nice_dpll_sma_pin_state_set(), and ice_dpll_ufl_pin_state_set() after\npf-\u003edplls.lock is released. Use __dpll_pin_change_ntf() because\ndpll_lock is still held by the dpll netlink layer (dpll_pin_pre_doit).\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-11-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "1a41b58fd4dc80dca16c717e6e77c88b9d4e83a7", "tree": "ae0f4e5fe3a86ab625e8cc72117f236f867d6f80", "parents": [ "620055cb1036a6125fd912e7a14b47a6572b809b" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:22 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix missing dpll notifications for SW pins\n\nThe SMA/U.FL pin redesign (commit 2dd5d03c77e2 (\"ice: redesign dpll\nsma/u.fl pins control\")) introduced software-controlled pins that wrap\nbacking CGU input/output pins, but never updated the notification and\ndata paths to propagate pin events to these SW wrappers.\n\nThe periodic work sends dpll_pin_change_ntf() only for direct CGU input\npins. SW pins that wrap these inputs never receive change or phase\noffset notifications, so userspace consumers such as synce4l monitoring\nSMA pins via dpll netlink never learn about state transitions or phase\noffset updates. Similarly, ice_dpll_phase_offset_get() reads the SW\npin\u0027s own phase_offset field which is never updated; the PPS monitor\nwrites to the backing CGU input\u0027s field instead.\n\nFix by introducing ice_dpll_pin_ntf(), a wrapper around\ndpll_pin_change_ntf() that also notifies any registered SMA/U.FL pin\nwhose backing CGU input matches. Replace all direct\ndpll_pin_change_ntf() calls in the periodic notification paths with\nthis wrapper. Fix ice_dpll_phase_offset_get() to return the backing\nCGU input\u0027s phase_offset for input-direction SW pins.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-10-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "620055cb1036a6125fd912e7a14b47a6572b809b", "tree": "5b2c64040626789e1f3b21897cfa7d43da8b82ff", "parents": [ "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44" ], "author": { "name": "Ivan Vecera", "email": "ivecera@redhat.com", "time": "Mon Apr 27 22:22:21 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "dpll: export __dpll_pin_change_ntf() for use under dpll_lock\n\nExport __dpll_pin_change_ntf() so that drivers can send pin change\nnotifications from within pin callbacks, which are already called\nunder dpll_lock. Using dpll_pin_change_ntf() in that context would\ndeadlock.\n\nAdd lockdep_assert_held() to catch misuse without the lock held.\n\nAcked-by: Vadim Fedorenko \u003cvadim.fedorenko@linux.dev\u003e\nSigned-off-by: Ivan Vecera \u003civecera@redhat.com\u003e\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-9-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "6f9d8393c9f50fbc68b9c9e99f78ca5a7b43ff44", "tree": "a6be3b768a9ab77971f9b0cac5ccce5a330b333e", "parents": [ "56a643aed0f0af5c29ebb4593d4917b78344dd48" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:20 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:39 2026 +0200" }, "message": "ice: fix SMA and U.FL pin state changes affecting paired pin\n\nSMA and U.FL pins share physical signal paths in pairs (SMA1/U.FL1 and\nSMA2/U.FL2) controlled by the PCA9575 GPIO expander. Each pair can\nonly have one active pin at a time: SMA1 output and U.FL1 output share\nthe same CGU output, SMA2 input and U.FL2 input share the same CGU\ninput. The PCA9575 register bits determine which connector in each\npair owns the signal path.\n\nThe driver does not account for this pairing in two places:\n\nice_dpll_ufl_pin_state_set() modifies PCA9575 bits and disables the\nbacking CGU pin without checking whether the U.FL pin is currently\nactive. Disconnecting an already inactive U.FL pin flips bits that\nthe paired SMA pin relies on, breaking its connection.\n\nice_dpll_sma_direction_set() does not propagate direction changes to\nthe paired U.FL pin. For SMA2/U.FL2 the ICE_SMA2_UFL2_RX_DIS bit is\nnever managed, so U.FL2 stays disconnected after SMA2 switches to\noutput. For both pairs the backing CGU pin of the U.FL side is never\nenabled when a direction change activates it, so userspace sees the\npin as disconnected even though the routing is correct.\n\nFix by guarding the U.FL disconnect path against inactive pins and by\nupdating the paired U.FL pin fully on SMA direction changes: manage\nICE_SMA2_UFL2_RX_DIS for the SMA2/U.FL2 pair and enable the backing\nCGU pin whenever the peer becomes active.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-8-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "56a643aed0f0af5c29ebb4593d4917b78344dd48", "tree": "918eaa44dc55d8aac4681acb6fdabcf775469f2d", "parents": [ "70ad216411e030f67b1743774e245601194aee6a" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:19 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix missing SMA pin initialization in DPLL subsystem\n\nThe DPLL SMA/U.FL pin redesign introduced ice_dpll_sw_pin_frequency_get()\nwhich gates frequency reporting on the pin\u0027s active flag. This flag is\ndetermined by ice_dpll_sw_pins_update() from the PCA9575 GPIO expander\nstate. Before the redesign, SMA pins were exposed as direct HW\ninput/output pins and ice_dpll_frequency_get() returned the CGU\nfrequency unconditionally — the PCA9575 state was never consulted.\n\nThe PCA9575 powers on with all outputs high, setting ICE_SMA1_DIR_EN,\nICE_SMA1_TX_EN, ICE_SMA2_DIR_EN and ICE_SMA2_TX_EN. Nothing in the\ndriver writes the register during initialization, so\nice_dpll_sw_pins_update() sees all pins as inactive and\nice_dpll_sw_pin_frequency_get() permanently returns 0 Hz for every\nSW pin.\n\nFix this by writing a default SMA configuration in\nice_dpll_init_info_sw_pins(): clear all SMA bits, then set SMA1 and\nSMA2 as active inputs (DIR_EN\u003d0) with U.FL1 output and U.FL2 input\ndisabled. Each SMA/U.FL pair shares a physical signal path so only\none pin per pair can be active at a time. U.FL pins still report\nfrequency 0 after this fix: U.FL1 (output-only) is disabled by\nICE_SMA1_TX_EN which keeps the TX output buffer off, and U.FL2\n(input-only) is disabled by ICE_SMA2_UFL2_RX_DIS. They can be\nactivated by changing the corresponding SMA pin direction via dpll\nnetlink.\n\nFixes: 2dd5d03c77e2 (\"ice: redesign dpll sma/u.fl pins control\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Ivan Vecera \u003civecera@redhat.com\u003e\nReviewed-by: Arkadiusz Kubalewski \u003carkadiusz.kubalewski@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-7-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70ad216411e030f67b1743774e245601194aee6a", "tree": "e1494f675d4da476f6c896f0fdf3dc1783e7c55e", "parents": [ "54ef02487914c24170c7e1c061e45212dc55365e" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:18 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix infinite recursion in ice_cfg_tx_topo via ice_init_dev_hw\n\nOn certain E810 configurations where firmware supports Tx scheduler\ntopology switching (tx_sched_topo_comp_mode_en), ice_cfg_tx_topo()\nmay need to apply a new 5-layer or 9-layer topology from the DDP\npackage. If the AQ command to set the topology fails (e.g. due to\ninvalid DDP data or firmware limitations), the global configuration\nlock must still be cleared via a CORER reset.\n\nCommit 86aae43f21cf (\"ice: don\u0027t leave device non-functional if Tx\nscheduler config fails\") correctly fixed this by refactoring\nice_cfg_tx_topo() to always trigger CORER after acquiring the global\nlock and re-initialize hardware via ice_init_hw() afterwards.\n\nHowever, commit 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end\nof deinit paths\") later moved ice_init_dev_hw() into ice_init_hw(),\nbreaking the reinit path introduced by 86aae43f21cf. This creates an\ninfinite recursive call chain:\n\n ice_init_hw()\n ice_init_dev_hw()\n ice_cfg_tx_topo() # topology change needed\n ice_deinit_hw()\n ice_init_hw() # reinit after CORER\n ice_init_dev_hw() # recurse\n ice_cfg_tx_topo()\n ... # stack overflow\n\nFix by moving ice_init_dev_hw() back out of ice_init_hw() and calling\nit explicitly from ice_probe() and ice_devlink_reinit_up(). The third\ncaller, ice_cfg_tx_topo(), intentionally does not need ice_init_dev_hw()\nduring its reinit, it only needs the core HW reinitialization. This\nbreaks the recursion cleanly without adding flags or guards.\n\nThe deinit ordering changes from commit 8a37f9e2ff40 (\"ice: move\nice_deinit_dev() to the end of deinit paths\") which fixed slow rmmod\nare preserved, only the init-side placement of ice_init_dev_hw() is\nreverted.\n\nFixes: 8a37f9e2ff40 (\"ice: move ice_deinit_dev() to the end of deinit paths\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Paul Menzel \u003cpmenzel@molgen.mpg.de\u003e\nReviewed-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nTested-by: Alexander Nowlin \u003calexander.nowlin@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-6-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "54ef02487914c24170c7e1c061e45212dc55365e", "tree": "420a92651ea7be9dcdad0c6bca7e57540c7a0fa3", "parents": [ "34d33313b52eeac3a97ad2e3176d523ec70d9283" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:17 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "ice: fix NULL pointer dereference in ice_reset_all_vfs()\n\nice_reset_all_vfs() ignores the return value of ice_vf_rebuild_vsi().\nWhen the VSI rebuild fails (e.g. during NVM firmware update via\nnvmupdate64e), ice_vsi_rebuild() tears down the VSI on its error path,\nleaving txq_map and rxq_map as NULL. The subsequent unconditional call\nto ice_vf_post_vsi_rebuild() leads to a NULL pointer dereference in\nice_ena_vf_q_mappings() when it accesses vsi-\u003etxq_map[0].\n\nThe single-VF reset path in ice_reset_vf() already handles this\ncorrectly by checking the return value of ice_vf_reconfig_vsi() and\nskipping ice_vf_post_vsi_rebuild() on failure.\n\nApply the same pattern to ice_reset_all_vfs(): check the return value\nof ice_vf_rebuild_vsi() and skip ice_vf_post_vsi_rebuild() and\nice_eswitch_attach_vf() on failure. The VF is left safely disabled\n(ICE_VF_STATE_INIT not set, VFGEN_RSTAT not set to VFACTIVE) and can\nbe recovered via a VFLR triggered by a PCI reset of the VF\n(sysfs reset or driver rebind).\n\nNote that this patch does not prevent the VF VSI rebuild from failing\nduring NVM update — the underlying cause is firmware being in a\ntransitional state while the EMP reset is processed, which can cause\nAdmin Queue commands (ice_add_vsi, ice_cfg_vsi_lan) to fail. This\npatch only prevents the subsequent NULL pointer dereference that\ncrashes the kernel when the rebuild does fail.\n\n crash\u003e bt\n PID: 50795 TASK: ff34c9ee708dc680 CPU: 1 COMMAND: \"kworker/u512:5\"\n #0 [ff72159bcfe5bb50] machine_kexec at ffffffffaa8850ee\n #1 [ff72159bcfe5bba8] __crash_kexec at ffffffffaaa15fba\n #2 [ff72159bcfe5bc68] crash_kexec at ffffffffaaa16540\n #3 [ff72159bcfe5bc70] oops_end at ffffffffaa837eda\n #4 [ff72159bcfe5bc90] page_fault_oops at ffffffffaa893997\n #5 [ff72159bcfe5bce8] exc_page_fault at ffffffffab528595\n #6 [ff72159bcfe5bd10] asm_exc_page_fault at ffffffffab600bb2\n [exception RIP: ice_ena_vf_q_mappings+0x79]\n RIP: ffffffffc0a85b29 RSP: ff72159bcfe5bdc8 RFLAGS: 00010206\n RAX: 00000000000f0000 RBX: ff34c9efc9c00000 RCX: 0000000000000000\n RDX: 0000000000000000 RSI: 0000000000000010 RDI: ff34c9efc9c00000\n RBP: ff34c9efc27d4828 R8: 0000000000000093 R9: 0000000000000040\n R10: ff34c9efc27d4828 R11: 0000000000000040 R12: 0000000000100000\n R13: 0000000000000010 R14: R15:\n ORIG_RAX: ffffffffffffffff CS: 0010 SS: 0018\n #7 [ff72159bcfe5bdf8] ice_sriov_post_vsi_rebuild at ffffffffc0a85e2e [ice]\n #8 [ff72159bcfe5be08] ice_reset_all_vfs at ffffffffc0a920b4 [ice]\n #9 [ff72159bcfe5be48] ice_service_task at ffffffffc0a31519 [ice]\n #10 [ff72159bcfe5be88] process_one_work at ffffffffaa93dca4\n #11 [ff72159bcfe5bec8] worker_thread at ffffffffaa93e9de\n #12 [ff72159bcfe5bf18] kthread at ffffffffaa946663\n #13 [ff72159bcfe5bf50] ret_from_fork at ffffffffaa8086b9\n\n The panic occurs attempting to dereference the NULL pointer in RDX at\n ice_sriov.c:294, which loads vsi-\u003etxq_map (offset 0x4b8 in ice_vsi).\n\n The faulting VSI is an allocated slab object but not fully initialized\n after a failed ice_vsi_rebuild():\n\n crash\u003e struct ice_vsi 0xff34c9efc27d4828\n netdev \u003d 0x0,\n rx_rings \u003d 0x0,\n tx_rings \u003d 0x0,\n q_vectors \u003d 0x0,\n txq_map \u003d 0x0,\n rxq_map \u003d 0x0,\n alloc_txq \u003d 0x10,\n num_txq \u003d 0x10,\n alloc_rxq \u003d 0x10,\n num_rxq \u003d 0x10,\n\n The nvmupdate64e process was performing NVM firmware update:\n\n crash\u003e bt 0xff34c9edd1a30000\n PID: 49858 TASK: ff34c9edd1a30000 CPU: 1 COMMAND: \"nvmupdate64e\"\n #0 [ff72159bcd617618] __schedule at ffffffffab5333f8\n #4 [ff72159bcd617750] ice_sq_send_cmd at ffffffffc0a35347 [ice]\n #5 [ff72159bcd6177a8] ice_sq_send_cmd_retry at ffffffffc0a35b47 [ice]\n #6 [ff72159bcd617810] ice_aq_send_cmd at ffffffffc0a38018 [ice]\n #7 [ff72159bcd617848] ice_aq_read_nvm at ffffffffc0a40254 [ice]\n #8 [ff72159bcd6178b8] ice_read_flat_nvm at ffffffffc0a4034c [ice]\n #9 [ff72159bcd617918] ice_devlink_nvm_snapshot at ffffffffc0a6ffa5 [ice]\n\n dmesg:\n ice 0000:13:00.0: firmware recommends not updating fw.mgmt, as it\n may result in a downgrade. continuing anyways\n ice 0000:13:00.1: ice_init_nvm failed -5\n ice 0000:13:00.1: Rebuild failed, unload and reload driver\n\nFixes: 12bb018c538c (\"ice: Refactor VF reset\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-5-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "34d33313b52eeac3a97ad2e3176d523ec70d9283", "tree": "9e5bb72e361e644f61c5763bb573c71a85d6ee63", "parents": [ "bbcbe4ed70dea948849549af7edf44bd42bbd695" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:16 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: add VIRTCHNL_OP_ADD_VLAN to success completion handler\n\nThe V1 ADD_VLAN opcode had no success handler; filters sent via V1\nstayed in ADDING state permanently. Add a fallthrough case so V1\nfilters also transition ADDING -\u003e ACTIVE on PF confirmation.\n\nCritically, add an `if (v_retval) break` guard: the error switch in\niavf_virtchnl_completion() does NOT return after handling errors,\nit falls through to the success switch. Without this guard, a\nPF-rejected ADD would incorrectly mark ADDING filters as ACTIVE,\ncreating a driver/HW mismatch where the driver believes the filter\nis installed but the PF never accepted it.\n\nFor V2, this is harmless: iavf_vlan_add_reject() in the error\nblock already kfree\u0027d all ADDING filters, so the success handler\nfinds nothing to transition.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-4-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "bbcbe4ed70dea948849549af7edf44bd42bbd695", "tree": "7765699a79e01b685bae6f905800c1f751b1cfad", "parents": [ "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:15 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: wait for PF confirmation before removing VLAN filters\n\nThe VLAN filter DELETE path was asymmetric with the ADD path: ADD\nwaits for PF confirmation (ADD -\u003e ADDING -\u003e ACTIVE), but DELETE\nimmediately frees the filter struct after sending the DEL message\nwithout waiting for the PF response.\n\nThis is problematic because:\n - If the PF rejects the DEL, the filter remains in HW but the driver\n has already freed the tracking structure, losing sync.\n - Race conditions between DEL pending and other operations\n (add, reset) cannot be properly resolved if the filter struct\n is already gone.\n\nAdd IAVF_VLAN_REMOVING state to make the DELETE path symmetric:\n\n REMOVE -\u003e REMOVING (send DEL) -\u003e PF confirms -\u003e kfree\n -\u003e PF rejects -\u003e ACTIVE\n\nIn iavf_del_vlans(), transition filters from REMOVE to REMOVING\ninstead of immediately freeing them. The new DEL completion handler\nin iavf_virtchnl_completion() frees filters on success or reverts\nthem to ACTIVE on error.\n\nUpdate iavf_add_vlan() to handle the REMOVING state: if a DEL is\npending and the user re-adds the same VLAN, queue it for ADD so\nit gets re-programmed after the PF processes the DEL.\n\nThe !VLAN_FILTERING_ALLOWED early-exit path still frees filters\ndirectly since no PF message is sent in that case.\n\nAlso update iavf_del_vlan() to skip filters already in REMOVING\nstate: DEL has been sent to PF and the completion handler will\nfree the filter when PF confirms. Without this guard, the sequence\nDEL(pending) -\u003e user-del -\u003e second DEL could cause the PF to return\nan error for the second DEL (filter already gone), causing the\ncompletion handler to incorrectly revert a deleted filter back to\nACTIVE.\n\nFixes: 968996c070ef (\"iavf: Fix VLAN_V2 addition/rejection\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-3-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "f2ce65b9b917474a1a6ce68d357e15fac2aca0f2", "tree": "fddd2a408a9276640ab1ea06a0d4d5f931a027c1", "parents": [ "70d62b669f1f9080a25278fc90b64309f4ae8959" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:14 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: stop removing VLAN filters from PF on interface down\n\nWhen a VF goes down, the driver currently sends DEL_VLAN to the PF for\nevery VLAN filter (ACTIVE -\u003e DISABLE -\u003e send DEL -\u003e INACTIVE), then\nre-adds them all on UP (INACTIVE -\u003e ADD -\u003e send ADD -\u003e ADDING -\u003e\nACTIVE). This round-trip is unnecessary because:\n\n 1. The PF disables the VF\u0027s queues via VIRTCHNL_OP_DISABLE_QUEUES,\n which already prevents all RX/TX traffic regardless of VLAN filter\n state.\n\n 2. The VLAN filters remaining in PF HW while the VF is down is\n harmless - packets matching those filters have nowhere to go with\n queues disabled.\n\n 3. The DEL+ADD cycle during down/up creates race windows where the\n VLAN filter list is incomplete. With spoofcheck enabled, the PF\n enables TX VLAN filtering on the first non-zero VLAN add, blocking\n traffic for any VLANs not yet re-added.\n\nRemove the entire DISABLE/INACTIVE state machinery:\n - Remove IAVF_VLAN_DISABLE and IAVF_VLAN_INACTIVE enum values\n - Remove iavf_restore_filters() and its call from iavf_open()\n - Remove VLAN filter handling from iavf_clear_mac_vlan_filters(),\n rename it to iavf_clear_mac_filters()\n - Remove DEL_VLAN_FILTER scheduling from iavf_down()\n - Remove all DISABLE/INACTIVE handling from iavf_del_vlans()\n\nVLAN filters now stay ACTIVE across down/up cycles. Only explicit\nuser removal (ndo_vlan_rx_kill_vid) or PF/VF reset triggers VLAN\nfilter deletion/re-addition.\n\nFixes: ed1f5b58ea01 (\"i40evf: remove VLAN filters on close\")\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-2-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "70d62b669f1f9080a25278fc90b64309f4ae8959", "tree": "2de08f80a19a0edff011324a5bb342804ca748cf", "parents": [ "5ef343614db766acdc01c56d66e780a1b43c6ac6" ], "author": { "name": "Petr Oros", "email": "poros@redhat.com", "time": "Mon Apr 27 22:22:13 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 11:37:38 2026 +0200" }, "message": "iavf: rename IAVF_VLAN_IS_NEW to IAVF_VLAN_ADDING\n\nRename the IAVF_VLAN_IS_NEW state to IAVF_VLAN_ADDING to better\ndescribe what the state represents: an ADD request has been sent to\nthe PF and is waiting for a response.\n\nThis is a pure rename with no behavioral change, preparing for a\ncleanup of the VLAN filter state machine.\n\nSigned-off-by: Petr Oros \u003cporos@redhat.com\u003e\nReviewed-by: Aleksandr Loktionov \u003caleksandr.loktionov@intel.com\u003e\nTested-by: Rafal Romanowski \u003crafal.romanowski@intel.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nReviewed-by: Przemek Kitszel \u003cprzemyslaw.kitszel@intel.com\u003e\nSigned-off-by: Jacob Keller \u003cjacob.e.keller@intel.com\u003e\nLink: https://patch.msgid.link/20260427-jk-iwl-net-petr-oros-fixes-v1-1-cdcb48303fd8@intel.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "fdd2c9a1d082c838ad8b66d7795c6dd450a8c9ee", "tree": "526731e7bb5655b0d31fc5b58894e76adfde91cc", "parents": [ "28df22acc2751abf6e6316a9f1f9cd422741bd03", "4baf2415992e3051cb39b831191d12cb7e85ab60" ], "author": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:39:12 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:39:13 2026 +0200" }, "message": "Merge branch \u0027reimplement-tcp-ao-using-crypto-library\u0027\n\nEric Biggers says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nReimplement TCP-AO using crypto library\n\nThis series can also be retrieved from:\n\n git fetch https://git.kernel.org/pub/scm/linux/kernel/git/ebiggers/linux.git tcp-ao-v2\n\nThis series is targeting net-next for 7.2. To make this series\nself-contained in the networking code, I dropped the patches that remove\nsupport for transformation cloning from the crypto API, which is a\nfurther negative 275-line cleanup and optimization this series enables.\nThat will be done as a follow-up, either through the crypto tree for\n7.3, or still through net-next for 7.2 at maintainer preference.\n\nThis series refactors the TCP-AO (TCP Authentication Option) code to do\nMAC and KDF computations using lib/crypto/ instead of crypto_ahash.\nThis greatly simplifies the code and makes it much more efficient. The\nentire tcp_sigpool mechanism becomes unnecessary and is removed, as the\nproblems it was designed to solve don\u0027t exist with the library APIs.\n\nThe crypto API\u0027s support for crypto transformation cloning also becomes\nunnecessary and will be removed in follow-up patches. Note that as part\nof that, we\u0027ll be able to roll back the addition of the reference count\nto crypto_tfm, which had regressed performance for all crypto API users.\n\nTo make this simplification and optimization possible, this series also\nupdates the TCP-AO code to support a specific set of algorithms, rather\nthan arbitrary algorithms that don\u0027t make sense and are very likely not\nbeing used, e.g. CRC-32 and HMAC-MD5.\n\nSpecifically, this series retains the support for AES-128-CMAC,\nHMAC-SHA1, and HMAC-SHA256. AES-128-CMAC and HMAC-SHA1 are the only\nalgorithms that are actually standardized for use in TCP-AO, while\nHMAC-SHA256 makes sense to continue supporting as a Linux extension. Of\ncourse, other algorithms can still be (re-)added later if ever needed.\nIt\u0027s worth noting that TCP-AO MACs are limited to 20 bytes by the TCP\noptions space, which limits the benefit of further algorithm upgrades.\n\nThis series passes the tcp_ao selftests\n(sudo make -C tools/testing/selftests/net/tcp_ao/ run_tests).\n\nTo get a sense for how much more efficient this makes the TCP-AO code,\nhere\u0027s a microbenchmark for tcp_ao_hash_skb() with skb-\u003elen \u003d\u003d 128:\n\n Algorithm Avg cycles (before) Avg cycles (after)\n --------- ------------------- ------------------\n HMAC-SHA1 3319 1256\n HMAC-SHA256 3311 1344\n AES-128-CMAC 2720 1107\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427172727.9310-1-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4baf2415992e3051cb39b831191d12cb7e85ab60", "tree": "526731e7bb5655b0d31fc5b58894e76adfde91cc", "parents": [ "8e4f61e431634730af2244312c783f746575905d" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Apr 27 10:27:27 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:38:56 2026 +0200" }, "message": "net/tcp: Remove tcp_sigpool\n\ntcp_sigpool is no longer used. It existed only as a workaround for\nissues in the design of the crypto_ahash API, which have been avoided by\nswitching to the much easier-to-use library APIs instead. Remove it.\n\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260427172727.9310-6-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "8e4f61e431634730af2244312c783f746575905d", "tree": "410e092eb615bd599e7bda1cd290390a4816f7f2", "parents": [ "48168799896c58d3132822ba8513b10f8d6fe039" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Apr 27 10:27:26 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:38:56 2026 +0200" }, "message": "net/tcp-ao: Return void from functions that can no longer fail\n\nSince tcp-ao now uses the crypto library API instead of crypto_ahash,\nand MACs and keys now have a statically-known maximum size, many tcp-ao\nfunctions can no longer fail. Propagate this change up into the return\ntypes of various functions.\n\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260427172727.9310-5-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "48168799896c58d3132822ba8513b10f8d6fe039", "tree": "14ddf3bd15d6b7810cb6dc50eef2fb956124efa3", "parents": [ "068f5a00955675f10348986d4809edc4dbc0cae0" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Apr 27 10:27:25 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:38:56 2026 +0200" }, "message": "net/tcp-ao: Use stack-allocated MAC and traffic_key buffers\n\nNow that the maximum MAC and traffic key lengths are statically-known\nsmall values, allocate MACs and traffic keys on the stack instead of\nwith kmalloc. This eliminates multiple failure-prone GFP_ATOMIC\nallocations.\n\nNote that some cases such as tcp_ao_prepare_reset() are left unchanged\nfor now since they would require slightly wider changes.\n\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260427172727.9310-4-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "068f5a00955675f10348986d4809edc4dbc0cae0", "tree": "ce10e7eafdfc47a0e3e63d6c9e9c0c77087db475", "parents": [ "5eb0cfedb2588650b63f0a65963ad64272df938d" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Apr 27 10:27:24 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:38:56 2026 +0200" }, "message": "net/tcp-ao: Use crypto library API instead of crypto_ahash\n\nCurrently the kernel\u0027s TCP-AO implementation does the MAC and KDF\ncomputations using the crypto_ahash API. This API is inefficient and\ndifficult to use, and it has required extensive workarounds in the form\nof per-CPU preallocated objects (tcp_sigpool) to work at all.\n\nLet\u0027s use lib/crypto/ instead. This means switching to straightforward\nstack-allocated structures, virtually addressed buffers, and direct\nfunction calls. It also means removing quite a bit of error handling.\nThis makes TCP-AO quite a bit faster.\n\nThis also enables many additional cleanups, which later commits will\nhandle: removing tcp-sigpool, removing support for crypto_tfm cloning,\nremoving more error handling, and replacing more dynamically-allocated\nbuffers with stack buffers based on the now-statically-known limits.\n\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260427172727.9310-3-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "5eb0cfedb2588650b63f0a65963ad64272df938d", "tree": "d7b194cac0c5545f58e7199c00748842d075d756", "parents": [ "28df22acc2751abf6e6316a9f1f9cd422741bd03" ], "author": { "name": "Eric Biggers", "email": "ebiggers@kernel.org", "time": "Mon Apr 27 10:27:23 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Thu Apr 30 09:38:56 2026 +0200" }, "message": "net/tcp-ao: Drop support for most non-RFC-specified algorithms\n\nRFC 5926 (https://datatracker.ietf.org/doc/html/rfc5926) specifies the\nuse of AES-128-CMAC and HMAC-SHA1 with TCP-AO. This includes a\nspecification for how traffic keys shall be derived for each algorithm.\n\nSupport for any other algorithms with TCP-AO isn\u0027t standardized, though\nan expired Internet Draft (a work-in-progress document, not a standard)\nfrom 2019 does propose adding HMAC-SHA256 support:\nhttps://datatracker.ietf.org/doc/html/draft-nayak-tcp-sha2-03\n\nSince both documents specify the KDF for each algorithm individually, it\nisn\u0027t necessarily clear how any other algorithm should be integrated.\n\nNevertheless, the Linux implementation of TCP-AO allows userspace to\nspecify the MAC algorithm as a string tcp_ao_add::alg_name naming either\n\"cmac(aes128)\" or an arbitrary algorithm in the crypto_ahash API. The\nset of valid strings is undocumented. The implementation assumes that\n\"cmac(aes128)\" is the only algorithm that requires an entropy extraction\nstep and that all algorithms accept keys with length equal to the\nuntruncated MAC; thus, arbitrary HMAC algorithms probably do work, but\nsome other MAC algorithms like AES-256-CMAC have never actually worked.\n\nUnfortunately, this undocumented string allows many obsolete, insecure,\nor redundant algorithms. For example, \"hmac(md5)\" and the\nnon-cryptographic \"crc32\" are accepted. It also ties the implementation\nto crypto_ahash and requires that most memory be dynamically allocated,\nmaking the implementation unnecessarily complex and inefficient. Still\nfurthermore, this implementation requires the crypto API to support\n\"transformation cloning\", whose only user is this feature.\n\nFortunately, it\u0027s very likely that only a few algorithms are actually\nused in practice. Let\u0027s restrict the set of allowed algorithms to\n\"cmac(aes128)\" (or \"cmac(aes)\" with keylen\u003d16), \"hmac(sha1)\", and\n\"hmac(sha256)\". The first two are the actually standard ones, while\nHMAC-SHA256 seems like a reasonable algorithm to continue supporting as\na Linux extension, considering the Internet Draft for it and the fact\nthat SHA-256 is the usual choice of upgrade from the outdated SHA-1.\n\nIf any other algorithm ever turns out to be needed, e.g. HMAC-SHA512, it\ncan of course be (re-)added in library form. However, note that the TCP\noptions space limits TCP-AO MACs to 20 bytes (160 bits) anyway, which\nlimits the potential benefit of any further upgrade to the algorithm.\n\nReviewed-by: Ard Biesheuvel \u003cardb@kernel.org\u003e\nSigned-off-by: Eric Biggers \u003cebiggers@kernel.org\u003e\nLink: https://patch.msgid.link/20260427172727.9310-2-ebiggers@kernel.org\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "e75a43c7cec459a07d91ed17de4de13ede2b7758", "tree": "84382cb8f3addaf5ee15a6fa8c1ce24dac0f900f", "parents": [ "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 22:21:44 2026 -0700" }, "message": "Merge tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace\n\nPull tracing fixes from Steven Rostedt:\n\n - Fix inverted check of registering the stats for branch tracing\n\n When calling register_stat_tracer() which returns zero on success and\n negative on error, the callers were checking the return of zero as an\n error and printing a warning message. Because this was just a normal\n printk() message and not a WARN(), it wasn\u0027t caught in any testing.\n\n Fix the check to print the warning message when an error actually\n happens.\n\n - Fix a typo in a comment in tracepoint.h\n\n - Limit the size of event probes to 3K in size\n\n It is possible to create a dynamic event probe via the tracefs system\n that is greater than the max size of an event that the ring buffer\n can hold. This basically causes the event to become useless.\n\n Limit the size of an event probe to be 3K as that should be large\n enough to handle any dynamic events being created, and fits within\n the PAGE_SIZE sub-buffers of the ring buffer.\n\n* tag \u0027trace-v7.1-rc1\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:\n tracing/probes: Limit size of event probe to 3K\n tracepoint: Fix typo in tracepoint.h comment\n tracing: branch: Fix inverted check on stat tracer registration\n" }, { "commit": "5ef343614db766acdc01c56d66e780a1b43c6ac6", "tree": "0b31b19657617984e4945bb4afa0209289f1adb2", "parents": [ "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e" ], "author": { "name": "Hasan Basbunar", "email": "basbunarhasan@gmail.com", "time": "Tue Apr 28 19:07:39 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 19:11:49 2026 -0700" }, "message": "page_pool: fix memory-provider leak in page_pool_create_percpu() error path\n\nWhen page_pool_create_percpu() fails on page_pool_list(), it falls\nthrough to its err_uninit: label, which calls page_pool_uninit().\nAt that point page_pool_init() has already taken two references\nwhen the user requested PP_FLAG_ALLOW_UNREADABLE_NETMEM:\n\n\tpool-\u003emp_ops-\u003einit(pool)\n\tstatic_branch_inc(\u0026page_pool_mem_providers);\n\nNeither is undone by page_pool_uninit(); both are only undone by\n__page_pool_destroy() (success-side teardown). The error path\ntherefore leaks the per-provider reference taken by mp_ops-\u003einit\n(io_zcrx_ifq-\u003erefs in the io_uring zcrx provider, the dmabuf\nbinding refcount in the devmem provider) plus one increment of\nthe page_pool_mem_providers static branch on every failure of\nxa_alloc_cyclic() inside page_pool_list().\n\nThe leaked io_zcrx_ifq-\u003erefs in turn pins everything\nio_zcrx_ifq_free() would release on cleanup: ifq-\u003euser (uid),\nifq-\u003emm_account (mmdrop), ifq-\u003edev (device refcount),\nifq-\u003enetdev_tracker (netdev refcount), and the rbuf region.\nThe leaked static branch increment forces all subsequent\npage_pool_alloc_netmems() and page_pool_return_page() callers to\ntake the slow mp_ops branch for the lifetime of the kernel.\n\nReachable via the io_uring zcrx path:\n\n\tio_uring_register(IORING_REGISTER_ZCRX_IFQ) /* CAP_NET_ADMIN */\n\t -\u003e __io_uring_register\n\t -\u003e io_register_zcrx\n\t -\u003e zcrx_register_netdev\n\t -\u003e netif_mp_open_rxq\n\t -\u003e driver ndo_queue_mem_alloc\n\t -\u003e page_pool_create_percpu\n\t -\u003e page_pool_init succeeds (mp_ops-\u003einit runs, branch++)\n\t -\u003e page_pool_list fails (xa_alloc_cyclic -ENOMEM)\n\t -\u003e goto err_uninit \u003c-- leak\n\nThe same shape applies to the devmem dmabuf provider via\nmp_dmabuf_devmem_init()/mp_dmabuf_devmem_destroy().\n\nRestore the cleanup symmetry by moving the mp_ops-\u003edestroy() and\nstatic_branch_dec() calls out of __page_pool_destroy() and into\npage_pool_uninit(), so page_pool_uninit() is again the strict\ninverse of page_pool_init(). page_pool_uninit() has only two\ncallers (the err_uninit: path and __page_pool_destroy()), so this\npreserves the single-call invariant on the success path while\nfixing the err path. The error path of page_pool_init() itself\nstill skips the mp_ops cleanup correctly: mp_ops-\u003einit is the\nlast action that takes a reference before page_pool_init() returns\n0, so when it returns an error neither the refcount nor the static\nbranch has been touched.\n\nTriggering the bug requires xa_alloc_cyclic() to fail with -ENOMEM,\nwhich under normal GFP_KERNEL retry behaviour is rare. It is\ndeterministic under CONFIG_FAULT_INJECTION with fail_page_alloc /\nxa fault injection, or under sustained memory pressure. The leak\nis silent: there is no warning, and the released kernel build\ncontinues running with a permanently-incremented static branch.\n\nFixes: 0f9214046893 (\"memory-provider: dmabuf devmem memory provider\")\nSigned-off-by: Hasan Basbunar \u003cbasbunarhasan@gmail.com\u003e\nLink: https://patch.msgid.link/20260428170739.34881-1-basbunarhasan@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "28df22acc2751abf6e6316a9f1f9cd422741bd03", "tree": "fb059e7f59c29e3e4e6eaadbe33d27800144539c", "parents": [ "c13581876f2c99f9139c10dcb2d880f3a9a5ed06" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Wed Apr 29 01:08:09 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 19:02:47 2026 -0700" }, "message": "tcp: add tcp_mstamp_refresh_inline()\n\nWe want to inline tcp_mstamp_refresh() in fast path only:\n\n- tcp_rcv_established()\n- tcp_write_xmit()\n\nAdd tcp_mstamp_refresh_inline() for this purpose.\n\nAdd noinline qualifier on tcp_mstamp_refresh() for the other paths,\nto reduce bloat.\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 1/4 up/down: 26/-123 (-97)\nFunction old new delta\ntcp_rcv_established 2238 2264 +26\ntcp_connect 4027 4003 -24\ntcp_tsq_write 152 120 -32\ntcp_send_active_reset 476 444 -32\ntcp_send_window_probe 235 200 -35\nTotal: Before\u003d25316710, After\u003d25316613, chg -0.00%\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Neal Cardwell \u003cncardwell@google.com\u003e\nLink: https://patch.msgid.link/20260429010809.784315-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c4f050ce06c56cfb5993268af4a5cb66ed1cd04e", "tree": "b29a78420378d62cea69de50210636f01b9ac31f", "parents": [ "4ca01292ea2f2363660610a65ba0285d7c3309ed" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 28 12:32:07 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:32:02 2026 -0700" }, "message": "bonding: 3ad: implement proper RCU rules for port-\u003eaggregator\n\nsyzbot found a data-race in bond_3ad_get_active_agg_info /\nbond_3ad_state_machine_handler [1] which hints at lack of proper\nRCU implementation.\n\nAdd __rcu qualifier to port-\u003eaggregator, and add proper RCU API.\n\n[1]\n\nBUG: KCSAN: data-race in bond_3ad_get_active_agg_info / bond_3ad_state_machine_handler\n\nwrite to 0xffff88813cf5c4b0 of 8 bytes by task 36 on cpu 0:\n ad_port_selection_logic drivers/net/bonding/bond_3ad.c:1659 [inline]\n bond_3ad_state_machine_handler+0x9d5/0x2d60 drivers/net/bonding/bond_3ad.c:2569\n process_one_work kernel/workqueue.c:3302 [inline]\n process_scheduled_works+0x4f0/0x9c0 kernel/workqueue.c:3385\n worker_thread+0x58a/0x780 kernel/workqueue.c:3466\n kthread+0x22a/0x280 kernel/kthread.c:436\n ret_from_fork+0x146/0x330 arch/x86/kernel/process.c:158\n ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245\n\nread to 0xffff88813cf5c4b0 of 8 bytes by task 22063 on cpu 1:\n __bond_3ad_get_active_agg_info drivers/net/bonding/bond_3ad.c:2858 [inline]\n bond_3ad_get_active_agg_info+0x8c/0x230 drivers/net/bonding/bond_3ad.c:2881\n bond_fill_info+0xe0f/0x10f0 drivers/net/bonding/bond_netlink.c:853\n rtnl_link_info_fill net/core/rtnetlink.c:906 [inline]\n rtnl_link_fill+0x1d7/0x4e0 net/core/rtnetlink.c:927\n rtnl_fill_ifinfo+0xf8e/0x1380 net/core/rtnetlink.c:2168\n rtmsg_ifinfo_build_skb+0x11c/0x1b0 net/core/rtnetlink.c:4453\n rtmsg_ifinfo_event net/core/rtnetlink.c:4486 [inline]\n rtmsg_ifinfo+0x6d/0x110 net/core/rtnetlink.c:4495\n __dev_notify_flags+0x76/0x390 net/core/dev.c:9790\n netif_change_flags+0xac/0xd0 net/core/dev.c:9823\n do_setlink+0x905/0x2950 net/core/rtnetlink.c:3180\n rtnl_group_changelink net/core/rtnetlink.c:3813 [inline]\n __rtnl_newlink net/core/rtnetlink.c:3981 [inline]\n rtnl_newlink+0xf55/0x1400 net/core/rtnetlink.c:4109\n rtnetlink_rcv_msg+0x64b/0x720 net/core/rtnetlink.c:6995\n netlink_rcv_skb+0x123/0x220 net/netlink/af_netlink.c:2550\n rtnetlink_rcv+0x1c/0x30 net/core/rtnetlink.c:7022\n netlink_unicast_kernel net/netlink/af_netlink.c:1318 [inline]\n netlink_unicast+0x5a8/0x680 net/netlink/af_netlink.c:1344\n netlink_sendmsg+0x5c8/0x6f0 net/netlink/af_netlink.c:1894\n sock_sendmsg_nosec net/socket.c:787 [inline]\n __sock_sendmsg net/socket.c:802 [inline]\n ____sys_sendmsg+0x563/0x5b0 net/socket.c:2698\n ___sys_sendmsg+0x195/0x1e0 net/socket.c:2752\n __sys_sendmsg net/socket.c:2784 [inline]\n __do_sys_sendmsg net/socket.c:2789 [inline]\n __se_sys_sendmsg net/socket.c:2787 [inline]\n __x64_sys_sendmsg+0xd4/0x160 net/socket.c:2787\n x64_sys_call+0x194c/0x3020 arch/x86/include/generated/asm/syscalls_64.h:47\n do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline]\n do_syscall_64+0x12c/0x3b0 arch/x86/entry/syscall_64.c:94\n entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nvalue changed: 0x0000000000000000 -\u003e 0xffff88813cf5c400\n\nReported by Kernel Concurrency Sanitizer on:\nCPU: 1 UID: 0 PID: 22063 Comm: syz.0.31122 Tainted: G W syzkaller #0 PREEMPT(full)\nTainted: [W]\u003dWARN\nHardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026\n\nFixes: 47e91f56008b (\"bonding: use RCU protection for 3ad xmit path\")\nReported-by: syzbot+9bb2ff2a4ab9e17307e1@syzkaller.appspotmail.com\nCloses: https://lore.kernel.org/netdev/69f0a82f.050a0220.3aadc4.0000.GAE@google.com/\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nCc: Jay Vosburgh \u003cjv@jvosburgh.net\u003e\nCc: Andrew Lunn \u003candrew+netdev@lunn.ch\u003e\nLink: https://patch.msgid.link/20260428123207.3809211-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "4ca01292ea2f2363660610a65ba0285d7c3309ed", "tree": "9db972c62902c0d9f0dcc771bae9887e055f9bbe", "parents": [ "b31681206e3f527970a7c7ed807fbf6a028fc25b" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Apr 28 08:53:16 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:29:54 2026 -0700" }, "message": "net: airoha: Do not return err in ndo_stop() callback\n\nAlways complete the airoha_dev_stop() routine regardless of the\nairoha_set_vip_for_gdm_port() return value, since errors from\nndo_stop() are ignored by the networking stack and the interface is\nalways considered down after the call.\n\nFixes: 23020f049327 (\"net: airoha: Introduce ethernet support for EN7581 SoC\")\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260428-airoha-ndo-stop-not-err-v1-1-674506d29a91@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c13581876f2c99f9139c10dcb2d880f3a9a5ed06", "tree": "9b3bd6dc40a3c953f6f974775e25235c770b127c", "parents": [ "c06a2f2903f6fba0a3088ad05fc5cf61a66e5d89" ], "author": { "name": "Bartosz Golaszewski", "email": "bartosz.golaszewski@oss.qualcomm.com", "time": "Tue Apr 28 11:33:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 18:01:48 2026 -0700" }, "message": "net: mdio: drop unneeded dependency on OF_GPIO\n\nOF_GPIO is selected automatically on all OF systems. Any symbols it\ncontrols also provide stubs so there\u0027s really no reason to select it\nexplicitly.\n\nSigned-off-by: Bartosz Golaszewski \u003cbartosz.golaszewski@oss.qualcomm.com\u003e\nLink: https://patch.msgid.link/20260428093338.35043-1-bartosz.golaszewski@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c06a2f2903f6fba0a3088ad05fc5cf61a66e5d89", "tree": "77ac08ce66e63690daa2296624407bbb2ad40671", "parents": [ "b7ebbf9f7aea1c0fdcad0a09d6bd15fa0975ae47" ], "author": { "name": "Lorenzo Bianconi", "email": "lorenzo@kernel.org", "time": "Tue Apr 28 07:23:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:57:25 2026 -0700" }, "message": "net: airoha: Rename get_src_port_id callback in get_sport\n\nFor code consistency, rename get_src_port_id callback in get_sport.\nPlease note this patch does not introduce any logical change and it is\njust a cosmetic patch.\n\nSigned-off-by: Lorenzo Bianconi \u003clorenzo@kernel.org\u003e\nLink: https://patch.msgid.link/20260428-airoha-get_src_port_id-callback-v1-1-3f765c91c1e8@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b7ebbf9f7aea1c0fdcad0a09d6bd15fa0975ae47", "tree": "c8cbe98c8bc7f200f214c16bd1a7298de9c25207", "parents": [ "115553b80f774348596e5e252975c795ab021e12" ], "author": { "name": "Birger Koblitz", "email": "mail@birger-koblitz.de", "time": "Tue Apr 28 05:44:58 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:56:15 2026 -0700" }, "message": "r8152: Use ocp/mdio test and clear functions in r8157_hw_phy_cfg()\n\nReplace explicit testing of bits and clearing these bits by existing\nfunctions ocp_word_test_and_clr_bits() and r8152_mdio_test_and_clr_bit()\nto re-use this code.\n\nThis allows to remove the \"ocp_data\" variable. Also remove the \"ret\" variable\nwhich was incorrectly used for the r8153_phy_status() return value which\nis a u16, so that the remaining \"data\" variable is sufficient.\n\nSigned-off-by: Birger Koblitz \u003cmail@birger-koblitz.de\u003e\nLink: https://patch.msgid.link/20260428-use_bit_functions-v1-1-6eb5a3507610@birger-koblitz.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "115553b80f774348596e5e252975c795ab021e12", "tree": "e9814114d4c6e3483d5e6961b7f69e235d39e3b2", "parents": [ "b60f81e62b022f07533a04f7686e1a9d54e46ab0" ], "author": { "name": "Birger Koblitz", "email": "mail@birger-koblitz.de", "time": "Tue Apr 28 05:43:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:55:07 2026 -0700" }, "message": "r8152: Fix double consecutive clearing of PLA_MCU_SPDWN_EN bit\n\nDue to a Copy \u0026 Paste Error, the PLA_MCU_SPDWN_EN bit was cleared\ntwice consecutively using ocp_word_clr_bits. Fix that.\n\nSigned-off-by: Birger Koblitz \u003cmail@birger-koblitz.de\u003e\nLink: https://patch.msgid.link/20260428-patch_double-v1-1-27c830a9eb2e@birger-koblitz.de\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b60f81e62b022f07533a04f7686e1a9d54e46ab0", "tree": "35212980bdff515bb8b54dc178f482d19dd14885", "parents": [ "e2d217fe3ff2a73ace0dbfe41b620c7fb767b000", "6a92fe1956d285dd8d454e2b7ef49d0bae81bcbc" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:46:30 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:46:30 2026 -0700" }, "message": "Merge branch \u0027net-mlx5-fix-e-switch-work-queue-deadlock-with-devlink-lock\u0027\n\nTariq Toukan says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/mlx5: Fix E-Switch work queue deadlock with devlink lock\n\nmlx5_eswitch_cleanup() calls destroy_workqueue() while holding the\ndevlink lock through mlx5_uninit_one(). E-Switch workqueue workers also\nneed the devlink lock, but previously took it before checking whether\ntheir work item was stale. Cleanup can therefore wait for a worker that\nis blocked on the same devlink lock.\n\nMode changes have the same ordering hazard: the mode-change path holds\ndevlink lock while tearing down the current mode, and old work may still\nbe pending on the E-Switch workqueue.\n\nFix this by making esw_wq_handler() check the generation counter before\nattempting to take devlink lock. The worker uses devl_trylock(); if the\nlock is busy and the work is still current, it sleeps on an E-Switch wait\nqueue with a short timeout. Invalidation increments the generation\ncounter and wakes the wait queue, so stale workers exit without spinning\nor blocking cleanup.\n\nThe generation counter already existed but was buried in\nmlx5_esw_functions and only covered function-change events. The three\npatches get from there to the fix in small steps.\n\nPatch 1 moves the counter up to mlx5_eswitch. Pure refactor,\nno behavior change.\n\nPatch 2 cleans up the work queue plumbing: factors out the repeated\nlock/check/dispatch boilerplate into a single esw_wq_handler() and\nadds mlx5_esw_add_work() as the one place to enqueue work.\n\nPatch 3 is the actual fix: check the generation before the lock, use\ndevl_trylock() instead of devl_lock(), add a wait queue so lock retries\ndo not spin, and invalidate pending work at the earliest safe operation\nboundary. Cleanup invalidates before destroy_workqueue(), and mode\nteardown unregisters the work-producing notifiers before invalidating so\nnew notifier work cannot capture the new generation.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260428051018.219093-1-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "6a92fe1956d285dd8d454e2b7ef49d0bae81bcbc", "tree": "35212980bdff515bb8b54dc178f482d19dd14885", "parents": [ "2a110ee54e8911aa6f66baec52252ce4431afe91" ], "author": { "name": "Mark Bloch", "email": "mbloch@nvidia.com", "time": "Tue Apr 28 08:10:17 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:46:28 2026 -0700" }, "message": "net/mlx5: E-Switch, fix deadlock between devlink lock and esw-\u003ewq\n\nmlx5_eswitch_cleanup() calls destroy_workqueue() while holding the\ndevlink lock through mlx5_uninit_one(). E-Switch workqueue workers also\nneed the devlink lock, but previously took it before checking whether\ntheir work item was stale. This can deadlock when cleanup waits for a\nworker that is blocked on the same devlink lock.\n\nMode changes have the same ordering hazard: the mode-change path holds\ndevlink lock while tearing down the current mode, and old work may still\nbe pending on the E-Switch workqueue.\n\nFix this by making esw_wq_handler() check the generation counter before\nattempting to take devlink lock. The worker uses devl_trylock(); if the\nlock is busy and the work is still current, it sleeps on an E-Switch wait\nqueue with a short timeout. Invalidation increments the generation\ncounter and wakes the wait queue, so stale workers exit without spinning\nor blocking cleanup.\n\nInvalidate work at the earliest safe operation boundary. Cleanup\ninvalidates before destroy_workqueue(), and QoS cleanup runs after the\nworkqueue is destroyed. Mode teardown unregisters the work-producing\nnotifiers first, then invalidates the queue before tearing down\nFDB/QoS/rate-node state. This prevents new notifier work from capturing\nthe new generation while still making old work stale before expensive\nteardown starts.\n\nmlx5_devlink_eswitch_mode_set() now relies on\nmlx5_eswitch_disable_locked() for the mode-change invalidation instead\nof incrementing the generation after disable. mlx5_eswitch_disable()\ngets the same coverage. SR-IOV enable/disable paths invalidate before VF\nstate changes so work against the old VF count or mode is discarded.\n\nRemove the conditional generation increment in\nmlx5_eswitch_event_handler_unregister(); mlx5_eswitch_disable_locked()\nnow handles it unconditionally after the relevant notifiers are\nunregistered.\n\nSigned-off-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260428051018.219093-4-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "2a110ee54e8911aa6f66baec52252ce4431afe91", "tree": "d4463e319873582f45557d48efdc692161aaa2b8", "parents": [ "f950ddb57ce46eee0d2b8f1d6ea47f835c224103" ], "author": { "name": "Mark Bloch", "email": "mbloch@nvidia.com", "time": "Tue Apr 28 08:10:16 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:46:27 2026 -0700" }, "message": "net/mlx5: E-Switch, introduce generic work queue dispatch helper\n\nEach E-Switch work item requires the same boilerplate: acquire the\ndevlink lock, check whether the work is stale, dispatch to the\nappropriate handler, and release the lock. Factor this out.\n\nAdd a func callback to mlx5_host_work so the generic handler\nesw_wq_handler() can dispatch to the right function without\nduplicating locking logic. Introduce mlx5_esw_add_work() as the\nsingle enqueue point: it stamps the work item with the current\ngeneration counter and queues it onto the E-Switch work queue.\n\nRefactor esw_vfs_changed_event_handler() to match the new contract:\nit no longer receives work_gen or out as parameters. It queries\nmlx5_esw_query_functions() itself and owns the kvfree() of the\nresult. The devlink lock is acquired and released by esw_wq_handler()\nbefore dispatching, so the handler runs with the lock already held.\n\nUpdate mlx5_esw_funcs_changed_handler() to use mlx5_esw_add_work().\n\nSigned-off-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260428051018.219093-3-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f950ddb57ce46eee0d2b8f1d6ea47f835c224103", "tree": "5706714304c7af8f6eeac0343e271719b0ef052c", "parents": [ "e2d217fe3ff2a73ace0dbfe41b620c7fb767b000" ], "author": { "name": "Mark Bloch", "email": "mbloch@nvidia.com", "time": "Tue Apr 28 08:10:15 2026 +0300" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:46:27 2026 -0700" }, "message": "net/mlx5: E-Switch, move work queue generation counter\n\nThe generation counter in mlx5_esw_functions is used to detect stale\nwork items on the E-Switch work queue. Move it from mlx5_esw_functions\nto the top-level mlx5_eswitch struct so it can guard all work types,\nnot just function-change events.\n\nThis is a mechanical refactor: no behavioral change.\n\nSigned-off-by: Mark Bloch \u003cmbloch@nvidia.com\u003e\nReviewed-by: Cosmin Ratiu \u003ccratiu@nvidia.com\u003e\nSigned-off-by: Tariq Toukan \u003ctariqt@nvidia.com\u003e\nLink: https://patch.msgid.link/20260428051018.219093-2-tariqt@nvidia.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b31681206e3f527970a7c7ed807fbf6a028fc25b", "tree": "ddfd6607f932c271a0d55281b1a894a5052df638", "parents": [ "e73cafaf4acea5445df2e5ee021a335d717c1697" ], "author": { "name": "Hamza Mahfooz", "email": "hamzamahfooz@linux.microsoft.com", "time": "Tue Apr 28 08:53:39 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:30:45 2026 -0700" }, "message": "hv_sock: fix ARM64 support\n\nVMBUS ring buffers must be page aligned. Therefore, the current value of\n24K presents a challenge on ARM64 kernels (with 64K pages). So, use\nVMBUS_RING_SIZE() to ensure they are always aligned and large enough to\nhold all of the relevant data.\n\nCc: stable@vger.kernel.org\nFixes: 77ffe33363c0 (\"hv_sock: use HV_HYP_PAGE_SIZE for Hyper-V communication\")\nTested-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nReviewed-by: Dexuan Cui \u003cdecui@microsoft.com\u003e\nSigned-off-by: Hamza Mahfooz \u003chamzamahfooz@linux.microsoft.com\u003e\nAcked-by: Stefano Garzarella \u003csgarzare@redhat.com\u003e\nLink: https://patch.msgid.link/20260428125339.13963-1-hamzamahfooz@linux.microsoft.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e2d217fe3ff2a73ace0dbfe41b620c7fb767b000", "tree": "55a1c253d1df914b05af7f3056f92f39be93780d", "parents": [ "776059b70231bd235493d68ae77d12df65d8dfe7" ], "author": { "name": "Maxime Chevallier", "email": "maxime.chevallier@bootlin.com", "time": "Tue Apr 28 14:58:27 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 17:30:05 2026 -0700" }, "message": "net: phy: aquantia: use ADVERTISE_XNP for extended next page advertising\n\nWhen configuring the link parameters in forced mode for the AQR-105, the\nExtended Next Page bit gets advertised for Multi-Gigabit modes.\n\nThis is done through bit 12 of MDIO_AN_ADVERTISE in MDIO_MMD_AN. This\ncontains a copy of the MII_ADVERTISE, for which 802.3 defines bit 12 as\nthe Extended Next Page advertising. This bit used to be marked as\nreserved, but a proper define for it was added in :\n\ncommit e7a62edd34b1 (\"net: phy: qcom: at803x: Use the correct bit to disable extended next page\")\n\nLet\u0027s use it instead of the ADVERTISE_RESV definition, making the code\nmore self-documenting.\n\nSigned-off-by: Maxime Chevallier \u003cmaxime.chevallier@bootlin.com\u003e\nReviewed-by: Andrew Lunn \u003candrew@lunn.ch\u003e\nLink: https://patch.msgid.link/20260428125827.238469-1-maxime.chevallier@bootlin.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "776059b70231bd235493d68ae77d12df65d8dfe7", "tree": "ee106e2fc0878e69a01d518440fb465570f281e1", "parents": [ "1656f1788342a05eb9c8fc30ebfb1f9f674fcce7", "c2b22277ad897d21341f502f87fccd905ff4e207" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:55:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:55:59 2026 -0700" }, "message": "Merge branch \u0027net-psp-add-more-validation\u0027\n\nJakub Kicinski says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet: psp: add more validation\n\nAddress some AI code-scan issues with the PSP code.\nI don\u0027t think any of these are real bugs, but they may\nbecome bugs in the future. The two real bugs discovered\nwere posted separately for net. AI reports 3 more which\nseem plain wrong (rx SPI \"leak\" on error etc.).\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260428205352.1247325-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "c2b22277ad897d21341f502f87fccd905ff4e207", "tree": "ee106e2fc0878e69a01d518440fb465570f281e1", "parents": [ "5637fcb11c9128283db598ff398924d910c73143" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:53:52 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:55:55 2026 -0700" }, "message": "psp: validate IPv4 header fields in psp_dev_rcv()\n\npsp_dev_rcv() is called from the NIC driver\u0027s RX completion path\nbefore the frame reaches ip_rcv_core(), so the IP header has not\nbeen validated in SW, yet. We expect that the device has done\nall this validation, but let\u0027s also add the SW checks, to avoid\nsurprises.\n\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260428205352.1247325-4-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5637fcb11c9128283db598ff398924d910c73143", "tree": "f3e2cbbb5a7f84d579d522b0f6e7c6ddd5c16f84", "parents": [ "28e71cb51cdfcbc0f37ef8011a5a1c7a49423faf" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:53:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:55:55 2026 -0700" }, "message": "psp: add a comment about a psp_dev add netlink notification\n\nIn psp_dev_create(), the DEV_ADD_NTF netlink notification is sent\nbefore the device is published to the netdev via rcu_assign_pointer().\nIIRC this is intentional because a single PSP device is expected\nto be shared with multiple netdevs. So we are trying to default to\nnot having the netdev info. We can change it if someone complains\nbut for now just add a comment that it\u0027s intentional.\n\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260428205352.1247325-3-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "28e71cb51cdfcbc0f37ef8011a5a1c7a49423faf", "tree": "53d26bccea4f581c85b1dc323d012b8fb4724a3f", "parents": [ "1656f1788342a05eb9c8fc30ebfb1f9f674fcce7" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:53:50 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:55:54 2026 -0700" }, "message": "psp: validate protocol before mutating skb in psp_dev_encapsulate()\n\nCode checkers / AI scans will complain that we have already modified\nthe packet by the time we realize that protocol is not IP.\n\nMove the skb-\u003eprotocol check to before skb_push()/memmove() so that\nthe skb is not left in a corrupted state when the function returns\nfalse for an unsupported protocol. psp_dev_rcv() follows similar\npattern.\n\nToday this path is unreachable because both in-tree callers (mlx5 and\nnetdevsim) only reach psp_dev_encapsulate() from TCP socket TX paths\nwhere skb-\u003eprotocol is always ETH_P_IP or ETH_P_IPV6, and both drop\nthe skb on a false return, anyway.\n\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260428205352.1247325-2-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1656f1788342a05eb9c8fc30ebfb1f9f674fcce7", "tree": "b54494aadcea81d7792a627bd6d3d8e1d2670388", "parents": [ "52472519ef61c62bdac8f0ffa10268b5bf123cc4" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:36:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:53:41 2026 -0700" }, "message": "selftests: drv-net: rss: add case for field config on RSS context\n\nWe had some issues with a suspected traffic imbalance on an RSS\ncontext. Make sure the tests cover the RXFH field selection\nvs additional contexts.\n\nTested-by: Pavan Chebbi \u003cpavan.chebbi@broadcom.com\u003e\nLink: https://patch.msgid.link/20260428203624.1224387-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e73cafaf4acea5445df2e5ee021a335d717c1697", "tree": "d809154cd32ce098ab99e043b88c2dc6f95f504f", "parents": [ "72e9647e2b20c31b4f2febf981566e3c5cdef90e" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:39:24 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:52:33 2026 -0700" }, "message": "MAINTAINERS: update the IPv4/IPv6 entry and add Ido Schimmel\n\nThe IPv4/IPv6 and routing code is not very well separated from\nthe TCP/UDP code. Scope it down properly by providing a more\naccurate file list, instead of net/ipv4/ and net/ipv6/\n\nNow that the entry is more accurately representing layer 3\nand routing merge in the nexthop entry into it.\n\nAdd Ido Schimmel as a co-maintainer, Ido\u0027s git history speaks\nfor itself.\n\nReviewed-by: David Ahern \u003cdsahern@kernel.org\u003e\nReviewed-by: Ido Schimmel \u003cidosch@nvidia.com\u003e\nReviewed-by: Nikolay Aleksandrov \u003crazor@blackwall.org\u003e\nLink: https://patch.msgid.link/20260428203924.1229169-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "72e9647e2b20c31b4f2febf981566e3c5cdef90e", "tree": "769d62592321826f880a9f536764626a65ba7c65", "parents": [ "c3388f8c1cbb5aae3731749b586499ed126b4156" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 13:33:57 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:48:21 2026 -0700" }, "message": "selftests: drv-net: clarify linters and frameworks in README\n\nMinor clarifications in the README:\n - call out what linters we expect to be clean\n - make it clear that by \"frameworks\" we mean code under lib/\n not just factoring code out in the same file\n\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n\n" }, { "commit": "c3388f8c1cbb5aae3731749b586499ed126b4156", "tree": "52808a0aa42c3d233682986b3e3aaa386c748e2e", "parents": [ "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9" ], "author": { "name": "David Heidelberg", "email": "david@ixit.cz", "time": "Tue Apr 28 16:24:38 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:46:51 2026 -0700" }, "message": "MAINTAINERS: Add myself as NFC subsystem maintainer\n\nAdd myself and update the mailing list.\n\nSigned-off-by: David Heidelberg \u003cdavid@ixit.cz\u003e\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "52472519ef61c62bdac8f0ffa10268b5bf123cc4", "tree": "194491689a32ec9cb705832dfd6f688cbdca556e", "parents": [ "f48bf6145116980661476f8fe1027203af9b5f29" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Tue Apr 28 07:09:19 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:42:44 2026 -0700" }, "message": "net/sched: rename qstats_overlimit_inc() to qstats_cpu_overlimit_inc()\n\nqstats_overlimit_inc() is only used to increment per cpu overlimits.\n\nIt can use this_cpu_inc() to avoid this_cpu_ptr() extra cost\nand avoid potential store tearing.\n\nChange qstats_overlimit_inc() name and its argument type.\n\nAlso add a WRITE_ONCE() in qdisc_qstats_overlimit() to prevent\nstore tearing.\n\n$ scripts/bloat-o-meter -t vmlinux.0 vmlinux.1\nadd/remove: 0/0 grow/shrink: 0/7 up/down: 0/-91 (-91)\nFunction old new delta\ntcf_skbmod_act 772 764 -8\ntcf_police_act 733 725 -8\ntcf_gate_act 318 310 -8\ntcf_pedit_act 1295 1284 -11\ntcf_mirred_to_dev 1126 1114 -12\ntcf_ife_act 1077 1061 -16\ntcf_mirred_act 1324 1296 -28\nTotal: Before\u003d24274627, After\u003d24274536, chg -0.00%\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nReviewed-by: Jamal Hadi Salim \u003cjhs@mojatatu.com\u003e\nLink: https://patch.msgid.link/20260428070919.3109557-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "735a309b4bfb9e1e26636ff4a3e8a146f53c54f9", "tree": "e91db943670e99cad9c3ae0fc10ff8e2baab6df5", "parents": [ "0c7a5ba011d336df4fcd1f667fcc16ea5549be12" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 19:53:20 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:40:08 2026 -0700" }, "message": "net: add net_iov_init() and use it to initialize -\u003epage_type\n\nCommit db359fccf212 (\"mm: introduce a new page type for page pool in\npage type\") added a page_type field to struct net_iov at the same\noffset as struct page::page_type, so that page_pool_set_pp_info() can\ncall __SetPageNetpp() uniformly on both pages and net_iovs.\n\nThe page-type API requires the field to hold the UINT_MAX \"no type\"\nsentinel before a type can be set; for real struct page that invariant\nis established by the page allocator on free. struct net_iov is not\nallocated through the page allocator, so the field is left as zero\n(io_uring zcrx, which uses __GFP_ZERO) or as slab garbage (devmem,\nwhich uses kvmalloc_objs() without zeroing). When the page pool then\ncalls page_pool_set_pp_info() on a freshly-bound niov,\n__SetPageNetpp()\u0027s VM_BUG_ON_PAGE(page-\u003epage_type !\u003d UINT_MAX) fires\nand the kernel BUGs. Triggered in selftests by io_uring zcrx setup\nthrough the fbnic queue restart path:\n\n kernel BUG at ./include/linux/page-flags.h:1062!\n RIP: 0010:page_pool_set_pp_info (./include/linux/page-flags.h:1062\n net/core/page_pool.c:716)\n Call Trace:\n \u003cTASK\u003e\n net_mp_niov_set_page_pool (net/core/page_pool.c:1360)\n io_pp_zc_alloc_netmems (io_uring/zcrx.c:1089 io_uring/zcrx.c:1110)\n fbnic_fill_bdq (./include/net/page_pool/helpers.h:160\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:906)\n __fbnic_nv_restart (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2470\n drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2874)\n fbnic_queue_start (drivers/net/ethernet/meta/fbnic/fbnic_txrx.c:2903)\n netdev_rx_queue_reconfig (net/core/netdev_rx_queue.c:137)\n __netif_mp_open_rxq (net/core/netdev_rx_queue.c:234)\n io_register_zcrx (io_uring/zcrx.c:818 io_uring/zcrx.c:903)\n __io_uring_register (io_uring/register.c:931)\n __do_sys_io_uring_register (io_uring/register.c:1029)\n do_syscall_64 (arch/x86/entry/syscall_64.c:63\n arch/x86/entry/syscall_64.c:94)\n \u003c/TASK\u003e\n\nThe same path is reachable through devmem dmabuf binding via\nnetdev_nl_bind_rx_doit() -\u003e net_devmem_bind_dmabuf_to_queue().\n\nAdd a net_iov_init() helper that stamps -\u003eowner, -\u003etype and the\n-\u003epage_type sentinel, and use it from both the devmem and io_uring\nzcrx niov init loops.\n\nFixes: db359fccf212 (\"mm: introduce a new page type for page pool in page type\")\nAcked-by: Vlastimil Babka (SUSE) \u003cvbabka@kernel.org\u003e\nAcked-by: Byungchul Park \u003cbyungchul@sk.com\u003e\nReviewed-by: Jens Axboe \u003caxboe@kernel.dk\u003e\nAcked-by: Pavel Begunkov \u003casml.silence@gmail.com\u003e\nLink: https://patch.msgid.link/20260428025320.853452-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f48bf6145116980661476f8fe1027203af9b5f29", "tree": "7b6aae545a323ed7dd452fc63f34fddcddb94719", "parents": [ "09942ddedcb960f9e78fd817ec33f501d1040c5b" ], "author": { "name": "Krzysztof Kozlowski", "email": "krzysztof.kozlowski@oss.qualcomm.com", "time": "Mon Apr 27 09:01:27 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Wed Apr 29 16:38:54 2026 -0700" }, "message": "net: Unify user-visible \"Qualcomm\" name\n\nVarious names for Qualcomm as a company are used in user-visible config\noptions: QCOM, Qualcomm and Qualcomm Technologies. Switch to unified\n\"Qualcomm\" so it will be easier for users to identify the options when\nfor example running menuconfig.\n\nSigned-off-by: Krzysztof Kozlowski \u003ckrzysztof.kozlowski@oss.qualcomm.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nLink: https://patch.msgid.link/20260427070127.18471-2-krzysztof.kozlowski@oss.qualcomm.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b2aa3b4d64e460ac606f386c24e7d8a873ce6f1a", "tree": "4687d9d5c912c18448bda8fd59d5e4e8fe262648", "parents": [ "5ec07d5204b4544271f32f6261ee097fe53cb081" ], "author": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 12:23:02 2026 -0400" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Wed Apr 29 16:07:38 2026 -0400" }, "message": "tracing/probes: Limit size of event probe to 3K\n\nThere currently isn\u0027t a max limit an event probe can be. One could make an\nevent greater than PAGE_SIZE, which makes the event useless because if\nit\u0027s bigger than the max event that can be recorded into the ring buffer,\nthen it will never be recorded.\n\nA event probe should never need to be greater than 3K, so make that the\nmax size. As long as the max is less than the max that can be recorded\nonto the ring buffer, it should be fine.\n\nCc: stable@vger.kernel.org\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nFixes: 93ccae7a22274 (\"tracing/kprobes: Support basic types on dynamic events\")\nLink: https://patch.msgid.link/20260428122302.706610ba@gandalf.local.home\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "57b8e2d666a31fa201432d58f5fe3469a0dd83ba", "tree": "6c70b7a6aa9eb203f4ceb558151b8c56ea33f487", "parents": [ "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "39f1c201b93f4ff71631bac72cff6eb155f976a4" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Wed Apr 29 06:56:50 2026 -0700" }, "message": "Merge tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm\n\nPull kvm updates from Paolo Bonzini:\n \"On top of a lot of Arm fixes, this includes a massive rename of types\n and variables in tools/testing/selftests/kvm - these were\n unnecessarily different from what the kernel uses, so they\u0027re being\n made consistent.\n\n arm64:\n\n - Allow tracing for non-pKVM, which was accidentally disabled when\n the series was merged\n\n - Rationalise the way the pKVM hypercall ranges are defined by using\n the same mechanism as already used for the vcpu_sysreg enum\n\n - Enforce that SMCCC function numbers relayed by the pKVM proxy are\n actually compliant with the specification\n\n - Fix a couple of feature to idreg mappings which resulted in the\n wrong sanitisation being applied\n\n - Fix the GICD_IIDR revision number field that could never been\n written correctly by userspace\n\n - Make kvm_vcpu_initialized() correctly use its parameter instead of\n relying on the surrounding context\n\n - Enforce correct ordering in __pkvm_init_vcpu(), plugging a\n potential pin leak at the same time\n\n - Move __pkvm_init_finalise() to a less dangerous spot, avoiding\n future problems\n\n - Restore functional userspace irqchip support after a four year\n breakage (last functional kernel was 5.18...)\n\n - Spelling fixes\n\n Selftests:\n\n - Rename types across all KVM selftests to more closely align with\n types used in the kernel:\n\n vm_vaddr_t -\u003e gva_t\n vm_paddr_t -\u003e gpa_t\n\n uint64_t -\u003e u64\n uint32_t -\u003e u32\n uint16_t -\u003e u16\n uint8_t -\u003e u8\n\n int64_t -\u003e s64\n int32_t -\u003e s32\n int16_t -\u003e s16\n int8_t -\u003e s8\n\n - Fix Loongarch compilation\"\n\n* tag \u0027for-linus\u0027 of git://git.kernel.org/pub/scm/virt/kvm/kvm: (31 commits)\n KVM: selftests: Add check_steal_time_uapi() implementation for LoongArch\n KVM: arm64: Wake-up from WFI when iqrchip is in userspace\n KVM: arm64: Fix initialisation order in __pkvm_init_finalise()\n KVM: arm64: Fix pin leak and publication ordering in __pkvm_init_vcpu()\n KVM: arm64: Fix kvm_vcpu_initialized() macro parameter\n KVM: arm64: Fix FEAT_SPE_FnE to use PMSIDR_EL1.FnE, not PMSVer\n KVM: arm64: Fix typo in feature check comments\n KVM: arm64: Fix FEAT_Debugv8p9 to check DebugVer, not PMUVer\n KVM: arm64: Reject non compliant SMCCC function calls in pKVM\n KVM: arm64: vgic: Fix IIDR revision field extracted from wrong value\n KVM: selftests: Replace \"paddr\" with \"gpa\" throughout\n KVM: selftests: Replace \"u64 nested_paddr\" with \"gpa_t l2_gpa\"\n KVM: selftests: Replace \"u64 gpa\" with \"gpa_t\" throughout\n KVM: selftests: Replace \"vaddr\" with \"gva\" throughout\n KVM: selftests: Clarify that arm64\u0027s inject_uer() takes a host PA, not a guest PA\n KVM: selftests: Rename translate_to_host_paddr() \u003d\u003e translate_hva_to_hpa()\n KVM: selftests: Rename vm_vaddr_populate_bitmap() \u003d\u003e vm_populate_gva_bitmap()\n KVM: selftests: Rename vm_vaddr_unused_gap() \u003d\u003e vm_unused_gva_gap()\n KVM: selftests: Drop \"vaddr_\" from APIs that allocate memory for a given VM\n KVM: selftests: Use u8 instead of uint8_t\n ...\n" }, { "commit": "e052a1f7199260eda4d6ca08a59c3b98738f8491", "tree": "c5d97c6c4671d44037e8707cf75b1f8f6126c42a", "parents": [ "90df4957a3271adf391b3432cd76a40887cf3273" ], "author": { "name": "Shenghao Ding", "email": "shenghao-ding@ti.com", "time": "Wed Apr 29 13:42:06 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:51:17 2026 +0200" }, "message": "ALSA: hda/tas2781: Fix incorrect bit update for non-book-zero or book 0 pages \u003e1\n\nIn TAS2781 SPI mode, when accessing non-book-zero or page numbers greater\nthan 1 in book 0, an additional byte must be read. The first byte in such\ncases is a dummy byte and should be ignored.\n\nFixes: 9fa6a693ad8d (\"ALSA: hda/tas2781: Remove tas2781_spi_fwlib.c and leverage SND_SOC_TAS2781_FMWLIB\")\nSigned-off-by: Shenghao Ding \u003cshenghao-ding@ti.com\u003e\nLink: https://patch.msgid.link/20260429054206.429-1-shenghao-ding@ti.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "90df4957a3271adf391b3432cd76a40887cf3273", "tree": "42c40128fa8691e66a5d6d0be4f84265297ff85d", "parents": [ "b0e2333a231107adedd38c6fcfe1adc6162716fc" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Tue Apr 28 14:05:31 2026 +0100" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:50:16 2026 +0200" }, "message": "ALSA: hda: cs35l56: Fix uninitialized value in cs35l56_hda_read_acpi()\n\nEliminate the uninitialized \u0027nval\u0027 in cs35l56_hda_read_acpi() if a\nsystem-specific quirk overrides processing of the dev-index property.\nThe value is now stored in a new \u0027num_amps\u0027 member of struct cs35l56_hda\nso that the quirk handler can set the value.\n\nThe quirk for the Lenovo Yoga Book 9i GenX replaces the values from the\ndev-index property with hardcoded indexes. So cs35l56_hda_read_acpi() would\nthen skip reading the property. But this left the \u0027nval\u0027 local variable\nuninitialized when it is later passed to cirrus_scodec_get_speaker_id().\n\nFixes: 40b1c2f9b299 (\"ALSA: hda/cs35l56: Workaround bad dev-index on Lenovo Yoga Book 9i GenX\")\nReported-by: Dan Carpenter \u003cerror27@gmail.com\u003e\nCloses: https://lore.kernel.org/linux-sound/aenFesLAStjrVNy8@stanley.mountain/T/#u\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260428130531.169600-1-rf@opensource.cirrus.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "b0e2333a231107adedd38c6fcfe1adc6162716fc", "tree": "dfe55fa1a9b86fb98c136abbcee7738627690ea4", "parents": [ "077c593dacf7ee33511468e4f29417d795cf07a4" ], "author": { "name": "wangdicheng", "email": "wangdicheng@kylinos.cn", "time": "Tue Apr 28 16:04:50 2026 +0800" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:49:44 2026 +0200" }, "message": "ALSA: hda/conexant: Fix missing error check for jack detection\n\nIn cx_probe(), the return value of snd_hda_jack_detect_enable_callback()\nis ignored. This function returns a pointer, and if it fails (e.g., due\nto memory allocation failure), it returns an error pointer which must\nbe checked using IS_ERR().\n\nIf the registration fails, the driver continues to probe, but the jack\ndetection callback will not be registered. This can lead to a kernel\ncrash later when the driver attempts to handle jack events or accesses\nthe uninitialized structure.\n\nCheck the return value using IS_ERR() and propagate the error via\nPTR_ERR() to the probe caller.\n\nFixes: 7aeb25908648 (\"ALSA: hda/conexant: Fix headset auto detect fail in cx8070 and SN6140\")\nSigned-off-by: wangdicheng \u003cwangdicheng@kylinos.cn\u003e\nLink: https://patch.msgid.link/20260428080450.108801-1-wangdich9700@163.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "077c593dacf7ee33511468e4f29417d795cf07a4", "tree": "d2871d6a61ff214c59f4d95afde9661aa8257ebd", "parents": [ "2d80392a97cf205a766d75539b4c814a4f5e7490" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Tue Apr 28 08:17:56 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:49:09 2026 +0200" }, "message": "ALSA: hda: Avoid WARN_ON() for HDMI chmap slot checks\n\nAt parsing the channel mapping for HDMI, the current code may spew\nWARN_ON() unnecessarily for the case where only invalid (zero) channel\nmaps are given from the hardware. Drop WARN_ON() and reorganize the\ncode a bit for avoiding the hdmi_slot over the array size.\n\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221390\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\nLink: https://patch.msgid.link/20260428061800.80527-1-tiwai@suse.de\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "2d80392a97cf205a766d75539b4c814a4f5e7490", "tree": "b0c5ae65cfb03bd245274f2313c5f521f590ebd7", "parents": [ "a7b75a11c6f16c049a2ea17cf9d1aaaa57201cf3" ], "author": { "name": "Abhinav Mahadevan", "email": "abhi220204@gmail.com", "time": "Tue Apr 28 21:20:00 2026 +0530" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:54 2026 +0200" }, "message": "ALSA: usb-audio: Fix quirk entry placement for PreSonus AudioBox USB\n\nThe quirk entry for PreSonus AudioBox USB was mistakenly placed inside\na disabled #if 0 block. Move it to the correct position after the\n\nFixes: 34fe4a9df247 (\"ALSA: usb-audio: Add quirk for PreSonus AudioBox USB\")\nSigned-off-by: Abhinav Mahadevan \u003cabhi220204@gmail.com\u003e\nLink: https://patch.msgid.link/20260428155117.5170-1-abhi220204@gmail.com\nSigned-off-by: Takashi Iwai \u003ctiwai@suse.de\u003e\n" }, { "commit": "a7b75a11c6f16c049a2ea17cf9d1aaaa57201cf3", "tree": "a156862cf2a94e17ab55ee8c17658c8f3b2b942f", "parents": [ "6e7247d8f5fefeceb0bb9cc80a5388a636b219cd", "03dcb5b68a96b51157ec2d17042fa2f0106828ae" ], "author": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:33 2026 +0200" }, "committer": { "name": "Takashi Iwai", "email": "tiwai@suse.de", "time": "Wed Apr 29 07:46:33 2026 +0200" }, "message": "Merge tag \u0027asoc-fix-v7.1-rc1\u0027 of https://git.kernel.org/pub/scm/linux/kernel/git/broonie/sound into for-linus\n\nASoC: Fixes for v7.1\n\nWe\u0027ve had quite a lot of fixes come in this past week, all driver stuff\nrather than any broad systematic issue. All quite routine stuff.\n" }, { "commit": "03dcb5b68a96b51157ec2d17042fa2f0106828ae", "tree": "3b04c2a0e2409b45c7e93876639e5bfb0dd4f959", "parents": [ "6b4afbaaa342eaa52172e0be5ef8d1fcbf9ff460" ], "author": { "name": "Troy Mitchell", "email": "troy.mitchell@linux.spacemit.com", "time": "Wed Apr 29 09:38:48 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 11:41:32 2026 +0900" }, "message": "ASoC: spacemit: adjust FIFO trigger threshold to half FIFO size\n\nSet both TX and RX FIFO trigger thresholds (TFT/RFT) to 0xF (half of\nthe 32-entry FIFO) instead of 5. This provides better DMA efficiency\nby allowing more data to accumulate before triggering a DMA request,\nreducing the number of DMA transactions needed.\n\nSigned-off-by: Troy Mitchell \u003ctroy.mitchell@linux.spacemit.com\u003e\nLink: https://patch.msgid.link/20260429-k3-i2s-v1-3-2fe99db11ecb@linux.spacemit.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "6b4afbaaa342eaa52172e0be5ef8d1fcbf9ff460", "tree": "9fa5eb2c0361d0dcf882fb1b8f76c95c0ad076c4", "parents": [ "a201aef1a88b675e9eb8487e27d14e2eef3cef80" ], "author": { "name": "Troy Mitchell", "email": "troy.mitchell@linux.spacemit.com", "time": "Wed Apr 29 09:38:47 2026 +0800" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 11:41:32 2026 +0900" }, "message": "ASoC: spacemit: move hw constraints from hw_params to startup\n\nHardware constraints should be applied in the startup callback rather\nthan hw_params, as hw_params may be called too late for the constraints\nto take effect properly.\n\nMove the channel count and format constraints for I2S and DSP_A/DSP_B\nmodes into a new startup callback. This also tightens the I2S mode\nchannel constraint from 1-2 to exactly 2, matching the actual hardware\nbehavior.\n\nSigned-off-by: Troy Mitchell \u003ctroy.mitchell@linux.spacemit.com\u003e\nLink: https://patch.msgid.link/20260429-k3-i2s-v1-2-2fe99db11ecb@linux.spacemit.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "0c7a5ba011d336df4fcd1f667fcc16ea5549be12", "tree": "fa86fec95728a585ba2eb119525e0eade1c3afb1", "parents": [ "21a7bb5cde5585aded53a47f21d6534d7da2ae48", "1774d3cf3cf17baaf30c095606cda496268283b3" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:29 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:29 2026 -0700" }, "message": "Merge branch \u0027mptcp-misc-fixes-for-v7-1-rc2\u0027\n\nMatthieu Baerts says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nmptcp: misc fixes for v7.1-rc2\n\nHere are various unrelated fixes:\n\n- Patches 1-2: set timestamp flags on \u0027ssk\u0027, not \u0027sk\u0027 (typo); Plus do\n that with sleepable lock_sock/release_sock. A fix for v5.14.\n\n- Patch 3: respect SO_LINGER(1, 0) by sending MP_FASTCLOSE at close time\n as expected. A fix for v6.1.\n\n- Patch 4: reset fullmesh counter after a flush. A fix for v6.19.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-0-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "1774d3cf3cf17baaf30c095606cda496268283b3", "tree": "fa86fec95728a585ba2eb119525e0eade1c3afb1", "parents": [ "f14d6e9c3678a067f304abba561e0c5446c7e845" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Mon Apr 27 21:54:36 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: pm: kernel: reset fullmesh counter after flush\n\nThis variable counts how many MPTCP endpoints have a \u0027fullmesh\u0027 flag\nset. After having flushed all MPTCP endpoints, it is then needed to\nreset this counter.\n\nWithout this reset, this counter exposed to the userspace is wrong, but\nalso non-fullmesh endpoints added after the flush will not be taken into\naccount to create subflows in reaction to ADD_ADDRs.\n\nFixes: f88191c7f361 (\"mptcp: pm: in-kernel: record fullmesh endp nb\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260422-mptcp-inc-limits-v6-0-903181771530%40kernel.org?part\u003d15\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-4-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "f14d6e9c3678a067f304abba561e0c5446c7e845", "tree": "5e0a4304d86aa2df8e73676c1bbb398c27b3a409", "parents": [ "b5c52908d52c6c8eb8933264aa6087a0600fd892" ], "author": { "name": "Matthieu Baerts (NGI0)", "email": "matttbe@kernel.org", "time": "Mon Apr 27 21:54:35 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: fastclose msk when linger time is 0\n\nThe SO_LINGER socket option has been supported for a while with MPTCP\nsockets [1], but it didn\u0027t cause the equivalent of a TCP reset as\nexpected when enabled and its time was set to 0. This was causing some\nbehavioural differences with TCP where some connections were not\npromptly stopped as expected.\n\nTo fix that, an extra condition is checked at close() time before\nsending an MP_FASTCLOSE, the MPTCP equivalent of a TCP reset.\n\nNote that backporting up to [1] will be difficult as more changes are\nneeded to be able to send MP_FASTCLOSE. It seems better to stop at [2],\nwhich was supposed to already imitate TCP.\n\nValidated with MPTCP packetdrill tests [3].\n\nFixes: 268b12387460 (\"mptcp: setsockopt: support SO_LINGER\") [1]\nFixes: d21f83485518 (\"mptcp: use fastclose on more edge scenarios\") [2]\nCc: stable@vger.kernel.org\nReported-by: Lance Tuller \u003clance@lance0.com\u003e\nCloses: https://github.com/lance0/xfr/pull/67\nLink: https://github.com/multipath-tcp/packetdrill/pull/196 [3]\nReviewed-by: Mat Martineau \u003cmartineau@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-3-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b5c52908d52c6c8eb8933264aa6087a0600fd892", "tree": "425819243d9dc066614e36b6670b6d0cf6498aa0", "parents": [ "5f95c21fc23a7ef22b4d27d1ed9bb55557ffb926" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Mon Apr 27 21:54:34 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: fix scheduling with atomic in timestamp sockopt\n\nUsing lock_sock_fast() (atomic context) around sock_set_timestamp()\nand sock_set_timestamping() is unsafe, as both helpers can sleep.\n\nReplace lock_sock_fast() with sleepable lock_sock()/release_sock()\nto avoid scheduling while atomic panic.\n\nFixes: 9061f24bf82e (\"mptcp: sockopt: propagate timestamp request to subflows\")\nCc: stable@vger.kernel.org\nReported-by: Sashiko \u003csashiko-bot@kernel.org\u003e\nCloses: https://sashiko.dev/#/patchset/20260420093343.16443-1-gang.yan@linux.dev\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-2-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "5f95c21fc23a7ef22b4d27d1ed9bb55557ffb926", "tree": "a83dfab44bf6e0f9bbb5008e1fec7ed8c776b170", "parents": [ "21a7bb5cde5585aded53a47f21d6534d7da2ae48" ], "author": { "name": "Gang Yan", "email": "yangang@kylinos.cn", "time": "Mon Apr 27 21:54:33 2026 +0200" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:36:27 2026 -0700" }, "message": "mptcp: sockopt: set timestamp flags on subflow socket, not msk\n\nBoth mptcp_setsockopt_sol_socket_tstamp() and\nmptcp_setsockopt_sol_socket_timestamping() iterate over subflows,\nacquire the subflow socket lock, but then erroneously pass the MPTCP\nmsk socket to sock_set_timestamp() / sock_set_timestamping() instead\nof the subflow ssk. As a result, the timestamp flags are set on the\nwrong socket and have no effect on the actual subflows.\n\nPass ssk instead of sk to both helpers.\n\nFixes: 9061f24bf82e (\"mptcp: sockopt: propagate timestamp request to subflows\")\nCc: stable@vger.kernel.org\nSigned-off-by: Gang Yan \u003cyangang@kylinos.cn\u003e\nReviewed-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nSigned-off-by: Matthieu Baerts (NGI0) \u003cmatttbe@kernel.org\u003e\nLink: https://patch.msgid.link/20260427-net-mptcp-misc-fixes-7-1-rc2-v1-1-7432b7f279fa@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "09942ddedcb960f9e78fd817ec33f501d1040c5b", "tree": "5b70b714e851c8c7708dee6ea1770c39c1e6fd59", "parents": [ "bed510e44095903ec3430861f18f7d7d30d30dc4" ], "author": { "name": "Qingfang Deng", "email": "qingfang.deng@linux.dev", "time": "Tue Apr 28 09:28:26 2026 +0800" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:31:10 2026 -0700" }, "message": "ppp: add PPPOX symbol\n\nAdd a dedicated CONFIG_PPPOX symbol to handle the PPPoX generic module,\navoiding redundant pppox.o definitions in the Makefile.\n\nSigned-off-by: Qingfang Deng \u003cqingfang.deng@linux.dev\u003e\nLink: https://patch.msgid.link/20260428012830.3069-1-qingfang.deng@linux.dev\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "21a7bb5cde5585aded53a47f21d6534d7da2ae48", "tree": "ae964878a6e357fd20a1ec407f94b79466f1f119", "parents": [ "403e7e34cc2ea75a2546c94176271591211b3334", "869cd6490fafe09c89a15d01610e8a03932d79f0" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:14 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:15 2026 -0700" }, "message": "Merge branch \u0027netconsole-configfs-store-callback-fixes\u0027\n\nBreno Leitao says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnetconsole: configfs store callback fixes\n\nThere are still some changes I want to make, such as, having the dynamic\nlock when reading from configfs (_show() callbacks), wich will solve\nother issues, but I will keep it for later.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-0-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "869cd6490fafe09c89a15d01610e8a03932d79f0", "tree": "ae964878a6e357fd20a1ec407f94b79466f1f119", "parents": [ "92ceb7bff62c2606f664c204750eca0b85d44112" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:38 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:12 2026 -0700" }, "message": "netconsole: restore userdatum value on update_userdata() failure\n\nuserdatum_value_store() updates udm-\u003evalue first and only then calls\nupdate_userdata() to rebuild the on-the-wire payload. If\nupdate_userdata() fails (e.g. -ENOMEM from kmalloc), the function\nreturns the error to userspace, but udm-\u003evalue already holds the new\nstring while the live nt-\u003euserdata buffer still reflects the old one.\n\nThe next successful write to any sibling userdatum on the same target\nwill call update_userdata() again, which walks every entry and packs\nthe now-stale udm-\u003evalue into the payload. The failed write is thus\nsilently activated later, with no indication to userspace that the\nvalue it tried to set was rejected.\n\nSnapshot the previous value before overwriting udm-\u003evalue and restore\nit if update_userdata() fails so the visible state and the active\npayload stay consistent.\n\nFixes: eb83801af2dc (\"netconsole: Dynamic allocation of userdata buffer\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-4-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "92ceb7bff62c2606f664c204750eca0b85d44112", "tree": "aa3b04733e17dc9c7fe6f20afcdcf539e37f892a", "parents": [ "e6dd94252b0fa7b4fcc00577c6898432c5d97a08" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:37 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: propagate device name truncation in dev_name_store()\n\ndev_name_store() calls strscpy(nt-\u003enp.dev_name, buf, IFNAMSIZ) without\nchecking the return value. If userspace writes an interface name longer\nthan IFNAMSIZ - 1, strscpy() silently truncates and returns -E2BIG, but\nthe function ignores it and reports a fully successful write back to\nuserspace.\n\nIf a real interface happens to match the truncated name, netconsole will\nbind to the wrong device on the next enable, sending kernel logs and\npanic output to an unintended network segment with no indication to\nuserspace that anything was rewritten.\n\nReject writes whose length cannot fit in nt-\u003enp.dev_name up front:\n\n\tif (count \u003e\u003d IFNAMSIZ)\n\t\treturn -ENAMETOOLONG;\n\nThis is not a big deal of a problem, but, it is still the correct\napproach.\n\nFixes: 0bcc1816188e57 (\"[NET] netconsole: Support dynamic reconfiguration using configfs\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-3-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "e6dd94252b0fa7b4fcc00577c6898432c5d97a08", "tree": "bdac07f9d060c38cde5b04ee96a91eea46962926", "parents": [ "d62c6f2df5c0e1390b9a1f45b1b52689e3f234f0" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:36 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: avoid clobbering userdatum value on truncated write\n\nuserdatum_value_store() bounds count by MAX_EXTRADATA_VALUE_LEN (200)\nand then copies straight into udm-\u003evalue, which is itself 200 bytes:\n\n\tif (count \u003e MAX_EXTRADATA_VALUE_LEN)\n\t\treturn -EMSGSIZE;\n\t...\n\tret \u003d strscpy(udm-\u003evalue, buf, sizeof(udm-\u003evalue));\n\tif (ret \u003c 0)\n\t\tgoto out_unlock;\n\nIf userspace writes exactly MAX_EXTRADATA_VALUE_LEN bytes with no NUL\nwithin them, strscpy() copies 199 bytes plus a NUL into udm-\u003evalue and\nreturns -E2BIG. The function jumps to out_unlock and reports the error\nto userspace, but udm-\u003evalue has already been overwritten with the\ntruncated string and update_userdata() is skipped, so the corruption\nis not yet visible on the wire.\n\nThe next successful write to any userdatum entry under the same target\ncalls update_userdata(), which packs udm-\u003evalue into the active\nnetconsole payload. From that point on, every netconsole message\ncarries the silently truncated value, and userspace has no indication\nthat a previous, error-returning write left state behind.\n\nTighten the entry check from \"count \u003e MAX_EXTRADATA_VALUE_LEN\" to\n\"count \u003e\u003d MAX_EXTRADATA_VALUE_LEN\". With count strictly less than\nsizeof(udm-\u003evalue), strscpy() can no longer return -E2BIG here, so\nthe corrupting truncation path is removed entirely.\n\nFixes: 8a6d5fec6c7f (\"net: netconsole: add a userdata config_group member to netconsole_target\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-2-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "d62c6f2df5c0e1390b9a1f45b1b52689e3f234f0", "tree": "f73aee2bc768541b38a67fbd6400afbede7f3c66", "parents": [ "403e7e34cc2ea75a2546c94176271591211b3334" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 27 07:30:35 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:28:11 2026 -0700" }, "message": "netconsole: return count instead of strnlen(buf, count) from store callbacks\n\nSeveral configfs store callbacks in netconsole end with:\n\n\tret \u003d strnlen(buf, count);\n\nThis under-reports the number of bytes consumed when the input\ncontains an embedded NUL within count, telling the VFS that fewer\nbytes were written than userspace actually handed in. A conformant\npartial-write loop would then retry the trailing bytes against a\ncallback that has already accepted them.\n\nEvery other configfs driver in the tree returns count directly from\nits store callbacks once parsing has succeeded, including\ndrivers/nvme/target/configfs.c, drivers/gpio/gpio-sim.c,\ndrivers/most/configfs.c, drivers/block/null_blk/main.c,\ndrivers/pci/endpoint/pci-ep-cfs.c, and the rest of the configfs\nusers. netconsole was the outlier (along with\ndrivers/infiniband/core/cma_configfs.c, which has the same latent\nissue).\n\nAlign netconsole with the rest of the configfs ecosystem: return\ncount once the parser/validator has accepted the input. The numeric\nand boolean parsers (kstrtobool, kstrtou16, mac_pton,\nnetpoll_parse_ip_addr) have already validated the meaningful prefix;\nany trailing bytes are padding and should simply be reported as\nconsumed.\n\nFixes: 0bcc1816188e (\"[NET] netconsole: Support dynamic reconfiguration using configfs\")\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nLink: https://patch.msgid.link/20260427-netconsole_ai_fixes-v2-1-59965f29d9cc@debian.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "403e7e34cc2ea75a2546c94176271591211b3334", "tree": "1a16997fcdd83c2e0e8430826d79f5e6a95c1855", "parents": [ "aa6c6d9ee064aabfede4402fd1283424e649ca19", "a6c95b833dc17e84d16a8ac0f40fd0931616a52d" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:53 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:54 2026 -0700" }, "message": "Merge branch \u0027net-sched-sch_cake-annotate-data-races-in-cake_dump_stats-series\u0027\n\nEric Dumazet says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nnet/sched: sch_cake: annotate data-races in cake_dump_stats() (series)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nThis mini series adds missing READ_ONCE()/WRITE_ONCE() annotations.\n\nOriginal patch was too big, splitting it eases code review.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260427083606.459355-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a6c95b833dc17e84d16a8ac0f40fd0931616a52d", "tree": "1a16997fcdd83c2e0e8430826d79f5e6a95c1855", "parents": [ "8fab48d87745a6ab1cec594b8d5865d9ae2db879" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:06 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:51 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (V)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this final patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor cparams.target and cparams.interval.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-6-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8fab48d87745a6ab1cec594b8d5865d9ae2db879", "tree": "4d41f028e3661c9bc3ba04e7cf857e0e012321f4", "parents": [ "276a98a434964088fccd4745db5b34d6e831e358" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:05 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:51 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (IV)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this fourth patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- avg_peak_bandwidth\n- buffer_limit\n- buffer_max_used\n- avg_netoff\n- max_netlen\n- max_adjlen\n- min_netlen\n- min_adjlen\n- active_queues\n- tin_rate_bps\n- bytes\n- tin_backlog\n\nOther annotations are added in following patch, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: Toke Høiland-Jørgensen \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-5-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "276a98a434964088fccd4745db5b34d6e831e358", "tree": "3fba48454fc969d0e977c23abeba8a3fbae54201", "parents": [ "91a96427b93b9ba27413077b7e825d2fefbfa134" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:04 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (III)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this third patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- packets\n- tin_dropped\n- tin_ecn_mark\n- ack_drops\n- peak_delay\n- avge_delay\n- base_delay\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-4-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "91a96427b93b9ba27413077b7e825d2fefbfa134", "tree": "d9306d11e118b261c14bc14c2dd07acc6468b6ea", "parents": [ "44967ac3785ebef6442377708925181d4a0eb1c8" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:03 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (II)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this second patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- bulk_flow_count\n- unresponsive_flow_count\n- max_skblen\n- flow_quantum\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-3-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "44967ac3785ebef6442377708925181d4a0eb1c8", "tree": "2dde8cb5dd3a428f613bcf31e371307b9323ee7f", "parents": [ "aa6c6d9ee064aabfede4402fd1283424e649ca19" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 08:36:02 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:27:50 2026 -0700" }, "message": "net/sched: sch_cake: annotate data-races in cake_dump_stats() (I)\n\ncake_dump_stats() runs without qdisc spinlock being held.\n\nIn this first patch, I add READ_ONCE()/WRITE_ONCE() annotations\nfor the following fields:\n\n- way_hits\n- way_misses\n- way_collisions\n- sparse_flow_count\n- decaying_flow_count\n\nOther annotations are added in following patches, to ease code review.\n\nFixes: 046f6fd5daef (\"sched: Add Common Applications Kept Enhanced (cake) qdisc\")\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nAcked-by: \"Toke Høiland-Jørgensen\" \u003ctoke@toke.dk\u003e\nLink: https://patch.msgid.link/20260427083606.459355-2-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "aa6c6d9ee064aabfede4402fd1283424e649ca19", "tree": "4f8990610b83b33e766f9fea6c14ec77e9aa017e", "parents": [ "dfb7e3b9a925262603867a4f1210717b347fb234" ], "author": { "name": "Weiming Shi", "email": "bestswngs@gmail.com", "time": "Sun Apr 26 09:53:51 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 18:16:53 2026 -0700" }, "message": "bareudp: fix NULL pointer dereference in bareudp_fill_metadata_dst()\n\nbareudp_fill_metadata_dst() passes bareudp-\u003esock to\nudp_tunnel6_dst_lookup() in the IPv6 path without a NULL check.\nThe socket is only created in bareudp_open() and NULLed in\nbareudp_stop(), so calling this function while the device is down\ntriggers a NULL dereference via sock-\u003esk.\n\n BUG: kernel NULL pointer dereference, address: 0000000000000018\n RIP: 0010:udp_tunnel6_dst_lookup (net/ipv6/ip6_udp_tunnel.c:160)\n Call Trace:\n \u003cTASK\u003e\n bareudp_fill_metadata_dst (drivers/net/bareudp.c:532)\n do_execute_actions (net/openvswitch/actions.c:901)\n ovs_execute_actions (net/openvswitch/actions.c:1589)\n ovs_packet_cmd_execute (net/openvswitch/datapath.c:700)\n genl_family_rcv_msg_doit (net/netlink/genetlink.c:1114)\n genl_rcv_msg (net/netlink/genetlink.c:1209)\n netlink_rcv_skb (net/netlink/af_netlink.c:2550)\n \u003c/TASK\u003e\n\nAdd a NULL check returning -ESHUTDOWN, consistent with the xmit paths\nin the same driver.\n\nFixes: 571912c69f0e (\"net: UDP tunnel encapsulation module for tunnelling different protocols like MPLS, IP, NSH etc.\")\nReported-by: Xiang Mei \u003cxmei5@asu.edu\u003e\nSigned-off-by: Weiming Shi \u003cbestswngs@gmail.com\u003e\nReviewed-by: Kuniyuki Iwashima \u003ckuniyu@google.com\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260426165350.1663137-2-bestswngs@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "dfb7e3b9a925262603867a4f1210717b347fb234", "tree": "0c28d88b3cdcf00c0a66b4ddb8cf0ce48893ad46", "parents": [ "b718342a7fbaa2dff5fefc31988c07af8c6cbc21", "8a92cb475ca90d84db769e4d4383e631ace0d6e5" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:22 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:23 2026 -0700" }, "message": "Merge branch \u0027sctp-fix-a-vtag-verification-failure-caused-by-stale-inits\u0027\n\nXin Long says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nsctp: fix a vtag verification failure caused by stale INITs\n\nSimilar to Scenario B in commit 8e56b063c865 ( netfilter: handle the\nconnecting collision properly in nf_conntrack_proto_sctp\"):\n\nScenario B: INIT_ACK is delayed until the peer completes its own handshake\n\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [COOKIE ECHO]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [COOKIE ACK]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *\n\nThere is another case:\n\nScenario F: INIT is delayed until the peer completes its own handshake\n\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n (OVS upcall)\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT] [init tag: 144230885]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT ACK] [init tag: 3922216408]\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [COOKIE ECHO]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [COOKIE ACK]\n 192.168.1.2 \u003e 192.168.1.1: sctp (1) [INIT] [init tag: 3922216408]\n (delayed)\n 192.168.1.1 \u003e 192.168.1.2: sctp (1) [INIT ACK] [init tag: 3914796021] *\n\nIn this case, the delayed INIT (e.g. due to OVS upcall) is recorded by\nconntrack, which prevents vtag verification from dropping the unexpected\nINIT-ACK in nf_conntrack_sctp_packet():\n\n vtag \u003d ct-\u003eproto.sctp.vtag[!dir];\n if (!ct-\u003eproto.sctp.init[!dir] \u0026\u0026 vtag \u0026\u0026 vtag !\u003d ih-\u003einit_tag)\n goto out_unlock;\n\nThis happens because ct-\u003eproto.sctp.init[!dir] is set by the delayed INIT,\neven though it is stale.\n\nFix this in two parts:\n\n- In netfilter: Do not record INITs whose init_tag matches the peer vtag,\n as they carry no new handshake state in the 1st patch.\n\n- In SCTP: Prevent endpoints from responding to such INITs with INIT-ACK,\n ensuring correctness even when middleboxes lack the netfilter fix in\n the 2nd patch.\n\nA follow-up selftest for this scenario will be posted in a separate patch\nby Yi Chen.\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/cover.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "8a92cb475ca90d84db769e4d4383e631ace0d6e5", "tree": "0c28d88b3cdcf00c0a66b4ddb8cf0ce48893ad46", "parents": [ "576a5d2bad4814c881a829576b1261b9b8159d2b" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Sun Apr 26 10:46:41 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:19 2026 -0700" }, "message": "sctp: discard stale INIT after handshake completion\n\nAfter an association reaches ESTABLISHED, the peer’s init_tag is already\nknown from the handshake. Any subsequent INIT with the same init_tag is\nnot a valid restart, but a delayed or duplicate INIT.\n\nDrop such INIT chunks in sctp_sf_do_unexpected_init() instead of\nprocessing them as new association attempts.\n\nFixes: 1da177e4c3f4 (\"Linux-2.6.12-rc2\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nAcked-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nLink: https://patch.msgid.link/5788c76c1ee122a3ed00189e88dcf9df1fba226c.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "576a5d2bad4814c881a829576b1261b9b8159d2b", "tree": "9ba438fc3ab1bd9c16f7f26d98fae9c909b39123", "parents": [ "b718342a7fbaa2dff5fefc31988c07af8c6cbc21" ], "author": { "name": "Xin Long", "email": "lucien.xin@gmail.com", "time": "Sun Apr 26 10:46:40 2026 -0400" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:52:19 2026 -0700" }, "message": "netfilter: skip recording stale or retransmitted INIT\n\nAn INIT whose init_tag matches the peer\u0027s vtag does not provide new state\ninformation. It indicates either:\n\n- a stale INIT (after INIT-ACK has already been seen on the same side), or\n- a retransmitted INIT (after INIT has already been recorded on the same\n side).\n\nIn both cases, the INIT must not update ct-\u003eproto.sctp.init[] state, since\nit does not advance the handshake tracking and may otherwise corrupt\nINIT/INIT-ACK validation logic.\n\nAllow INIT processing only when the conntrack entry is newly created\n(SCTP_CONNTRACK_NONE), or when the init_tag differs from the stored peer\nvtag.\n\nNote it skips the check for the ct with old_state SCTP_CONNTRACK_NONE in\nnf_conntrack_sctp_packet(), as it is just created in sctp_new() where it\nset ct-\u003eproto.sctp.vtag[IP_CT_DIR_REPLY] \u003d ih-\u003einit_tag.\n\nFixes: 9fb9cbb1082d (\"[NETFILTER]: Add nf_conntrack subsystem.\")\nSigned-off-by: Xin Long \u003clucien.xin@gmail.com\u003e\nReviewed-by: Marcelo Ricardo Leitner \u003cmarcelo.leitner@gmail.com\u003e\nAcked-by: Florian Westphal \u003cfw@strlen.de\u003e\nLink: https://patch.msgid.link/ee56c3e416452b2a40589a2a85245ac2ad5e9f4b.1777214801.git.lucien.xin@gmail.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "a201aef1a88b675e9eb8487e27d14e2eef3cef80", "tree": "3688865ea958637280540768d7e337c31f29d1be", "parents": [ "be102efb832ef7e30e4cd4c2edf22bbf64ddf35a" ], "author": { "name": "Christian A. Ehrhardt", "email": "christian.ehrhardt@codasip.com", "time": "Tue Apr 28 21:22:49 2026 +0200" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 09:47:39 2026 +0900" }, "message": "ASoC: codecs: ab8500: Fix casting of private data\n\nab8500_filter_controls[i].private_value is initialized using\n\n\t.private_value \u003d (unsigned long)\u0026(struct filter_control)\n\t\t{.count \u003d xcount, .min \u003d xmin, .max \u003d xmax}\n\nthus it\u0027s a pointer to a struct filter_control casted to unsigned long.\n\nSo to get back that pointer .private_data must be cast back, not its\naddress.\n\nFixes: 679d7abdc754 (\"ASoC: codecs: Add AB8500 codec-driver\")\nSigned-off-by: Christian A. Ehrhardt \u003cchristian.ehrhardt@codasip.com\u003e\nSigned-off-by: Uwe Kleine-König (The Capable Hub) \u003cu.kleine-koenig@baylibre.com\u003e\nLink: https://patch.msgid.link/20260428192255.2294705-2-u.kleine-koenig@baylibre.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "bed510e44095903ec3430861f18f7d7d30d30dc4", "tree": "4b2cc20e816de757a9a33fc0d47a7c63211a6eea", "parents": [ "790ead9394860e7d70c5e0e50a35b243e909a618" ], "author": { "name": "Eric Dumazet", "email": "edumazet@google.com", "time": "Mon Apr 27 09:10:16 2026 +0000" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:45:21 2026 -0700" }, "message": "net: dummy: do not acquire RTNL for too long\n\nInstead of holding RTNL for an arbitrary amount of time,\ncall register_netdev() for each dummy device created\nat module loading time.\n\nTested:\n\nmodprobe dummy numdummies\u003d10000\n\nSigned-off-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/20260427091016.737015-1-edumazet@google.com\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b718342a7fbaa2dff5fefc31988c07af8c6cbc21", "tree": "5a9912a82d45107ae363a3f9f603db8b3882865b", "parents": [ "b89769f936a8fa9e66de72ddc1b71a9745a488e6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 12:58:56 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:44:20 2026 -0700" }, "message": "net: psp: require admin permission for dev-set and key-rotate\n\nThe dev-set and key-rotate netlink operations modify shared device\nstate (PSP version configuration and cryptographic key material,\nrespectively) but do not require CAP_NET_ADMIN. The only access\ncontrol is psp_dev_check_access() which merely verifies netns\nmembership.\n\nFixes: 00c94ca2b99e (\"psp: base PSP device support\")\nReviewed-by: Daniel Zahka \u003cdaniel.zahka@gmail.com\u003e\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260427195856.401223-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "b89769f936a8fa9e66de72ddc1b71a9745a488e6", "tree": "490816c0380f1e23f37a44f4f08cc298335d9e2c", "parents": [ "67d7ae3340cae0a18ec1d53a2fce198c31a211b8" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Mon Apr 27 12:06:06 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:43:32 2026 -0700" }, "message": "net: psp: check for device unregister when creating assoc\n\npsp_assoc_device_get_locked() obtains a psp_dev reference via\npsp_dev_get_for_sock() (which uses psp_dev_tryget() under RCU);\nit then acquires psd-\u003elock and drops the reference. Before\nthe lock is taken, psp_dev_unregister() can run to completion:\ntake psd-\u003elock, clear out state, unlock, drop the registration\nreference.\n\nThe expectation is that the lock prevents device unregistration,\nbut much like with netdevs special care has to be taken when\n\"upgrading\" a reference to a locked device. Add the missing\ncheck if device is still alive. psp_dev_is_registered() exists\nalready but had no callers, which makes me wonder if I either\nforgot to add this or lost the check during refactoring...\n\nReported-by: Yiming Qian \u003cyimingqian591@gmail.com\u003e\nFixes: 6b46ca260e22 (\"net: psp: add socket security association code\")\nReviewed-by: Willem de Bruijn \u003cwillemb@google.com\u003e\nLink: https://patch.msgid.link/20260427190606.366101-1-kuba@kernel.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "67d7ae3340cae0a18ec1d53a2fce198c31a211b8", "tree": "aad3431cf21c685c4fd0ee9dd3cd01d60b791fbd", "parents": [ "46f74a3f7d57d9cc0110b09cbc8163fa0a01afa2", "8cf6809cddcbe301aedfc6b51bcd4944d45795f6" ], "author": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:41:05 2026 -0700" }, "committer": { "name": "Jakub Kicinski", "email": "kuba@kernel.org", "time": "Tue Apr 28 17:41:06 2026 -0700" }, "message": "Merge tag \u0027nf-26-04-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf\n\nPablo Neira Ayuso says:\n\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\nNetfilter fixes for net\n\nThe following patchset contains Netfilter fixes for net:\n\n1) IEEE1394 ARP payload contains no target hardware address in the\n ARP packet. Apparently, arp_tables was never updated to deal with\n IEEE1394 ARP properly. To deal with this, return no match in case\n the target hardware address selector is used, either for inverse or\n normal match. Moreover, arpt_mangle disallows mangling of the target\n hardware and IP address because, it is not worth to adjust the\n offset calculation to fix this, we suspect no users of arp_tables\n for this family.\n\n2) Use list_del_rcu() to delete device hooks in nf_tables, this hook\n list is RCU protected, concurrent netlink dump readers can be\n walking on this list, fix it by adding a helper function and use it\n for consistency. From Florian Westphal.\n\n3) Add list_splice_rcu(), this is useful for joining the local list of\n new device hooks to the RCU protected hook list in chain and\n flowtable. Reviewed by Paul E. McKenney.\n\n4) Use list_splice_rcu() to publish the new device hooks in chain and\n flowtable to fix concurrent netlink dump traversal.\n\n5) Add a new hook transaction object to track device hook deletions.\n The current approach moves device hooks to be deleted around during\n the preparation phase, this breaks concurrent RCU reader via netlink\n dump. This new hook transaction is combined with NFT_HOOK_REMOVE\n flag to annotate hooks for removal in the preparation phase.\n\n6) xt_policy inbound policy check in strict mode can lead to\n out-of-bound access of the secpath array due to incorrect.\n The iteration over the secpath needs to be reversed in the inbound\n to check for the human readable policy, expecting inner in first\n position and outer in second position, the secpath from inbound\n actually stores outer in first position then in second position.\n From Jiexun Wang.\n\n7) Fix possible zero shift in nft_bitwise triggering UBSAN splat,\n reject zero shift from control plane, from Kai Ma.\n\n8) Replace simple_strtoul() in the conntrack SIP helper since it relies\n on nul-terminated strings. From Florian Westphal.\n\n* tag \u0027nf-26-04-28\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:\n netfilter: nf_conntrack_sip: don\u0027t use simple_strtoul\n netfilter: reject zero shift in nft_bitwise\n netfilter: xt_policy: fix strict mode inbound policy matching\n netfilter: nf_tables: add hook transactions for device deletions\n netfilter: nf_tables: join hook list via splice_list_rcu() in commit phase\n rculist: add list_splice_rcu() for private lists\n netfilter: nf_tables: use list_del_rcu for netlink hooks\n netfilter: arp_tables: fix IEEE1394 ARP payload parsing\n\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\u003d\n\nLink: https://patch.msgid.link/20260428095840.51961-1-pablo@netfilter.org\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n" }, { "commit": "be102efb832ef7e30e4cd4c2edf22bbf64ddf35a", "tree": "d633a78e56579a4a6b84ad38e3544923fc4917d9", "parents": [ "13d30682e8dee191ac04e93642f0372a723e8b0c" ], "author": { "name": "Richard Fitzgerald", "email": "rf@opensource.cirrus.com", "time": "Tue Apr 28 12:52:28 2026 +0100" }, "committer": { "name": "Mark Brown", "email": "broonie@kernel.org", "time": "Wed Apr 29 08:41:14 2026 +0900" }, "message": "ASoC: cs35l56: Fix illegal writes to OTP_MEM registers\n\nMark the OTP_MEM registers as volatile so that regcache_sync() will not\nattempt to write to them.\n\nThese registers hold a constant, and originally they were marked as\nreadable non-volatile so that this value would be read into the regmap\ncache. The problem with this is regcache_sync() issues a write for any\ncached register that does not have a reg_default.\n\nThough these registers are constants and writing them in normal use\ncannot change OTP, it is illegal for the host to write to them.\n\nFixes: e1830f66f6c6 (\"ASoC: cs35l56: Add helper functions for amp calibration\")\nSigned-off-by: Richard Fitzgerald \u003crf@opensource.cirrus.com\u003e\nLink: https://patch.msgid.link/20260428115228.158252-1-rf@opensource.cirrus.com\nSigned-off-by: Mark Brown \u003cbroonie@kernel.org\u003e\n" }, { "commit": "664f0f6be37ce4ef80992cf2ed74761cd5bbe207", "tree": "7e2714963b58fa6732df54be5685588158ec2a51", "parents": [ "dca922e019dd758b4c1b4bec8f1d509efddeaab4", "d99f7a32f09dccbe396187370ec1a74a31b73d7e" ], "author": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "committer": { "name": "Linus Torvalds", "email": "torvalds@linux-foundation.org", "time": "Tue Apr 28 16:26:11 2026 -0700" }, "message": "Merge tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext\n\nPull sched_ext fixes from Tejun Heo:\n \"The merge window pulled in the cgroup sub-scheduler infrastructure,\n and new AI reviews are accelerating bug reporting and fixing - hence\n the larger than usual fixes batch:\n\n - Use-after-frees during scheduler load/unload:\n - The disable path could free the BPF scheduler while deferred\n irq_work / kthread work was still in flight\n - cgroup setter callbacks read the active scheduler outside the\n rwsem that synchronizes against teardown\n Fix both, and reuse the disable drain in the enable error paths so\n the BPF JIT page can\u0027t be freed under live callbacks.\n\n - Several BPF op invocations didn\u0027t tell the framework which runqueue\n was already locked, so helper kfuncs that re-acquire the runqueue\n by CPU could deadlock on the held lock\n\n Fix the affected callsites, including recursive parent-into-child\n dispatch.\n\n - The hardlockup notifier ran from NMI but eventually took a\n non-NMI-safe lock. Bounce it through irq_work.\n\n - A handful of bugs in the new sub-scheduler hierarchy:\n - helper kfuncs hard-coded the root instead of resolving the\n caller\u0027s scheduler\n - the enable error path tried to disable per-task state that had\n never been initialized, and leaked cpus_read_lock on the way\n out\n - a sysfs object was leaked on every load/unload\n - the dispatch fast-path used the root scheduler instead of the\n task\u0027s\n - a couple of CONFIG #ifdef guards were misclassified\n\n - Verifier-time hardening: BPF programs of unrelated struct_ops types\n (e.g. tcp_congestion_ops) could call sched_ext kfuncs - a semantic\n bug and, once sub-sched was enabled, a KASAN out-of-bounds read.\n Now rejected at load. Plus a few NULL and cross-task argument\n checks on sched_ext kfuncs, and a selftest covering the new deny.\n\n - rhashtable (Herbert): restore the insecure_elasticity toggle and\n bounce the deferred-resize kick through irq_work to break a\n lock-order cycle observable from raw-spinlock callers. sched_ext\u0027s\n scheduler-instance hash is the first user of both.\n\n - The bypass-mode load balancer used file-scope cpumasks; with\n multiple scheduler instances now possible, those raced. Move to\n per-instance cpumasks, plus a follow-up to skip tasks whose\n recorded CPU is stale relative to the new owning runqueue.\n\n - Smaller fixes:\n - a dispatch queue\u0027s first-task tracking misbehaved when a parked\n iterator cursor sat in the list\n - the runqueue\u0027s next-class wasn\u0027t promoted on local-queue\n enqueue, leaving an SCX task behind RT in edge cases\n - the reference qmap scheduler stopped erroring on legitimate\n cross-scheduler task-storage misses\"\n\n* tag \u0027sched_ext-for-7.1-rc1-fixes\u0027 of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext: (26 commits)\n sched_ext: Fix scx_flush_disable_work() UAF race\n sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n sched_ext: Release cpus_read_lock on scx_link_sched() failure in root enable\n sched_ext: Reject NULL-sch callers in scx_bpf_task_set_slice/dsq_vtime\n sched_ext: Refuse cross-task select_cpu_from_kfunc calls\n sched_ext: Align cgroup #ifdef guards with SUB_SCHED vs GROUP_SCHED\n sched_ext: Make bypass LB cpumasks per-scheduler\n sched_ext: Pass held rq to SCX_CALL_OP() for core_sched_before\n sched_ext: Pass held rq to SCX_CALL_OP() for dump_cpu/dump_task\n sched_ext: Save and restore scx_locked_rq across SCX_CALL_OP\n sched_ext: Use dsq-\u003efirst_task instead of list_empty() in dispatch_enqueue() FIFO-tail\n sched_ext: Resolve caller\u0027s scheduler in scx_bpf_destroy_dsq() / scx_bpf_dsq_nr_queued()\n sched_ext: Read scx_root under scx_cgroup_ops_rwsem in cgroup setters\n sched_ext: Don\u0027t disable tasks in scx_sub_enable_workfn() abort path\n sched_ext: Skip tasks with stale task_rq in bypass_lb_cpu()\n sched_ext: Guard scx_dsq_move() against NULL kit-\u003edsq after failed iter_new\n sched_ext: Unregister sub_kset on scheduler disable\n sched_ext: Defer scx_hardlockup() out of NMI\n sched_ext: sync disable_irq_work in bpf_scx_unreg()\n sched_ext: Fix local_dsq_post_enq() to use task\u0027s scheduler in sub-sched\n ...\n" }, { "commit": "5ec07d5204b4544271f32f6261ee097fe53cb081", "tree": "aea41e260d471234fef4a09d02479ffe4439b1fe", "parents": [ "3b75dd76e64a04771861bb5647951c264919e563" ], "author": { "name": "Sheng Che Peng", "email": "synte4028@gmail.com", "time": "Wed Apr 22 10:18:19 2026 +0800" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 14:28:29 2026 -0400" }, "message": "tracepoint: Fix typo in tracepoint.h comment\n\nChange \"my\" to \"may\" in the description of subsystem configurations.\n\nLink: https://patch.msgid.link/20260422021819.1788091-1-synte4028@gmail.com\nSigned-off-by: Sheng Che Peng \u003csynte4028@gmail.com\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "3b75dd76e64a04771861bb5647951c264919e563", "tree": "27e8045c5332240d71c921fcd22a44998b93df78", "parents": [ "254f49634ee16a731174d2ae34bc50bd5f45e731" ], "author": { "name": "Breno Leitao", "email": "leitao@debian.org", "time": "Mon Apr 20 06:25:09 2026 -0700" }, "committer": { "name": "Steven Rostedt", "email": "rostedt@goodmis.org", "time": "Tue Apr 28 14:28:29 2026 -0400" }, "message": "tracing: branch: Fix inverted check on stat tracer registration\n\ninit_annotated_branch_stats() and all_annotated_branch_stats() check the\nreturn value of register_stat_tracer() with \"if (!ret)\", but\nregister_stat_tracer() returns 0 on success and a negative errno on\nfailure. The inverted check causes the warning to be printed on every\nsuccessful registration, e.g.:\n\n Warning: could not register annotated branches stats\n\nwhile leaving real failures silent. The initcall also returned a\nhard-coded 1 instead of the actual error.\n\nInvert the check and propagate ret so that the warning fires on real\nerrors and the initcall reports the correct status.\n\nCc: Mathieu Desnoyers \u003cmathieu.desnoyers@efficios.com\u003e\nCc: Ingo Molnar \u003cmingo@elte.hu\u003e\nCc: Frederic Weisbecker \u003cfweisbec@gmail.com\u003e\nLink: https://patch.msgid.link/20260420-tracing-v1-1-d8f4cd0d6af1@debian.org\nFixes: 002bb86d8d42 (\"tracing/ftrace: separate events tracing and stats tracing engine\")\nSigned-off-by: Breno Leitao \u003cleitao@debian.org\u003e\nAcked-by: Masami Hiramatsu (Google) \u003cmhiramat@kernel.org\u003e\nSigned-off-by: Steven Rostedt \u003crostedt@goodmis.org\u003e\n" }, { "commit": "d99f7a32f09dccbe396187370ec1a74a31b73d7e", "tree": "54a5a52b58b3ce0f5cb550bb4a93da8681bb34c9", "parents": [ "163f8b7f9a84086c67c76aeadc04e6d43e32df6e" ], "author": { "name": "Cheng-Yang Chou", "email": "yphbchou0911@gmail.com", "time": "Wed Apr 29 01:36:12 2026 +0800" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 07:40:03 2026 -1000" }, "message": "sched_ext: Fix scx_flush_disable_work() UAF race\n\nscx_flush_disable_work() calls irq_work_sync() followed by\nkthread_flush_work() to ensure that the disable kthread work has\nfully completed before bpf_scx_unreg() frees the SCX scheduler.\n\nHowever, a concurrent scx_vexit() (e.g., triggered by a watchdog stall)\ncreates a race window between scx_claim_exit() and irq_work_queue():\n\n CPU A (scx_vexit (watchdog)) CPU B (bpf_scx_unreg)\n ---- ----\n scx_claim_exit()\n atomic_try_cmpxchg(NONE-\u003ekind)\n stack_trace_save()\n vscnprintf()\n scx_disable()\n scx_claim_exit() -\u003e FAIL\n scx_flush_disable_work()\n irq_work_sync() // no-op: not queued yet\n kthread_flush_work() // no-op: not queued yet\n kobject_put(\u0026sch-\u003ekobj) -\u003e free %sch\n irq_work_queue() -\u003e UAF on %sch\n scx_disable_irq_workfn()\n kthread_queue_work() -\u003e UAF\n\nThe root cause is that CPU B\u0027s scx_flush_disable_work() returns after\nsyncing an irq_work that has not yet been queued, while CPU A is still\nexecuting the code between scx_claim_exit() and irq_work_queue().\n\nLoop until exit_kind reaches SCX_EXIT_DONE or SCX_EXIT_NONE, draining\ndisable_irq_work and disable_work in each pass. This ensures that any\nwork queued after the previous check is caught, while also correctly\nhandling cases where no disable was triggered (e.g., the\nscx_sub_enable_workfn() abort path).\n\nFixes: 510a27055446 (\"sched_ext: sync disable_irq_work in bpf_scx_unreg()\")\nReported-by: https://sashiko.dev/#/patchset/20260424100221.32407-1-icheng%40nvidia.com\nSuggested-by: Tejun Heo \u003ctj@kernel.org\u003e\nSigned-off-by: Cheng-Yang Chou \u003cyphbchou0911@gmail.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "163f8b7f9a84086c67c76aeadc04e6d43e32df6e", "tree": "571d82152fb8e08455663c68d3b6dae14e8dc875", "parents": [ "deb7b2f93d0129b79425f830a1e5e7e1bb2c4973" ], "author": { "name": "Kuba Piecuch", "email": "jpiecuch@google.com", "time": "Tue Apr 28 12:46:01 2026 +0000" }, "committer": { "name": "Tejun Heo", "email": "tj@kernel.org", "time": "Tue Apr 28 06:28:48 2026 -1000" }, "message": "sched_ext: Call wakeup_preempt() in local_dsq_post_enq()\n\nThere are several edge cases (see linked thread) where an IMMED task\ncan be left lingering on a local DSQ if an RT task swoops in at the\nwrong time. All of these edge cases are due to rq-\u003enext_class being idle\neven after dispatching a task to rq\u0027s local DSQ. We should bump\nrq-\u003enext_class to \u0026ext_sched_class as soon as we\u0027ve inserted a task into\nthe local DSQ.\n\nTo optimize the common case of rq-\u003enext_class \u003d\u003d \u0026ext_sched_class,\nonly call wakeup_preempt() if rq-\u003enext_class is below EXT. If next_class\nis EXT or above, wakeup_preempt() is a no-op anyway.\n\nThis lets us also simplify the preempt_curr() logic a bit since\nwakeup_preempt() will call preempt_curr() for us if next_class is\nbelow EXT.\n\nLink: https://lore.kernel.org/all/DHZPHUFXB4N3.2RY28MUEWBNYK@google.com/\nSigned-off-by: Kuba Piecuch \u003cjpiecuch@google.com\u003e\nSigned-off-by: Tejun Heo \u003ctj@kernel.org\u003e\n" }, { "commit": "46f74a3f7d57d9cc0110b09cbc8163fa0a01afa2", "tree": "f59e7a83a1df420450d1af94affbcbab52bd6fe3", "parents": [ "4ca07b9239bd0478ae586632a2ed72be37ed8407" ], "author": { "name": "Heiko Schocher", "email": "hs@nabladev.com", "time": "Sat Apr 25 05:13:39 2026 +0200" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 15:51:55 2026 +0200" }, "message": "net: phy: dp83869: fix setting CLK_O_SEL field.\n\nTable 7-121 in datasheet says we have to set register 0xc6\nto value 0x10 before CLK_O_SEL can be modified. No more infos\nabout this field found in datasheet. With this fix, setting\nof CLK_O_SEL field in IO_MUX_CFG register worked through dts\nproperty \"ti,clk-output-sel\" on a DP83869HMRGZR.\n\nSigned-off-by: Heiko Schocher \u003chs@nabladev.com\u003e\nReviewed-by: Simon Horman \u003chorms@kernel.org\u003e\nFixes: 01db923e8377 (\"net: phy: dp83869: Add TI dp83869 phy\")\nLink: https://patch.msgid.link/20260425031339.3318-1-hs@nabladev.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "4ca07b9239bd0478ae586632a2ed72be37ed8407", "tree": "3c7827139d70c8e27aa954e2fbd697564cc522b0", "parents": [ "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8" ], "author": { "name": "William A. Kennington III", "email": "william@wkennington.com", "time": "Thu Apr 23 00:46:52 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 13:11:53 2026 +0200" }, "message": "net: mctp i2c: check length before marking flow active\n\nCurrently, mctp_i2c_get_tx_flow_state() is called before the packet length\nsanity check. This function marks a new flow as active in the MCTP core.\n\nIf the sanity check fails, mctp_i2c_xmit() returns early without calling\nmctp_i2c_lock_nest(). This results in a mismatched locking state: the\nflow is active, but the I2C bus lock was never acquired for it.\n\nWhen the flow is later released, mctp_i2c_release_flow() will see the\nactive state and queue an unlock marker. The TX thread will then\ndecrement midev-\u003ei2c_lock_count from 0, causing it to underflow to -1.\n\nThis underflow permanently breaks the driver\u0027s locking logic, allowing\nfuture transmissions to occur without holding the I2C bus lock, leading\nto bus collisions and potential hardware hangs.\n\nMove the mctp_i2c_get_tx_flow_state() call to after the length sanity\ncheck to ensure we only transition the flow state if we are actually\ngoing to proceed with the transmission and locking.\n\nFixes: f5b8abf9fc3d (\"mctp i2c: MCTP I2C binding driver\")\nSigned-off-by: William A. Kennington III \u003cwilliam@wkennington.com\u003e\nAcked-by: Jeremy Kerr \u003cjk@codeconstruct.com.au\u003e\nLink: https://patch.msgid.link/20260423074741.201460-1-william@wkennington.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" }, { "commit": "0bb05e6adfa99a2ea1fee1125cc0953409f83ed8", "tree": "f9acc5596db6383fe33e839bb85e718df3c19c85", "parents": [ "f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e" ], "author": { "name": "Sam Edwards", "email": "cfsworks@gmail.com", "time": "Tue Apr 21 21:45:03 2026 -0700" }, "committer": { "name": "Paolo Abeni", "email": "pabeni@redhat.com", "time": "Tue Apr 28 12:26:20 2026 +0200" }, "message": "net: stmmac: Prevent NULL deref when RX memory exhausted\n\nThe CPU receives frames from the MAC through conventional DMA: the CPU\nallocates buffers for the MAC, then the MAC fills them and returns\nownership to the CPU. For each hardware RX queue, the CPU and MAC\ncoordinate through a shared ring array of DMA descriptors: one\ndescriptor per DMA buffer. Each descriptor includes the buffer\u0027s\nphysical address and a status flag (\"OWN\") indicating which side owns\nthe buffer: OWN\u003d0 for CPU, OWN\u003d1 for MAC. The CPU is only allowed to set\nthe flag and the MAC is only allowed to clear it, and both must move\nthrough the ring in sequence: thus the ring is used for both\n\"submissions\" and \"completions.\"\n\nIn the stmmac driver, stmmac_rx() bookmarks its position in the ring\nwith the `cur_rx` index. The main receive loop in that function checks\nfor rx_descs[cur_rx].own\u003d0, gives the corresponding buffer to the\nnetwork stack (NULLing the pointer), and increments `cur_rx` modulo the\nring size. After the loop exits, stmmac_rx_refill(), which bookmarks its\nposition with `dirty_rx`, allocates fresh buffers and rearms the\ndescriptors (setting OWN\u003d1). If it fails any allocation, it simply stops\nearly (leaving OWN\u003d0) and will retry where it left off when next called.\n\nThis means descriptors have a three-stage lifecycle (terms my own):\n- `empty` (OWN\u003d1, buffer valid)\n- `full` (OWN\u003d0, buffer valid and populated)\n- `dirty` (OWN\u003d0, buffer NULL)\n\nBut because stmmac_rx() only checks OWN, it confuses `full`/`dirty`. In\nthe past (see \u0027Fixes:\u0027), there was a bug where the loop could cycle\n`cur_rx` all the way back to the first descriptor it dirtied, resulting\nin a NULL dereference when mistaken for `full`. The aforementioned\ncommit resolved that *specific* failure by capping the loop\u0027s iteration\nlimit at `dma_rx_size - 1`, but this is only a partial fix: if the\nprevious stmmac_rx_refill() didn\u0027t complete, then there are leftover\n`dirty` descriptors that the loop might encounter without needing to\ncycle fully around. The current code therefore panics (see \u0027Closes:\u0027)\nwhen stmmac_rx_refill() is memory-starved long enough for `cur_rx` to\ncatch up to `dirty_rx`.\n\nFix this by explicitly checking, before advancing `cur_rx`, if the next\nentry is dirty; exit the loop if so. This prevents processing of the\nfinal, used descriptor until stmmac_rx_refill() succeeds, but\nfully prevents the `cur_rx \u003d\u003d dirty_rx` ambiguity as the previous bugfix\nintended: so remove the clamp as well. Since stmmac_rx_zc() is a\ncopy-paste-and-tweak of stmmac_rx() and the code structure is identical,\nany fix to stmmac_rx() will also need a corresponding fix for\nstmmac_rx_zc(). Therefore, apply the same check there.\n\nIn stmmac_rx() (not stmmac_rx_zc()), a related bug remains: after the\nMAC sets OWN\u003d0 on the final descriptor, it will be unable to send any\nfurther DMA-complete IRQs until it\u0027s given more `empty` descriptors.\nCurrently, the driver simply *hopes* that the next stmmac_rx_refill()\nsucceeds, risking an indefinite stall of the receive process if not. But\nthis is not a regression, so it can be addressed in a future change.\n\nFixes: b6cb4541853c7 (\"net: stmmac: avoid rx queue overrun\")\nCloses: https://bugzilla.kernel.org/show_bug.cgi?id\u003d221010\nCc: stable@vger.kernel.org\nSuggested-by: Russell King \u003clinux@armlinux.org.uk\u003e\nSigned-off-by: Sam Edwards \u003cCFSworks@gmail.com\u003e\nLink: https://patch.msgid.link/20260422044503.5349-1-CFSworks@gmail.com\nSigned-off-by: Paolo Abeni \u003cpabeni@redhat.com\u003e\n" } ], "next": "f9c52a6ba9780bd27e0bf4c044fd91c13c778b6e" }