github-mirror/linux
1
0
Fork 0
mirror of https://github.com/torvalds/linux.git synced 2026-09-14 16:10:02 +02:00
Code Issues Actions Packages Projects Releases Wiki Activity Graph
1,463,162 Commits 1 Branch 946 Tags 16 GiB
0461ba9a79
Commit Graph

54241 Commits

Author SHA1 Message Date
Linus Torvalds
c10dc5c03e Misc perf events fixes: 
- Fix a perf_event_attr::remove_on_exec bug for group
    events (Taeyang Lee)
 
  - Fix uprobes CALL emulation interaction with shadow stacks,
    and add a testcase for this (David Windsor)
 
  - Fix uprobes unregister bug (Jiri Olsa)
 
 Signed-off-by: Ingo Molnar <mingo@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEBpT5eoXrXCwVQwEKEnMQ0APhK1gFAmpKCX8RHG1pbmdvQGtl
 cm5lbC5vcmcACgkQEnMQ0APhK1hwJRAAne1HniwuV9PV2GQHNKipeKV320tod2iR
 WY9yy9ez5WJbPttS7Fy28NobQKxuTanNWnAJqqM3TJF0tPPSrrYqkhAGrpEb2ab0
 G7gl4KlrO//5kKTZnnI86t/quSV5BDt00UUdMBFp+hbNYXNul5/AeUxqMhNoGqB6
 DpJHrV+7kNQZ4I7tjatYWL11hZHpEhrx4QWLUsnd+nDwddpmdsRNXVZwpGh9+Dh4
 +XXcgLD7M8FqNFN3GCVfhJKO8x8HRaBWv3FHeGqbCUL9k5viWcn+N91IbrcPVat1
 HBk0JDtpLK286WHLFy7uROafCA59AlYp5DX7mobXi0VF1FdMqPtjaXEsZM7Ng/P5
 /tpbV5P4irrUnMSCEDSDzqZJWXbcBSqCJ9p6z5/Tjzo3VegHyrXe29wjVoqvXjLx
 og/9OnPZv/2QEsE37rBRwNC889ihFMUDZh3T+uUc1YKUEwYWFXwtUECTg+0Oi+lL
 mLTdK05j/6NmVkcY77mFjQfTMFAZeD78g6cPY3yDHiHRFtxPOIhknCKBeLD5BjXD
 tz08x3MN0ItVEBXfuKAlkb1KPhHy8x02IrpdfVojoQ7lUBRH/JqLvnSGgvVsRM+0
 v9D3N9BAuB3s8DmxEdh0wyRzISl6jzBHJDJ83+uWSfZWLlEW+RVn9NbH2ubNU/jt
 FO3U81r1MvE=
 =Mb4z
 -----END PGP SIGNATURE-----

Merge tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip

Pull perf events fixes from Ingo Molnar:

 - Fix a perf_event_attr::remove_on_exec bug for group events
   (Taeyang Lee)

 - Fix uprobes CALL emulation interaction with shadow stacks, and
   add a testcase for this (David Windsor)

 - Fix uprobes unregister bug (Jiri Olsa)

* tag 'perf-urgent-2026-07-05' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
  uprobes/x86: Use proper mm_struct in __in_uprobe_trampoline
  selftests/x86: Add shadow stack uprobe CALL test
  x86/uprobes: Keep shadow stack in sync for emulated CALLs
  perf/core: Detach event groups during remove_on_exec
 2026-07-05 05:34:43 -10:00
Linus Torvalds
71dfdfb020 vfs-7.2-rc2.fixes 
Please consider pulling these changes from the signed vfs-7.2-rc2.fixes tag.
 
 Thanks!
 Christian
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQRAhzRXHqcMeLMyaSiRxhvAZXjcogUCakeSGAAKCRCRxhvAZXjc
 opdAAQDCui7Q517Wxe59USK+wtnOVARMzCN0Tu6e/HodvbbIEAD/RmgGnQrYF13I
 3BuCwTMS9Q1lHQLUtIkd9WqqYa2rQws=
 =uL08
 -----END PGP SIGNATURE-----

Merge tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs

Pull vfs fixes from Christian Brauner:

 - netfs:

    - fix the decision when to disallow write-streaming with fscache in
      use, handling of asynchronous cache object creation, a double fput
      in cachefiles, clearing S_KERNEL_FILE without the inode lock held,
      page extraction bugs in the iov_iter helpers (a potential
      underflow, a missing allocation failure check, a memory leak, and
      a folio offset miscalculation), writeback error and ENOMEM
      handling, DIO write retry for filesystems without a
      ->prepare_write() method, and the replacement of the wb_lock mutex
      with a bit lock plus writethrough collection offload so that
      multiple asynchronous writebacks don't interfere with each other.

    - Fix the barriering when walking the netfs subrequest list during
      retries as it was possible to see a subrequest that was just added
      by the application thread.

 - iomap:

    - Change iomap to submit read bios after each extent instead of
      building them up across extents. The old behavior was considered
      problematic for a while and now caused an actual erofs bug.

    - Guard the ioend io_size EOF trim in iomap against underflow when a
      concurrent truncate moves EOF below the start of the ioend,
      wrapping io_size to a huge value.

 - overlayfs

    - Fix a stale overlayfs comment about the locking order.

    - Store the linked-in upper dentry instead of the disconnected
      O_TMPFILE dentry during overlayfs tmpfile copy-up. With a FUSE or
      virtiofs upper layer ->d_revalidate() would try to look up "/" in
      the workdir and fail, causing persistent ESTALE errors that broke
      dpkg and apt.

 - vfs-bpf:

   Have the bpf_real_data_inode() kfunc take a struct file instead of a
   dentry so it is usable from the bprm_check_security, mmap_file, and
   file_mprotect hooks, and rename it from bpf_real_inode() to make the
   data-inode semantics explicit. The kfunc landed this cycle so the
   change is safe.

 - afs:

   NULL pointer dereferences in the callback service and in
   afs_get_tree(), several memory and refcount leaks, missing locking
   around the dynamic root inode numbers and premature cell exposure
   through /afs, a netns destruction hang caused by a misplaced
   increment of net->cells_outstanding, a bulk lookup malfunction caused
   by the dir_emit() API change, inode (re)initialisation issues, and
   assorted smaller fixes to error codes, seqlock handling, and debug
   output.

 - vfs:

   Refuse O_TMPFILE creation with an unmapped fsuid or fsgid and add a
   selftest for it.

 - vboxsf:

   Add Jori Koolstra as vboxsf maintainer, taking over from Hans de
   Goede.

 - dio:

   Release the pages attached to a short atomic dio bio; the REQ_ATOMIC
   size check error path leaked them.

 - procfs:

   Only bump the parent directory link count when registering
   directories in procfs. Registering regular files inflated the count
   and leaked a link on every create and remove cycle.

 - minix:

   Avoid an unsigned overflow in the minix bitmap block count
   calculation that let crafted images with huge inode or zone counts
   pass superblock validation and crash the kernel during mount.

 - cachefiles:

   Fix a double unlock in the cachefiles nomem_d_alloc error path left
   over from the start_creating() conversion.

 - fat:

   Stop fat from reading directory entries past the 0x00
   end-of-directory marker. If the trailing on-disk slots aren't
   zero-filled the driver surfaced arbitrary garbage as directory
   entries.

 - freexvfs:

   Don't BUG() on unknown typed-extent types in freevxfs, reachable via
   ioctl(FIBMAP) on a crafted image; fail with an I/O error instead.

 - orangefs:

   Keep the readdir entry size 64-bit in orangefs fill_from_part().
   Truncating it to __u32 bypassed the bounds check and led to
   out-of-bounds reads triggerable by the userspace client.

 - xfs:

   Fix the error unwind in xfs_open_devices() which released the rt
   device file twice and left dangling buftarg pointers behind that were
   freed again when the failed mount was torn down.

 - exec:

   Fix an off-by-one in the comment documenting the maximum binfmt
   rewrite depth in exec_binprm(). The code allows five rewrites, not
   four; restricting the code would break userspace so the comment is
   fixed instead.

 - file handles:

   Reject detached mounts in capable_wrt_mount(). A detached mount can
   be dissolved concurrently, leaving a NULL mount namespace that
   open_by_handle_at() would dereference.

* tag 'vfs-7.2-rc2.fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/vfs/vfs: (57 commits)
  netfs: Fix barriering when walking subrequest list
  iomap: submit read bio after each extent
  fuse: call fuse_send_readpages explicitly from fuse_readahead
  iomap: consolidate bio submission
  fhandle: reject detached mounts in capable_wrt_mount()
  netfs: Fix DIO write retry for filesystems without a ->prepare_write()
  netfs: Fix folio state after ENOMEM whilst under writeback iteration
  netfs: Fix writeback error handling
  netfs: Fix writethrough to use collection offload
  netfs: Replace wb_lock with a bit lock for asynchronicity
  netfs: Fix kdoc warning
  scatterlist: Fix offset in folio calc in extract_xarray_to_sg()
  iov_iter: Remove unused variable in kunit_iov_iter.c
  iov_iter: Fix a memory leak in iov_iter_extract_user_pages()
  iov_iter: Fix missing alloc fail check in iov_iter_extract_bvec_pages()
  iov_iter: Fix potential underflow in iov_iter_extract_xarray_pages()
  cachefiles: Fix file burial to take lock when unsetting S_KERNEL_FILE
  cachefiles: Fix double fput
  netfs: Fix netfs_create_write_req() to handle async cache object creation
  netfs: Fix decision whether to disallow write-streaming due to fscache use
  ...
 2026-07-03 05:48:05 -10:00
Linus Torvalds
d2c9a99135 Split <linux/mod_devicetable.h> in per subsystem headers 
<linux/mod_devicetable.h> is included transitively in nearly every
 driver in an x86_64 allmodconfig build of v7.1:
 
         $ find drivers -name \*.o -not -name \*.mod.o | wc -l
         21330
         $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
         17038
 
 The result of this mixture of different and unrelated subsystem details
 is that even when touching an obscure device id struct most of the
 kernel needs to be recompiled. Given that each driver typically only
 needs one or two of these structures, splitting into per subsystem
 headers and only including what is really needed reduces the amount of
 needed recompilation.
 
 This split is implemented in the first commit and then after some
 preparatory work in the following commits, the last two replace
 includes of <linux/mod_devicetable.h> by the actually needed more
 specific headers. There are still a few instances left, but the ones
 with high impact (that is in headers that are used a lot) and the easy
 ones (.c files) are handled. These remaining includes will be addressed
 during the next merge window.
 -----BEGIN PGP SIGNATURE-----
 
 iQEzBAABCgAdFiEEP4GsaTp6HlmJrf7Tj4D7WH0S/k4FAmpHSvIACgkQj4D7WH0S
 /k6Rdgf/QqxMIt7DEAN6KvyCnwVnNnvEWQhac/DtYA3NF1JaynieJIoFcimrRr/j
 cntxjz2zlMhLH4CYZ87IunZ7nGZgkMlsnl/OVMm5NY0wq0vVYX6VmpiSvhMAgvjV
 QxKHOAyuVqPslwVE8DF2Vh9mgJILviH5t/yIy8DHF85QBrDSjcd/n6csx09uTjIy
 +D6NuxQ7ZeOi+O2wZuiDhYpD1kwgO1sXAg56ogN1OSTQoo1kkKqj66b5fgbPVm4/
 MX3EBOjKIytX8csfWBJjNSB7aRyWVMkMKmmDO9+7MIq6tPRbc3yYwhu2kZBAw5Pt
 mQfy1oyUi+0jwew4yKHeoVLyWAc4bg==
 =YhFg
 -----END PGP SIGNATURE-----

Merge tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux

Pull mod_devicetable.h header split from Uwe Kleine-König:
 "Split <linux/mod_devicetable.h> in per subsystem headers

  <linux/mod_devicetable.h> is included transitively in nearly every
  driver in an x86_64 allmodconfig build of v7.1:

      $ find drivers -name \*.o -not -name \*.mod.o | wc -l
      21330
      $ find drivers -name \*.o.cmd -not -name \*.mod.o.cmd | xargs grep -l mod_devicetable.h | wc -l
      17038

  The result of this mixture of different and unrelated subsystem
  details is that even when touching an obscure device id struct most of
  the kernel needs to be recompiled. Given that each driver typically
  only needs one or two of these structures, splitting into per
  subsystem headers and only including what is really needed reduces the
  amount of needed recompilation.

  This split is implemented in the first commit and then after some
  preparatory work in the following commits, the last two replace
  includes of <linux/mod_devicetable.h> by the actually needed more
  specific headers.

  There are still a few instances left, but the ones with high impact
  (that is in headers that are used a lot) and the easy ones (.c files)
  are handled. These remaining includes will be addressed during the
  next merge window"

* tag 'device-id-rework' of git://git.kernel.org/pub/scm/linux/kernel/git/ukleinek/linux:
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files)
  Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (headers)
  parisc: #include <linux/compiler.h> for unlikely() in <asm/ptrace.h>
  media: em28xx: Add include for struct usb_device_id
  LoongArch: KVM: Add include defining struct cpu_feature
  ALSA: hda/core: Add include defining struct hda_device_id
  usb: dwc2: Add include defining struct pci_device_id
  platform/x86: int3472: Add include defining struct dmi_system_id
  platform/x86: x86-android-tablets: Add include defining struct dmi_system_id
  i2c: Let i2c-core.h include <linux/i2c.h>
  of: Explicitly include <linux/types.h> and <linux/err.h>
  platform/x86: msi-ec: Ensure dmi_system_id is defined
  usb: serial: Include <linux/usb.h> in <linux/usb/serial.h>
  driver core: platform: Include header for struct platform_device_id
  driver: core: Include headers for acpi_device_id and of_device_id for struct device_driver
  media: ti: vpe: #include <linux/platform_device.h> explicitly
  mod_devicetable.h: Split into per subsystem headers
 2026-07-02 20:54:26 -10:00
Uwe Kleine-König (The Capable Hub)
995832b2ce Replace <linux/mod_devicetable.h> by more specific <linux/device-id/*.h> (c files) 
Replace the #include of <linux/mod_devicetable.h> by the more specific
<linux/device-id/*.h> where applicable. For most cases the include
can be dropped completely, only a few drivers need one or two headers
added.

Acked-by: Danilo Krummrich <dakr@kernel.org>
Acked-by: Takashi Sakamoto <o-takashi@sakamocchi.jp>
Acked-by: Bjorn Helgaas <bhelgaas@google.com>
Link: https://patch.msgid.link/1a3f2007c5c5dcf555c09a4035ce3ae8ef1b6c49.1782808461.git.u.kleine-koenig@baylibre.com
Signed-off-by: Uwe Kleine-König (The Capable Hub) <u.kleine-koenig@baylibre.com>
 2026-07-03 07:38:17 +02:00
Linus Torvalds
51512e22ef BPF fixes: 
- Initialize task local storage before fork bails out to
   free the task (Jann Horn)
 
 - Fix insn_aux_data leak on verifier error path (KaFai Wan)
 
 - Reject BPF inode storage map creation when BPF LSM is
   uninitialized (Matt Bobrowski)
 
 - Mask pseudo pointer values in verifier logs when pointer
   leaks are not allowed (Nuoqi Gui)
 
 - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)
 
 - Reject a skb-modifying SK_SKB stream parser since the latter
   is only meant to measure the next message (Sechang Lim)
 
 - Fix bpf_refcount_acquire to reject refcounted allocation
   arguments with a non-zero fixed offset (Yiyang Chen)
 
 Signed-off-by: Daniel Borkmann <daniel@iogearbox.net>
 -----BEGIN PGP SIGNATURE-----
 
 iIsEABYKADMWIQTFp0I1jqZrAX+hPRXbK58LschIgwUCaka0NhUcZGFuaWVsQGlv
 Z2VhcmJveC5uZXQACgkQ2yufC7HISIMPywD/ePh+eOZjFwXy88kOdNa2qmKLuTQm
 nv6jPDOEafVDfbUA/R0qT9t+144K5Ig1NU58uR9vMIevqWRjLrnQtWU7KI0D
 =4aKP
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull BPF fixes from Daniel Borkmann:

 - Initialize task local storage before fork bails out to free the task
   (Jann Horn)

 - Fix insn_aux_data leak on verifier error path (KaFai Wan)

 - Reject BPF inode storage map creation when BPF LSM is uninitialized
   (Matt Bobrowski)

 - Mask pseudo pointer values in verifier logs when pointer leaks are
   not allowed (Nuoqi Gui)

 - Harden BPF JIT against spraying via IBPB flush (Pawan Gupta)

 - Reject a skb-modifying SK_SKB stream parser since the latter is only
   meant to measure the next message (Sechang Lim)

 - Fix bpf_refcount_acquire to reject refcounted allocation arguments
   with a non-zero fixed offset (Yiyang Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Prefer dirty packs for eBPF allocations
  bpf: Prefer packs that won't trigger an IBPB flush on allocation
  bpf: Skip redundant IBPB in pack allocator
  bpf: Restrict JIT predictor flush to cBPF
  x86/bugs: Enable IBPB flush on BPF JIT allocation
  bpf: Support for hardening against JIT spraying
  bpf: Reject BPF_MAP_TYPE_INODE_STORAGE creation if BPF LSM is uninitialized
  bpf,fork: wipe ->bpf_storage before bailouts that access it
  bpf: Fix insn_aux_data leak on verifier err_free_env path
  selftests/bpf: Cover pseudo-BTF ksym log masking
  bpf: Mask pseudo pointer values in verifier logs
  selftests/bpf: Cover refcount acquire node offsets
  bpf: Reject offset refcount acquire arguments
  selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser
  bpf, sockmap: reject a packet-modifying SK_SKB stream parser
  selftests/bpf: don't modify the skb in the strparser parser prog
 2026-07-02 16:39:28 -10:00
Linus Torvalds
826eec5b5e VFIO fixes for v7.2-rc2 
- Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci
    variant driver with a binary split between setup/release and
    runtime modified flags.  These were noted across several Sashiko
    reviews as pre-existing issues. (Alex Williamson)
 
  - Fix runtime PM inconsistency where the vfio-pci driver module_init
    could modify the idle PM policy of existing devices through globals
    managed in vfio-pci-core, leading to unbalanced runtime PM
    operations. (Alex Williamson)
 
  - Restore mutability of writable vfio-pci module options by further
    pulling policy globals out of vfio-pci-core, to instead be latched
    per device at device init.  Provide visibility of the per device
    latched values through debugfs. (Alex Williamson)
 
  - Fix missing VGA arbiter uninit callback in unwind path.
    (Alex Williamson)
 
  - Reorder device debugfs removal before device_del() to avoid gap
    where debugfs is available with stale devres pointers.
    (Alex Williamson)
 
  - Move UUID library linking flag from vfio selftest Makefile into
    libvfio.mk to avoid exposing such dependencies when linking with
    KVM selftests. (Sean Christopherson)
 -----BEGIN PGP SIGNATURE-----
 
 iQJFBAABCgAvFiEEQvbATlQL0amee4qQI5ubbjuwiyIFAmpGoBgRHGFsZXhAc2hh
 emJvdC5vcmcACgkQI5ubbjuwiyIsTQ//aBSIKmchiU701m5Cl9FP/er0IRkjqmJd
 EoKseoQoFvBi9Rsog5RiDwTnsu3NTcvqaZgcWshxJZ0G3/rPP6wTqr3W3sGMqsXp
 q6EwdeebmCsBecc14gexMjic6azS3w4IyqDGo56X30i7BbRAxpQdnlOG2oGdCmz6
 bxjIlRVYiYgC4NYJM5wwpx+fVxcHmoejgKQVxetG3ersvW/PoWR8DT8AEP1iDA2W
 /jhj+aqX0Il7+Wxxxxhw7qQoBe0U1U1uz3+frRVAMwBQY0dTsMzU6aGuT+ajbTJC
 /rgXSiXVDUoRaIUGi8TolWwXXE+V9IpXoNouEokCoQ6WoxiThhS4codKwveArWOv
 C4LdEV1XLiZTBFj59q4DKCj7+6mYWK2z8OylPIUxXckxvWsEH8b4U/BjMH+NwyAy
 hn854fEpMA0SSIl4GEJRocZcH7C+EzE7CDDBop18e4fKDIwjU3odnci5c1titG8W
 kvqSel11JYnOnThLCF8qvqAHmRJqqbtUurlrzPQwWif+tNwAl/QVyHYxr/HY4UMB
 wLKgfb9TbFD2jH1b3KPOeUv8I2AkIBbXARsBZXn1r0+MWHr0hRkrlgir1thTzcxn
 yau7OWlkOnbf9NCiB+KyZ0xwqhG+dBJWmX2lzQcDMQ/1hbrqOTfAaKvg9kRZNdjn
 qckJIv7VGwQ=
 =V/L3
 -----END PGP SIGNATURE-----

Merge tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio

Pull VFIO fixes from Alex Williamson:
 "Mostly straightforward fixes here, inconsistent runtime PM handling
  due to global device policies, bitfield races, unwind path gaps,
  teardown ordering, and a misplaced library flag.

   - Fix racy bitfield updates in vfio-pci-core and the mlx5 vfio-pci
     variant driver with a binary split between setup/release and
     runtime modified flags. These were noted across several Sashiko
     reviews as pre-existing issues (Alex Williamson)

   - Fix runtime PM inconsistency where the vfio-pci driver module_init
     could modify the idle PM policy of existing devices through globals
     managed in vfio-pci-core, leading to unbalanced runtime PM
     operations (Alex Williamson)

   - Restore mutability of writable vfio-pci module options by further
     pulling policy globals out of vfio-pci-core, to instead be latched
     per device at device init. Provide visibility of the per device
     latched values through debugfs (Alex Williamson)

   - Fix missing VGA arbiter uninit callback in unwind path (Alex
     Williamson)

   - Reorder device debugfs removal before device_del() to avoid gap
     where debugfs is available with stale devres pointers (Alex
     Williamson)

   - Move UUID library linking flag from vfio selftest Makefile into
     libvfio.mk to avoid exposing such dependencies when linking with
     KVM selftests (Sean Christopherson)"

* tag 'vfio-v7.2-rc2' of https://github.com/awilliam/linux-vfio:
  vfio: selftests: Add luuid to libvfio.mk's list of libraries, not to the Makefile
  vfio/pci: Expose latched module parameter policy in debugfs
  vfio: Remove device debugfs before releasing devres
  vfio/pci: Latch all module parameters per device
  vfio/mlx5: Fix racy bitfields and tighten struct layout
  vfio/pci: Fix racy bitfields and tighten struct layout
  vfio/pci: Release the VGA arbiter client on register_device() failure
  vfio/pci: Latch disable_idle_d3 per device
 2026-07-02 15:25:54 -10:00
Linus Torvalds
87320be9f0 Including fixes from netfilter and batman-adv. 
Current release - new code bugs:
 
   - netfilter: cthelper: cap to maximum number of expectation per master
 
 Previous releases - regressions:
 
   - netpoll: fix a use-after-free on shutdown path
 
   - tcp: restore RCU grace period in tcp_ao_destroy_sock
 
   - ipv6: fix NULL deref in fib6_walk_continiue() on multi-batch dump
 
   - batman-adv: dat: ensure accessible eth_hdr proto field
 
   - eth: virtio_net: disable cb when NAPI is busy-polled
 
   - eth: lan743x: Initialize eth_syslock spinlock before use
 
 Previous releases - always broken:
 
   - netfilter:
     - nft_set_pipapo: don't leak bad clone into future transaction
 
   - sched:
     - sch_teql: Introduce slaves_lock to avoid race condition and UAF
     - replace direct dequeue call with peek and qdisc_dequeue_peeked
 
   - sctp: add INIT verification after cookie unpacking
 
   - tipc: fix out-of-bounds read in broadcast Gap ACK blocks
 
   - seg6: validate SRH length before reading fixed fields
 
   - eth: mlx5e: fix use-after-free of metadata_dst on RX SC delete
 
   - eth: enetc: check the number of BDs needed for xdp_frame
 
   - eth: fbnic: don't cache shinfo across skb realloc
 
 Signed-off-by: Paolo Abeni <pabeni@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iQJGBAABCgAwFiEEg1AjqC77wbdLX2LbKSR5jcyPE6QFAmpGTMASHHBhYmVuaUBy
 ZWRoYXQuY29tAAoJECkkeY3MjxOkjDMQAIWWaKs8zb+d/aTW0uNzlatQuY2w7+rU
 i2+W5Bb7e2w95OP3dM2abNu4oGb/O69PsLzTAg8/TYTICcBe6j8i3QThXNtw0vNi
 USZqvZdeCUB8r/ICvBki7FoV2bxDZh2TAWsHHxbPEup7y/SbWg9Wk7kAQj+uxjFa
 dV5DoVBrS376xt+VO/D89BKCoqneJRetHJoO11cKNPbd+btXcbConXBTYYDfxzaO
 fdwqbP7nNN6X6ADXcjf0oSHkj/bdiw+CdaU2Z1lSa0cuDolO80aIXW5d1AVnrxC1
 C6hOz5rvQS0l0+ionRkB6S77B6PNPp12cYo3L9HaoQuE+oQc3QvotwxvJpzRxHYf
 wTBQ11Ab0mke11OVXjjGZREA9c+BZ9j8Tto539H11s9tUegRU/V9AFvErTdfx/Ym
 Hr82C+wC3Bv6b7iYjAF7BJAtV9GJ0VSwaw3luSFOh4S6XyBzqn482XfnKF2m/Js3
 7l5TQYLYtUjYJ0NhuXDkwWBKkP8HimIWZs7de41GZv6DMa/aaoFlzr4MRrD+Uuc0
 CW6G5UNOOGVNNuNMPKIMw3w9diMVoc72yFleNGwlOBsrOyncW2JI1eIyWBLx3E9G
 l9jabZPD2qzsi/iXCzPM4rn2hp3Sb5qOvuBg8qRsiDqz5t1b1mRhvPVcu36k38Mu
 gAwmDBbogPcC
 =E5mR
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Paolo Abeni:
 "Including fixes from netfilter and batman-adv.

  Current release - new code bugs:

   - netfilter: cthelper: cap to maximum number of expectation per master

  Previous releases - regressions:

   - netpoll: fix a use-after-free on shutdown path

   - tcp: restore RCU grace period in tcp_ao_destroy_sock

   - ipv6: fix NULL deref in fib6_walk_continiue() on multi-batch dump

   - batman-adv: dat: ensure accessible eth_hdr proto field

   - eth:
      - virtio_net: disable cb when NAPI is busy-polled
      - lan743x: Initialize eth_syslock spinlock before use

  Previous releases - always broken:

   - netfilter:
      - nft_set_pipapo: don't leak bad clone into future transaction

   - sched:
      - sch_teql: Introduce slaves_lock to avoid race condition and UAF
      - replace direct dequeue call with peek and qdisc_dequeue_peeked

   - sctp: add INIT verification after cookie unpacking

   - tipc: fix out-of-bounds read in broadcast Gap ACK blocks

   - seg6: validate SRH length before reading fixed fields

   - eth:
      - mlx5e: fix use-after-free of metadata_dst on RX SC delete
      - enetc: check the number of BDs needed for xdp_frame
      - fbnic: don't cache shinfo across skb realloc"

* tag 'net-7.2-rc2' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (58 commits)
  net/mlx5: HWS, fix matcher leak on resize target setup failure
  net/sched: hhf: clear heavy-hitter state on reset
  net/sched: dualpi2: clear stale classification on filter miss
  net/sched: act_bpf: use rcu_dereference_bh() to read the filter
  selftests: drv-net: tso: don't touch dangerous feature bits
  cxgb4: Fix decode strings dump for T6 adapters
  virtio_net: disable cb when NAPI is busy-polled
  sctp: fix addr_wq_timer race in sctp_free_addr_wq()
  selftests: net: bump default cmd() timeout to 20 seconds
  bridge: stp: Fix a potential use-after-free when deleting a bridge
  net/sched: sch_teql: Introduce slaves_lock to avoid race condition and UAF
  net: gianfar: dispose irq mappings on probe failure and device removal
  net: lan743x: Initialize eth_syslock spinlock before use
  net: libwx: fix VMDQ mask for 1-queue mode
  net: airoha: fix max receive size configuration
  fsl/fman: Free init resources on KeyGen failure in fman_init()
  netfilter: nftables: restrict checkum update offset
  netfilter: nftables: restrict linklayer and network header writes
  netfilter: nfnetlink_queue: restrict writes to network header
  netfilter: nft_fib: reject fib expression on the netdev egress hook
  ...
 2026-07-02 06:01:12 -10:00
David Windsor
5166973b20 selftests/x86: Add shadow stack uprobe CALL test 
Add coverage for entry uprobes installed on CALL instructions while user
shadow stack is enabled. The test puts an entry uprobe on a helper whose
first instruction is a relative CALL, then verifies that the call/return
sequence completes without SIGSEGV.

This catches regressions where x86 uprobe CALL emulation updates the
regular user stack but leaves the CET shadow stack stale.

Signed-off-by: David Windsor <dwindsor@gmail.com>
Signed-off-by: Peter Zijlstra (Intel) <peterz@infradead.org>
Link: https://patch.msgid.link/b957039191118c5eba97d01d80c494b859f115a6.1782777969.git.dwindsor@gmail.com
 2026-07-02 13:21:49 +02:00
Christian Brauner
d943e68edc
selftests/filesystems: test O_TMPFILE creation on idmapped mounts 
Add a regression test for the fsuidgid_has_mapping() check in
vfs_tmpfile().  It idmaps a detached tmpfs mount so that the
caller-visible id range [0, 10000) maps onto the on-disk range
[10000, 20000) and checks that:

  - a caller whose fsuid/fsgid fall outside that range cannot create an
    O_TMPFILE through the mount and gets -EOVERFLOW instead of an inode
    owned by (uid_t)-1;

  - a mapped caller can create an O_TMPFILE, link it into the namespace,
    and the ownership round-trips through the mount idmap: it is reported
    as 0 through the mount and stored as 10000 on the underlying tmpfs.

The test runs entirely as root and uses setfsuid()/setfsgid() to become
the unmapped caller, so it needs no helper user.  The layer directory is
world-writable so that an unmapped caller still clears the directory
permission check and reaches the fsuidgid_has_mapping() test.

Link: https://patch.msgid.link/20260615-work-idmapped-tmpfile-v1-2-754a94d81f83@kernel.org
Reviewed-by: Jan Kara <jack@suse.cz>
Signed-off-by: Christian Brauner (Amutable) <brauner@kernel.org>
 2026-07-01 15:26:18 +02:00
Jakub Kicinski
2f7f2e3111 selftests: drv-net: tso: don't touch dangerous feature bits 
query_nic_features() detects which offloads depend on tx-gso-partial
by enabling everything, turning tx-gso-partial off, and seeing which
active features drop out. Enabling all hw features is dangerous:
we may end up enabling rx-fcs and loopback for example. For the
ice driver we end up getting into problems with feature dependencies
so the cleanup isn't successful either, and the test exits with
rx-fcs and loopback enabled.

Scope the feature probing just to segmentation bits.

Fixes: 266b835e5e ("selftests: drv-net: tso: enable test cases based on hw_features")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Reviewed-by: Daniel Zahka <daniel.zahka@gmail.com>
Link: https://patch.msgid.link/20260629233923.2151144-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-30 17:23:25 -07:00
Jakub Kicinski
57bb59ab6f selftests: net: bump default cmd() timeout to 20 seconds 
We always used 5 sec as the default command timeout. But soon after
it was introduced, David effectively made us ignore the timeout
(it was passed to process.communicate() as the wrong argument).
Gal recently fixed that, but turns out the 5 sec is not enough
for a lot of tests and setups. The fix caused regressions.

In particular running reconfig commands (e.g. XDP attach) on mlx5
with 32 rings and 9k MTU, on a heavily-debug-enabled kernel takes
more than 5 sec. The XDP installation command will time out after
5 sec but since the sleeps in the kernel are non interruptible
the command finishes anyway, leaving the XDP program attached,
but with non-zero exit code. defer()ed cleanups are not installed,
breaking the environment for subsequent tests.

Since "install XDP" is a pretty normal command a "point fix"
does not seem appropriate. 32 rings is a fairly reasonable
config, too, so we should just increase the timeout to 20 sec.

There's no real reason behind the value of 20.

Fixes: 1cf2704242 ("net: selftest: add test for netdev netlink queue-get API")
Fixes: f0bd193166 ("selftests: net: fix timeout passed as positional argument to communicate()")
Reviewed-by: Pavan Chebbi <pavan.chebbi@broadcom.com>
Acked-by: Breno Leitao <leitao@debian.org>
Reviewed-by: Nimrod Oren <noren@nvidia.com>
Link: https://patch.msgid.link/20260629233348.2145841-1-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-30 16:54:37 -07:00
Sean Christopherson
e242e974e8 vfio: selftests: Add luuid to libvfio.mk's list of libraries, not to the Makefile 
Link to the uuid library as part of libvfio.mk instead of as only linking
it via VFIO selftests' Makefile, as the whole point of providing libvfio.mk
is to allow linking the VFIO library functionality into KVM selftests,
without KVM selftests having to know the gory details or duplicate code.

Cc: Raghavendra Rao Ananta <rananta@google.com>
Cc: David Matlack <dmatlack@google.com>
Cc: Vipin Sharma <vipinsh@google.com>
Cc: Alex Williamson <alex@shazbot.org>
Fixes: e65f1bf8a2 ("vfio: selftests: Extend container/iommufd setup for passing vf_token")
Signed-off-by: Sean Christopherson <seanjc@google.com>
Reviewed-by: David Matlack <dmatlack@google.com>
Link: https://lore.kernel.org/r/20260630212805.474418-1-seanjc@google.com
Signed-off-by: Alex Williamson <alex@shazbot.org>
 2026-06-30 15:50:55 -06:00
Linus Torvalds
51cb1aa125 LoongArch changes for v7.2 
1, Add THREAD_INFO_IN_TASK implementation;
 2, Add build salt to the vDSO;
 3, Add some BPF JIT inline helpers;
 4, Update DTS for I2C clocks and clock-frequency;
 5, Some bug fixes and other small changes.
 -----BEGIN PGP SIGNATURE-----
 
 iQJKBAABCAA0FiEEzOlt8mkP+tbeiYy5AoYrw/LiJnoFAmo+MBYWHGNoZW5odWFj
 YWlAa2VybmVsLm9yZwAKCRAChivD8uImesGWD/9HygPT6/JFvFR2rijLaym9TNYi
 +X8m0GTUJDrBGasDQ1rXSgUAkWKIQHEvx0Q947HYWhceiIrwbiZrgMStVapk40hd
 /WsiuTHFaiVzjiiXf2bdTSr9uWHIon3P1EZ6zkmdRO4l2VsvAq2elMJXazIP7NUa
 fTnTGAMPXvA/TinNXZqGq/Ny9c6gp63pVUgATcBpSUmYCNYGz6xx7OwSWyGV0ncq
 Kfxm87nVq6wdyCgmrzfYSGze9vM0FxfFpzvZbX9vLOfGZBGaxzDcBjH9LRU09vyp
 /9fNpacKT49yNOfLO3R3MHSPFSa5DCg8ph8CDfMnqPmP01SfZpC+zmlFWv23ojx5
 4v47fyaRQu6ucKL2vxkIJfKO6l8bXgcuzVgZPGVt5q5yJ5O+7yhuamncrxUKk6Ol
 KGpIEJM3iKbcHKr9GF0EUcgJkbA2J/pU/094snBU3HlkoHDVcp28XxlJmNtW+jY4
 49dCTbX/5v+680uf/KTUyXJ4j3m9bxMOB6feE1uVaSJF1nx6f7WYHRg7A/1pXnWy
 f2chgwR4eUeqZRpFlUhcLx4R+OOD2ORvvdM0qcNv4T7E8FD31JtFVD873R2iFEG8
 AlKG4Ln3DUeJdhskXXmJRIDD5nZb9XZNYlnM4ghQLBas5dtSxsSPnzkSjJHirTjR
 naFFT9xxRBQOBBTrjQ==
 =EvQG
 -----END PGP SIGNATURE-----

Merge tag 'loongarch-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson

Pull LoongArch updates from Huacai Chen:

 - Add THREAD_INFO_IN_TASK implementation

 - Add build salt to the vDSO

 - Add some BPF JIT inline helpers

 - Update DTS for I2C clocks and clock-frequency

 - Some bug fixes and other small changes

* tag 'loongarch-7.2' of git://git.kernel.org/pub/scm/linux/kernel/git/chenhuacai/linux-loongson:
  selftests/bpf: Test jited inline of bpf_get_smp_processor_id() for LoongArch
  selftests/bpf: Test jited inline of bpf_get_current_task() for LoongArch
  selftests/bpf: Add __arch_loongarch to limit test cases for LoongArch
  selftests/bpf: Add get_preempt_count() support for LoongArch
  LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K2000
  LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K1000
  LoongArch: dts: Add i2c clocks and clock-frequency properties to LS2K0500
  LoongArch: BPF: Inline bpf_get_smp_processor_id() helper
  LoongArch: BPF: Inline bpf_get_current_task/_btf() helpers
  LoongArch: BPF: Fix off-by-one error in tail call
  LoongArch: BPF: Fix outdated tail call comments
  LoongArch: Add build salt to the vDSO
  LoongArch: Fix nr passing in set_direct_map_valid_noflush()
  LoongArch: Fix missing dirty page tracking in {pte,pmd}_wrprotect()
  LoongArch: Move struct kimage forward declaration before use
  LoongArch: Report dying CPU to RCU in stop_this_cpu()
  LoongArch: Add PIO for early access before ACPI PCI root register
  LoongArch: Add THREAD_INFO_IN_TASK implementation
 2026-06-26 08:42:49 -07:00
Nuoqi Gui
8a870967ca selftests/bpf: Cover pseudo-BTF ksym log masking 
Add verifier_unpriv coverage for a raw socket-filter load of the
bpf_prog_active typed ksym. The test verifies that the unprivileged load
remains accepted and that the verbose verifier log prints the ldimm64
immediate as 0x0 instead of exposing a nonzero kernel address.

Signed-off-by: Nuoqi Gui <gnq25@mails.tsinghua.edu.cn>
Link: https://lore.kernel.org/r/20260623-f01-13-pseudo-btf-id-cap-bpf-v2-2-a190ebb8f3e2@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
 2026-06-25 17:59:05 -07:00
Yiyang Chen
0371fb57a0 selftests/bpf: Cover refcount acquire node offsets 
Add regression coverage for bpf_refcount_acquire() on graph-node-derived
pointers.

The rejected case passes a popped list node pointer directly to
bpf_refcount_acquire(), which must fail because the pointer carries a
non-zero fixed offset.

Signed-off-by: Yiyang Chen <chenyy23@mails.tsinghua.edu.cn>
Reviewed-by: Emil Tsalapatis <emil@etsalapatis.com>
Acked-by: Yonghong Song <yonghong.song@linux.dev>
Link: https://lore.kernel.org/r/bf2a2033ced272106292de4465b8ef3fb991c912.1782192383.git.chenyy23@mails.tsinghua.edu.cn
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-06-25 17:51:20 -07:00
Sechang Lim
05fb34384d selftests/bpf: test rejection of a packet-modifying SK_SKB stream parser 
Verify that attaching an SK_SKB stream parser that can modify the packet
is rejected, while a read-only parser still attaches.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Link: https://lore.kernel.org/r/20260620024423.4141004-4-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-06-25 17:42:02 -07:00
Sechang Lim
22a0cc10da selftests/bpf: don't modify the skb in the strparser parser prog 
sockmap_parse_prog.c is attached as an SK_SKB stream parser and modifies
the skb: it calls bpf_skb_pull_data() and writes a byte into the packet.
A stream parser runs on strparser's message head and must not modify it.
A resize frees the frag_list segments strparser still tracks, leading to
a use-after-free.

Make the parser read-only. It only needs to return the message length,
which keeps it attaching once packet-modifying parsers are rejected.

Reviewed-by: Jiayuan Chen <jiayuan.chen@linux.dev>
Signed-off-by: Sechang Lim <rhkrqnwk98@gmail.com>
Link: https://lore.kernel.org/r/20260620024423.4141004-2-rhkrqnwk98@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-06-25 17:42:02 -07:00
Linus Torvalds
4edcdefd40 bpf-fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCAAdFiEE+soXsSLHKoYyzcli6rmadz2vbToFAmo9if4ACgkQ6rmadz2v
 bTqujQ/+IUqsYYfnOzxHoaWOy5aLFDjjFBwbbBqU3qBrgkAVNa1xLtuM2Dt/zro9
 eNBHa1OitQG4ZZ3ZjFqw7W+ErsUlUagYXa3ldmlpNs1euDqAtLgg6lW8sYj5zIfn
 KV9coUxArcos8hdX3YQqV3ZWFxFvTuEduniW502swYGTjUXLjBrbPhHhyXVtf3i4
 v6MMYkraWSo3ez8Wh+TiyfkOFVNP5JoDRP66vmN5k90B4VuZgVHIQsXp/kFPTmxL
 XpbGRF4/SevWgE5TEY7tBjwWV5aOcsPL55H6lStMt2ViOdQyWCGF6CY8UISXMC3L
 WlWu8e4ICpg9YWOXb98pfp8f2mZW7J8ppa3fed0IRcnHh40ywG69ubNJSddPLfFf
 LtzR3wCQd4DIg0CqWcGnAuOTgioLh3GEwQJ1JzjFmKHw7wlsD4PzoJ6jFdwop6zw
 2/3tKv/9jhcM9yeLWW7qFiySMxsENbkhkje/hqWd24PL6HKj2d5mXzoX8Msq1ccE
 VQ3HGjXHLawTSQ4YDUp4NoZh7E7KkKZkH8UHS8YgrlQsshdTpuiVpmtX08cJHNWP
 0SpSVMYxvZtOBbrbCk7qyu/H6ubUod6gscdB2L6t06QjEYl4GyurpP1Uygs9hGy8
 9vlUSBRxSa7u7VAAEolgxkiutWfD4CnulYX02f4H1h+jfBKEMQA=
 =wnIr
 -----END PGP SIGNATURE-----

Merge tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf

Pull bpf fixes from Alexei Starovoitov:

 - Fix effective prog array index with BPF_F_PREORDER (Amery Hung)

 - Zero-initialize the fib lookup flow struct (Avinash Duduskar)

 - Disable xfrm_decode_session hook attachment (Bradley Morgan)

 - Allow type tag BTF records to succeed other modifier records (Emil
   Tsalapatis)

 - Fix build_id caching in stack_map_get_build_id_offset() (Ihor
   Solodrai)

 - Add missing access_ok call to copy_user_syms (Jiri Olsa)

 - Fix stack slot index in nospec checks (Nuoqi Gui)

 - Preserve pointer spill metadata during half-slot cleanup (Nuoqi Gui)

 - Fix partial copy of non-linear test_run output (Sun Jian)

 - Fix BPF_PROG_ASSOC_STRUCT_OPS last field check (Thiébaud Weksteen)

 - Reset register bounds before narrowing retval range (Tristan Madani)

 - Fix vmlinux BTF leak in bpftool cgroup commands (Yichong Chen)

 - Guard error writes in conntrack kfuncs (Yiyang Chen)

* tag 'bpf-fixes' of git://git.kernel.org/pub/scm/linux/kernel/git/bpf/bpf:
  bpf: Disable xfrm_decode_session hook attachment
  selftests/bpf: Add test for stale bounds on LSM retval context load
  bpf: Reset register bounds before narrowing retval range in check_mem_access()
  selftests/bpf: Cover small conntrack opts error writes
  bpf: Guard conntrack opts error writes
  selftests/bpf: Cover half-slot cleanup of pointer spills
  bpf: Preserve pointer spill metadata during half-slot cleanup
  selftests/bpf: Test cgroup link replace with BPF_F_PREORDER
  bpf: Fix effective prog array index with BPF_F_PREORDER
  bpf: Fix BPF_PROG_ASSOC_STRUCT_OPS last field check
  bpf: zero-initialize the fib lookup flow struct
  bpftool: Fix vmlinux BTF leak in cgroup commands
  bpf: Add missing access_ok call to copy_user_syms
  bpf: Allow type tag BTF records to succeed other modifier records
  bpf: Emit verbose message when prog-specific btf_struct_access rejects a write
  bpf: Fix build_id caching in stack_map_get_build_id_offset()
  bpf: Fix partial copy of non-linear test_run output
  selftests/bpf: Cover stack nospec slot indexing
  bpf: Fix stack slot index in nospec checks
 2026-06-25 14:09:26 -07:00
Linus Torvalds
75218b7ace rtla fixes for 7.2: 
- Fix and cleanup .gitignore
 
 - Fix pgrep filter in get_workload_pids.sh
 
   Fix parsing of kernel thread names in get_workload_pids() helper
   function. On some systems pgrep matches kernel thread names including
   the brackets (e.g. "[osnoise/0]") and other systems brackets are not
   included. Fix the tests to handle both.
 -----BEGIN PGP SIGNATURE-----
 
 iIoEABYKADIWIQRRSw7ePDh/lE+zeZMp5XQQmuv6qgUCaj0udBQccm9zdGVkdEBn
 b29kbWlzLm9yZwAKCRAp5XQQmuv6qgS1AQD8bo/T+tyBeumqV/gmObk+dRd1SVI/
 H0aVZ+f7mmns1gEAiFLn0vWm0zslNjOAhn9exC7FVTScRXdTB6ehN6zBbQQ=
 =fhMS
 -----END PGP SIGNATURE-----

Merge tag 'trace-tools-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace

Pull rtla fixes from Steven Rostedt:

 - Fix and cleanup .gitignore

 - Fix pgrep filter in get_workload_pids.sh

   Fix parsing of kernel thread names in get_workload_pids() helper
   function. On some systems pgrep matches kernel thread names including
   the brackets (e.g. "[osnoise/0]") and other systems brackets are not
   included. Fix the tests to handle both.

* tag 'trace-tools-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/trace/linux-trace:
  rtla/tests: Fix pgrep filter in get_workload_pids.sh
  rtla: Fix and clean up .gitignore
 2026-06-25 12:33:15 -07:00
Linus Torvalds
805185b7c7 Including fixes from netfilter and IPsec. 
Current release - regressions:
 
  - net: do not acquire dev->tx_global_lock in netdev_watchdog_up()
 
  - net: ethtool: keep rtnl_lock for ops using ethtool_op_get_link()
 
  - net: fix deadlock in nested UP notifier events
 
 Current release - new code bugs:
 
  - eth: cn20k: fix subbank free list indexing for search order
 
  - eth: airoha: fix BQL underflow in shared QDMA TX ring
 
 Previous releases - regressions:
 
  - netfilter:
    - flowtable: fix offloaded ct timeout never being extended
    - nf_conncount: prevent connlimit drops for early confirmed ct
 
 Previous releases - always broken:
 
  - require CAP_NET_ADMIN in the originating netns when modifying
    cross-netns devices
 
  - report NAPI thread PID in the caller's pid namespace
 
  - mac802154: fix dirty frag in in-place crypto for IOT radios
 
  - sctp: hold socket lock when dumping endpoints in sctp_diag,
    avoid an overflow
 
  - eth: gve: fix header buffer corruption with header-split and HW-GRO
 
  - af_key: initialize alg_key_len for IPComp states, prevent OOB read
 
 Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEE6jPA+I1ugmIBA4hXMUZtbf5SIrsFAmo9ZaUACgkQMUZtbf5S
 IrtO5w/+JgRT+RjKiCCLsEUM1R9hCA2Hxhos99YFpmMZitU2v3IZIdD/sZL6Ppxa
 fq7hlsfMicF/isez+sharJ8H8NrX5MZ9YtvcbbRG2+aUPlAJDVSfxbqCcsjEMqdP
 s4wtAhUoPwIVpw/rwcSSubQrGFTJlshVi1Yp48xxNHzNAk1wNoitSeKS+lAToaJf
 6ZUl9uamxrbMG8j9FBOSWeOcQ2ywmrQiSGbRy74X0qolRfS+1r0pNchwGsv8s2RP
 Sa3an4qfD3vBV0YNh8KglycBuvU6LMAt90/XIZ6zY8TBzISyM9PgrQbcNqKMlxQ0
 LNPy5qosWvIEFVBjrUlw1IyyfSWOBnybwXViIE83/x/sUTyhRX4vnn20hdNlMyB2
 FkWfU1C/X+D/idSoynCXGY4VXq7ikkfvTOXlTGcd9Q8sse98sQV+TpeVdu5gkqX8
 KvjhIM896Kt4eVHkmVQ0DCu+GN8srbzmMCoPqBv04zfQX4rk9tWH4iyMIaNgniZe
 8SrgFg3IA/WoaIU+Ac3oc2LNCf0XbeNQXMSfTu5t3H1bXgteDzdar/ncNXaPx/S2
 72kP35DooMpgApP4TbpxiPZ1bVSfFK7mtoxxdHQVZVGwo9NY1Fz2eqpG28y/pk18
 RXn2GSfeEmzsPGRYte+09QkwoaDnRj5GZ2ETbVxibPmJ71t6Iz0=
 =dIVQ
 -----END PGP SIGNATURE-----

Merge tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net

Pull networking fixes from Jakub Kicinski:
 "Including fixes from netfilter and IPsec.

  Current release - regressions:

   - do not acquire dev->tx_global_lock in netdev_watchdog_up()

   - ethtool: keep rtnl_lock for ops using ethtool_op_get_link()

   - fix deadlock in nested UP notifier events

  Current release - new code bugs:

   - eth:
      - cn20k: fix subbank free list indexing for search order
      - airoha: fix BQL underflow in shared QDMA TX ring

  Previous releases - regressions:

   - netfilter:
     - flowtable: fix offloaded ct timeout never being extended
     - nf_conncount: prevent connlimit drops for early confirmed ct

  Previous releases - always broken:

   - require CAP_NET_ADMIN in the originating netns when modifying
     cross-netns devices

   - report NAPI thread PID in the caller's pid namespace

   - mac802154: fix dirty frag in in-place crypto for IOT radios

   - sctp: hold socket lock when dumping endpoints in sctp_diag, avoid
     an overflow

   - eth: gve: fix header buffer corruption with header-split and HW-GRO

   - af_key: initialize alg_key_len for IPComp states, prevent OOB read"

* tag 'net-7.2-rc1' of git://git.kernel.org/pub/scm/linux/kernel/git/netdev/net: (213 commits)
  selftests: bonding: add a test for VLAN propagation over a bonded real device
  vlan: defer real device state propagation to netdev_work
  net: add the driver-facing netdev_work scheduling API
  net: turn the rx_mode work into a generic netdev_work facility
  net: ethtool: keep rtnl_lock for ops using ethtool_op_get_link()
  rxrpc: Fix rxrpc_rotate_tx_rotate() to check there's something to rotate
  rxrpc: Fix leak of released call in recvmsg(MSG_PEEK)
  rxrpc: Fix socket notification race
  rxrpc: Fix potential infinite loop in rxrpc_recvmsg()
  rxrpc: Fix oob challenge leak in cleanup after notification failure
  rxrpc: Fix the reception of a reply packet before data transmission
  afs: Fix uncancelled rxrpc OOB message handler
  afs: Fix further netns teardown to cancel the preallocation charger
  rxrpc: Fix double unlock in rxrpc_recvmsg()
  rxrpc: Fix leak of connection from OOB challenge
  rxrpc: Fix ACKALL packet handling
  net: hns3: differentiate autoneg default values between copper and fiber
  net: hns3: fix permanent link down deadlock after reset
  net: hns3: refactor MAC autoneg and speed configuration
  net: hns3: unify copper port ksettings configuration path
  ...
 2026-06-25 12:25:36 -07:00
Linus Torvalds
c75597caad s390: 
* Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
   unrelated capabilities
 
 * Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
   memory corruption in some scenarios
 
 * A bunch of misc gmap fixes (locking, behaviour under memory pressure)
 
 * Fix CMMA dirty tracking
 
 x86:
 
 * Tidy up some WARN_ON() and BUG_ON(), replacing them with WARN_ON_ONCE()
   or KVM_BUG_ON().  All of these have obviously never triggered, or
   somebody would have been annoyed earlier, but still.
 
 * Fix missing interrupt due to stale CR8 intercept
 
 * Add a statistic that can come in handy to debug leaks as well as the
   vulnerability to a class of recently-discovered issues.
 
 * Do not ask arch/x86/kernel to export default_cpu_present_to_apicid()
   just for KVM.
 -----BEGIN PGP SIGNATURE-----
 
 iQFIBAABCgAyFiEE8TM4V0tmI4mGbHaCv/vSX3jHroMFAmo7xaAUHHBib256aW5p
 QHJlZGhhdC5jb20ACgkQv/vSX3jHroN7bwf/Ua6PrRrgdzfUGiIruBDnFGtXnaKf
 UPGpgl35Kl4ntPlmH6wRG6N0jP9sloa17Qj/Y33O1Um3Mi/eDV0UESW8o8tfFE2J
 CWUPc3/adw2urhnkXsoleSFy21a89TgLd0p4tot832p+IHi3iNJ45fx7XxftBeGt
 fa/liscncEX5tGwie0ZVkIEE/ob3+eX4ZYsTLXMi6FxAlyGPYNrp4jwJeYH9AFSd
 ZYGqVbDjDq14vhnppKXM8DMfHTXN4OVYw2RJZ9Y7u2h7ku3sN0XakzVTAUz5gtoM
 h+iu8dn5yslODBZiNGlls8UYm2bweOBCumH1ZITe/eTNuEdUOJGILorKRw==
 =QzfV
 -----END PGP SIGNATURE-----

Merge tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm

Pull kvm fixes from Paolo Bonzini:
 "s390:

   - Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
     unrelated capabilities

   - Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
     memory corruption in some scenarios

   - A bunch of misc gmap fixes (locking, behaviour under memory
     pressure)

   - Fix CMMA dirty tracking

  x86:

   - Tidy up some WARN_ON() and BUG_ON(), replacing them with
     WARN_ON_ONCE() or KVM_BUG_ON(). All of these have obviously never
     triggered, or somebody would have been annoyed earlier, but still...

   - Fix missing interrupt due to stale CR8 intercept

   - Add a statistic that can come in handy to debug leaks as well as
     the vulnerability to a class of recently-discovered issues

   - Do not ask arch/x86/kernel to export
     default_cpu_present_to_apicid() just for KVM"

* tag 'for-linus' of git://git.kernel.org/pub/scm/virt/kvm/kvm: (22 commits)
  x86/apic: KVM: Use cpu_physical_id() to get APIC ID of running vCPU for AVIC
  KVM: x86/mmu: Expose number of shadow MMU shadow pages as a stat
  KVM: x86: Unconditionally recompute CR8 intercept on PPR update
  KVM: VMX: Grab vmcs12 on CR8 interception update iff vCPU is in guest mode
  KVM: x86: WARN (once) if RTC pending EOI tracking goes off the rails
  KVM: x86: WARN and fail kvm_set_irq() if a PIC or I/O APIC vector is invalid
  KVM: x86: Bug the VM, not the kernel, if the ISR count {under,over}flows
  KVM: x86/mmu: Bug the VM, not the host kernel, if KVM write-protects upper SPTEs
  KVM: x86: Replace BUG_ON() with WARN_ON_ONCE() on "bad" nested GPA translation
  KVM: Replace guest-triggerable BUG_ON() in ioeventfd datamatch with get_unaligned()
  KVM: s390: Return failure in case of failure in kvm_s390_set_cmma_bits()
  KVM: s390: selftests: Fix cmma selftest
  KVM: s390: Fix cmma dirty tracking
  KVM: s390: Fix locking in kvm_s390_set_mem_control()
  KVM: s390: Fix handle_{sske,pfmf} under memory pressure
  KVM: s390: Fix code typo in gmap_protect_asce_top_level()
  KVM: s390: Do not set special large pages dirty
  KVM: s390: Fix dat_peek_cmma() overflow
  s390/mm: Fix handling of _PAGE_UNUSED pte bit
  KVM: s390: Fix typo in UCONTROL documentation
  ...
 2026-06-25 10:21:13 -07:00
Jakub Kicinski
e83d0a2472 selftests: bonding: add a test for VLAN propagation over a bonded real device 
Add a regression test for the VLAN notifier handling that the netdev_work
deferral fixed.

A VLAN's real device propagates its UP/DOWN, MTU and feature changes onto
the VLANs stacked on top of it. This used to be done synchronously from the
real device's notifier and deadlocked when the real device was brought up
while enslaved to a bond (instance lock held across NETDEV_UP) and the VLAN
on top was itself a bond member: the synchronous propagation re-entered the
stack and took the same instance lock again.

The test covers both halves:
 - that the deferred UP/DOWN, MTU and feature propagation actually lands on
   the VLAN (link state and MTU use an ops-locked dummy, i.e. the deferral
   path; features use veth, which exports vlan_features to inherit), and
 - that the deadlock-prone topology - a VLAN on a dummy, with the VLAN and
   the dummy each enslaved to a different bond - can be built without
   hanging.

Reviewed-by: Aleksandr Loktionov <aleksandr.loktionov@intel.com>
Acked-by: Stanislav Fomichev <sdf@fomichev.me>
Link: https://patch.msgid.link/20260624182018.2445732-5-kuba@kernel.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-25 10:18:40 -07:00
Linus Torvalds
da07894d1d A handful of late-arriving docs fixes, along with one document update 
that fell through the cracks before.
 -----BEGIN PGP SIGNATURE-----
 
 iQFDBAABCgAtFiEEIw+MvkEiF49krdp9F0NaE2wMflgFAmo9JLAPHGNvcmJldEBs
 d24ubmV0AAoJEBdDWhNsDH5Y78sH/jWxQF61bEtdwa4RbO8xw/4j2HK2GPguynK+
 ctdYQE0V6lLwcsPyvu5IPoHXXJ+z3RAyNkRu/n6/LTIFGQ0Z4lXOyu3fjVYhC2Tw
 QXVWp0G1Wb5gHVdW9g2KwXWv2U/9Z2HIftr3RlXbr+Zt8aIn+A4kqsjuQI5y7Dlu
 4aTRI0xjeRhSZHUT1dwlaqV9vH3MB/lgwmnbHCKF2uxuRK3K/1HfNppnPdBkmKyA
 bru70pdw7PR+m87H+9sCr99T4YfrLFGRdOdM/pO+BsmmuSeC8SIWKaAHKWQJAn1A
 WGZdnuiZON8jV9RpwRK7BSeW/k7QxjO9TYxM96xBLQQuAo2REec=
 =jpJf
 -----END PGP SIGNATURE-----

Merge tag 'docs-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux

Pull more documentation updates from Jonathan Corbet:
 "A handful of late-arriving docs fixes, along with one document update
  that fell through the cracks before"

* tag 'docs-7.2-2' of git://git.kernel.org/pub/scm/linux/kernel/git/docs/linux:
  docs: tools: Fix typo 'ackward' to 'awkward' in unittest.rst
  kdoc: xforms: ignore special static/inline macros
  kdoc: xforms_lists: handle DECLARE_PER_CPU() in kernel-doc
  MAINTAINERS: Fix regex for kdoc
  docs: kgdb: Fix path of driver options
  Documentation: tracing: fix typo in events documentation
  Docs/driver-api/uio-howto: document mmap_prepare callback
  docs/mm: clarify that we are not looking for LLM generated content
  kernel-doc: xforms: support __SYSFS_FUNCTION_ALTERNATIVE()
 2026-06-25 09:09:38 -07:00
Nirmoy Das
3e52f56875 selftests: tls: size splice_short pipe by page size 
splice_short grows its pipe with (MAX_FRAGS + 1) * 0x1000 so it can
queue one short vmsplice() buffer for each fragment before draining the
pipe. That assumes 4K pipe buffers.

On 64K-page kernels the request is rounded to 262144 bytes, which
provides only four pipe buffers. The fifth one-byte vmsplice() blocks in
pipe_wait_writable and the test times out before it reaches the TLS path.

Request enough bytes for the same number of pipe buffers using the
runtime page size, and assert that the kernel granted at least that much.
If an unprivileged run cannot raise the pipe above the system
pipe-max-size limit, skip the test because it cannot exercise the
intended path.

Fixes: 3667e9b442 ("selftests: tls: add test for short splice due to full skmsg")
Signed-off-by: Nirmoy Das <nirmoyd@nvidia.com>
Reviewed-by: Simon Horman <horms@kernel.org>
Link: https://patch.msgid.link/20260624134416.3235403-1-nirmoyd@nvidia.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-25 09:01:58 -07:00
Tiezhu Yang
262a3b4fa1 selftests/bpf: Test jited inline of bpf_get_smp_processor_id() for LoongArch 
Add the testcase for the jited inline of bpf_get_smp_processor_id(),
only for LoongArch currently.

Here is the test result on LoongArch:

  $ sudo ./test_progs -t verifier_jit_inline
  #604/1   verifier_jit_inline/inline_bpf_get_current_task:OK
  #604/2   verifier_jit_inline/inline_bpf_get_smp_processor_id:OK
  #604     verifier_jit_inline:OK
  Summary: 1/2 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2026-06-25 13:08:58 +08:00
Tiezhu Yang
689c121446 selftests/bpf: Test jited inline of bpf_get_current_task() for LoongArch 
Add the jited inline instruction of bpf_get_current_task() for LoongArch
to pass the test case.

Before:

  $ sudo ./test_progs -t verifier_jit_inline
  #604/1   verifier_jit_inline/inline_bpf_get_current_task:SKIP
  #604     verifier_jit_inline:SKIP
  Summary: 1/0 PASSED, 1 SKIPPED, 0 FAILED

After:

  $ sudo ./test_progs -t verifier_jit_inline
  #604/1   verifier_jit_inline/inline_bpf_get_current_task:OK
  #604     verifier_jit_inline:OK
  Summary: 1/1 PASSED, 0 SKIPPED, 0 FAILED

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2026-06-25 13:08:58 +08:00
Tiezhu Yang
d5381d2dd4 selftests/bpf: Add __arch_loongarch to limit test cases for LoongArch 
Make it possible to limit certain tests to LoongArch, just like it is
already done for x86_64, arm64, riscv64, and s390x.

This is a follow up patch of:

  commit ee7fe84468 ("selftests/bpf: __arch_* macro to limit test cases to specific archs")
  commit 1e4e6b9e26 ("selftests/bpf: Add __arch_s390x macro")

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2026-06-25 13:08:57 +08:00
Tiezhu Yang
edc5cb8b2b selftests/bpf: Add get_preempt_count() support for LoongArch 
There is no LoongArch support for get_preempt_count() currently and its
fallback path always returns 0, just add it so that bpf_in_interrupt(),
bpf_in_nmi(), bpf_in_hardirq(), bpf_in_serving_softirq(), bpf_in_task()
work for LoongArch as well.

The latest kernels select CONFIG_THREAD_INFO_IN_TASK, it can just read
preempt_count from the thread_info which is embedded within task_struct.

With this patch, "./test_progs -t exe_ctx" passes on LoongArch.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
Signed-off-by: Huacai Chen <chenhuacai@loongson.cn>
 2026-06-25 13:08:57 +08:00
Jakub Kicinski
02f144fbb4 netfilter pull request 26-06-23 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEjF9xRqF1emXiQiqU1w0aZmrPKyEFAmo7AFcACgkQ1w0aZmrP
 KyGwJQ/+IbMU5lwz7IY3Xdp6TTJyRYj6IF47tRpygts73bmFAfgxpkHw8Kjly2gu
 outN2xyYJKZ/yeIbDZDCC7FVNFS/LUjV0+AeIj78LIfmaf/a33T6gg92vfiQdB2I
 rhNEx23rho3aVN5seRpkdATwNAflt3hG+GLAToRMDf1CgQnN8w+wvyOXdg1tAJXP
 ArmgSS2ILhe8shrLp51csg9rFyPYiF4P9IQnHNVYanVjfIseHz2YIkR4ynHKMhts
 eThPDHDN6k60K+gVMGPIA6n0OFaRdVH/BRqRvlvYJW4Y35YxDLUa6OmN0MErrsWa
 Fd2isoD6MZYD5MTeYFc8Mz/zxyVj1/AZwYsqYDqGUhrW1bKhsjK4BtNkffIkFjP1
 xTrEDnP0+8qKMRbN1kXTlkf4FYM+8gml+mOP47usJlO3aG5iiSXYa9yFy6mfo7vX
 B8rjANFfM42eMQNrMZw5xYER8AXbMAOcMZoWnhvYbHrlDY8QIpGhMHnvfn1MykmC
 jTZ3mQUBYxFniHP8kL+XstCIqr5rmb6Me6obOWYRfZOEWGhpxcZOG070uDgcRbdN
 A906pag1SLPQAD997/7pxdjiN9PyLoFi+16Lkguzpk/dVdDBbCJhaXTGTVT8oleu
 Nu+tj6sXh8Dy1m2BXOCFglDRde/7QTlFwOytrpyAg7gM9Y29Nqw=
 =BXU0
 -----END PGP SIGNATURE-----

Merge tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf

Pablo Neira Ayuso says:

====================
Netfilter fixes for net

The following patchset contains Netfilter fixes for net:

1) Add a workaround to avoid a possible crash if nf_nat and nft_chain_nat are
   compiled built-in and nf_nat fails to register, allowing nft_chain_nat to
   access the incorrect pernetns area. This is crash specific of all built-in
   compilation. From Matias Krause.

2) Revisit conncount GC optimization for confirmed conntracks, skip GC round
   if IPS_ASSURED is set on. This is addressing an issue for corner case
   use case scenario involving locally generated traffic. No crash, just a
   functionality fix. From Fernando F. Mancera.

3) Validate iph->ihl in flowtable IPIP tunnel support, from Lorenzo Bianconi.
   This a sanity check to bounces back malformed IPIP packets to classic
   forwarding path.

4) Kdoc fixes for x_tables.h, from Randy Dunlap.

5) Use info->options so nft_synproxy_tcp_options() stays on the same local
   snapshot, otherwise eval path can observe inconsistent mix of mss and
   timestamps. From Runyu Xiao.

6) Add conntrack_sctp_collision.sh to cover for SCTP INIT collisions.
   From Yi Chen.

7) Do not allow NFPROTO_UNSPEC targets if family is NFPROTO_BRIDGE in
   nft_compat. This allows to use non-sense targets such as xt_nat leading
   to crash. From Florian Westphal.

8) Add a selftest queueing from bridge family. From Florian Westphal.

9) Do not allow to reset a conntrack helper via ctnetlink. This feature
   antedates the creation of the conntrack-tools, and it is not used
   I don't have a usecase for it, I prefer to remove than fixing it.

10) Add deprecation warning for IPv4 only conntrack helpers for PPTP
    and IRC. From Florian Westphal.

11) Store the master tuple in the expectation object and use it,
    otherwise SLAB_TYPESAFE_RCU rules allow to display incorrect
    master tuple information through ctnetlink.

12) Run expectation eviction when inserting an expectation with no
    helper, this is a fix for the nft_ct custom expectation support.

13) Fix nft_ct custom expectation timeouts, userspace provides a
    timeout in milliseconds but kernel assumes this comes in seconds.
    From Florian Westphal.

14) Cap maximum number of expectations per class to 255 expectations
    per master conntrack at helper registration. This is a fix to
    restrict the maximum number of expectations per master conntrack
    which can be a issue for the new lazy GC expectation approach.

* tag 'nf-26-06-23' of git://git.kernel.org/pub/scm/linux/kernel/git/netfilter/nf:
  netfilter: nf_conntrack_helper: cap maximum number of expectation at helper registration
  netfilter: nft_ct: expectation timeouts are passed in milliseconds
  netfilter: nf_conntrack_expect: run expectation eviction with no helper
  netfilter: nf_conntrack_expect: store master_tuple in expectation
  netfilter: conntrack: add deprecation warnings for irc and pptp trackers
  netfilter: ctnetlink: do not allow to reset helper on existing conntrack
  selftests: nft_queue.sh: add a bridge queue test
  netfilter: nft_compat: ebtables emulation must reject non-bridge targets
  selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test
  netfilter: nft_synproxy: stop bypassing the priv->info snapshot
  netfilter: x_tables.h: fix all kernel-doc warnings
  netfilter: flowtable: Validate iph->ihl in nf_flow_ip4_tunnel_proto()
  netfilter: nf_conncount: prevent connlimit drops for early confirmed ct
  netfilter: nf_nat: avoid invalid nat_net pointer use on failed nf_nat_init()
====================

Link: https://patch.msgid.link/20260623221548.701545-1-pablo@netfilter.org
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-24 19:56:59 -07:00
Thorsten Leemhuis
636838ebb7 tools/ynl: add missing uapi header deps in Makefile.deps 
drm_ras includes drm/drm_ras.h, which is a relatively new header not yet
shipped in most distro kernel-header packages. Without the explicit
entry, the build might fail with a message like this:

  drm_ras-user.c:19:10: error: ‘DRM_RAS_CMD_CLEAR_ERROR_COUNTER’ \
   undeclared here (not in a function); did you mean \
  ‘DRM_RAS_CMD_GET_ERROR_COUNTER’

Signed-off-by: Thorsten Leemhuis <linux@leemhuis.info>
Link: https://patch.msgid.link/20260623070818.2161810-1-linux@leemhuis.info
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-24 19:30:55 -07:00
Greg Thelen
8c37e76f96 tools: ynl: build archives with $(AR) 
Use $(AR) to allow build system to override the archiver tool (e.g.,
when cross-compiling for a different architecture) by setting the AR
environment variable.

GNU Make defaults AR to ar, so this change will not break existing build
environments that do not explicitly set AR.

Fixes: 07c3cc51a0 ("tools: net: package libynl for use in selftests")
Fixes: 86878f14d7 ("tools: ynl: user space helpers")
Signed-off-by: Greg Thelen <gthelen@google.com>
Link: https://patch.msgid.link/20260622161659.145047-1-gthelen@google.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-24 19:22:42 -07:00
Paolo Bonzini
91b16b53a0 KVM: s390: Fix S390_USER_OPEREXEC and more gmap fixes 
-----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEoWuZBM6M3lCBSfTnuARItAMU6BMFAmo7nlMACgkQuARItAMU
 6BPr+A//VLw9/5C2pgKVWRvJRVNcf8kIgAF1feONXJVoJiDGrbyiFcy4oCrppIZi
 OxAB2GvqV7Dbyu+tWH/iqPp3gxLf86sNh8JLkba8puWXP5SElyvVpEADYw8T97pX
 dL6j+9vYptMSTIVrhEYgiS5ghgCW6NymM2/6d+uWOCcPjuCaa2owO7K9fCsaLfAK
 O2D6HeRKEQdDszNKdplloSP5FjNn/t/zdPINclhfHdDNl7zSCF5Z3Y9cWGf+L2vL
 fYUiCPRPGANOreBcGMEBtDif667/U7nwiq7daC1rB+Q0MwRoq4h5jk0130aTTgXs
 hOA2EypipNO/ELO1hPJBNYTaSF1XjJMlrq5FHGkXXC+byWTsoKJgFXYkC9pQVd+r
 dcpu7S9nh9jkjSgc8F1+sNQ3+GHc9XrI214ALYgDr1PIZBevSlXaE3dtcU98+qtH
 IfKkonDEeRc8oZUTVLiINkQtZwtHqDKhqdhn5z508xJw5n+qr2oLEe/76NMjwH+E
 jteqA4WFaS2TGnOVf6IsYVdOQFMuOKrl+Se/M7fE1ZQ41IL4+aWT4gnpz3O+8sg9
 XmgiZJHXRtcH5nXfLbGryoO4HZPvwoV2mv0GmbmMVHBkve5qGqdElCRIQLAVImGc
 77/1DL73Kln7XawIik/MFDkCdt7GG3Qbqu1ALbKObCdJRSiFhzk=
 =OiBj
 -----END PGP SIGNATURE-----

Merge tag 'kvm-s390-next-7.2-2' of https://git.kernel.org/pub/scm/linux/kernel/git/kvms390/linux into HEAD

* Fix S390_USER_OPEREXEC so it can now be enabled regardless of other
  unrelated capabilities

* Fix handling of the _PAGE_UNUSED pte bit that could lead to guest
  memory corruption in some scenarios

* A bunch of misc gmap fixes (locking, behaviour under memory pressure)

* Fix CMMA dirty tracking
 2026-06-24 13:41:41 +02:00
Claudio Imbrenda
125a3d3fac KVM: s390: selftests: Fix cmma selftest 
The existing cmma selftest depended on the host allocating page tables
for all present memslots. Since the gmap rewrite, memory that is not
accessed by the guest might not have page tables allocated yet.

This caused the test to fail due to a mismatch in the assertion.

Fix by having the guest access also the second half of the test
memslot, thus guaranteeing that its page tables are present.

Fixes: e38c884df9 ("KVM: s390: Switch to new gmap")
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260623153331.233784-9-imbrenda@linux.ibm.com>
 2026-06-24 10:08:57 +02:00
Eric Farman
1a4794f17d KVM: s390: selftests: Extended user_operexec tests 
There is a possibility that the user_operexec capability
only works if facility bit 74 is enabled. This is now fixed,
but add a selftest to demonstrate that.

Signed-off-by: Eric Farman <farman@linux.ibm.com>
Acked-by: Janosch Frank <frankja@linux.ibm.com>
Reviewed-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Signed-off-by: Claudio Imbrenda <imbrenda@linux.ibm.com>
Message-ID: <20260507200836.3500368-3-farman@linux.ibm.com>
 2026-06-24 10:01:56 +02:00
Jakub Sitnicki
33a971d549 selftests/bpf: Add LWT encap tests for skb metadata 
Test that an LWT encapsulation does not silently corrupt XDP metadata
sitting in the skb headroom. Exercise all three LWT dispatch paths:

- BPF LWT xmit prog reserves headroom on the LWT .xmit redirect,
- mpls pushes an MPLS label on the LWT .xmit redirect,
- seg6 in encap mode runs on the LWT .input redirect,
- ioam6 encap inserts an IOAM Hop-by-Hop option on LWT .output redirect.

Signed-off-by: Jakub Sitnicki <jakub@cloudflare.com>
Link: https://patch.msgid.link/20260619-bpf-lwt-drop-skb-metadata-v3-2-71d6a33ab76b@cloudflare.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-23 19:07:23 -07:00
Randy Dunlap
d42197c735 kdoc: xforms: ignore special static/inline macros 
drivers/gpu/drm/amd/display/amdgpu_dm/amdgpu_dm_color.c contains 7 (for
now) functions that use STATIC_IFN_KUNIT or INLINE_IFN_KUNIT macros for
function qualifiers (static or not, inline or not).

These cause parse warnings from kernel-doc:
Invalid C declaration: Expected identifier in nested name, got keyword:
  struct [error at 29]
STATIC_IFN_KUNIT const struct drm_color_lut * __extract_blob_lut (const
  struct drm_property_blob *blob, uint32_t *size)

Handle these in kernel-doc to prevent multiple warnings.

Fixes: 647d1fd046 ("drm/amd/display: Add KUnit test for color helpers")
Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260612234458.1084156-1-rdunlap@infradead.org>
 2026-06-23 14:41:52 -06:00
Tushar Vyavahare
ea4e9c9d8b selftests/xsk: restore shared_umem after POLL_TXQ_FULL 
POLL_TXQ_FULL temporarily disables shared_umem on TX to exercise the
TX timeout path in isolation.

With shared_umem enabled, TX setup expects RX UMEM to be initialized
first and fails with: "RX UMEM is not initialized before shared-UMEM TX
setup".

Save and restore shared_umem around POLL_TXQ_FULL execution, and restore
it on both success and pkt_stream_replace() failure paths.

Also add an in-code comment explaining why shared_umem is temporarily
disabled in this test.

This keeps timeout setup local and prevents cross-test state leakage.

Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20260616154955.1492560-4-tushar.vyavahare@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-23 13:40:45 -07:00
Tushar Vyavahare
483c1405f8 selftests/xsk: fix timeout thread harness sequencing 
Prevent workers from running before XDP program attachment completes.
The previous ordering allowed races between worker startup and setup.

Attach XDP programs before entering traffic validation.

Remove SIGUSR1-based worker termination and use pthread_join() for
thread shutdown so blocking syscalls are not interrupted.

Use barriers only for dual-thread runs so participants match and
teardown ordering stays deterministic.

This removes setup/startup races and stabilizes harness sequencing.

Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20260616154955.1492560-3-tushar.vyavahare@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-23 13:40:44 -07:00
Tushar Vyavahare
b56cded131 selftests/xsk: make poll timeout mode explicit 
Stop inferring timeout behavior from RX UMEM initialization state.
That ties timeout semantics to setup internals and obscures intent.

Use test_spec::poll_tmout as the explicit timeout-mode selector in
TX and RX paths.

In RX, treat poll timeout as expected only in timeout mode.
In TX, let send_pkts() own loop completion in non-timeout mode
and use __send_pkts() only for progress and timeout detection.

This makes timeout logic explicit and keeps control flow predictable.

Signed-off-by: Magnus Karlsson <magnus.karlsson@intel.com>
Signed-off-by: Tushar Vyavahare <tushar.vyavahare@intel.com>
Reviewed-by: Jason Xing <kerneljasonxing@gmail.com>
Acked-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Tested-by: Maciej Fijalkowski <maciej.fijalkowski@intel.com>
Link: https://patch.msgid.link/20260616154955.1492560-2-tushar.vyavahare@intel.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-23 13:40:40 -07:00
Randy Dunlap
da5e67d0e1 kdoc: xforms_lists: handle DECLARE_PER_CPU() in kernel-doc 
Add support for DECLARE_PER_CPU() as a var (variable) as used in
<linux/netfilter/x_tables.h>.

Warning: include/linux/netfilter/x_tables.h:345 function parameter 'seqcount_t' not described in 'DECLARE_PER_CPU'
Warning: include/linux/netfilter/x_tables.h:345 function parameter 'xt_recseq' not described in 'DECLARE_PER_CPU'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260614052452.1557987-1-rdunlap@infradead.org>
 2026-06-23 14:37:25 -06:00
Linus Torvalds
7603d8e780 sched_ext: Source tree reorganization for v7.2 
Follow-up to the v7.2 sched_ext pull. Pure source reorganization with no
 functional change: the kernel/sched/ext* files move into a new
 kernel/sched/ext/ subdirectory, and the headers and sources are made
 self-contained so editor tooling can parse each file on its own.
 -----BEGIN PGP SIGNATURE-----
 
 iIQEABYKACwWIQTfIjM1kS57o3GsC/uxYfJx3gVYGQUCajmn3w4cdGpAa2VybmVs
 Lm9yZwAKCRCxYfJx3gVYGYRyAP4qs7Xlkva8ppSiJX/nja4OpQixpCZ1zi1yPDGK
 iaJ+tQEA+bnkb2QI0Cwd9l+kY12/kl8gHUfqG0UPVyyEOvAeXgs=
 =MvGz
 -----END PGP SIGNATURE-----

Merge tag 'sched_ext-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext

Pull sched_ext tree reorg from Tejun Heo:
 "Pure source reorganization with no functional change:

   - the kernel/sched/ext* files move into a new kernel/sched/ext/
     subdirectory

   - the headers and sources are made self-contained so editor tooling
     can parse each file on its own"

* tag 'sched_ext-for-7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/tj/sched_ext:
  sched_ext: Move shared helpers from ext.c into internal.h and cid.h
  sched_ext: Make kernel/sched/ext/ sources self-contained for clangd
  sched_ext: Move sources under kernel/sched/ext/
 2026-06-23 13:36:09 -07:00
Randy Dunlap
3b61bb3fe1 kernel-doc: xforms: support __SYSFS_FUNCTION_ALTERNATIVE() 
Add support for __SYSFS_FUNCTION_ALTERNATIVE() to create a union of its
members (as though CONFIG_CFI is unset).

Fixes these docs build warnings:

WARNING: include/linux/device.h:117 Invalid param: __SYSFS_FUNCTION_ALTERNATIVE( ssize_t (*show)(struct device *dev, struct device_attribute *attr, char *buf)
WARNING: include/linux/device.h:117 struct member '__SYSFS_FUNCTION_ALTERNATIVE( ssize_t (*show' not described in 'device_attribute'
WARNING: include/linux/device.h:117 Invalid param: __SYSFS_FUNCTION_ALTERNATIVE( ssize_t (*store)(struct device *dev, struct device_attribute *attr, const char *buf, size_t count)
WARNING: include/linux/device.h:117 struct member '__SYSFS_FUNCTION_ALTERNATIVE( ssize_t (*store' not described in 'device_attribute'

Signed-off-by: Randy Dunlap <rdunlap@infradead.org>
Reviewed-by: Thomas Weißschuh <linux@weissschuh.net>
Signed-off-by: Jonathan Corbet <corbet@lwn.net>
Message-ID: <20260623190006.406571-1-rdunlap@infradead.org>
 2026-06-23 14:31:25 -06:00
Linus Torvalds
a1a8bab741 mm.git review status for linus..mm-stable 
Everything:
 
 Total patches:       118
 Reviews/patch:       1.57
 Reviewed rate:       62%
 
 Excluding DAMON:
 
 Total patches:       117
 Reviews/patch:       1.58
 Reviewed rate:       63%
 
 Excluding DAMON and selftests:
 
 Total patches:       42
 Reviews/patch:       3.14
 Reviewed rate:       92%
 
 Patch series in this merge:
 
 - The 14 patch series "khugepaged: add mTHP collapse support" from Nico
   Pache provides khugepaged with the capability to collapse anonymous
   memory regions to mTHPs.
 
 - The 14 patch series "Remove CONFIG_READ_ONLY_THP_FOR_FS and enable
   file THP for writable files" from Zi Yan ends up removing the
   READ_ONLY_THP_FOR_FS check in file_thp_enabled(), so that khugepaged and
   MADV_COLLAPSE can run on FSes with PMD THP pagecache support even
   without READ_ONLY_THP_FOR_FS enabled.
 
 - The 55 patch series "make MM selftests more CI friendly" from Mike
   Rapoport provides general fixes and cleanups to the MM selftests.  It
   also moves more MM selftests uder the kselftest framework, making them
   more amenable to ongoing CI testing.
 
 - The 13 patch series "selftests/mm: fix failures and robustness
   improvements" from Sayali Patil fixes several issues in MM selftests
   which were revealed by powerpc 64k pagesize.
 
 - The 3 patch series "selftests/mm: assorted fixes for hmm-tests" from
   Sayali Patil fixes more 64k pagesize issues in the MM selftests.
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQTTMBEPP41GrTpTJgfdBJ7gKXxAjgUCajqsgwAKCRDdBJ7gKXxA
 jlNoAP0bM125zRNpqy13hUYfofQQg8lC9k7cfEHqVtvD/dpaKgD/Xbjd8AUGbwjs
 qoj3nNmUOfGFPubPZsU6YSFyVsYfzwM=
 =T44n
 -----END PGP SIGNATURE-----

Merge tag 'mm-stable-2026-06-23-08-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm

Pull more MM updates from Andrew Morton:

 - "khugepaged: add mTHP collapse support" (Nico Pache)

   Provide khugepaged with the capability to collapse anonymous memory
   regions to mTHPs

 - "Remove CONFIG_READ_ONLY_THP_FOR_FS and enable file THP for writable
   files" (Zi Yan)

   Remove the READ_ONLY_THP_FOR_FS check in file_thp_enabled(), so that
   khugepaged and MADV_COLLAPSE can run on filesystems with PMD THP
   pagecache support even without READ_ONLY_THP_FOR_FS enabled

 - "make MM selftests more CI friendly" (Mike Rapoport)

   General fixes and cleanups to the MM selftests. Also move more MM
   selftests under the kselftest framework, making them more amenable to
   ongoing CI testing

 - "selftests/mm: fix failures and robustness improvements" and
   "selftests/mm: assorted fixes for hmm-tests" (Sayali Patil)

   Fix several issues in MM selftests which were revealed by powerpc 64k
   pagesize

* tag 'mm-stable-2026-06-23-08-55' of git://git.kernel.org/pub/scm/linux/kernel/git/akpm/mm: (118 commits)
  Revert "mm: limit filemap_fault readahead to VMA boundaries"
  mm/vmscan: pass NULL to trace vmscan node reclaim
  mm: use mapping_mapped to simplify the code
  selftests/mm: fix exclusive_cow test fork() handling
  selftests/mm: remove hardcoded THP sizing assumptions in hmm tests
  selftests/mm: allow PUD-level entries in compound testcase of hmm tests
  mm/gup_test: reject wrapped user ranges
  mm/page_frag: reject invalid CPUs in page_frag_test
  mm/damon/core: always put unsuccessfully committed target pids
  mm: page_isolation: avoid unsafe folio reads while scanning compound pages
  mm/shrinker: do not hold RCU lock in shrinker_debugfs_count_show()
  selftests: mm: fix and speedup "droppable" test
  mm: merge writeout into pageout
  MAINTAINERS: add Hao Ge as reviewer for codetag and alloc_tag
  selftests/mm: clarify alternate unmapping in compaction_test
  selftests/mm: move hwpoison setup into run_test() and silence modprobe output for memory-failure category
  selftests/mm: skip uffd-stress test when nr_pages_per_cpu is zero
  selftests/mm: skip uffd-wp-mremap if UFFD write-protect is unsupported
  selftests/mm: ensure destination is hugetlb-backed in hugetlb-mremap
  selftest/mm: register existing mapping with userfaultfd in hugetlb-mremap
  ...
 2026-06-23 12:03:44 -07:00
Linus Torvalds
05d2a3da15 perf tools changes for v7.2: 
- Introduce 'perf inject --aslr' to remap ASLR-randomized
   addresses in perf.data files, enabling reproducible analysis
   across runs with different address space layouts.
 
 - Refactor evsel out of sample processing paths: store evsel in
   struct perf_sample and remove the redundant evsel parameter from
   tool APIs, tracepoint handlers, hist entry iterators, and
   db-export, simplifying the entire tool callback chain.
 
 - Switch architecture detection from string-based perf_env__arch()
   comparisons to the numeric ELF e_machine field across the
   codebase (capstone, print_insn, c2c, lock-contention, sort,
   sample-raw, machine, header), making cross-analysis more robust.
 
 - Overhaul ARM CoreSight ETM tests: add deterministic and
   named_threads workloads, speed up basic and disassembly tests,
   add process attribution and concurrent threads tests, remove
   unused workloads and duplicate tests, queue context packets for
   the frontend decoder.
 
 - Add ARM SPE IMPDEF event decoding for Arm Neoverse N1, store
   MIDR in arm_spe_pkt for per-CPU event mapping, handle missing
   CPU IDs gracefully.
 
 - Refactor libunwind support: remove the libunwind-local backend,
   make register reading cross-platform, add RISC-V libunwind
   support, allow dynamic selection between libdw and libunwind
   unwinding at runtime.
 
 - Extensive hardening of perf.data parsing against crafted files:
   add bounds checks and byte-swap validation for session records,
   feature sections, header attributes, BPF metadata, auxtrace
   errors, compressed events, CPU maps, build ID notes, and ELF
   program headers. Add minimum event size validation and file
   offset diagnostics.
 
 - Fix libdw API contract violations across dwarf-aux, libdw,
   probe-finder, annotate-data, and debuginfo subsystems. Fix
   callchain parent update in ORDER_CALLER mode, support DWARF line
   0 in inline lists, handle multiple address spaces in callchains.
 
 - Fix numerous 'perf sched' bugs: thread reference leaks, memory
   leaks, heap overflows with cross-machine recordings, NULL
   dereferences, replace BUG_ON assertions with graceful error
   handling, bounds-check CPU indices, fix SIGCHLD vs pause() races
   in sched stats.
 
 - Overhaul the build system: move BPF skeleton generation out of
   Makefile.perf into bpf_skel.mak, decouple pmu-events from the
   prepare target, make beauty generated C code standalone .o files,
   compile BPF skeletons with -mcpu=v3, fix continuous rebuilds,
   various cleanups.
 
 - Add 'perf test' JUnit XML reporting with -j/--junit option, split
   monolithic test suites into sub-tests, add summary reporting,
   refactor parallel poll loop, fix test failures on musl-based
   systems.
 
 - Fix 'perf c2c' memory leaks in hist entry and format list
   handling, use-after-free in error paths, bounds-check CPU and
   node IDs.
 
 - Fix 'perf bpf' metadata leaks on duplicate insert and alloc
   failure, bounds-check array offsets, validate event sizes and
   func_info fields, add NULL checks.
 
 - Fix hwmon PMU: off-by-one null termination on sysfs reads,
   strlcpy buffer overflow in parse_hwmon_filename(), fd 0 check,
   empty label reads, scnprintf usage.
 
 - Fix symbols subsystem: bounds-check ELF and sysfs build ID note
   iteration, validate p_filesz, fix 32-bit ELF bswap error, fix
   signed overflow in size checks, bounds-check .gnu_debuglink
   section.
 
 - Fix tools lib api: null termination in filename__read_int/ull(),
   uninitialized stack data in filename__write_int(), snprintf
   truncation in mount_overload().
 
 - Replace libbabeltrace with babeltrace2-ctf-writer for CTF
   conversion in 'perf data'.
 
 - Add RISC-V SDT argument parsing for static tracepoints.
 
 - Add 'perf trace --show-cpu' option to display CPU id.
 
 - Add 'perf bench sched pipe --write-size' option.
 
 - Add a perf-specific .clang-format that overrides some kernel
   style behaviors.
 
 - Update Intel vendor events for Alder Lake, Arrow Lake, Clearwater
   Forest, Emerald Rapids, Granite Rapids, Grand Ridge, Lunar Lake,
   Meteor Lake, Panther Lake, Sapphire Rapids, Sierra Forest.
 
 - Add IOMMU metrics for AMD and Intel.
 
 - Fix AMD event: switch l2_itlb_misses to
   bp_l1_tlb_miss_l2_tlb_miss.all.
 
 - Add AMD IBS improvements: decode Streaming-store and
   Remote-Socket flags, suppress bogus fields on Zen4+, skip
   privilege test on Zen6+.
 
 - Fix 'perf lock contention' SIGCHLD vs pause() race, allow
   'mmap_lock' in -L filter, enable end-timestamp for cgroup
   aggregation, fix non-atomic data updates.
 
 - Fix 'perf stat' false NMI watchdog warning in aggregation modes,
   bounds-check CPU index in topology callbacks, add aggr_nr metric
   parser support for uncore scaling.
 
 - Fix 'perf timechart' memory leaks, CPU bounds checking,
   use-after-free on corrupted callchains.
 
 - Fix 'perf inject' itrace branch stack synthesis, fix synthesized
   sample size with branch stacks.
 
 - Fix DSO heap overflow on decompressed paths, uninitialized
   pathname on fallback, set proper error codes.
 
 - Fix various snprintf/scnprintf usages to prevent buffer overflows
   and truncation across the codebase.
 
 - Fix off-by-one stack buffer overflow in kallsyms__parse().
 
 - Fix 'perf kwork' memory management, address sanitizer issues,
   bounds check work->cpu.
 
 - Fix 'perf tpebs' concurrent stop races and PID reuse hazards.
 
 - Add O_CLOEXEC to open() calls and use mkostemp() for temporary
   files to prevent file descriptor leaks to child processes.
 
 - Fix s390 Python extension TEXTREL by compiling as PIC.
 
 - Fix build with ASAN for jitdump.
 
 - Fix build failure due to btf_vlen() return type change.
 
 Signed-off-by: Arnaldo Carvalho de Melo <acme@redhat.com>
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQR2GiIUctdOfX2qHhGyPKLppCJ+JwUCajmIQAAKCRCyPKLppCJ+
 J/8DAQCHYyodbD+Y+zX2kvaed6EStTTTLN4nyteWVb/3b0UZ5AEA4ECHdgpxgAx8
 h6C+n8m8aAC6LyMgSYJwGm92rGgaewM=
 =CPUX
 -----END PGP SIGNATURE-----

Merge tag 'perf-tools-for-v7.2-1-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools

Pull perf tools updates from Arnaldo Carvalho de Melo:

 - Introduce 'perf inject --aslr' to remap ASLR-randomized addresses in
   perf.data files, enabling reproducible analysis across runs with
   different address space layouts

 - Refactor evsel out of sample processing paths: store evsel in struct
   perf_sample and remove the redundant evsel parameter from tool APIs,
   tracepoint handlers, hist entry iterators, and db-export, simplifying
   the entire tool callback chain

 - Switch architecture detection from string-based perf_env__arch()
   comparisons to the numeric ELF e_machine field across the codebase
   (capstone, print_insn, c2c, lock-contention, sort, sample-raw,
   machine, header), making cross-analysis more robust

 - Overhaul ARM CoreSight ETM tests: add deterministic and named_threads
   workloads, speed up basic and disassembly tests, add process
   attribution and concurrent threads tests, remove unused workloads and
   duplicate tests, queue context packets for the frontend decoder

 - Add ARM SPE IMPDEF event decoding for Arm Neoverse N1, store MIDR in
   arm_spe_pkt for per-CPU event mapping, handle missing CPU IDs
   gracefully

 - Refactor libunwind support: remove the libunwind-local backend, make
   register reading cross-platform, add RISC-V libunwind support, allow
   dynamic selection between libdw and libunwind unwinding at runtime

 - Extensive hardening of perf.data parsing against crafted files: add
   bounds checks and byte-swap validation for session records, feature
   sections, header attributes, BPF metadata, auxtrace errors,
   compressed events, CPU maps, build ID notes, and ELF program headers.
   Add minimum event size validation and file offset diagnostics

 - Fix libdw API contract violations across dwarf-aux, libdw,
   probe-finder, annotate-data, and debuginfo subsystems. Fix callchain
   parent update in ORDER_CALLER mode, support DWARF line 0 in inline
   lists, handle multiple address spaces in callchains

 - Fix numerous 'perf sched' bugs: thread reference leaks, memory leaks,
   heap overflows with cross-machine recordings, NULL dereferences,
   replace BUG_ON assertions with graceful error handling, bounds-check
   CPU indices, fix SIGCHLD vs pause() races in sched stats

 - Overhaul the build system: move BPF skeleton generation out of
   Makefile.perf into bpf_skel.mak, decouple pmu-events from the prepare
   target, make beauty generated C code standalone .o files, compile BPF
   skeletons with -mcpu=v3, fix continuous rebuilds, various cleanups

 - Add 'perf test' JUnit XML reporting with -j/--junit option, split
   monolithic test suites into sub-tests, add summary reporting,
   refactor parallel poll loop, fix test failures on musl-based systems

 - Fix 'perf c2c' memory leaks in hist entry and format list handling,
   use-after-free in error paths, bounds-check CPU and node IDs

 - Fix 'perf bpf' metadata leaks on duplicate insert and alloc failure,
   bounds-check array offsets, validate event sizes and func_info
   fields, add NULL checks

 - Fix hwmon PMU: off-by-one null termination on sysfs reads, strlcpy
   buffer overflow in parse_hwmon_filename(), fd 0 check, empty label
   reads, scnprintf usage

 - Fix symbols subsystem: bounds-check ELF and sysfs build ID note
   iteration, validate p_filesz, fix 32-bit ELF bswap error, fix signed
   overflow in size checks, bounds-check .gnu_debuglink section

 - Fix tools lib api: null termination in filename__read_int/ull(),
   uninitialized stack data in filename__write_int(), snprintf
   truncation in mount_overload()

 - Replace libbabeltrace with babeltrace2-ctf-writer for CTF conversion
   in 'perf data'

 - Add RISC-V SDT argument parsing for static tracepoints

 - Add 'perf trace --show-cpu' option to display CPU id

 - Add 'perf bench sched pipe --write-size' option

 - Add a perf-specific .clang-format that overrides some kernel style
   behaviors

 - Update Intel vendor events for Alder Lake, Arrow Lake, Clearwater
   Forest, Emerald Rapids, Granite Rapids, Grand Ridge, Lunar Lake,
   Meteor Lake, Panther Lake, Sapphire Rapids, Sierra Forest

 - Add IOMMU metrics for AMD and Intel

 - Fix AMD event: switch l2_itlb_misses to
   bp_l1_tlb_miss_l2_tlb_miss.all

 - Add AMD IBS improvements: decode Streaming-store and Remote-Socket
   flags, suppress bogus fields on Zen4+, skip privilege test on Zen6+

 - Fix 'perf lock contention' SIGCHLD vs pause() race, allow 'mmap_lock'
   in -L filter, enable end-timestamp for cgroup aggregation, fix
   non-atomic data updates

 - Fix 'perf stat' false NMI watchdog warning in aggregation modes,
   bounds-check CPU index in topology callbacks, add aggr_nr metric
   parser support for uncore scaling

 - Fix 'perf timechart' memory leaks, CPU bounds checking,
   use-after-free on corrupted callchains

 - Fix 'perf inject' itrace branch stack synthesis, fix synthesized
   sample size with branch stacks

 - Fix DSO heap overflow on decompressed paths, uninitialized pathname
   on fallback, set proper error codes

 - Fix various snprintf/scnprintf usages to prevent buffer overflows and
   truncation across the codebase

 - Fix off-by-one stack buffer overflow in kallsyms__parse()

 - Fix 'perf kwork' memory management, address sanitizer issues, bounds
   check work->cpu

 - Fix 'perf tpebs' concurrent stop races and PID reuse hazards

 - Add O_CLOEXEC to open() calls and use mkostemp() for temporary files
   to prevent file descriptor leaks to child processes

 - Fix s390 Python extension TEXTREL by compiling as PIC

 - Fix build with ASAN for jitdump

 - Fix build failure due to btf_vlen() return type change

* tag 'perf-tools-for-v7.2-1-2026-06-22' of git://git.kernel.org/pub/scm/linux/kernel/git/perf/perf-tools: (343 commits)
  perf bpf: Fix up build failure due to change of btf_vlen() return type
  perf dso: Set standard errno on decompression failure
  perf bpf: Validate array presence before casting BPF prog info pointers
  perf c2c: Fix hist entry and format list leaks in c2c_he_free()
  perf c2c: Free format list entries when c2c_hists__init() fails
  perf cs-etm: Bounds-check CPU in cs_etm__get_queue()
  perf cs-etm: Require full global header in auxtrace_info size check
  perf cs-etm: Validate num_cpu before metadata allocation
  perf machine: Use snprintf() for guestmount path construction
  perf machine: Propagate machine__init() error to callers
  perf trace: Guard __probe_ip suppression with evsel__is_probe()
  perf evsel: Add lazy-initialized probe type detection helpers
  perf evsel: Add no-libtraceevent stubs for evsel__field() and evsel__common_field()
  perf cs-etm: Reject CPU IDs that would overflow signed comparison
  perf c2c: Free format list entries when releasing c2c hist entries
  perf bpf: Bounds-check array offsets in bpil_offs_to_addr()
  perf bpf: Reject oversized BPF metadata events that truncate header.size
  perf bpf: Validate func_info_rec_size and sub_id in synthesize_bpf_prog_name()
  perf sched: Replace (void*)1 sentinel with proper runtime allocation
  perf hwmon: Fix fd check to accept fd 0 in hwmon_pmu__describe_items()
  ...
 2026-06-23 11:34:49 -07:00
Linus Torvalds
f31c00c377 platform-drivers-x86 for v7.2-1 
Highlights:
 
 - amd/hfi: Add support for dynamic ranking tables (version 3)
 
 - amd/pmc:
   - Add PMC driver support for AMD 1Ah M80H SoC
   - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
     switch problems after s2idle
 
 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver
 
 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR
 
 - asus-wmi: add keystone dongle support
 
 - dell-dw5826e: Add reset driver for DW5826e
 
 - dell-laptop: Fix rollback path
 
 - hp-wmi:
   - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F
 
 - intel-hid:
   - Add HP ProBook x360 440 G1 5 button array support
   - Prevent racing ACPI notify handlers
 
 - intel/pmc:
   - Add Nova Lake support
   - Rate-limit LTR scale-factor warning
 
 - intel-uncore-freq:
   - Expose instance ID in the sysfs
   - Fix current_freq_khz after CPU hotplug
 
 - intel/vsec: Restore BAR fallback for header walk
 
 - ISST: Restore SST-PP control to all domains
 
 - lenovo-wmi-*:
   - Add more CPU tunable attributes
   - Add GPU tunable attributes
   - Add WMI battery charge limiting
 
 - oxpec: add support for OneXPlayer Super X
 
 - sel3350-platform: Retain LED state on load and unload
 
 - surface: SAM: Add support for Surface Pro 12in
 
 - uniwill-laptop: Add support for battery charge modes
 
 - tools/power/x86/intel-speed-select: Harden daemon pidfile open
 
 - Major refactoring efforts:
   - ACPI driver to platform driver conversion
   - Converting drivers to use the improved WMI API
 
 - Miscellaneous cleanups / refactoring / improvements
 
 The following is an automated shortlog grouped by driver:
 
 ACPI:
  -  provide acpi_bus_find_device_by_name()
 
 alienware-wmi-base:
  -  Transition to new WMI API
 
 amd: hfi:
  -  Support for ranking table versions
 
 amd/hsmp:
  -  Clamp ioctl/send_message indices (Spectre v1)
 
 amd/pmc:
  -  Add delay_suspend module parameter
  -  Add PMC driver support for AMD 1Ah M80H SoC
  -  Check for intermediate wakeup in function
  -  Delay suspend for some Lenovo Laptops
  -  Don't log during intermediate wakeups
  -  Use per-SoC cpu_info struct for SMU mailbox and IP info
 
 apple-gmux:
  -  Drop unused assignment of pnp_device_id driver data
 
 arm64:
  -  Add driver for EC found on Qualcomm reference devices
 
 arm64: qcom-hamoa-ec:
  -  Fix indentation in comment tables
 
 arm64 Use named initializers for struct i2c_device_id:
  - arm64 Use named initializers for struct i2c_device_id
 
 asus-armoury:
  -  add support for FX608JPR
  -  add support for G614PR
  -  add support for GA402NJ
  -  add support for GA403UM
 
 asus-wmi:
  -  add keystone dongle support
 
 barco-p50-gpio:
  -  attach software node to its target GPIO device
 
 classmate-laptop:
  -  Address memory leaks on driver removal
  -  Convert accel driver to a platform one
  -  Convert ipml driver to a platform one
  -  Convert keys driver to a platform one
  -  Convert tablet driver to a platform one
  -  Convert v4 accel driver to a platform one
  -  Pass struct device pointer to helpers
  -  Register ACPI notify handlers directly
  -  Rename two helper functions
  -  Unify probe rollback and remove code
 
 dell-ddv:
  -  Use new buffer-based WMI API
 
 dell-descriptor:
  -  Use new buffer-based WMI API
 
 dell-dw5826e:
  -  Add reset driver for DW5826e
 
 dell-laptop:
  -  add Inspiron N5110 to touchpad LED quirk table
  -  fix missing cleanups in init error path
 
 dell-privacy:
  -  correct CONFIG_DELL_WMI_PRIVACY macro name in comments
  -  Use new buffer-based WMI API
 
 dell_rbu:
  -  use strscpy in image_type_write
 
 dell-smbios-wmi:
  -  Use new buffer-based WMI API
 
 dell-wmi-base:
  -  Use new buffer-based WMI API
 
 docs:
  -  fix typo in uniwill-laptop.rst
 
 hp-wmi:
  -  Add support for Omen 16-ap0xxx (8D26)
  -  Add support for Omen 16-ap0xxx (8E35)
  -  Add thermal support for board 8B2F
 
 hwmon:
  -  (dell-smm) Use new buffer-based WMI API
 
 intel-hid:
  -  Add HP ProBook x360 440 G1 to button_array_table
  -  Protect ACPI notify handler against recursion
 
 intel/pmc:
  -  Add ACPI PWRM telemetry driver for Nova Lake S
  -  Add Nova Lake support to intel_pmc_core driver
  -  Add NVL PCI IDs for SSRAM telemetry discovery
  -  Add PMC SSRAM Kconfig description
  -  Add support for variable DMU offsets
  -  Enable Pkgc blocking residency counter
  -  Enable PkgC LTR blocking counter
  -  rate-limit LTR scale-factor warning
  -  Retrieve PMC info only for available PMCs
 
 intel/pmc/ssram:
  -  Add ACPI discovery scaffolding
  -  Add PCI platform data
  -  Make PMT registration optional
  -  Refactor DEVID/PWRMBASE extraction into helper
  -  Rename probe and PCI ID table for consistency
  -  Switch to static array with per-index probe state
 
 intel/pmc:
  -  Use __free() in pmc_core_punit_pmt_init()
  -  Use PCI DID for PMC SSRAM device discovery
 
 intel/pmt:
  -  Add pre/post decode hooks around header parsing
  -  Cache the telemetry discovery header
 
 intel/pmt/crashlog:
  -  Split init into pre-decode
 
 intel/pmt:
  -  Pass discovery index instead of resource
 
 intel/pmt/telemetry:
  -  Move overlap check to post-decode hook
 
 intel/pmt:
  -  Unify header fetch and add ACPI source
 
 intel/tpmi:
  -  convert mutex in mem_write() to guard
  -  use cleanup helpers in mem_write()
 
 intel-uncore-freq:
  -  Expose instance ID in the sysfs
  -  Fix current_freq_khz after CPU hotplug
  -  Rename instance_id
 
 intel/vsec:
  -  allocate res with intel_vsec_dev
  -  Restore BAR fallback for header walk
 
 ISST:
  -  Restore SST-PP control to all domains
 
 lenovo-wmi-capdata:
  -  Add debugfs file for dumping capdata
 
 lenovo-wmi-helpers:
  -  Add helper for creating per-device debugfs dir
 
 lenovo-wmi-other:
  -  Add force_load_psy_ext module parameter
  -  Add GPU tunable attributes
  -  Add missing CPU tunable attributes
  -  Add WMI battery charge limiting
  -  Rename LWMI_OM_FW_ATTR_BASE_PATH
 
 meraki-mx100:
  -  use real software node references
 
 modpost:
  -  Handle malformed WMI GUID strings
 
 Move delayed work on system_dfl_wq:
  - Move delayed work on system_dfl_wq
 
 msi-ec:
  -  Add support for MSI Pulse GL66 12th Gen
 
 oxpec:
  -  add support for OneXPlayer Super X
 
 panasonic-laptop:
  -  simplify allocation of sinf
 
 pcengines-apuv2:
  -  reduce indiraction in swnode assignment
 
 pmc_atom:
  -  Use named initializer for pci_device_id array
 
 sel3350-platform:
  -  Retain LED state on load and unload
 
 sonypi:
  -  use strscpy() in sonypi_acpi_probe
 
 surface: SAM:
  -  Add support for Surface Pro 12in
 
 thinkpad_acpi:
  -  Add debugfs entry to display HWDD raw
  -  Remove unneeded goto
 
 tools/power/x86/intel-speed-select:
  -  Harden daemon pidfile open
 
 uniwill-laptop:
  -  Add support for battery charge modes
  -  Enable battery charge modes on supported devices
  -  Mark EC_ADDR_OEM_4 as volatile
  -  Rework FN lock/super key suspend handling
 
 use u8 * for raw byte buffers:
  - use u8 * for raw byte buffers
 
 wmi:
  -  Make sysfs attributes const
  -  Make wmi_bus_class const
 
 x86-android-tablets:
  -  enable fwnode matching of GPIO chips
  -  Use named initializers for struct i2c_device_id
 
 x86/platform/olpc: xo15:
  -  Convert ACPI driver to a platform one
  -  Drop wakeup source on driver removal
 
 xo15-ebook:
  -  Convert ACPI driver to a platform one
  -  Fix formatting of labels
  -  Fix wakeup source and GPE handling
  -  Register ACPI notify handler directly
  -  Use devres-based resource management
 
 Merges:
  -  Merge branch 'fixes' into for-next
  -  Merge branch 'fixes' of into for-next
  -  Merge branch 'intel-sst' of https://github.com/spandruvada/linux-kernel into review-ilpo-next
 -----BEGIN PGP SIGNATURE-----
 
 iHUEABYKAB0WIQSCSUwRdwTNL2MhaBlZrE9hU+XOMQUCajl8LgAKCRBZrE9hU+XO
 MZ47AP0Z0IoiT8WEcXL4wuTQyR6ruXWClYk82wiroAFEko8Z5AD/WYNWCBXqjZk+
 FlJbtleRLA/ADmgT3Mj+biHNTIqyBA0=
 =Q3d+
 -----END PGP SIGNATURE-----

Merge tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86

Pull x86 platform driver updates from Ilpo Järvinen:

 - amd/hfi: Add support for dynamic ranking tables (version 3)

 - amd/pmc:
     - Add PMC driver support for AMD 1Ah M80H SoC
     - Delay suspend for some Lenovo Laptops to avoid keyboard and lid
       switch problems after s2idle

 - arm64: qcom-hamoa-ec: Add Hamoa/Purwa/Glymur EC driver

 - asus-armoury: add support for G614PR, GA402NJ, GA403UM, and FX608JPR

 - asus-wmi: add keystone dongle support

 - dell-dw5826e: Add reset driver for DW5826e

 - dell-laptop: Fix rollback path

 - hp-wmi:
     - Add support for Omen 16-ap0xxx (board ID 8D26) and board ID 8B2F

 - intel-hid:
     - Add HP ProBook x360 440 G1 5 button array support
     - Prevent racing ACPI notify handlers

 - intel/pmc:
     - Add Nova Lake support
     - Rate-limit LTR scale-factor warning

 - intel-uncore-freq:
     - Expose instance ID in the sysfs
     - Fix current_freq_khz after CPU hotplug

 - intel/vsec: Restore BAR fallback for header walk

 - ISST: Restore SST-PP control to all domains

 - lenovo-wmi-*:
     - Add more CPU tunable attributes
     - Add GPU tunable attributes
     - Add WMI battery charge limiting

 - oxpec: add support for OneXPlayer Super X

 - sel3350-platform: Retain LED state on load and unload

 - surface: SAM: Add support for Surface Pro 12in

 - uniwill-laptop: Add support for battery charge modes

 - tools/power/x86/intel-speed-select: Harden daemon pidfile open

 - Major refactoring efforts:
     - ACPI driver to platform driver conversion
     - Converting drivers to use the improved WMI API

 - Miscellaneous cleanups / refactoring / improvements

* tag 'platform-drivers-x86-v7.2-1' of git://git.kernel.org/pub/scm/linux/kernel/git/pdx86/platform-drivers-x86: (115 commits)
  platform/x86/intel/pmc: Add NVL PCI IDs for SSRAM telemetry discovery
  platform/x86/intel/pmc/ssram: Make PMT registration optional
  platform/x86/intel/pmc/ssram: Add ACPI discovery scaffolding
  platform/x86/intel/pmc/ssram: Switch to static array with per-index probe state
  platform/x86/intel/pmc/ssram: Refactor DEVID/PWRMBASE extraction into helper
  platform/x86/intel/pmc/ssram: Add PCI platform data
  platform/x86/intel/pmc/ssram: Rename probe and PCI ID table for consistency
  platform/x86/intel/pmc: Add ACPI PWRM telemetry driver for Nova Lake S
  platform/x86/intel/pmc: Add PMC SSRAM Kconfig description
  platform/x86/intel/pmt: Unify header fetch and add ACPI source
  platform/x86/intel/pmt: Cache the telemetry discovery header
  platform/x86/intel/pmt: Pass discovery index instead of resource
  platform/x86/intel/pmt/telemetry: Move overlap check to post-decode hook
  platform/x86/intel/pmt/crashlog: Split init into pre-decode
  platform/x86/intel/pmt: Add pre/post decode hooks around header parsing
  modpost: Handle malformed WMI GUID strings
  platform/wmi: Make sysfs attributes const
  platform/wmi: Make wmi_bus_class const
  hwmon: (dell-smm) Use new buffer-based WMI API
  platform/x86: dell-ddv: Use new buffer-based WMI API
  ...
 2026-06-23 08:31:33 -07:00
Linus Torvalds
3eb20a97b3 linux_kselftest-next-7.2-rc1-second 
Fixes ftrace test and kselftest document
 
 -- docs: remove obsolete wiki link from kselftest.rst
 -- ftrace: drop invalid top-level local in test_ownership
 -- ftrace: Fix trace_marker_raw test on 64K page kernels
 -----BEGIN PGP SIGNATURE-----
 
 iQIzBAABCgAdFiEEPZKym/RZuOCGeA/kCwJExA0NQxwFAmo5UVkACgkQCwJExA0N
 Qxy9Mw//UsjfWnhp5yYIcgpJw7MN/OfQ0ONXF92T0QQJqVHqp1S5sy8iAA43ykne
 9NYv6kBJqKAWy+VR0W4BIa7iJWM8Nxf0LxO5TnFf1HIm2WjT4/gxj5ImhFTHjmQN
 gtTm0W5HdKLHCFlLlPzYJ2ySc/qVHTeWZobZpvKPuufUQJFku8hRmTUJQYqpJ51s
 PqTDlZLAuwhTO61vuFm+0PyObuIMSa1eW0Ezv4ZjMvrWTEO+dhaRNi0zh1ukr1sw
 /WFnyyufhniFd/ow1UFXTX5rSA6gPcrZHiyYqPsG2a2c2XPch4BgWWV52HsNxxbQ
 a52CAKZyN4VQq5Tdlsu0ROXyxMYNtZzCJr9XYuus+SZXzXgc3X7rw/X8FkQX0Ks5
 J/ccPf8iQ8WKSPEI/JLnTv/3ZEQhQxAzHU1eetH1juM8fnsmptccCc3eWtxEzw9w
 has6vi7eSVzdvL97AvK8BqsskJzLGxDB69jNi33AOZ6l/jL6ok7VDcOKTD1GimzD
 mA/bnAHJcGRFhiZMCGe1ZwDf/hq/M1K/pKwQAvUxsTPZmRTzigTD/D+MsmS2w4Pc
 tTDctFucON3TxpoaraZG0cSgU6jwrObMlTfUYeNBCLtoZmQn0dgMd4FDIBMh+Kei
 2D6F4qVh5h24N704CPEx1s5u7RyllNzYNL5jETHw9++vATi9ms8=
 =yVej
 -----END PGP SIGNATURE-----

Merge tag 'linux_kselftest-next-7.2-rc1-second' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest

Pull more kselftest updates from Shuah Khan:
 "Docs:
    -remove obsolete wiki link from kselftest.rst

  ftrace:
    - drop invalid top-level local in test_ownership
    - Fix trace_marker_raw test on 64K page kernels"

* tag 'linux_kselftest-next-7.2-rc1-second' of git://git.kernel.org/pub/scm/linux/kernel/git/shuah/linux-kselftest:
  docs: kselftest: remove link to obsolete wiki
  selftests/ftrace: Fix trace_marker_raw test on 64K page kernels
  selftests/ftrace: Drop invalid top-level local in test_ownership
 2026-06-23 07:35:37 -07:00
Florian Westphal
8a2cfe7951 selftests: nft_queue.sh: add a bridge queue test 
Add a test queueing from bridge family.
This was lacking: we queued from inet for ipv4 and ipv6 but
we had no bridge queue test so far.

Given kernel MUST validate that in/out port are still part of
a bridge device on reinject add a test case for this before
adding this check.

Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 2026-06-23 08:11:22 +02:00
Yi Chen
a49a8e51ee selftests: netfilter: conntrack_sctp_collision.sh: Introduce SCTP INIT collision test 
The existing test covered a scenario where a delayed INIT_ACK chunk
updates the vtag in conntrack after the association has already been
established.

A similar issue can occur with a delayed SCTP INIT chunk.

Add a new simultaneous-open test case where the client's INIT is
delayed, allowing conntrack to establish the association based on
the server-initiated handshake.

When the stale INIT arrives later, it may get recorded and cause a
following INIT_ACK from the peer to be accepted instead of dropped.
This INIT_ACK overwrites the vtag in conntrack, causing subsequent
SCTP DATA chunks to be considered as invalid and then dropped by
nft rules matching on ct state invalid.

This test verifies such stale INIT chunks do not cause problems.

Signed-off-by: Yi Chen <yiche.cy@gmail.com>
Acked-by: Xin Long <lucien.xin@gmail.com>
Signed-off-by: Florian Westphal <fw@strlen.de>
Signed-off-by: Pablo Neira Ayuso <pablo@netfilter.org>
 2026-06-23 08:11:22 +02:00
Willem de Bruijn
e38fec239d selftests: drv-net: so_txtime: relax variance bounds 
The net-next-hw spinners on netdev.bots.linux.dev observe failing
so-txtime-py tests. A review of stdout shows most failures to be
due to exceeding the 4ms grace period. All I saw were within 8ms.
So increase to that.

Double the bounds from 4 to 8ms. This is still is small enough to
differentiate the delays programmed by the test, 10 and 20ms.

Fixes: 5c6baef388 ("selftests: drv-net: convert so_txtime to drv-net")
Reported-by: Jakub Kicinski <kuba@kernel.org>
Closes: https://lore.kernel.org/netdev/20260610170651.1b644001@kernel.org/
Signed-off-by: Willem de Bruijn <willemb@google.com>
Link: https://patch.msgid.link/20260621200137.1564776-1-willemdebruijn.kernel@gmail.com
Signed-off-by: Jakub Kicinski <kuba@kernel.org>
 2026-06-22 18:42:35 -07:00
Tristan Madani
644332f48f selftests/bpf: Add test for stale bounds on LSM retval context load 
Add a verifier test that catches the stale-bounds issue fixed in the
previous patch. The test sets r6 = 0 to create known bounds, then loads
the LSM hook return value into r6 from the context. Without the fix,
the verifier intersects the retval range with the stale bounds and
incorrectly narrows r6 to a single value, pruning the fall-through
branch as dead code and missing the div-by-zero.

Suggested-by: Eduard Zingerman <eddyz87@gmail.com>
Signed-off-by: Tristan Madani <tristan@talencesecurity.com>
Acked-by: Eduard Zingerman <eddyz87@gmail.com>
Link: https://lore.kernel.org/r/20260622230123.3695446-3-tristmd@gmail.com
Signed-off-by: Alexei Starovoitov <ast@kernel.org>
 2026-06-22 17:11:46 -07:00